Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
MDE_File_Sample_a3e5f36a6c6aa8d153a311c66de474a8b21a6684.zip

Overview

General Information

Sample name:MDE_File_Sample_a3e5f36a6c6aa8d153a311c66de474a8b21a6684.zip
Analysis ID:1545920
MD5:0d8df8a956ab6a852b9deb175968ce71
SHA1:9a063d5d313a72c097d40b15810f763d575c9a00
SHA256:4b2d3d66b3890cb3e2a5a978b3271791a088ef54d1da8c0d5d2d63d831701825
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Sigma detected: Suspicious Office Outbound Connections

Classification

Process Tree

  • System is w10x64_ra
  • rundll32.exe (PID: 6872 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)
  • WINWORD.EXE (PID: 7056 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_a3e5f36a6c6aa8d153a311c66de474a8b21a6684.zip\74980.docx" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)
  • WINWORD.EXE (PID: 5988 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_a3e5f36a6c6aa8d153a311c66de474a8b21a6684.zip\74980.docx" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)
  • WINWORD.EXE (PID: 2424 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_a3e5f36a6c6aa8d153a311c66de474a8b21a6684.zip\74980.docx" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Suspicious Office Outbound Connections
Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.16, DestinationIsIpv6: false, DestinationPort: 49788, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, Initiated: true, ProcessId: 2424, Protocol: tcp, SourceIp: 13.107.253.45, SourceIsIpv6: false, SourcePort: 443
Sigma detected: Office Macro File Creation
Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 7056, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknownHTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.16:49788 version: TLS 1.2
Source: Joe Sandbox ViewIP Address: 13.107.253.45 13.107.253.45
Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: global trafficHTTP traffic detected: GET /rules/winword.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global trafficHTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
Source: unknownHTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.16:49788 version: TLS 1.2
Source: classification engineClassification label: clean1.winZIP@7/188@0/1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Users\user\AppData\Roaming\Microsoft\OfficeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Temp\{27090B44-0D8A-4096-8343-5C4BAC5F2827} - OProcSessId.datJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Windows\System32\rundll32.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknownProcess created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_a3e5f36a6c6aa8d153a311c66de474a8b21a6684.zip\74980.docx" /o ""
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_a3e5f36a6c6aa8d153a311c66de474a8b21a6684.zip\74980.docx" /o ""
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_a3e5f36a6c6aa8d153a311c66de474a8b21a6684.zip\74980.docx" /o ""
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess created: unknown unknownJump to behavior
Source: Templates.LNK.3.drLNK file: ..\..\Templates
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OfficeJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information queried: ProcessInformationJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Rundll32		LSASS Memory1
File and Directory Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Process Injection		Security Account Manager2
System Information Discovery		SMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1545920 Sample: MDE_File_Sample_a3e5f36a6c6... Startdate: 31/10/2024 Architecture: WINDOWS Score: 1 4 WINWORD.EXE 21 51 2->4         started        7 WINWORD.EXE 137 322 2->7         started        9 WINWORD.EXE 501 93 2->9         started        11 rundll32.exe 2->11         started        dnsIp3 13 s-part-0017.t-0009.fb-t-msedge.net 13.107.253.45, 443, 49788, 49789 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 4->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
s-part-0017.t-0009.fb-t-msedge.net
13.107.253.45
truefalse
    		unknown

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    13.107.253.45
    		s-part-0017.t-0009.fb-t-msedge.netUnited States
    		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse

    General Information

    Joe Sandbox version:41.0.0 Charoite
    Analysis ID:1545920
    Start date and time:2024-10-31 10:18:57 +01:00
    Joe Sandbox product:CloudBasic
    Overall analysis duration:0h 4m 9s
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:defaultwindowsinteractivecookbook.jbs
    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
    Number of analysed new started processes analysed:17
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Sample name:MDE_File_Sample_a3e5f36a6c6aa8d153a311c66de474a8b21a6684.zip
    Detection:CLEAN
    Classification:clean1.winZIP@7/188@0/1
    EGA Information:Failed
    HCA Information:
    • Successful, ratio: 100%
    • Number of executed functions: 0
    • Number of non-executed functions: 0
    Cookbook Comments:
    • Found application associated with file extension: .zip

    Warnings

    • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
    • Excluded IPs from analysis (whitelisted): 52.109.28.46, 52.113.194.132, 20.189.173.5, 95.101.111.179, 95.101.111.168, 95.101.111.132, 88.221.110.138, 88.221.110.192, 52.109.68.130, 20.42.65.91, 95.101.111.186, 95.101.111.148, 2.16.164.34, 2.16.164.89, 20.42.72.131
    • Excluded domains from analysis (whitelisted): onedscolprdwus04.westus.cloudapp.azure.com, azurefd-t-fb-prod.trafficmanager.net, binaries.templates.cdn.office.net.edgesuite.net, odc.officeapps.live.com, slscr.update.microsoft.com, europe.odcsm1.live.com.akadns.net, templatesmetadata.office.net.edgekey.net, onedscolprdeus17.eastus.cloudapp.azure.com, otelrules.afd.azureedge.net, a1847.dscg2.akamai.net, mobile.events.data.microsoft.com, ecs-office.s-0005.s-msedge.net, officeclient.microsoft.com, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, frc-azsc-000.odc.officeapps.live.com, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, e26769.dscb.akamaiedge.net, s-0005.s-msedge.net, config.officeapps.live.com, osiprod-frc-bronze-azsc-000.francecentral.cloudapp.azure.com, onedscolprdeus00.eastus.cloudapp.azure.com, azureedge-t-prod.trafficmanager.net, metadata.templates.cdn.office.net, ecs
    • Not all processes where analyzed, report is missing behavior information
    • Report size getting too big, too many NtCreateFile calls found.
    • Report size getting too big, too many NtCreateKey calls found.
    • Report size getting too big, too many NtQueryAttributesFile calls found.
    • Report size getting too big, too many NtQueryValueKey calls found.
    • Report size getting too big, too many NtSetInformationFile calls found.
    • Report size getting too big, too many NtSetValueKey calls found.
    • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
    • VT rate limit hit for: MDE_File_Sample_a3e5f36a6c6aa8d153a311c66de474a8b21a6684.zip

    Simulations

    Behavior and APIs

    ⊘No simulations

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    13.107.253.45UCLouvain.onepkgGet hashmaliciousUnknownBrowse
      0T32Kz4dZU.exeGet hashmaliciousStealc, VidarBrowse
        file.exeGet hashmaliciousStealc, VidarBrowse
          https://railrent-railrent.powerappsportals.com/Get hashmaliciousUnknownBrowse
            https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s553e3fe901654d86bcc4ed44c7c05dd3&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0V1a19QbFZsQVlaTnZNVHRSTWZBWGRNQmtvbDQ2b1NlN1o5MGFiazNzS3lGSlE_ZT1UMnQ4S3Y&wd=target%28Sezione%20senza%20titolo.one%7C8d7e5173-6006-4648-a69d-e39e66e7041a%2FAblehnung%20Rechnung%20R15946098273-KU30_WE02%20Vom%2028%5C%2F%7Cd77916b9-b471-429a-a13e-74764563e56b%2F%29&wdorigin=NavigationUrlGet hashmaliciousUnknownBrowse
              Transferencia.xlsGet hashmaliciousUnknownBrowse
                cotizaci#U00f2n.xlam.xlsxGet hashmaliciousUnknownBrowse
                  https://assets-usa.mkt.dynamics.com/a915fd66-2592-ef11-8a66-00224803a417/digitalassets/standaloneforms/3d7495e3-e695-ef11-8a69-000d3a3501d6Get hashmaliciousMamba2FABrowse
                    https://docs.google.com/drawings/d/1OzqwiA1nI8GUoiKob_qJY5xL1HmGK6VrRXlYUDuD68w/preview?pli=1JXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlGet hashmaliciousMamba2FABrowse
                      Jo Smalley shared _Harbour Healthcare Ltd Project_ with you..emlGet hashmaliciousHTMLPhisherBrowse

                        Domains

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        s-part-0017.t-0009.fb-t-msedge.netUCLouvain.onepkgGet hashmaliciousUnknownBrowse
                        • 13.107.253.45
                        https://www.kwconnect.com/redirect?url=https%3A%2F%2Fwww.ingenieriawj.com/trx/#XdGFtYXJhLnBlcmVpcmFkZWplc3VzQGRhaWljaGktc2Fua3lvLmV1Get hashmaliciousHTMLPhisherBrowse
                        • 13.107.253.45
                        67JPbskewt.exeGet hashmaliciousUnknownBrowse
                        • 13.107.253.45
                        Receipt.htmGet hashmaliciousUnknownBrowse
                        • 13.107.253.45
                        https://1rkzzyapew.beefreedesign.com/EfTl-assets-eurmktdynamicsGet hashmaliciousUnknownBrowse
                        • 13.107.253.45
                        0T32Kz4dZU.exeGet hashmaliciousStealc, VidarBrowse
                        • 13.107.253.45
                        https://www.leadsonline.caGet hashmaliciousUnknownBrowse
                        • 13.107.253.45
                        file.exeGet hashmaliciousStealc, VidarBrowse
                        • 13.107.253.45
                        https://joseordenes.com/n/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9TUZCc01WYz0mdWlkPVVTRVIyODEwMjAyNFUxOTEwMjgxMA==N0123N%5BEMAIL%5DGet hashmaliciousHTMLPhisher, Mamba2FABrowse
                        • 13.107.253.45
                        http://xn--gba7iaacaabba0ab51nca04ecacdad9203oearjjb191bfa.mkto-sj030022.comGet hashmaliciousUnknownBrowse
                        • 13.107.253.45

                        ASNs

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        MICROSOFT-CORP-MSN-AS-BLOCKUSUCLouvain.onepkgGet hashmaliciousUnknownBrowse
                        • 52.109.28.46
                        file.exeGet hashmaliciousPureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake StealerBrowse
                        • 94.245.104.56
                        file.exeGet hashmaliciousStealc, VidarBrowse
                        • 20.42.65.90
                        file.exeGet hashmaliciousStealcBrowse
                        • 94.245.104.56
                        Payment&WarantyBonds.exeGet hashmaliciousFormBookBrowse
                        • 20.2.249.7
                        file.exeGet hashmaliciousStealc, VidarBrowse
                        • 20.96.153.111
                        Arquivo_4593167.msiGet hashmaliciousAteraAgentBrowse
                        • 40.119.152.241
                        file.exeGet hashmaliciousStealc, VidarBrowse
                        • 20.189.173.26
                        Paiement.emlGet hashmaliciousHTMLPhisherBrowse
                        • 40.126.32.138
                        https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3Get hashmaliciousMamba2FABrowse
                        • 13.107.246.45

                        JA3 Fingerprints

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        a0e9f5d64349fb13191bc781f81f42e1file.exeGet hashmaliciousLummaCBrowse
                        • 13.107.253.45
                        file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, XWormBrowse
                        • 13.107.253.45
                        Swift payment confirmation.exeGet hashmaliciousDBatLoader, FormBookBrowse
                        • 13.107.253.45
                        file.exeGet hashmaliciousLummaCBrowse
                        • 13.107.253.45
                        file.exeGet hashmaliciousLummaCBrowse
                        • 13.107.253.45
                        file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                        • 13.107.253.45
                        file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                        • 13.107.253.45
                        file.exeGet hashmaliciousPureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake StealerBrowse
                        • 13.107.253.45
                        file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                        • 13.107.253.45
                        file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, WhiteSnake StealerBrowse
                        • 13.107.253.45

                        Dropped Files

                        ⊘No context

                        Created / dropped Files

                        C:\Users\user\AppData\Local\Microsoft\Office\Features\0-7FeatureCache.txt (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):884
                        Entropy (8bit):2.710599858645342
                        Encrypted:false
                        SSDEEP:12:YIrxK16fFwCGjKrn2Qrn2GJP7c1JBQ/otm2mqDVHd+HYW/pMSc1N1kFPfgPQ8Uk9:YIrVFwvWtxJ8Sg6qD9o48KeboIHWn
                        MD5:43D115B263BC9DD317F816C7EB754297
                        SHA1:B45012F300B575EF10FF6687779DDE454F055D43
                        SHA-256:6E1F3C558188860D570CB1F8DA6B7D37ECD9D3C8BFE02596EFE1188A9DC5AFB0
                        SHA-512:F75E2670F64E553E5C248B3E5EFBD6DC43D78DAD78447E1F27939CD8984E8479B5251B0A56A4E58A3368C10BEF326A66B74D745BE6C318A92F59B396C1099EDF
                        Malicious:false
                        Reputation:low
                        Preview:3.7.4.6.3.7.6.,.1.1.9.6.3.7.8.,.1.7.8.8.6.5.8.,.7.7.8.7.0.2.2.2.5.,.4.8.0.9.1.5.7.6.3.,.1.2.2.3.4.3.4.,.5.2.1.6.4.2.,.1.2.5.,.;.6.3.6.4.3.3.4.,.6.3.6.4.3.1.8.,.3.1.4.1.5.9.1.5.,.2.3.7.1.6.5.1.,.1.0.6.9.5.5.2.,.1.6.5.7.4.5.2.,.1.6.5.7.4.5.3.,.4.7.3.8.2.9.4.8.,.6.5.4.0.2.1.5.,.7.7.8.7.0.2.2.2.7.,.3.7.4.6.3.7.9.,.3.2.9.4.5.8.7.9.9.,.1.2.2.0.7.7.9.,.1.5.6.1.9.5.8.,.3.0.1.2.3.4.6.6.,.1.0.3.4.5.0.1.8.,.3.0.1.5.3.7.2.1.,.2.7.1.5.3.4.9.7.,.6.3.7.1.6.9.4.,.1.0.3.4.5.0.2.0.,.1.0.6.9.5.5.3.,.1.0.3.4.5.0.2.1.,.6.3.6.4.3.3.1.,.3.4.4.1.3.9.5.3.,.6.3.6.4.3.3.7.,.6.1.7.0.7.3.0.7.,.6.3.6.4.3.3.0.,.6.7.4.8.3.9.6.1.4.,.6.7.0.4.1.0.8.,.3.3.7.9.1.6.2.,.4.8.0.9.1.5.7.6.5.,.3.2.0.5.9.2.7.6.7.,.7.7.8.7.0.2.2.2.4.,.6.3.7.1.6.9.5.,.7.7.8.7.0.2.2.3.4.,.1.0.2.3.6.3.8.,.2.1.0.0.9.4.0.,.1.7.7.1.6.5.7.,.3.1.4.1.5.9.0.0.,.1.5.6.1.9.5.6.,.4.2.1.4.2.1.7.,.4.8.1.9.5.5.3.8.,.1.4.6.1.9.5.3.,.6.3.6.4.3.3.2.,.

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\mso3BE6.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):261
                        Entropy (8bit):5.800418414702846
                        Encrypted:false
                        SSDEEP:6:5jElnhoX9CAkoeYvS6UZstDxxMDcyu47KlnhdmX9I+lBX:5jCG66yQKDKuOaR
                        MD5:1DD837B10EFC1FECE1D0EAC023F8F0D3
                        SHA1:30E8A81A3DAAB592C4CBC35ABD4518A1D1DEE311
                        SHA-256:2E27D36BDE3D261E6FFCA5E4957AB340459926BA2F15CC58982B677C2C560CC4
                        SHA-512:ACCF4EF7C3A918D54515ED3E84D8585EA11B72651A73D2D9F1BA907D96EDB37C58CD47F25EAAB873F62657B41033323185941D0D8009A1056626D964CA9316C9
                        Malicious:false
                        Reputation:moderate, very likely benign file
                        Preview:PK..........!.I...y...........META-INF/manifest.xmlT.K..@....w.z.o'M&...z.f....kIODo......^7<...:{1D:l....r.5..4n.....L...T.._..*(......%..#-3..3..sKl7E..TE...?.........PK..-.........!.I...y.........................META-INF/manifest.xmlPK..........C.........

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\mso909D.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):261
                        Entropy (8bit):5.800418414702846
                        Encrypted:false
                        SSDEEP:6:5jElnhoX9CAkoeYvS6UZstDxxMDcyu47KlnhdmX9I+lBX:5jCG66yQKDKuOaR
                        MD5:1DD837B10EFC1FECE1D0EAC023F8F0D3
                        SHA1:30E8A81A3DAAB592C4CBC35ABD4518A1D1DEE311
                        SHA-256:2E27D36BDE3D261E6FFCA5E4957AB340459926BA2F15CC58982B677C2C560CC4
                        SHA-512:ACCF4EF7C3A918D54515ED3E84D8585EA11B72651A73D2D9F1BA907D96EDB37C58CD47F25EAAB873F62657B41033323185941D0D8009A1056626D964CA9316C9
                        Malicious:false
                        Reputation:moderate, very likely benign file
                        Preview:PK..........!.I...y...........META-INF/manifest.xmlT.K..@....w.z.o'M&...z.f....kIODo......^7<...:{1D:l....r.5..4n.....L...T.._..*(......%..#-3..3..sKl7E..TE...?.........PK..-.........!.I...y.........................META-INF/manifest.xmlPK..........C.........

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\msoEF6C.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):261
                        Entropy (8bit):5.800418414702846
                        Encrypted:false
                        SSDEEP:6:5jElnhoX9CAkoeYvS6UZstDxxMDcyu47KlnhdmX9I+lBX:5jCG66yQKDKuOaR
                        MD5:1DD837B10EFC1FECE1D0EAC023F8F0D3
                        SHA1:30E8A81A3DAAB592C4CBC35ABD4518A1D1DEE311
                        SHA-256:2E27D36BDE3D261E6FFCA5E4957AB340459926BA2F15CC58982B677C2C560CC4
                        SHA-512:ACCF4EF7C3A918D54515ED3E84D8585EA11B72651A73D2D9F1BA907D96EDB37C58CD47F25EAAB873F62657B41033323185941D0D8009A1056626D964CA9316C9
                        Malicious:false
                        Reputation:moderate, very likely benign file
                        Preview:PK..........!.I...y...........META-INF/manifest.xmlT.K..@....w.z.o'M&...z.f....kIODo......^7<...:{1D:l....r.5..4n.....L...T.._..*(......%..#-3..3..sKl7E..TE...?.........PK..-.........!.I...y.........................META-INF/manifest.xmlPK..........C.........

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{115D2516-EF2B-4AD4-A02A-0CC7C4813AE2}.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):1024
                        Entropy (8bit):0.03351732319703582
                        Encrypted:false
                        SSDEEP:3:ol3lG:40
                        MD5:830FBF83999E052538EAF156AB6ECB17
                        SHA1:9F6C69FA4232801D3A4857C630BA7A719662135A
                        SHA-256:D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
                        SHA-512:A83E2E9D5274F0065A26C306F355E9590D6126297EAD87AF053CC78FB64CB31694C533139F72686C77FC772148181D8AAE973E65978D04E5F20F6F6C6BA0A013
                        Malicious:false
                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{3178304E-1142-40C3-81D2-145E15B2C1AA}.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):1024
                        Entropy (8bit):0.03351732319703582
                        Encrypted:false
                        SSDEEP:3:ol3lG:40
                        MD5:830FBF83999E052538EAF156AB6ECB17
                        SHA1:9F6C69FA4232801D3A4857C630BA7A719662135A
                        SHA-256:D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
                        SHA-512:A83E2E9D5274F0065A26C306F355E9590D6126297EAD87AF053CC78FB64CB31694C533139F72686C77FC772148181D8AAE973E65978D04E5F20F6F6C6BA0A013
                        Malicious:false
                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Temp\3730EC8E.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):884
                        Entropy (8bit):2.710599858645342
                        Encrypted:false
                        SSDEEP:12:YIrxK16fFwCGjKrn2Qrn2GJP7c1JBQ/otm2mqDVHd+HYW/pMSc1N1kFPfgPQ8Uk9:YIrVFwvWtxJ8Sg6qD9o48KeboIHWn
                        MD5:43D115B263BC9DD317F816C7EB754297
                        SHA1:B45012F300B575EF10FF6687779DDE454F055D43
                        SHA-256:6E1F3C558188860D570CB1F8DA6B7D37ECD9D3C8BFE02596EFE1188A9DC5AFB0
                        SHA-512:F75E2670F64E553E5C248B3E5EFBD6DC43D78DAD78447E1F27939CD8984E8479B5251B0A56A4E58A3368C10BEF326A66B74D745BE6C318A92F59B396C1099EDF
                        Malicious:false
                        Preview:3.7.4.6.3.7.6.,.1.1.9.6.3.7.8.,.1.7.8.8.6.5.8.,.7.7.8.7.0.2.2.2.5.,.4.8.0.9.1.5.7.6.3.,.1.2.2.3.4.3.4.,.5.2.1.6.4.2.,.1.2.5.,.;.6.3.6.4.3.3.4.,.6.3.6.4.3.1.8.,.3.1.4.1.5.9.1.5.,.2.3.7.1.6.5.1.,.1.0.6.9.5.5.2.,.1.6.5.7.4.5.2.,.1.6.5.7.4.5.3.,.4.7.3.8.2.9.4.8.,.6.5.4.0.2.1.5.,.7.7.8.7.0.2.2.2.7.,.3.7.4.6.3.7.9.,.3.2.9.4.5.8.7.9.9.,.1.2.2.0.7.7.9.,.1.5.6.1.9.5.8.,.3.0.1.2.3.4.6.6.,.1.0.3.4.5.0.1.8.,.3.0.1.5.3.7.2.1.,.2.7.1.5.3.4.9.7.,.6.3.7.1.6.9.4.,.1.0.3.4.5.0.2.0.,.1.0.6.9.5.5.3.,.1.0.3.4.5.0.2.1.,.6.3.6.4.3.3.1.,.3.4.4.1.3.9.5.3.,.6.3.6.4.3.3.7.,.6.1.7.0.7.3.0.7.,.6.3.6.4.3.3.0.,.6.7.4.8.3.9.6.1.4.,.6.7.0.4.1.0.8.,.3.3.7.9.1.6.2.,.4.8.0.9.1.5.7.6.5.,.3.2.0.5.9.2.7.6.7.,.7.7.8.7.0.2.2.2.4.,.6.3.7.1.6.9.5.,.7.7.8.7.0.2.2.3.4.,.1.0.2.3.6.3.8.,.2.1.0.0.9.4.0.,.1.7.7.1.6.5.7.,.3.1.4.1.5.9.0.0.,.1.5.6.1.9.5.6.,.4.2.1.4.2.1.7.,.4.8.1.9.5.5.3.8.,.1.4.6.1.9.5.3.,.6.3.6.4.3.3.2.,.

                        C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1730366373086557400_27090B44-0D8A-4096-8343-5C4BAC5F2827.log

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:ASCII text, with very long lines (3280), with CRLF line terminators
                        Category:dropped
                        Size (bytes):15388
                        Entropy (8bit):5.510837797293209
                        Encrypted:false
                        SSDEEP:384:mvTmxLrqsNwIT+utbjCI4IpfsB697BC+/mwNBYYGo:mvTmVrq2T+utbjl4Ip0B65BC+/mwfH
                        MD5:103E790DE53DB1E6DB67D61E31063AA7
                        SHA1:ABD4899DF52C36E22B208006518985BECF23A076
                        SHA-256:B31968F01C4A316551BA859E1846EB46248C073E5D26744A3C7A7B47374ED3D7
                        SHA-512:AA546C670528838261924DE00DBC3A0BC9B36A248BFDEE10BACF6A118133BC10FBB324AD4D1E92F4B01518FF9CB22410E28629F16DD9EA631559A328DF991271
                        Malicious:false
                        Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/31/2024 09:19:33.175.WINWORD (0x1B90).0x1BEC.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":22,"Time":"2024-10-31T09:19:33.175Z","Contract":"Office.System.Activity","Activity.CV":"RAsJJ4oNlkCDQ1xLrF8oJw.7.1","Activity.Duration":698,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Activity.Result.Code":-2147024890,"Activity.Result.Type":"HRESULT","Activity.Result.Tag":528307459}...10/31/2024 09:19:33.175.WINWORD (0x1B90).0x1BEC.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.ProcessIdleQueueJob","Flags":33777014401990913,"InternalSequenceNumber":23,"Time":"2024-10-31T09:19:33.175Z","Contract":"Office.System.Activity","Activity.CV":"RAsJJ4oNlkCDQ1xLrF8oJw.7","Activity.Duration":1397,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Data.FailureD

                        C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1730366394142803400_FD167B95-EE9E-4E2A-B052-2EE45B72CD6A.log

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:ASCII text, with very long lines (28914), with CRLF line terminators
                        Category:dropped
                        Size (bytes):235358
                        Entropy (8bit):4.865452077993599
                        Encrypted:false
                        SSDEEP:1536:ByMf/U5NYn19aPfTBYlzyz5xCjxVA+2e85+6auy5gjUQ2ex70jWgxBjXUDuXm:vULU9a3Oy1sixuc
                        MD5:969DB10D8395764C4D329EAA2DE4EA2B
                        SHA1:B4FFAD698CEE055C0C2F96EAF2043D75CAA490C8
                        SHA-256:C1BD134110B76676EE50DA7EA0209FA49405AE64C3F9DE3755CEB2A217BCB886
                        SHA-512:0C85836F2AE7763B3D3A7C0E8012B98B648AC4C652823A6E82C0F4F908D7439C4CBCCD91496083AE45F51CCFF93ED357E06C533313F98191AE4061B8836F7DA7
                        Malicious:false
                        Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/31/2024 09:19:54.180.WINWORD (0x1764).0x1B0.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":27,"Time":"2024-10-31T09:19:54.180Z","Contract":"Office.System.Activity","Activity.CV":"lXsW/Z7uKk6wUi7kW3LNag.1.16","Activity.Duration":17,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/31/2024 09:19:54.196.WINWORD (0x1764).0x1B0.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":29,"Time":"2024-10-31T09:19:54.196Z","Contract":"Office.System.Activity","Activity.CV":"lXsW/Z7uKk6wUi7kW3LNag.1.17","Activity.Duration":10560,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVersion"

                        C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1730366415967638400_E042B313-E8E6-49B0-876D-2FE72082C1CB.log

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:ASCII text, with very long lines (28956), with CRLF line terminators
                        Category:dropped
                        Size (bytes):276484
                        Entropy (8bit):5.029366503192865
                        Encrypted:false
                        SSDEEP:1536:JZdzW0qffVwyQgxMwRuM5DsHB+1dINISJcbUjkyEICqzyJAEzWP/B536/XjbZsOP:E0EmyQ0Ruyy9cei5XIvfWzH
                        MD5:7A32A1C70F1AA1545D775C95DC558E9A
                        SHA1:062DCD7C400CAB79A7E7A27A5BE14B71805E5ED8
                        SHA-256:7B35FAD35E21772573F017E66D5E78FA9ACEF425EB573FF2437DFE605D8383FD
                        SHA-512:D89D0ED05103CCD1A526558DB660162D476C49ECFB19C207C4258E7D8B245807D2FEEAAA97AF874D23F0E3CB523DD3F24367052A31C092AEEDE94FCE0E3C9BA6
                        Malicious:false
                        Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/31/2024 09:20:16.003.WINWORD (0x978).0x77C.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":27,"Time":"2024-10-31T09:20:16.003Z","Contract":"Office.System.Activity","Activity.CV":"E7NC4ObosEmHbS/nIILByw.1.16","Activity.Duration":16,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/31/2024 09:20:16.019.WINWORD (0x978).0x77C.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":29,"Time":"2024-10-31T09:20:16.019Z","Contract":"Office.System.Activity","Activity.CV":"E7NC4ObosEmHbS/nIILByw.1.17","Activity.Duration":10499,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVersion":4

                        C:\Users\user\AppData\Local\Temp\F0029B2.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):884
                        Entropy (8bit):2.710599858645342
                        Encrypted:false
                        SSDEEP:12:YIrxE+2I1FFF/LDdQdPR1XjKrn2Qrn2GJP7c1JBQ/sm2mqDVHd+HYW/pMSc1YmxL:YIrSngFFTDd4WtxJ8S1qD9o4oXboIHWn
                        MD5:430B3D9F8CCC696E8F01CA87AA4D9F51
                        SHA1:5175C44B423A37218C75713B83AC57FC620A6EE2
                        SHA-256:C7C54957FDA1DFFA5EE038BDD5056DD30FC4BFF0424BD972F6F25B15C0445423
                        SHA-512:C425890E98E41229C321137550B970A8F3698CCF135DD53E46C53749B9BFACD1F9BB65E579D50726CA221E75153597F00A8E8247EF7C4C538AF4960142C57173
                        Malicious:false
                        Preview:3.7.4.6.3.7.6.,.1.1.9.6.3.7.8.,.1.7.8.8.6.5.8.,.5.2.1.6.4.2.,.4.8.0.9.1.5.7.6.3.,.7.7.8.7.0.2.2.2.5.,.1.2.5.,.1.2.2.3.4.3.4.,.;.6.3.6.4.3.3.4.,.3.0.1.5.3.7.2.1.,.1.7.7.1.6.5.7.,.2.1.0.0.9.4.0.,.7.7.8.7.0.2.2.3.4.,.6.3.6.4.3.1.8.,.3.1.4.1.5.9.1.5.,.2.3.7.1.6.5.1.,.1.0.6.9.5.5.2.,.1.6.5.7.4.5.2.,.1.6.5.7.4.5.3.,.4.7.3.8.2.9.4.8.,.6.5.4.0.2.1.5.,.7.7.8.7.0.2.2.2.7.,.3.7.4.6.3.7.9.,.3.2.9.4.5.8.7.9.9.,.1.2.2.0.7.7.9.,.1.5.6.1.9.5.8.,.3.0.1.2.3.4.6.6.,.1.0.3.4.5.0.1.8.,.2.7.1.5.3.4.9.7.,.6.3.7.1.6.9.4.,.1.0.3.4.5.0.2.0.,.1.0.6.9.5.5.3.,.1.0.3.4.5.0.2.1.,.6.3.6.4.3.3.1.,.3.4.4.1.3.9.5.3.,.6.3.6.4.3.3.7.,.6.1.7.0.7.3.0.7.,.6.3.6.4.3.3.0.,.6.7.4.8.3.9.6.1.4.,.6.7.0.4.1.0.8.,.3.3.7.9.1.6.2.,.4.8.0.9.1.5.7.6.5.,.3.2.0.5.9.2.7.6.7.,.7.7.8.7.0.2.2.2.4.,.6.3.7.1.6.9.5.,.1.0.2.3.6.3.8.,.3.1.4.1.5.9.0.0.,.1.5.6.1.9.5.6.,.4.2.1.4.2.1.7.,.4.8.1.9.5.5.3.8.,.1.4.6.1.9.5.3.,.6.3.6.4.3.3.2.,.

                        C:\Users\user\AppData\Local\Temp\TCD2B5F.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):286
                        Entropy (8bit):3.5502940710609354
                        Encrypted:false
                        SSDEEP:6:fxnxUXfQICl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXClNGHmD0wbnKYZAH/lMZqiv
                        MD5:9B8D7EFE8A69E41CDC2439C38FE59FAF
                        SHA1:034D46BEC5E38E20E56DD905E2CA2F25AF947ED1
                        SHA-256:70042F1285C3CD91DDE8D4A424A5948AE8F1551495D8AF4612D59709BEF69DF2
                        SHA-512:E50BB0C68A33D35F04C75F05AD4598834FEC7279140B1BB0847FF39D749591B8F2A0C94DA4897AAF6C33C50C1D583A836B0376015851910A77604F8396C7EF3C
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

                        C:\Users\user\AppData\Local\Temp\TCD2B5F.tmp\iso690.xsl

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):270198
                        Entropy (8bit):5.073814698282113
                        Encrypted:false
                        SSDEEP:6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
                        MD5:FF0E07EFF1333CDF9FC2523D323DD654
                        SHA1:77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
                        SHA-256:3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
                        SHA-512:B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

                        C:\Users\user\AppData\Local\Temp\TCD2B71.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):292
                        Entropy (8bit):3.5026803317779778
                        Encrypted:false
                        SSDEEP:6:fxnxUXC89ADni8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyf9ADiNGHmD0wbnKYZAH/lMZqiv
                        MD5:A0D51783BFEE86F3AC46A810404B6796
                        SHA1:93C5B21938DA69363DBF79CE594C302344AF9D9E
                        SHA-256:47B43E7DBDF8B25565D874E4E071547666B08D7DF4D736EA8521591D0DED640F
                        SHA-512:CA3DB5A574745107E1D6CAA60E491F11D8B140637D4ED31577CC0540C12FDF132D8BC5EBABEA3222F4D7BA1CA016FF3D45FE7688D355478C27A4877E6C4D0D75
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.t.i.t.l.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

                        C:\Users\user\AppData\Local\Temp\TCD2B71.tmp\gosttitle.xsl

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):251032
                        Entropy (8bit):5.102652100491927
                        Encrypted:false
                        SSDEEP:6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
                        MD5:F425D8C274A8571B625EE66A8CE60287
                        SHA1:29899E309C56F2517C7D9385ECDBB719B9E2A12B
                        SHA-256:DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
                        SHA-512:E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

                        C:\Users\user\AppData\Local\Temp\TCD2B72.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):286
                        Entropy (8bit):3.538396048757031
                        Encrypted:false
                        SSDEEP:6:fxnxUXcel8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyMelNGHmD0wbnKYZAH/lMZqiv
                        MD5:149948E41627BE5DC454558E12AF2DA4
                        SHA1:DB72388C037F0B638FCD007FAB46C916249720A8
                        SHA-256:1B981DC422A042CDDEBE2543C57ED3D468288C20D280FF9A9E2BB4CC8F4776ED
                        SHA-512:070B55B305DB48F7A8CD549A5AECF37DE9D6DCD780A5EC546B4BB2165AF4600FA2AF350DDDB48BECCAA3ED954AEE90F5C06C3183310B081F555389060FF4CB01
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .s.i.s.t.0.2...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

                        C:\Users\user\AppData\Local\Temp\TCD2B72.tmp\sist02.xsl

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):250983
                        Entropy (8bit):5.057714239438731
                        Encrypted:false
                        SSDEEP:6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
                        MD5:F883B260A8D67082EA895C14BF56DD56
                        SHA1:7954565C1F243D46AD3B1E2F1BAF3281451FC14B
                        SHA-256:EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
                        SHA-512:D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

                        C:\Users\user\AppData\Local\Temp\TCD2B85.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):288
                        Entropy (8bit):3.523917709458511
                        Encrypted:false
                        SSDEEP:6:fxnxUXC1l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnySvNGHmD0wbnKYZAH/lMZqiv
                        MD5:4A9A2E8DB82C90608C96008A5B6160EF
                        SHA1:A49110814D9546B142C132EBB5B9D8A1EC23E2E6
                        SHA-256:4FA948EEB075DFCB8DCA773A3F994560C69D275690953625731C4743CD5729F7
                        SHA-512:320B9CC860FFBDB0FD2DB7DA7B7B129EEFF3FFB2E4E4820C3FBBFEA64735EB8CFE1F4BB5980302770C0F77FF575825F2D9A8BB59FC80AD4C198789B3D581963B
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.i.c.a.g.o...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

                        C:\Users\user\AppData\Local\Temp\TCD2B85.tmp\chicago.xsl

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):296658
                        Entropy (8bit):5.000002997029767
                        Encrypted:false
                        SSDEEP:6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
                        MD5:9AC6DE7B629A4A802A41F93DB2C49747
                        SHA1:3D6E929AA1330C869D83F2BF8EBEBACD197FB367
                        SHA-256:52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
                        SHA-512:5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

                        C:\Users\user\AppData\Local\Temp\TCD2B97.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):314
                        Entropy (8bit):3.5230842510951934
                        Encrypted:false
                        SSDEEP:6:fxnxUXJuJaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyZuUw9eNGHmD0wbnKYZAH/lMZqiv
                        MD5:F25AC64EC63FA98D9E37782E2E49D6E6
                        SHA1:97DD9CFA4A22F5B87F2B53EFA37332A9EF218204
                        SHA-256:834046A829D1EA836131B470884905856DBF2C3C136C98ADEEFA0F206F38F8AB
                        SHA-512:A0387239CDE98BCDE1668B582B046619C3B3505F9440343DAD22B1B7B9E05F3B74F2AE29E591EC37B6570A0C0E5FE571442873594B0684DDCCB4F6A1B5E10B1F
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.e.e.e.2.0.0.6.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

                        C:\Users\user\AppData\Local\Temp\TCD2B97.tmp\ieee2006officeonline.xsl

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):294178
                        Entropy (8bit):4.977758311135714
                        Encrypted:false
                        SSDEEP:6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
                        MD5:0C9731C90DD24ED5CA6AE283741078D0
                        SHA1:BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
                        SHA-256:ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
                        SHA-512:A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLouserzed">.. <xsl:choose>.. <xsl:when test="b:StyleNameLouserzed/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLouserzed/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

                        C:\Users\user\AppData\Local\Temp\TCD2B9A.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):290
                        Entropy (8bit):3.5081874837369886
                        Encrypted:false
                        SSDEEP:6:fxnxUXCOzi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnydONGHmD0wbnKYZAH/lMZqiv
                        MD5:8D9B02CC69FA40564E6C781A9CC9E626
                        SHA1:352469A1ABB8DA1DC550D7E27924E552B0D39204
                        SHA-256:1D4483830710EF4A2CC173C3514A9F4B0ACA6C44DB22729B7BE074D18C625BAE
                        SHA-512:8B7DB2AB339DD8085104855F847C48970C2DD32ADB0B8EEA134A64C5CC7DE772615F85D057F4357703B65166C8CF0C06F4F6FD3E60FFC80DA3DD34B16D5B1281
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.n.a.m.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

                        C:\Users\user\AppData\Local\Temp\TCD2B9A.tmp\gostname.xsl

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):255948
                        Entropy (8bit):5.103631650117028
                        Encrypted:false
                        SSDEEP:6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
                        MD5:9888A214D362470A6189DEFF775BE139
                        SHA1:32B552EB3C73CD7D0D9D924C96B27A86753E0F97
                        SHA-256:C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
                        SHA-512:8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

                        C:\Users\user\AppData\Local\Temp\TCD2BAD.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):332
                        Entropy (8bit):3.4871192480632223
                        Encrypted:false
                        SSDEEP:6:fxnxUXsdDUaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyoRw9eNGHmD0wbnKYZAH/lMZqiv
                        MD5:333BA58FCE326DEA1E4A9DE67475AA95
                        SHA1:F51FAD5385DC08F7D3E11E1165A18F2E8A028C14
                        SHA-256:66142D15C7325B98B199AB6EE6F35B7409DE64EBD5C0AB50412D18CBE6894097
                        SHA-512:BFEE521A05B72515A8D4F7D13D8810846DC60F1E85C363FFEBD6CACD23AE8D2E664C563FC74700A4ED4E358F378508D25C46CB5BE1CF587E2E278EBC22BB2625
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .m.l.a.s.e.v.e.n.t.h.e.d.i.t.i.o.n.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

                        C:\Users\user\AppData\Local\Temp\TCD2BAD.tmp\mlaseventheditionofficeonline.xsl

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):254875
                        Entropy (8bit):5.003842588822783
                        Encrypted:false
                        SSDEEP:6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
                        MD5:377B3E355414466F3E3861BCE1844976
                        SHA1:0B639A3880ACA3FD90FA918197A669CC005E2BA4
                        SHA-256:4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
                        SHA-512:B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

                        C:\Users\user\AppData\Local\Temp\TCD2BAF.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):332
                        Entropy (8bit):3.547857457374301
                        Encrypted:false
                        SSDEEP:6:fxnxUXSpGLMeKlPaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyipTIw9eNGHmD0wbnKYZAH/lMZqiv
                        MD5:4EC6724CBBA516CF202A6BD17226D02C
                        SHA1:E412C574D567F0BA68B4A31EDB46A6AB3546EA95
                        SHA-256:18E408155A2C2A24D91CD45E065927FFDA726356AAB115D290A3C1D0B7100402
                        SHA-512:DE45011A084AB94BF5B27F2EC274D310CF68DF9FB082E11726E08EB89D5D691EA086C9E0298E16AE7AE4B23753E5916F69F78AAD82F4627FC6F80A6A43D163DB
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .h.a.r.v.a.r.d.a.n.g.l.i.a.2.0.0.8.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

                        C:\Users\user\AppData\Local\Temp\TCD2BAF.tmp\harvardanglia2008officeonline.xsl

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):284415
                        Entropy (8bit):5.00549404077789
                        Encrypted:false
                        SSDEEP:6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
                        MD5:33A829B4893044E1851725F4DAF20271
                        SHA1:DAC368749004C255FB0777E79F6E4426E12E5EC8
                        SHA-256:C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
                        SHA-512:41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLouserzed">.. <xsl:choose>.. <xsl:when test="b:StyleNameLouserzed/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLouserzed/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

                        C:\Users\user\AppData\Local\Temp\TCD2BC0.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):252
                        Entropy (8bit):3.4680595384446202
                        Encrypted:false
                        SSDEEP:6:fxnxUXivlE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyydGHmD0+dAH/luWvv
                        MD5:D79B5DE6D93AC06005761D88783B3EE6
                        SHA1:E05BDCE2673B6AA8CBB17A138751EDFA2264DB91
                        SHA-256:96125D6804544B8D4E6AE8638EFD4BD1F96A1BFB9EEF57337FFF40BA9FF4CDD1
                        SHA-512:34057F7B2AB273964CB086D8A7DF09A4E05D244A1A27E7589BDC7E5679AB5F587FAB52A2261DB22070DA11EF016F7386635A2B8E54D83730E77A7B142C2E3929
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .a.r.c.h.i.t.e.c.t.u.r.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

                        C:\Users\user\AppData\Local\Temp\TCD2BC0.tmp\architecture.glox

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):5783
                        Entropy (8bit):7.88616857639663
                        Encrypted:false
                        SSDEEP:96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
                        MD5:8109B3C170E6C2C114164B8947F88AA1
                        SHA1:FC63956575842219443F4B4C07A8127FBD804C84
                        SHA-256:F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
                        SHA-512:F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
                        Malicious:false
                        Preview:PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..|. 1^......&..|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

                        C:\Users\user\AppData\Local\Temp\TCD2BD3.tmp\APASixthEditionOfficeOnline.xsl

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):333258
                        Entropy (8bit):4.654450340871081
                        Encrypted:false
                        SSDEEP:6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
                        MD5:5632C4A81D2193986ACD29EADF1A2177
                        SHA1:E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
                        SHA-256:06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
                        SHA-512:676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

                        C:\Users\user\AppData\Local\Temp\TCD2BD3.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):328
                        Entropy (8bit):3.541819892045459
                        Encrypted:false
                        SSDEEP:6:fxnxUXuqRDA5McaQVTi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxny+AASZQoNGHmD0wbnKYZAH/lMZqiv
                        MD5:C3216C3FC73A4B3FFFE7ED67153AB7B5
                        SHA1:F20E4D33BABE978BE6A6925964C57D6E6EF1A92E
                        SHA-256:7CF1D6A4F0BE5E6184F59BFB1304509F38E480B59A3B091DBDC43B052D2137CB
                        SHA-512:D3B78BE6E7633FF943F5E34063B5EFA4AF239CD49F437227FC7575F6CC65C497B7D6F6A979EA065065BEAF257CB368560B5462542692286052B5C7E5C01755BC
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .A.P.A.S.i.x.t.h.E.d.i.t.i.o.n.O.f.f.i.c.e.O.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

                        C:\Users\user\AppData\Local\Temp\TCD2BE6.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):290
                        Entropy (8bit):3.5161159456784024
                        Encrypted:false
                        SSDEEP:6:fxnxUX+l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyulNGHmD0wbnKYZAH/lMZqiv
                        MD5:C15EB3F4306EBF75D1E7C3C9382DEECC
                        SHA1:A3F9684794FFD59151A80F97770D4A79F1D030A6
                        SHA-256:23C262DF3AEACB125E88C8FFB7DBF56FD23F66E0D476AFD842A68DDE69658C7F
                        SHA-512:ACDF7D69A815C42223FD6300179A991A379F7166EFAABEE41A3995FB2030CD41D8BCD46B566B56D1DFBAE8557AFA1D9FD55143900A506FA733DE9DA5D73389D6
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .t.u.r.a.b.i.a.n...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

                        C:\Users\user\AppData\Local\Temp\TCD2BE6.tmp\turabian.xsl

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):344303
                        Entropy (8bit):5.023195898304535
                        Encrypted:false
                        SSDEEP:6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
                        MD5:F079EC5E2CCB9CD4529673BCDFB90486
                        SHA1:FBA6696E6FA918F52997193168867DD3AEBE1AD6
                        SHA-256:3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
                        SHA-512:4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

                        C:\Users\user\AppData\Local\Temp\TCD2BE7.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):256
                        Entropy (8bit):3.464918006641019
                        Encrypted:false
                        SSDEEP:6:fxnxUXR+EqRGRnRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyB+5RmRGHmD0wbnKYZAH+Vwv
                        MD5:93149E194021B37162FD86684ED22401
                        SHA1:1B31CAEBE1BBFA529092BE834D3B4AD315A6F8F1
                        SHA-256:50BE99A154A6F632D49B04FCEE6BCA4D6B3B4B7C1377A31CE9FB45C462D697B2
                        SHA-512:410A7295D470EC85015720B2B4AC592A472ED70A04103D200FA6874BEA6A423AF24766E98E5ACAA3A1DBC32C44E8790E25D4611CD6C0DBFFFE8219D53F33ACA7
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.q.u.a.t.i.o.n.s...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

                        C:\Users\user\AppData\Local\Temp\TCD2BE7.tmp\Equations.dotx

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Word 2007+
                        Category:dropped
                        Size (bytes):51826
                        Entropy (8bit):5.541375256745271
                        Encrypted:false
                        SSDEEP:384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
                        MD5:2AB22AC99ACFA8A82742E774323C0DBD
                        SHA1:790F8B56DF79641E83A16E443A75A66E6AA2F244
                        SHA-256:BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
                        SHA-512:E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
                        Malicious:false
                        Preview:PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~|.?"....|.{.[..e^7E......Gi..V.by..G..|.......U..t.|..mW...m..|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b....*..w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

                        C:\Users\user\AppData\Local\Temp\TCD2C0B.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):252
                        Entropy (8bit):3.48087342759872
                        Encrypted:false
                        SSDEEP:6:fxnxUXXt1MIae2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyfMIaRGHmD0+dAH/luWvv
                        MD5:69757AF3677EA8D80A2FBE44DEE7B9E4
                        SHA1:26AF5881B48F0CB81F194D1D96E3658F8763467C
                        SHA-256:0F14CA656CDD95CAB385F9B722580DDE2F46F8622E17A63F4534072D86DF97C3
                        SHA-512:BDA862300BAFC407D662872F0BFB5A7F2F72FE1B7341C1439A22A70098FA50C81D450144E757087778396496777410ADCE4B11B655455BEDC3D128B80CFB472A
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.i.c.t.u.r.e.F.r.a.m.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

                        C:\Users\user\AppData\Local\Temp\TCD2C0B.tmp\PictureFrame.glox

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):4326
                        Entropy (8bit):7.821066198539098
                        Encrypted:false
                        SSDEEP:96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
                        MD5:D32E93F7782B21785424AE2BEA62B387
                        SHA1:1D5589155C319E28383BC01ED722D4C2A05EF593
                        SHA-256:2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
                        SHA-512:5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
                        Malicious:false
                        Preview:PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\*....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..*oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)...*.]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^..*....C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...|...l..\M..8p$]..poX-/.2}..}z\.|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..|)..q4.Z.b..PP....U.K..|.i.$v

                        C:\Users\user\AppData\Local\Temp\TCD2C0D.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):280
                        Entropy (8bit):3.484503080761839
                        Encrypted:false
                        SSDEEP:6:fxnxUXGdQ1MecJZMlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny2dQ98MlWlzGHmD0+dAH/luWvv
                        MD5:1309D172F10DD53911779C89A06BBF65
                        SHA1:274351A1059868E9DEB53ADF01209E6BFBDFADFB
                        SHA-256:C190F9E7D00E053596C3477455D1639C337C0BE01012C0D4F12DFCB432F5EC56
                        SHA-512:31B38AD2D1FFF93E03BF707811F3A18AD08192F906E36178457306DDAB0C3D8D044C69DE575ECE6A4EE584800F827FB3C769F98EA650F1C208FEE84177070339
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.t.e.r.c.o.n.n.e.c.t.e.d.B.l.o.c.k.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

                        C:\Users\user\AppData\Local\Temp\TCD2C0D.tmp\InterconnectedBlockProcess.glox

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):9191
                        Entropy (8bit):7.93263830735235
                        Encrypted:false
                        SSDEEP:192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
                        MD5:08D3A25DD65E5E0D36ADC602AE68C77D
                        SHA1:F23B6DDB3DA0015B1D8877796F7001CABA25EA64
                        SHA-256:58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
                        SHA-512:77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
                        Malicious:false
                        Preview:PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..|8..\uo.......K...._.Y..E6.|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

                        C:\Users\user\AppData\Local\Temp\TCD2C0E.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):302
                        Entropy (8bit):3.537169234443227
                        Encrypted:false
                        SSDEEP:6:fxnxUXfQIUA/e/Wl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXZ/eulNGHmD0wbnKYZAH/lMZqiv
                        MD5:9C00979164E78E3B890E56BE2DF00666
                        SHA1:1FA3C439D214C34168ADF0FBA5184477084A0E51
                        SHA-256:21CCB63A82F1E6ACD6BAB6875ABBB37001721675455C746B17529EE793382C7B
                        SHA-512:54AC8732C2744B60DA744E54D74A2664658E4257A136ABE886FF21585E8322E028D8243579D131EF4E9A0ABDDA70B4540A051C8B8B60D65C3EC0888FD691B9A7
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0.n.m.e.r.i.c.a.l...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

                        C:\Users\user\AppData\Local\Temp\TCD2C0E.tmp\iso690nmerical.xsl

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):217137
                        Entropy (8bit):5.068335381017074
                        Encrypted:false
                        SSDEEP:6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
                        MD5:3BF8591E1D808BCCAD8EE2B822CC156B
                        SHA1:9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
                        SHA-256:7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
                        SHA-512:D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

                        C:\Users\user\AppData\Local\Temp\TCD2C1F.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):374
                        Entropy (8bit):3.5414485333689694
                        Encrypted:false
                        SSDEEP:6:fxnxUX8FaE3f8AWqlQqr++lcWimqnKOE3QepmlJ0+3FbnKfZObdADryMluxHZypo:fxnyj9AWI+acgq9GHmD0wbnKYZAH/lMf
                        MD5:2F7A8FE4E5046175500AFFA228F99576
                        SHA1:8A3DE74981D7917E6CE1198A3C8E35C7E2100F43
                        SHA-256:1495B4EC56B371148EA195D790562E5621FDBF163CDD8A5F3C119F8CA3BD2363
                        SHA-512:4B8FBB692D91D88B584E46C2F01BDE0C05DCD5D2FF073D83331586FB3D201EACD777D48DB3751E534E22115AA1C3C30392D0D642B3122F21EF10E3EE6EA3BE82
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.e.x.t. .S.i.d.e.b.a.r. .(.A.n.n.u.a.l. .R.e.p.o.r.t. .R.e.d. .a.n.d. .B.l.a.c.k. .d.e.s.i.g.n.)...d.o.c.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

                        C:\Users\user\AppData\Local\Temp\TCD2C1F.tmp\Text Sidebar (Annual Report Red and Black design).docx

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Word 2007+
                        Category:dropped
                        Size (bytes):47296
                        Entropy (8bit):6.42327948041841
                        Encrypted:false
                        SSDEEP:768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
                        MD5:5A53F55DD7DA8F10A8C0E711F548B335
                        SHA1:035E685927DA2FECB88DE9CAF0BECEC88BC118A7
                        SHA-256:66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
                        SHA-512:095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
                        Malicious:false
                        Preview:PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~|.?"....|.{.[..e^7E......Gi..V.by..G..|.......U..t.|..mW...m..|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

                        C:\Users\user\AppData\Local\Temp\TCD2C20.tmp\CircleProcess.glox

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):16806
                        Entropy (8bit):7.9519793977093505
                        Encrypted:false
                        SSDEEP:384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
                        MD5:950F3AB11CB67CC651082FEBE523AF63
                        SHA1:418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
                        SHA-256:9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
                        SHA-512:D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
                        Malicious:false
                        Preview:PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

                        C:\Users\user\AppData\Local\Temp\TCD2C20.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):254
                        Entropy (8bit):3.4720677950594836
                        Encrypted:false
                        SSDEEP:6:fxnxUXOu9+MlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnycMlWlzGHmD0+dAH/luWvv
                        MD5:D04EC08EFE18D1611BDB9A5EC0CC00B1
                        SHA1:668FF6DFE64D5306220341FC2C1353199D122932
                        SHA-256:FA60500F951AFAF8FFDB6D1828456D60004AE1558E8E1364ADC6ECB59F5450C9
                        SHA-512:97EBCCAF64FA33238B7CFC0A6D853EFB050D877E21EE87A78E17698F0BB38382FCE7F6C4D97D550276BD6B133D3099ECAB9CFCD739F31BFE545F4930D896EEC3
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.l.e.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

                        C:\Users\user\AppData\Local\Temp\TCD2C30.tmp\BracketList.glox

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):4026
                        Entropy (8bit):7.809492693601857
                        Encrypted:false
                        SSDEEP:96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
                        MD5:5D9BAD7ADB88CEE98C5203883261ACA1
                        SHA1:FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
                        SHA-256:8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
                        SHA-512:7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
                        Malicious:false
                        Preview:PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..|. 1^......&..|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.|.."v....q..|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....*D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`|..0xH}......L.|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x*.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

                        C:\Users\user\AppData\Local\Temp\TCD2C30.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):250
                        Entropy (8bit):3.4916022431157345
                        Encrypted:false
                        SSDEEP:6:fxnxUXsAl8xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8A8xoGHmD0+dAH/luWvv
                        MD5:1A314B08BB9194A41E3794EF54017811
                        SHA1:D1E70DB69CA737101524C75E634BB72F969464FF
                        SHA-256:9025DD691FCAD181D5FD5952C7AA3728CD8A2CAF20DEA14930876419BED9B379
                        SHA-512:AB29C8674A85711EABAE5F9559E9048FE91A2F51EB12D5A46152A310DE59F759DF8C617DA248798A7C20F60E26FBB1B0FC8DB47C46B098BCD26CF8CE78989ACA
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.r.a.c.k.e.t.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

                        C:\Users\user\AppData\Local\Temp\TCD2C31.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):258
                        Entropy (8bit):3.4692172273306268
                        Encrypted:false
                        SSDEEP:6:fxnxUXcq9DsoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnysmYoGHmD0+dAH/luWvv
                        MD5:C1B36A0547FB75445957A619201143AC
                        SHA1:CDB0A18152F57653F1A707D39F3D7FB504E244A7
                        SHA-256:4DFF7D1CEF6DD85CC73E1554D705FA6586A1FBD10E4A73EEE44EAABA2D2FFED9
                        SHA-512:0923FB41A6DB96C85B44186E861D34C26595E37F30A6F8E554BD3053B99F237D9AC893D47E8B1E9CF36556E86EFF5BE33C015CBBDD31269CDAA68D6947C47F3F
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .p.i.c.t.u.r.e.o.r.g.c.h.a.r.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

                        C:\Users\user\AppData\Local\Temp\TCD2C31.tmp\pictureorgchart.glox

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):7370
                        Entropy (8bit):7.9204386289679745
                        Encrypted:false
                        SSDEEP:192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
                        MD5:586CEBC1FAC6962F9E36388E5549FFE9
                        SHA1:D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
                        SHA-256:1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
                        SHA-512:68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
                        Malicious:false
                        Preview:PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..|. 1^......&..|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

                        C:\Users\user\AppData\Local\Temp\TCD2C32.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):254
                        Entropy (8bit):3.4721586910685547
                        Encrypted:false
                        SSDEEP:6:fxnxUX9+RclTloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyteUTloGHmD0+dAH/luWvv
                        MD5:4DD225E2A305B50AF39084CE568B8110
                        SHA1:C85173D49FC1522121AA2B0B2E98ADF4BB95B897
                        SHA-256:6F00DD73F169C73D425CB9895DAC12387E21C6E4C9C7DDCFB03AC32552E577F4
                        SHA-512:0493AB431004191381FF84AD7CC46BD09A1E0FEEC16B3183089AA8C20CC7E491FAE86FE0668A9AC677F435A203E494F5E6E9E4A0571962F6021D6156B288B28A
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.e.v.r.o.n.a.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

                        C:\Users\user\AppData\Local\Temp\TCD2C32.tmp\chevronaccent.glox

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):4243
                        Entropy (8bit):7.824383764848892
                        Encrypted:false
                        SSDEEP:96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
                        MD5:7BC0A35807CD69C37A949BBD51880FF5
                        SHA1:B5870846F44CAD890C6EFF2F272A037DA016F0D8
                        SHA-256:BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
                        SHA-512:B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
                        Malicious:false
                        Preview:PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..|. 1^......&..|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.|.........|.&3.o.....S..K.T5g.U....g..n.f....T*.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,*....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

                        C:\Users\user\AppData\Local\Temp\TCD2C36.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):256
                        Entropy (8bit):3.4842773155694724
                        Encrypted:false
                        SSDEEP:6:fxnxUXDAlIJAFIloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyMlI7loGHmD0+dAH/luWvv
                        MD5:923D406B2170497AD4832F0AD3403168
                        SHA1:A77DA08C9CB909206CDE42FE1543B9FE96DF24FB
                        SHA-256:EBF9CF474B25DDFE0F6032BA910D5250CBA2F5EDF9CF7E4B3107EDB5C13B50BF
                        SHA-512:A4CD8C74A3F916CA6B15862FCA83F17F2B1324973CCBCC8B6D9A8AEE63B83A3CD880DC6821EEADFD882D74C7EF58FA586781DED44E00E8B2ABDD367B47CE45B7
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.o.n.v.e.r.g.i.n.g.T.e.x.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

                        C:\Users\user\AppData\Local\Temp\TCD2C36.tmp\ConvergingText.glox

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):11380
                        Entropy (8bit):7.891971054886943
                        Encrypted:false
                        SSDEEP:192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
                        MD5:C9F9364C659E2F0C626AC0D0BB519062
                        SHA1:C4036C576074819309D03BB74C188BF902D1AE00
                        SHA-256:6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
                        SHA-512:173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
                        Malicious:false
                        Preview:PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...|...pr.q

                        C:\Users\user\AppData\Local\Temp\TCD2C37.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):278
                        Entropy (8bit):3.5280239200222887
                        Encrypted:false
                        SSDEEP:6:fxnxUXQAl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyllNGHmD0wbnKYZAH/lMZqiv
                        MD5:877A8A960B2140E3A0A2752550959DB9
                        SHA1:FBEC17B332CBC42F2F16A1A08767623C7955DF48
                        SHA-256:FE07084A41CF7DB58B06D2C0D11BCACB603D6574261D1E7EBADCFF85F39AFB47
                        SHA-512:B8B660374EC6504B3B5FCC7DAC63AF30A0C9D24306C36B33B33B23186EC96AEFE958A3851FF3BC57FBA72A1334F633A19C0B8D253BB79AA5E5AFE4A247105889
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.b...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

                        C:\Users\user\AppData\Local\Temp\TCD2C37.tmp\gb.xsl

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):268317
                        Entropy (8bit):5.05419861997223
                        Encrypted:false
                        SSDEEP:6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
                        MD5:51D32EE5BC7AB811041F799652D26E04
                        SHA1:412193006AA3EF19E0A57E16ACF86B830993024A
                        SHA-256:6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
                        SHA-512:5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

                        C:\Users\user\AppData\Local\Temp\TCD2C48.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):254
                        Entropy (8bit):3.4845992218379616
                        Encrypted:false
                        SSDEEP:6:fxnxUXQFoElh/lE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8lLGHmD0+dAH/luWvv
                        MD5:E8B30D1070779CC14FBE93C8F5CF65BE
                        SHA1:9C87F7BC66CF55634AB3F070064AAF8CC977CD05
                        SHA-256:2E90434BE1F6DCEA9257D42C331CD9A8D06B848859FD4742A15612B2CA6EFACB
                        SHA-512:C0D5363B43D45751192EF06C4EC3C896A161BB11DBFF1FC2E598D28C644824413C78AE3A68027F7E622AF0D709BE0FA893A3A3B4909084DF1ED9A8C1B8267FCA
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .H.e.x.a.g.o.n.R.a.d.i.a.l...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

                        C:\Users\user\AppData\Local\Temp\TCD2C48.tmp\HexagonRadial.glox

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):6024
                        Entropy (8bit):7.886254023824049
                        Encrypted:false
                        SSDEEP:96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
                        MD5:20621E61A4C5B0FFEEC98FFB2B3BCD31
                        SHA1:4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
                        SHA-256:223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
                        SHA-512:BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
                        Malicious:false
                        Preview:PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....|C/N..K\}.....#..".

                        C:\Users\user\AppData\Local\Temp\TCD2C5B.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):246
                        Entropy (8bit):3.5039994158393686
                        Encrypted:false
                        SSDEEP:6:fxnxUX4f+E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvGHmD0+dAH/luWvv
                        MD5:16711B951E1130126E240A6E4CC2E382
                        SHA1:8095AA79AEE029FD06428244CA2A6F28408448DB
                        SHA-256:855342FE16234F72DA0C2765455B69CF412948CFBE70DE5F6D75A20ACDE29AE9
                        SHA-512:454EAA0FD669489583C317699BE1CE5D706C31058B08CF2731A7621FDEFB6609C2F648E02A7A4B2B3A3DFA8406A696D1A6FA5063DDA684BDA4450A2E9FEFB0EF
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.b.e.d.A.r.c...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

                        C:\Users\user\AppData\Local\Temp\TCD2C5B.tmp\TabbedArc.glox

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):3683
                        Entropy (8bit):7.772039166640107
                        Encrypted:false
                        SSDEEP:96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
                        MD5:E8308DA3D46D0BC30857243E1B7D330D
                        SHA1:C7F8E54A63EB254C194A23137F269185E07F9D10
                        SHA-256:6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
                        SHA-512:88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
                        Malicious:false
                        Preview:PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.*. .<%.BD..E....x... ..@...v.7f.Y......N.|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2..*....UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

                        C:\Users\user\AppData\Local\Temp\TCD2C5C.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):264
                        Entropy (8bit):3.4866056878458096
                        Encrypted:false
                        SSDEEP:6:fxnxUX0XrZUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXWloGHmD0+dAH/luWvv
                        MD5:6C489D45F3B56845E68BE07EA804C698
                        SHA1:C4C9012C0159770CB882870D4C92C307126CEC3F
                        SHA-256:3FE447260CDCDEE287B8D01CF5F9F53738BFD6AAEC9FB9787F2826F8DEF1CA45
                        SHA-512:D1355C48A09E7317773E4F1613C4613B7EA42D21F5A6692031D288D69D47B19E8F4D5A29AFD8B751B353FC7DE865EAE7CFE3F0BEC05F33DDF79526D64A29EB18
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

                        C:\Users\user\AppData\Local\Temp\TCD2C5C.tmp\ThemePictureAccent.glox

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):6448
                        Entropy (8bit):7.897260397307811
                        Encrypted:false
                        SSDEEP:192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
                        MD5:42A840DC06727E42D42C352703EC72AA
                        SHA1:21AAAF517AFB76BF1AF4E06134786B1716241D29
                        SHA-256:02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
                        SHA-512:8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
                        Malicious:false
                        Preview:PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g*5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~..*.l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..|f.n...H.=.|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

                        C:\Users\user\AppData\Local\Temp\TCD2C5E.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):242
                        Entropy (8bit):3.4938093034530917
                        Encrypted:false
                        SSDEEP:6:fxnxUX44lWWoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvToGHmD0+dAH/luWvv
                        MD5:A6B2731ECC78E7CED9ED5408AB4F2931
                        SHA1:BA15D036D522978409846EA682A1D7778381266F
                        SHA-256:6A2F9E46087B1F0ED0E847AF05C4D4CC9F246989794993E8F3E15B633EFDD744
                        SHA-512:666926612E83A7B4F6259C3FFEC3185ED3F07BDC88D43796A24C3C9F980516EB231BDEA4DC4CC05C6D7714BA12AE2DCC764CD07605118698809DEF12A71F1FDD
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

                        C:\Users\user\AppData\Local\Temp\TCD2C5E.tmp\TabList.glox

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):4888
                        Entropy (8bit):7.8636569313247335
                        Encrypted:false
                        SSDEEP:96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
                        MD5:0A4CA91036DC4F3CD8B6DBF18094CF25
                        SHA1:6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
                        SHA-256:E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
                        SHA-512:7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
                        Malicious:false
                        Preview:PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?...*..DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....*J.#J.... .P...P.1...!.#&...?A..&.."..|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

                        C:\Users\user\AppData\Local\Temp\TCD2C6F.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):262
                        Entropy (8bit):3.4901887319218092
                        Encrypted:false
                        SSDEEP:6:fxnxUXqhBMl0OoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyiMl0OoGHmD0+dAH/luWvv
                        MD5:52BD0762F3DC77334807DDFC60D5F304
                        SHA1:5962DA7C58F742046A116DDDA5DC8EA889C4CB0E
                        SHA-256:30C20CC835E912A6DD89FD1BF5F7D92B233B2EC24594F1C1FE0CADB03A8C3FAB
                        SHA-512:FB68B1CF9677A00D5651C51EC604B61DAC2D250D44A71D43CD69F41F16E4F0A7BAA7AD4A6F7BB870429297465A893013BBD7CC77A8F709AD6DB97F5A0927B1DD
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .R.a.d.i.a.l.P.i.c.t.u.r.e.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

                        C:\Users\user\AppData\Local\Temp\TCD2C6F.tmp\RadialPictureList.glox

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):5596
                        Entropy (8bit):7.875182123405584
                        Encrypted:false
                        SSDEEP:96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
                        MD5:CDC1493350011DB9892100E94D5592FE
                        SHA1:684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
                        SHA-256:F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
                        SHA-512:3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
                        Malicious:false
                        Preview:PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

                        C:\Users\user\AppData\Local\Temp\TCD2C81.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):260
                        Entropy (8bit):3.494357416502254
                        Encrypted:false
                        SSDEEP:6:fxnxUX0XPE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPGHmD0+dAH/luWvv
                        MD5:6F8FE7B05855C203F6DEC5C31885DD08
                        SHA1:9CC27D17B654C6205284DECA3278DA0DD0153AFF
                        SHA-256:B7F58DF058C938CCF39054B31472DC76E18A3764B78B414088A261E440870175
                        SHA-512:C518A243E51CB4A1E3C227F6A8A8D9532EE111D5A1C86EBBB23BD4328D92CD6A0587DF65B3B40A0BE2576D8755686D2A3A55E10444D5BB09FC4E0194DB70AFE6
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.G.r.i.d...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

                        C:\Users\user\AppData\Local\Temp\TCD2C81.tmp\ThemePictureGrid.glox

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):6193
                        Entropy (8bit):7.855499268199703
                        Encrypted:false
                        SSDEEP:192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
                        MD5:031C246FFE0E2B623BBBD231E414E0D2
                        SHA1:A57CA6134779D54691A4EFD344BC6948E253E0BA
                        SHA-256:2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
                        SHA-512:6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
                        Malicious:false
                        Preview:PK........X..<..Zn|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.*S=.$......T_6..I...6...d.NJ....r.p.p.........|.z.K.M..L.T.(........<..ks.......o...t}...P..*.7...`.+.[...H..._..X.u.....N....n....n|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j.*.?..mxk..n..|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6*.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow|&4>...d.O.|.|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

                        C:\Users\user\AppData\Local\Temp\TCD2C82.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):260
                        Entropy (8bit):3.4895685222798054
                        Encrypted:false
                        SSDEEP:6:fxnxUX4cPBl4xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyPl4xoGHmD0+dAH/luWvv
                        MD5:63E8B0621B5DEFE1EF17F02EFBFC2436
                        SHA1:2D02AD4FD9BF89F453683B7D2B3557BC1EEEE953
                        SHA-256:9243D99795DCDAD26FA857CB2740E58E3ED581E3FAEF0CB3781CBCD25FB4EE06
                        SHA-512:A27CDA84DF5AD906C9A60152F166E7BD517266CAA447195E6435997280104CBF83037F7B05AE9D4617323895DCA471117D8C150E32A3855156CB156E15FA5864
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.r.y.i.n.g.W.i.d.t.h.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

                        C:\Users\user\AppData\Local\Temp\TCD2C82.tmp\VaryingWidthList.glox

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):3075
                        Entropy (8bit):7.716021191059687
                        Encrypted:false
                        SSDEEP:48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
                        MD5:67766FF48AF205B771B53AA2FA82B4F4
                        SHA1:0964F8B9DC737E954E16984A585BDC37CE143D84
                        SHA-256:160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
                        SHA-512:AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
                        Malicious:false
                        Preview:PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..|. 1^......&..|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

                        C:\Users\user\AppData\Local\Temp\TCD2C92.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):238
                        Entropy (8bit):3.472155835869843
                        Encrypted:false
                        SSDEEP:6:fxnxUXGE2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny4GHmD0+dAH/luWvv
                        MD5:2240CF2315F2EB448CEA6E9CE21B5AC5
                        SHA1:46332668E2169E86760CBD975FF6FA9DB5274F43
                        SHA-256:0F7D0BD5A8CED523CFF4F99D7854C0EE007F5793FA9E1BA1CD933B0894BFBD0D
                        SHA-512:10BA73FF861112590BF135F4B337346F9D4ACEB10798E15DC5976671E345BC29AC8527C6052FEC86AA7058E06D1E49052E49D7BCF24A01DB259B5902DB091182
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .r.i.n.g.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

                        C:\Users\user\AppData\Local\Temp\TCD2C92.tmp\rings.glox

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):5151
                        Entropy (8bit):7.859615916913808
                        Encrypted:false
                        SSDEEP:96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
                        MD5:6C24ED9C7C868DB0D55492BB126EAFF8
                        SHA1:C6D96D4D298573B70CF5C714151CF87532535888
                        SHA-256:48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
                        SHA-512:A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
                        Malicious:false
                        Preview:PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..|. 1^......&..|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............|.c..x{_._..^0e.|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.|>YK.....o.|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..|..O>o.|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

                        C:\Users\user\AppData\Local\Temp\TCD2CA3.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):286
                        Entropy (8bit):3.4670546921349774
                        Encrypted:false
                        SSDEEP:6:fxnxUX0XPYDxUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPYDCloGHmD0+dAH/luWvv
                        MD5:3D52060B74D7D448DC733FFE5B92CB52
                        SHA1:3FBA3FFC315DB5B70BF6F05C4FF84B52A50FCCBC
                        SHA-256:BB980559C6FC38B703D1E9C41720D5CE8D00D2FF86D4F25136DB02B1E54B1518
                        SHA-512:952EF139A72562A528C1052F1942DAE1C0509D67654BF5E7C0602C87F90147E8EE9E251D2632BCB5B511AB2FF8A3734293D0A4E3DBD3D187F5E3C042685F9A0C
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.l.t.e.r.n.a.t.i.n.g.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

                        C:\Users\user\AppData\Local\Temp\TCD2CA3.tmp\ThemePictureAlternatingAccent.glox

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):5630
                        Entropy (8bit):7.87271654296772
                        Encrypted:false
                        SSDEEP:96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
                        MD5:2F8998AA9CF348F1D6DE16EAB2D92070
                        SHA1:85B13499937B4A584BEA0BFE60475FD4C73391B6
                        SHA-256:8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
                        SHA-512:F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
                        Malicious:false
                        Preview:PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.|8.!b.C..v..|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..|...!..q;;.w.".D..lt.".l.4".mt...E..mt

                        C:\Users\user\AppData\Local\Temp\TCD2D90.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):274
                        Entropy (8bit):3.438490642908344
                        Encrypted:false
                        SSDEEP:6:fxnxUXZlaWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyplagN2RGHmD0wbnKYZAH+Vwv
                        MD5:0F98498818DC28E82597356E2650773C
                        SHA1:1995660972A978D17BC483FCB5EE6D15E7058046
                        SHA-256:4587CA0B2A60728FF0A5B8E87D35BF6C6FDF396747E13436EC856612AC1C6288
                        SHA-512:768562F20CFE15001902CCE23D712C7439721ECA6E48DDDCF8BFF4E7F12A3BC60B99C274CBADD0128EEA1231DB19808BAA878E825497F3860C381914C21B46FF
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.l.e.m.e.n.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

                        C:\Users\user\AppData\Local\Temp\TCD2D90.tmp\Element design set.dotx

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Word 2007+
                        Category:dropped
                        Size (bytes):34415
                        Entropy (8bit):7.352974342178997
                        Encrypted:false
                        SSDEEP:768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
                        MD5:7CDFFC23FB85AD5737452762FA36AAA0
                        SHA1:CFBC97247959B3142AFD7B6858AD37B18AFB3237
                        SHA-256:68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
                        SHA-512:A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
                        Malicious:false
                        Preview:PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~|.?"....|.{.[..e^7E......Gi..V.by..G..|.......U..t.|..mW...m..|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b....*..w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&.*...Y.....4.u.., !po....9W....g..F...*+1....d,'...L.M[-~.Ey. ......[

                        C:\Users\user\AppData\Local\Temp\TCD2DA1.tmp\Banded.thmx

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):562113
                        Entropy (8bit):7.67409707491542
                        Encrypted:false
                        SSDEEP:12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
                        MD5:4A1657A3872F9A77EC257F41B8F56B3D
                        SHA1:4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
                        SHA-256:C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
                        SHA-512:7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
                        Malicious:false
                        Preview:PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

                        C:\Users\user\AppData\Local\Temp\TCD2DA1.tmp\content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):278
                        Entropy (8bit):3.535736910133401
                        Encrypted:false
                        SSDEEP:6:Q+sxnxUXeAlFkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyRGymD0wbnKNAH/lMz1
                        MD5:487E25E610F3FC2EEA27AB54324EA8F6
                        SHA1:11C2BB004C5E44503704E9FFEEFA7EA7C2A9305C
                        SHA-256:022EC5077279A8E447B590F7260E1DBFF764DE5F9CDFD4FDEE32C94C66D4A1A2
                        SHA-512:B8DF351E2C0EF101CF91DC02E136A3EE9C1FDB18294BECB13A29D676FBBE791A80A58A18FBDEB953BC21EC54EB7608154D401407C461ABD10ACB94CE8AD0E092
                        Malicious:false
                        Preview:..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.n.d.e.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

                        C:\Users\user\AppData\Local\Temp\TCD2E33.tmp\Dividend.thmx

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):570901
                        Entropy (8bit):7.674434888248144
                        Encrypted:false
                        SSDEEP:6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
                        MD5:D676DE8877ACEB43EF0ED570A2B30F0E
                        SHA1:6C8922697105CEC7894966C9C5553BEB64744717
                        SHA-256:DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
                        SHA-512:F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
                        Malicious:false
                        Preview:PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

                        C:\Users\user\AppData\Local\Temp\TCD2E33.tmp\content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):282
                        Entropy (8bit):3.5459495297497368
                        Encrypted:false
                        SSDEEP:6:Q+sxnxUXvBAuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnypJymD0wbnKNAH/lMz1
                        MD5:76340C3F8A0BFCEDAB48B08C57D9B559
                        SHA1:E1A6672681AA6F6D525B1D17A15BF4F912C4A69B
                        SHA-256:78FE546321EDB34EBFA1C06F2B6ADE375F3B7C12552AB2A04892A26E121B3ECC
                        SHA-512:49099F040C099A0AED88E7F19338140A65472A0F95ED99DEB5FA87587E792A2D11081D59FD6A83B7EE68C164329806511E4F1B8D673BEC9074B4FF1C09E3435D
                        Malicious:false
                        Preview:..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.i.v.i.d.e.n.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

                        C:\Users\user\AppData\Local\Temp\TCD2E43.tmp\Frame.thmx

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):523048
                        Entropy (8bit):7.715248170753013
                        Encrypted:false
                        SSDEEP:6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
                        MD5:C276F590BB846309A5E30ADC35C502AD
                        SHA1:CA6D9D6902475F0BE500B12B7204DD1864E7DD02
                        SHA-256:782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
                        SHA-512:B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
                        Malicious:false
                        Preview:PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

                        C:\Users\user\AppData\Local\Temp\TCD2E43.tmp\content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):276
                        Entropy (8bit):3.5159096381406645
                        Encrypted:false
                        SSDEEP:6:Q+sxnxUXQIa3ARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygIaqymD0wbnKNAH/lMz1
                        MD5:71CCB69AF8DD9821F463270FB8CBB285
                        SHA1:8FED3EB733A74B2A57D72961F0E4CF8BCA42C851
                        SHA-256:8E63D7ABA97DABF9C20D2FAC6EB1665A5D3FDEAB5FA29E4750566424AE6E40B4
                        SHA-512:E62FC5BEAEC98C5FDD010FABDAA8D69237D31CA9A1C73F168B1C3ED90B6A9B95E613DEAD50EB8A5B71A7422942F13D6B5A299EB2353542811F2EF9DA7C3A15DC
                        Malicious:false
                        Preview:..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .F.r.a.m.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

                        C:\Users\user\AppData\Local\Temp\TCD2E44.tmp\Basis.thmx

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):558035
                        Entropy (8bit):7.696653383430889
                        Encrypted:false
                        SSDEEP:12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
                        MD5:3B5E44DDC6AE612E0346C58C2A5390E3
                        SHA1:23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
                        SHA-256:9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
                        SHA-512:2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
                        Malicious:false
                        Preview:PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

                        C:\Users\user\AppData\Local\Temp\TCD2E44.tmp\content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):276
                        Entropy (8bit):3.5361139545278144
                        Encrypted:false
                        SSDEEP:6:Q+sxnxUXeMWMluRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnycMlMymD0wbnKNAH/lMz1
                        MD5:133D126F0DE2CC4B29ECE38194983265
                        SHA1:D8D701298D7949BE6235493925026ED405290D43
                        SHA-256:08485EBF168364D846C6FD55CD9089FE2090D1EE9D1A27C1812E1247B9005E68
                        SHA-512:75D7322BE8A5EF05CAA48B754036A7A6C56399F17B1401F3F501DA5F32B60C1519F2981043A773A31458C3D9E1EF230EC60C9A60CAC6D52FFE16147E2E0A9830
                        Malicious:false
                        Preview:..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.s.i.s...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

                        C:\Users\user\AppData\Local\Temp\TCD2E45.tmp\Metropolitan.thmx

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):777647
                        Entropy (8bit):7.689662652914981
                        Encrypted:false
                        SSDEEP:6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
                        MD5:B30D2EF0FC261AECE90B62E9C5597379
                        SHA1:4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
                        SHA-256:BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
                        SHA-512:2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
                        Malicious:false
                        Preview:PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~|.?"....|.{.[..e^7E......Gi..V.by..G..|.......U..t.|..mW...m..|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

                        C:\Users\user\AppData\Local\Temp\TCD2E45.tmp\content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):290
                        Entropy (8bit):3.5091498509646044
                        Encrypted:false
                        SSDEEP:6:Q+sxnxUX1MiDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyFdMymD0wbnKNAH/lMz1
                        MD5:23D59577F4AE6C6D1527A1B8CDB9AB19
                        SHA1:A345D683E54D04CC0105C4BFFCEF8C6617A0093D
                        SHA-256:9ADD2C3912E01C2AC7FAD6737901E4EECBCCE6EC60F8E4D78585469A440E1E2C
                        SHA-512:B85027276B888548ECB8A2FC1DB1574C26FF3FCA7AF1F29CD5074EC3642F9EC62650E7D47462837607E11DCAE879B1F83DF4762CA94667AE70CBF78F8D455346
                        Malicious:false
                        Preview:..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.t.r.o.p.o.l.i.t.a.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

                        C:\Users\user\AppData\Local\Temp\TCD7E7F.tmp\Content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):374
                        Entropy (8bit):3.5414485333689694
                        Encrypted:false
                        SSDEEP:6:fxnxUX8FaE3f8AWqlQqr++lcWimqnKOE3QepmlJ0+3FbnKfZObdADryMluxHZypo:fxnyj9AWI+acgq9GHmD0wbnKYZAH/lMf
                        MD5:2F7A8FE4E5046175500AFFA228F99576
                        SHA1:8A3DE74981D7917E6CE1198A3C8E35C7E2100F43
                        SHA-256:1495B4EC56B371148EA195D790562E5621FDBF163CDD8A5F3C119F8CA3BD2363
                        SHA-512:4B8FBB692D91D88B584E46C2F01BDE0C05DCD5D2FF073D83331586FB3D201EACD777D48DB3751E534E22115AA1C3C30392D0D642B3122F21EF10E3EE6EA3BE82
                        Malicious:false
                        Preview:[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.e.x.t. .S.i.d.e.b.a.r. .(.A.n.n.u.a.l. .R.e.p.o.r.t. .R.e.d. .a.n.d. .B.l.a.c.k. .d.e.s.i.g.n.)...d.o.c.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

                        C:\Users\user\AppData\Local\Temp\TCD7E7F.tmp\Text Sidebar (Annual Report Red and Black design).docx

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Word 2007+
                        Category:dropped
                        Size (bytes):47296
                        Entropy (8bit):6.42327948041841
                        Encrypted:false
                        SSDEEP:768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
                        MD5:5A53F55DD7DA8F10A8C0E711F548B335
                        SHA1:035E685927DA2FECB88DE9CAF0BECEC88BC118A7
                        SHA-256:66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
                        SHA-512:095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
                        Malicious:false
                        Preview:PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~|.?"....|.{.[..e^7E......Gi..V.by..G..|.......U..t.|..mW...m..|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

                        C:\Users\user\AppData\Local\Temp\TCD7F5C.tmp\View.thmx

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):486596
                        Entropy (8bit):7.668294441507828
                        Encrypted:false
                        SSDEEP:6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
                        MD5:0E37AECABDB3FDF8AAFEDB9C6D693D2F
                        SHA1:F29254D2476DF70979F723DE38A4BF41C341AC78
                        SHA-256:7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
                        SHA-512:DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
                        Malicious:false
                        Preview:PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~|.?"....|.{.[..e^7E......Gi..V.by..G..|.......U..t.|..mW...m..|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

                        C:\Users\user\AppData\Local\Temp\TCD7F5C.tmp\content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):274
                        Entropy (8bit):3.535303979138867
                        Encrypted:false
                        SSDEEP:6:Q+sxnxUX3IlVARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnynG6ymD0wbnKNAH/lMz1
                        MD5:35AFE8D8724F3E19EB08274906926A0B
                        SHA1:435B528AAF746428A01F375226C5A6A04099DF75
                        SHA-256:97B8B2E246E4DAB15E494D2FB5F8BE3E6361A76C8B406C77902CE4DFF7AC1A35
                        SHA-512:ACF4F124207974CFC46A6F4EA028A38D11B5AF40E55809E5B0F6F5DABA7F6FC994D286026FAC19A0B4E2311D5E9B16B8154F8566ED786E5EF7CDBA8128FD62AF
                        Malicious:false
                        Preview:..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.i.e.w...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

                        C:\Users\user\AppData\Local\Temp\TCD7F5D.tmp\Parcel.thmx

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):608122
                        Entropy (8bit):7.729143855239127
                        Encrypted:false
                        SSDEEP:6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
                        MD5:8BA551EEC497947FC39D1D48EC868B54
                        SHA1:02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
                        SHA-256:DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
                        SHA-512:CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
                        Malicious:false
                        Preview:PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

                        C:\Users\user\AppData\Local\Temp\TCD7F5D.tmp\content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):278
                        Entropy (8bit):3.516359852766808
                        Encrypted:false
                        SSDEEP:6:Q+sxnxUXKwRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6qymD0wbnKNAH/lMz1
                        MD5:960E28B1E0AB3522A8A8558C02694ECF
                        SHA1:8387E9FD5179A8C811CCB5878BAC305E6A166F93
                        SHA-256:2707FCA8CEC54DF696F19F7BCAD5F0D824A2AC01B73815DE58F3FCF0AAB3F6A0
                        SHA-512:89EA06BA7D18B0B1EA624BBC052F73366522C231BD3B51745B92CF056B445F9D655F9715CBDCD3B2D02596DB4CD189D91E2FE581F2A2AA2F6D814CD3B004950A
                        Malicious:false
                        Preview:..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.c.e.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

                        C:\Users\user\AppData\Local\Temp\TCD80A9.tmp\Parallax.thmx

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):924687
                        Entropy (8bit):7.824849396154325
                        Encrypted:false
                        SSDEEP:12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
                        MD5:97EEC245165F2296139EF8D4D43BBB66
                        SHA1:0D91B68CCB6063EB342CFCED4F21A1CE4115C209
                        SHA-256:3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
                        SHA-512:8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
                        Malicious:false
                        Preview:PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r..*.M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qd*w>.O.{h...|w..5.]..'.CS<.:8C}.g.|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

                        C:\Users\user\AppData\Local\Temp\TCD80A9.tmp\content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):282
                        Entropy (8bit):3.51145753448333
                        Encrypted:false
                        SSDEEP:6:Q+sxnxUXKsWkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6svymD0wbnKNAH/lMz1
                        MD5:7956D2B60E2A254A07D46BCA07D0EFF0
                        SHA1:AF1AC8CA6FE2F521B2EE2B7ABAB612956A65B0B5
                        SHA-256:C92B7FD46B4553FF2A656FF5102616479F3B503341ED7A349ECCA2E12455969E
                        SHA-512:668F5D0EFA2F5168172E746A6C32820E3758793CFA5DB6791DE39CB706EF7123BE641A8134134E579D3E4C77A95A0F9983F90E44C0A1CF6CDE2C4E4C7AF1ECA0
                        Malicious:false
                        Preview:..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.a.l.l.a.x...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

                        C:\Users\user\AppData\Local\Temp\TCD80D8.tmp\Quotable.thmx

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):966946
                        Entropy (8bit):7.8785200658952
                        Encrypted:false
                        SSDEEP:24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
                        MD5:F03AB824395A8F1F1C4F92763E5C5CAD
                        SHA1:A6E021918C3CEFFB6490222D37ECEED1FC435D52
                        SHA-256:D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
                        SHA-512:0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
                        Malicious:false
                        Preview:PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

                        C:\Users\user\AppData\Local\Temp\TCD80D8.tmp\content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):282
                        Entropy (8bit):3.5323495192404475
                        Encrypted:false
                        SSDEEP:6:Q+sxnxUXhduDARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyxdumymD0wbnKNAH/lMz1
                        MD5:BD6B5A98CA4E6C5DBA57C5AD167EDD00
                        SHA1:CCFF7F635B31D12707DC0AC6D1191AB5C4760107
                        SHA-256:F22248FE60A55B6C7C1EB31908FAB7726813090DE887316791605714E6E3CEF7
                        SHA-512:A178299461015970AF23BA3D10E43FCA5A6FB23262B0DD0C5DDE01D338B4959F222FD2DC2CC5E3815A69FDDCC3B6B4CB8EE6EC0883CE46093C6A59FF2B042BC1
                        Malicious:false
                        Preview:..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .Q.u.o.t.a.b.l.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

                        C:\Users\user\AppData\Local\Temp\TCD8109.tmp\Berlin.thmx

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):976001
                        Entropy (8bit):7.791956689344336
                        Encrypted:false
                        SSDEEP:24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
                        MD5:9E563D44C28B9632A7CF4BD046161994
                        SHA1:D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
                        SHA-256:86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
                        SHA-512:8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
                        Malicious:false
                        Preview:PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~|.?"....|.{.[..e^7E......Gi..V.by..G..|.......U..t.|..mW...m..|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/|c.

                        C:\Users\user\AppData\Local\Temp\TCD8109.tmp\content.inf

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):278
                        Entropy (8bit):3.5270134268591966
                        Encrypted:false
                        SSDEEP:6:Q+sxnxUXa3Y1kRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyt1mymD0wbnKNAH/lMz1
                        MD5:327DA4A5C757C0F1449976BE82653129
                        SHA1:CF74ECDF94B4A8FD4C227313C8606FD53B8EEA71
                        SHA-256:341BABD413AA5E8F0A921AC309A8C760A4E9BA9CFF3CAD3FB2DD9DF70FD257A6
                        SHA-512:9184C3FB989BB271B4B3CDBFEFC47EA8ABEB12B8904EE89797CC9823F33952BD620C061885A5C11BBC1BD3978C4B32EE806418F3F21DA74F1D2DB9817F6E167E
                        Malicious:false
                        Preview:..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.e.r.l.i.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

                        C:\Users\user\AppData\Local\Temp\cab2B4D.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 16689 bytes, 2 files, at 0x4c "iso690.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
                        Category:dropped
                        Size (bytes):32833
                        Entropy (8bit):7.825460303519308
                        Encrypted:false
                        SSDEEP:768:+0TU06CkaUYMoi//YX428RaFA8Pi6e9iA4I3w:vICTm/QorUpP7eAA4I3w
                        MD5:205AF51604EF96EF1E8E60212541F742
                        SHA1:D436FE689F8EF51FBA898454CF509DDB049C1545
                        SHA-256:DF3FFF163924D08517B41455F2D06788BA4E49C68337D15ECF329BE48CF7DA2D
                        SHA-512:BCBA80ED0E36F7ABC1AEF19E6FF6EB654B9E91268E79CA8F421CB8ADD6C2B0268AD6C45E6CC06652F59235084ECDA3BA2851A38E6BCD1A0387EB3420C6EC94AC
                        Malicious:false
                        Preview:MSCF....1A......L...........................1A...?..................S@......v...............iso690.xsl.................Content.inf.B.9.....[...A.c...32.E...P..'.^}.f...ikMJ....m..s..U.w{m{{...}n.4........I. ..9..d..I.......P|....F...F.......&&J.:I.34......+*M3..4mr.........m.r..m)....dK.wiw...H,...r........y.$..Cu...L...dH.../..V......g.PG$R39...4O..............{w..^....c.m.m.o.....#..Fgs..6.....b....3.I..O....B..B..1h"....K|f .41......_..g.N.<.>........(....o3a.M)....J..}....-......8.......g.hm!r<...-..1.1....q.?....S.m...`L.g#.K.igv.].ghD....L...p5..?.......iP.[JS.J..?z~.T/.Q...E.K.......P+\LW.-.c..[9.n.7.....P...*[.A1....m...4h.9...N[....h5 n%k.~RR.*c..n..=...4....).eH.-./..>....*.r..S.*..dE.........pF..s.A..?...f..u.+.{..?>N.4].}Xb.M......y......'.2..'..........J4{r..r.3........5>..a0.>.u_.y@g....+y.yu--,ZdD.........5]3..'.s...|.....K.....T..G.G.e...)..\x..OM.g...`..j0......BfH...+.....:......l`.qU...;.@...",.."........>;P.B.^F...3!......Rx.9..

                        C:\Users\user\AppData\Local\Temp\cab2B5D.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 15327 bytes, 2 files, at 0x4c "sist02.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
                        Category:dropped
                        Size (bytes):31471
                        Entropy (8bit):7.818389271364328
                        Encrypted:false
                        SSDEEP:768:eNtFWk68dbr2QxbM971RqpzAA8Pi6TlHaGRA5yr:eNtEkpGSbuHAkP7TlHaGq54
                        MD5:91AADBEC4171CFA8292B618492F5EF34
                        SHA1:A47DEB62A21056376DD8F862E1300F1E7DC69D1D
                        SHA-256:7E1A90CDB2BA7F03ABCB4687F0931858BF57E13552E0E4E54EC69A27325011EA
                        SHA-512:1978280C699F7F739CD9F6A81F2B665643BD0BE42CE815D22528F0D57C5A646FC30AAE517D4A0A374EFB8BD3C53EB9B3D129660503A82BA065679BBBB39BD8D5
                        Malicious:false
                        Preview:MSCF.....;......L............................;...?...................;......g...............sist02.xsl.................Content.inf....!....[...=.rF..3U.5...g.i?..w.oY..If'.......Y.;.B.....Wo.{T.TA.~......8......u.p....@Q..k.?.....G....j.|*.*J69H.2.ee..23s..;3..i..L.,...0se.%J........%.....!.....qB...SC...GAu5.P..u7....:.|.$Fo............{.......v.v.g..{o....e.....m.JeRG..,.%.1..Lh.@8.i.....l.#.HB`B....C......D@....?....P?..................|.9..q.......9.n.....F...s,....3..Q..N......y......_i..9|.<w...'q.Tq...U.E.B...q.?.4..O(_O.A.......*jC.~.21.7.....u.C...]uc.....-.g.{C~9q.q.1.1...4..=.0.Z.^....'../....-.6.K.....K...A#.GR..t.@.{.O.......Q5..=....X...^...F3.e.E.Z..b+R..?Z..0T1.....gQz.&....%y=zx.f.....6-*...u.Rm..x<...?...!g@.}..).J...:*...9.s&.v..}..'...\..Sd..F...........kQr.....h..3..1....B...B{M...%O.59.\.#....s/.pE.:}...k_.P.>.zj....5|.9+....$M..L........(...@#.....N.....N.*..........E..7..R$.:9!r>7.....v...>..S.w....9..]..n.w.;&.W..<r\S....

                        C:\Users\user\AppData\Local\Temp\cab2B5E.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 15338 bytes, 2 files, at 0x4c "gosttitle.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
                        Category:dropped
                        Size (bytes):31482
                        Entropy (8bit):7.808057272318224
                        Encrypted:false
                        SSDEEP:768:LgHv7aLOcoLGQ4EykdrHwLa+A8Pi6Iv8ACIa:LwvWyx4EykdTwLaWP7I0ACIa
                        MD5:F10DF902980F1D5BEEA96B2C668408A7
                        SHA1:92D341581B9E24284B7C29E5623F8028DBBAAFE9
                        SHA-256:E0100320A4F63E07C77138A89EA24A1CBD69784A89FE3BF83E35576114B4CE02
                        SHA-512:00A8FBCD17D791289AC8F12DC3C404B0AFD240278492DF74D2C5F37609B11D91A26D737BE95D3FE01CDBC25EEDC6DA0C2D63A2CCC4AB208D6E054014083365FB
                        Malicious:false
                        Preview:MSCF.....;......L............................;...?...................;......................gosttitle.xsl.$...............Content.inf....v....[...=..Ic.32.E...`o.............m....4uk[.,.......{...}k{.R@(Hq..68nv...@.D.....$...j....8Q..........8.8........3...*.bi?Wt...:(..J.;&eii..io.w..z...`.'..i.MLR@.>....N..3`P.>$X@(r.#.D..(....P"_..I.$o.. L!y...I...H.........{.{....{.3....7..w..{w.2sn.dYn.lW...l...c$.UH....L6. .D$$...!F.!... .D............_..'.`.Q.v>..Z..f.n.l....0o.......bK...?s..eO....'.>t......S'..........~....h...v&7:q.x9|qs...%....:..D...ag.....e..'...".A.Y..?w"....p1t.9J.~.4.........~vj.n.8.;.O......../.}..io{p...e...\m.d`.gAm.......1"...N*...8..g"......~..[.e+.....\6i4.....%...Rq.U-p?..4P..4.f.?N.vI?.M\i.;.s..E.L.hu.*...\..5....N......]......\`...rS.\g.....2..!a).?.l.!i.^.t.u...x...g/.A..v.E...\.@.>kM...&.g.....%.......{.....2..E.g...'..[w...N.w..& 4M.a.cu.%:...\.D..Q..C.'fm..i....@._......QI.. ....h..|fB.il.(`..h.d;.l...`.s:

                        C:\Users\user\AppData\Local\Temp\cab2B70.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 17466 bytes, 2 files, at 0x4c "chicago.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 10 datablocks, 0x1203 compression
                        Category:dropped
                        Size (bytes):33610
                        Entropy (8bit):7.8340762758330476
                        Encrypted:false
                        SSDEEP:768:IlFYcxiahedKSDNAPk5WEEfA8Pi6xnOKMRA58:2JitdKsNAM5WBDP7xOKMq58
                        MD5:51804E255C573176039F4D5B55C12AB2
                        SHA1:A4822E5072B858A7CCA7DE948CAA7D2268F1BB4B
                        SHA-256:3C6F66790C543D4E9D8E0E6F476B1ACADF0A5FCDD561B8484D8DDDADFDF8134B
                        SHA-512:2AC8B1E433C9283377B725A03AE72374663FEC81ABBA4C049B80409819BB9613E135FCD640ED433701795BDF4D5822461D76A06859C4084E7BAE216D771BB091
                        Malicious:false
                        Preview:MSCF....:D......L...........................:D...?..................XC.....................chicago.xsl. ...............Content.inf.!..B...[...H."m..3C.6...WP!i/Z..vn._...^omvw+...^..L.4o...g..y......^..x...BH.B.K....w.....F........p ./gg.h.0I',.$..a.`.*...^..vi..mw..........K....oQ............P...#...3.......U(.=...q.~?..H..?.'I4'.......X...}w.vw.....f.n..f{3.....-....%dK&q..D.H.Z..h-..H.[$ %.."..e....1...$.............'.....B..%..4...&`S!DQ...M.......N~............S..'....M..4E.^..dej..i..+.`...6F%sJ....Q..d.(*.s.Z...U-5Eh.s.CK...K..X$......j..T.?.`.|...=..R...-7...*...TU.....7a...&I.noOK|.W.R-+S.d..rR.....{h.Y...)..xJ..=.XM..o...P'.I4m..~I..C..m.....f.....;{Mzg+Wm.~...z...r-.....eK...lj:^.1g5...7.h(T"..t?5......u.....G.Z<..sL.\{...8=t...Z...'tps.:...|....6.....S..X...I...6l.M.....aq.;YS....{:.&.'.&.F.l...\.[L.%.so\.v.Lo...zO.^^...p..*9k...).CC..F0>L...VUE4.......2..c..p.rCi..#...b.C@o.l.. E_b..{d...hX.\_!a#.E.....yS.H...aZ...~D3.pj: ss?.]....~

                        C:\Users\user\AppData\Local\Temp\cab2B73.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 12767 bytes, 2 files, at 0x4c "ieee2006officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
                        Category:dropped
                        Size (bytes):28911
                        Entropy (8bit):7.7784119983764715
                        Encrypted:false
                        SSDEEP:384:WnJY165YD0tPYoCKa3HueqRyzVscLk1Yj2GjcgbA8E0GftpBjE2kWTpjFLrHRN7N:X4rtPzCK6uRoljXBA8Pi62ZphL0HRA5p
                        MD5:6D787B1E223DB6B91B69238062CCA872
                        SHA1:A02F3D847D1F8973E854B89D4558413EA2E349F7
                        SHA-256:DA2F261C3C82E229A097A9302C8580F014BB6442825DB47C008DA097CFCE0EE4
                        SHA-512:9856D88D5C63CD6EBCF26E5D7521F194FA6B6E7BF55DD2E0238457A1B760EB8FB0D573A6E85E819BF8E5BE596537E99BC8C2DCE7EC6E2809A43490CACCD44169
                        Malicious:false
                        Preview:MSCF.....1......L............................1...?...................0......"}..............ieee2006officeonline.xsl.:...............Content.inf.........[...G."...3$pE...G B....m3o[...I2&.f.,\..........}.n..{..e.8!^.3.A@...x..... .D.52gU..]..."..N8....s..CS..J3..HV...m...y..o....F.z......V.j._....=~k.....'.dY........1........#...d13.g.&C...C.xw.`f.hf..........]M....m.m....ud...,+.H~..cL...e#;(RI...eA....I.b...E...2..(...$.j...L...$..A....'[...H9..&..G.Q....".M.yl....]..?j%+....O~.*....|.se...K\.B"W..F.5.......=s...l.Y...K..yN.TBH[...sTWR.N.d...WEa....T.d.K.^sauI......m..s=.,qso5.b.V.s.]..9..,k4.\..L.;D...........;r.C...7.w.j..:N8.V6..a.3..j:A.mA..To..$.5....:./..p.x.3.=..__...8.EB.K.*..].-."..5-XU..J.....=o..K.Wavg.o].z.9.gk.._.........MZ.<.5............OY.n.o...r.9v.c.......[n.[..D...d..}.j.....LB,]_.9..St.@..C....\...^....-&.njq..!P....G^.....w.7.p~.......M..g.J............t1......q.w.rx...qp.....E.........-...2..G.........z.]B........d....C.@...@.

                        C:\Users\user\AppData\Local\Temp\cab2B74.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 14864 bytes, 2 files, at 0x4c "mlaseventheditionofficeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
                        Category:dropped
                        Size (bytes):31008
                        Entropy (8bit):7.806058951525675
                        Encrypted:false
                        SSDEEP:768:ktH7oN/HbwiV+M+4Jc+5UrT3czi5uOHQA8Pi6DxUR/WTZIy:87sPEANXJc+eTMsuzP7DmN0ZIy
                        MD5:E033CCBC7BA787A2F824CE0952E57D44
                        SHA1:EEEA573BEA217878CD9E47D7EA94E56BDAFFE22A
                        SHA-256:D250EB1F93B43EFB7654B831B4183C9CAEC2D12D4EFEE8607FEE70B9FAB20730
                        SHA-512:B807B024B32E7F975AED408B77563A6B47865EECE32E8BA993502D9874B56580ECC9D9A3FEFA057FDD36FB8D519B6E184DB0593A65CC0ACF5E4ACCBEDE0F9417
                        Malicious:false
                        Preview:MSCF.....:......L............................:...?...................9......................mlaseventheditionofficeonline.xsl.L...............Content.inf.N.#.....[...>..9..3c.5...F.B.]Y.3..%d.8...v;....~Y.L.=..v..m.g...|K.B....$......s.......#CdE.p.p..@...j.Nl2'...L..N.G:-V:.d.....i..M........mK.w.....\W.<.`..b$.!..!3..rT.A..#.).;KZ...a.-..j&e`R.~7dIRS.I..f.ff....}.}....^[wo.uw..i.m7......v$.I..n....-.Z.M5...iH..Ea..., [..0.L...DH..." ..... .@...H.@..+...}.......*^..'.4*.tHa..f].gV..~.7V.....C..).(.U"..f.@l..j'..%\.u.UU.....9<13...5..=........./..Z..{..-.L].+Y.fL.<EJ.q..!.j....W..]E./.~Y>...GgQ..-....Q.C..5..T+...fO. .)..~.7..Y....+..U=.e..8w.m...._..S..v.d.* ......S3z.X)......u...t.......i.;.a...X.Ji....g.3.!.O.....T.f6..[U....O..Z.X.q.G....?.k]..?...8.u.;].8y.T.9D..!?R....:........3+.P.....7?m}..............1...y3.g.\c.ks^;?.f.U5...U.j....E.N.}.!.......).R1....~.....R.....3.J.f...l..E^:...&_..%..v...^..E...rC..O....M.#..<..H..bB.+.W..

                        C:\Users\user\AppData\Local\Temp\cab2B86.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 15461 bytes, 2 files, at 0x4c "gostname.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
                        Category:dropped
                        Size (bytes):31605
                        Entropy (8bit):7.820497014278096
                        Encrypted:false
                        SSDEEP:384:7SpOUxgQ9gFodHZktfHa2TSmcAg76j8/xorK0JoZgbA8E0GftpBjE2PzFLrHRN7S:OngHltf7Bcp/xoB3A8Pi625D8RA54
                        MD5:69EDB3BF81C99FE8A94BBA03408C5AE1
                        SHA1:1AC85B369A976F35244BEEFA9C06787055C869C1
                        SHA-256:CEBE759BC4509700E3D23C6A5DF8D889132A60EBC92260A74947EAA1089E2789
                        SHA-512:BEA70229A21FBA3FD6D47A3DC5BECBA3EAA0335C08D486FAB808344BFAA2F7B24DD9A14A0F070E13A42BE45DE3FF54D32CF38B43192996D20DF4176964E81A53
                        Malicious:false
                        Preview:MSCF....e<......L...........................e<...?...................;......................gostname.xsl."...............Content.inf.[.......[...>..|..32.E..o`h....W.>.^...v..5...m.w.$.U..U......m.mu...'4....m`.9F.. ...I..PTS..O.D...GM#...#CUE.`.`%n..N...G,.~..+.6cv.L...G.m.Y..vy.....Yh9/.m,..wtw..;....Ka.a.{.\...'.....<X....%)...G..d......R./..4$..32..@....f.h....w..ov.}w..[.....{.v.......dr..&w#G..$3.zI&f..(C..L.z5J... .`...!.!4. ...!.` .$........w.J.X7.w_..@.w..f]=.C.....I-....s.s_.x...~..A... ...z...nM..;....Z....vt....6...~.w.....*x.g.h.T.J..-.3=....G.n..ti.A...s...j$.Bf..?......6.t.<j...>.."....&=BO?w.uN.o.t.-r..K....>C..^G..p...k...>.xZ.[fL..n.."].W#...|.i.0W.q.F: ..<#w......w....s....."...n.qu.../rI.....q....P~.B..|b?.N.}..MyO..q..:q.7..-~.xa.S...|.....X.....g.W.3.mo..yy.GG.s>....qy....r........#.F.P..A.......A....b.2..14.8.i6..w.S...v~{0z.<.Z...^!.;2mSV.i....{...U...+...r.;...h.++..T6.a...$....j5F+..1t....b......|.Q\d-.S..2... ......Y..A...s....

                        C:\Users\user\AppData\Local\Temp\cab2B96.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 15418 bytes, 2 files, at 0x4c "harvardanglia2008officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
                        Category:dropped
                        Size (bytes):31562
                        Entropy (8bit):7.81640835713744
                        Encrypted:false
                        SSDEEP:384:yhsBScEWkrljntbzuMmWh7ezPnGgbA8E0GftpBjohgsRFLrHRN7ybll7PK/p:MsBScwtnBmWNeTzA8PiuWsvyDI
                        MD5:1D6F8E73A0662A48D332090A4C8C898F
                        SHA1:CF9AD4F157772F5EDC0FDDEEFD9B05958B67549C
                        SHA-256:8077C92C66D15D7E03FBFF3A48BD9576B80F698A36A44316EABA81EE8043B673
                        SHA-512:5C03A99ECD747FBC7A15F082DF08C0D26383DB781E1F70771D4970E354A962294CE11BE53BECAAD6746AB127C5B194A93B7E1B139C12E6E45423B3A509D771FC
                        Malicious:false
                        Preview:MSCF....:<......L...........................:<...?..................D;.......V..............harvardanglia2008officeonline.xsl.L...............Content.inf.Vu......[...E..o..3D.5..nF.A..+.e.....6r..f........M3...-.s.m.... $r.b.!.q!.....G...0.\.......fd......%m...'1Y..f..O...*.#.P.,{..m...|..ww.{.m...f...n%...,..y...0y...8.Q...`.../.q....a...',.V......8.7..8t..................6.]..6..nw..ynm..-l.Y..,.I?..$....+b9$E!S@"..) .4........H...lA...@!a.F.l$..0#!.....n&.5j.t+..1f|.+....E.zDk.l8.+<q.^.........\5.l..iT.9...........Y..6.^,.o.bn.E*5w..s.../...W.gS..j9..'W.F......].4\Mzz..Td..Ho..~.Q...Z..D..O.JP..m..s.j.:..........y._.....#.*.rD....60.\!y........p.o3,..Ub,......[[L.{.5.....5.7UDB9.{;;g.z.z..jM.G.MY.oe.....(r..B6..CV.7Fl.Z/....-.O.vY.c...-..........b.T)3.u..f~x2.?.8.g.x.-.....Qt_...$e.l..jtP..b....h..*.sW0.`.....c...F_....t.........LC..*5I.X$^.;&....#.._\J..........;..wP..wX.qy.qs...}46..fK.XN.&0........k1....8...............'t.......}.......O_.

                        C:\Users\user\AppData\Local\Temp\cab2B98.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 4091 bytes, 2 files, at 0x44 "BracketList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
                        Category:dropped
                        Size (bytes):20235
                        Entropy (8bit):7.61176626859621
                        Encrypted:false
                        SSDEEP:384:j3W3yGyjgbA8E0GftpBjEHvFLrHRN7pDAlI66Yv1:j3WFyAA8Pi6HVpDZ66c1
                        MD5:E3C64173B2F4AA7AB72E1396A9514BD8
                        SHA1:774E52F7E74B90E6A520359840B0CA54B3085D88
                        SHA-256:16C08547239E5B969041AB201EB55A3E30EAD400433E926257331CB945DFF094
                        SHA-512:7ED618578C6517ED967FB3521FD4DBED9CDFB7F7982B2B8437804786833207D246E4FCD7B85A669C305BE3B823832D2628105F01E2CF30B494172A17FC48576D
                        Malicious:false
                        Preview:MSCF............D................................?..................................BracketList.glox.................Content.inf....7r...[.... G.q..@...B.....?X!.A.......!........X..Vk.JK...Z..=......PD.....P....5...jp..+..T....b.)np5.7.....Zz........... ..!.....S......1....`....h......T?.Nq../......z....[..:..5f;....O...d.FxD...4...Z....[..a...w..W.[..P...5.]...6..."...+t].!...2\%%`Q.\..)...=>.)......a.$.2.,...2,.Lw.?..+..qf....h....T/B.....}T.E...'.%.....,.......X....b..gt.hPYc|.....a...j...=...{..a.`!8!..|...L.T..k..!,.R.z/W....{..,...+..w.m..sQ..7<x..B....?....\.)..l...d...}.....v..W.C..'=p1c.Z=.W.g.e....&wm..N,..K.T../.oV../=9.}.....".28...r.Q....dzj{....S...1m...x9_...2PXpa...Q.n.$z...c..SGq...k......}kPE..*...3.|.5A.>..6.......+)qCB....q....qNkGe...W]..o..Z...J.<.i......qq.8....q..BE.(...._h.U.\@3.F...KdO..=1j+....).*Q.|B..Z..%......LDYk....j.....{klDW..#CVy}...X..O!..}..s..&..DC.....tL.j..b.......[...n.'..1..Xc...9Q..gM.....n..3...v.....~.).

                        C:\Users\user\AppData\Local\Temp\cab2B99.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 14813 bytes, 2 files, at 0x4c "iso690nmerical.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 7 datablocks, 0x1203 compression
                        Category:dropped
                        Size (bytes):30957
                        Entropy (8bit):7.808231503692675
                        Encrypted:false
                        SSDEEP:384:rKfgT03jNkAFbgUQWtxq9OGh1bBkd/1MVHb5iVOdMgbA8E0GftpBjEl8tFLrHRNF:r303jOrUQAkfhopWHbA8Pi6l8zuUIq
                        MD5:D3C9036E4E1159E832B1B4D2E9D42BF0
                        SHA1:966E04B7A8016D7FDAFE2C611957F6E946FAB1B9
                        SHA-256:434576EB1A16C2D14D666A33EDDE76717C896D79F45DF56742AFD90ACB9F21CE
                        SHA-512:D28D7F467F072985BCFCC6449AD16D528D531EB81912D4C3D956CF8936F96D474B18E7992B16D6834E9D2782470D193A17598CAB55A7F9EB0824BC3F069216B6
                        Malicious:false
                        Preview:MSCF.....9......L............................9...?...................8......1P..............iso690nmerical.xsl.................Content.inf...A@...[...5.....33.E...P.../..........5sv.]3srm8.T.=.......}.v.T.. ..4IH.r.%Z.(.q.\+K..[,....E....A......#CEF..}p..Y/s$...YKI.#M.?.t.1#C....I..v.vn...-...v7../S.m.Ma.....!.Y....4.......3.3....c&R9..%......(J..BDMI.>7J.....".....}.w.}w.wg.v...^.n.{....{f.mlI..%.#..I..S....D..QJ U......4........K.(@....DH.....}...8;..z...&0%e..G.OAM..x.3......\....zS9....}......89.B...e.W.p{;.....m.m3...}....../...q.~..;.,..".j.g..^N............iC.../|...g.=..9.Q].Gf.....QA....74..v.....9.n[......0.}..jo{y./.2..Ym......;u...b.(Jz^.....~..uM...{s../..#.)n2..S.S.c..6)U.V....!.'R.......P.S.D..S.p/......D.......{......?.u.",...Mp._....N..+..=Y#..&0w....r.......$.xwC......P.e7.>O....7....].y%q^S'....*.C.`.?..}Q..k../u.TK...y........S...{T.?......[.H.'L..AS.Y.|*..b...J.H-.^U>'9..uD[.".b[.l.......o..6.L).h.B0RJa.b..|m:.):......F

                        C:\Users\user\AppData\Local\Temp\cab2B9B.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 5864 bytes, 2 files, at 0x44 "architecture.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
                        Category:dropped
                        Size (bytes):22008
                        Entropy (8bit):7.662386258803613
                        Encrypted:false
                        SSDEEP:384:M7FUtfIdqSHQs7G8E0GftpBjED/C4RQrFLrHRN7TT8DlvQyUTL2mH:sWgdqR2G8Pi6D6YQZTTMvU+mH
                        MD5:ABBF10CEE9480E41D81277E9538F98CB
                        SHA1:F4EA53D180C95E78CC1DA88CD63F4C099BF0512C
                        SHA-256:557E0714D5536070131E7E7CDD18F0EF23FE6FB12381040812D022EC0FEE7957
                        SHA-512:9430DAACF3CA67A18813ECD842BE80155FD2DE0D55B7CD16560F4AAEFDA781C3E4B714D850D367259CAAB28A3BF841A5CB42140B19CFE04AC3C23C358CA87FFB
                        Malicious:false
                        Preview:MSCF............D................................?..................................architecture.glox.................Content.inf..q5.^...[.....0y......../..CL.C5.Q..U5g.z....UUUMPC...C..P....T.....=..s..4c...-3H..E...2..2*..T...../.i.;$..............%...................'h.........#0.......[........c.h.....O...%.61...[.J..:.,^....W.]$..u...N.R.....H.......:%I.g5Kd.n6...W2.#.UL..h.8NN../.P...H.;@.N.F...v."h..K.....~.....8...{.+...&.#A.Q'..A.....[NJ.X.....|.|.G5...vp.h.p..1.....-...gECV.,o{6W.#L....4v..x..z..)[.......T.....BQ.pf..D.}...H....V..[._.'.......3..1....?m..ad..c(K.......N.N.6F%.m......9...4..]?...l6..).\p;w.s....@...I%H.....;\...R......f...3~:C...A..x....X...>...:~.+..r@..."......I..m.y..)F.l..9...6....m...=..Q.F.z..u......J].{WX...V.Z.b.A0B..!....~.;Z.....K.`c..,X.MFz....].Q.2.9..L."...]...6...JOU..6...~../......4A.|.......i.LKrY...2.R.o..X.\....0.%......>H.....8.z..^....5d|...4|...C......R28.E......a....e...J.S..Ng.]<&..mm

                        C:\Users\user\AppData\Local\Temp\cab2B9C.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 4313 bytes, 2 files, at 0x44 "chevronaccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
                        Category:dropped
                        Size (bytes):20457
                        Entropy (8bit):7.612540359660869
                        Encrypted:false
                        SSDEEP:384:KyeISBuydn5rpmp77G8E0GftpBjE/kFLrHRN7ngslI66YVj:KHISBvd5rpmFG8Pi6/6nK666j
                        MD5:4EFA48EC307EAF2F9B346A073C67FCFB
                        SHA1:76A7E1234FF29A2B18C968F89082A14C9C851A43
                        SHA-256:3EE9AE1F8DAB4C498BD561D8FCC66D83E58F11B7BB4B2776DF99F4CDA4B850C2
                        SHA-512:2705644D501D85A821E96732776F61641FE82820FD6A39FFAF54A45AD126C886DC36C1398CDBDBB5FE282D9B09D27F9BFE7F26A646F926DA55DFF28E61FBD696
                        Malicious:false
                        Preview:MSCF............D................................?..................................chevronaccent.glox.................Content.inf..O.$N...[.........B.....?.....$Zy..Zkr...y<.....Di-.aVX/....h..-.~........#.../.Fz....T...p....A..eHMe[..p...=................f..../%o......F@..=..$.B!....}.0..g..^vlI......f.W.F...Nm..2`...)...,.HL4.nsl.F.ir.k..e.!^.j2.v.iT....t...*..!h..Y...2Q..-.x.,.Xj.U.cj,....9.....)..W..n3f.......(cH.D.4M.!.+..4..3r..y......|r..@.PD.R..#...F..nJAR..1{-.....u3..$..L.b+h....:lZ.>....q.?. ~l..^.%.m....a...cG.h.?.|.?7.'....b.G.4..'..A...o.Z...//..?...d..*.....C..Z.....]Yv.g.]..... .........]x.#=.../.7;R.j....G.....zq=O`[.'5g.D.u..)..../../.v.JmCW.da....3.f..C.z%...S=....;A.q.|....z.E.aRu........ k..J"+.f.S.@.........eD4....\0..t./U..%.H..........M:..U.......J...Z..H.DG..u^..D..P....`.^b.........`c......#.....c.?...#..C.V.&.'..f.'...f.[..F.O..a...&..{TiXg4; .X."..0...B.#..^..........N"..w.@f...gd.S..K.....E....ZR...;.twR>.z.

                        C:\Users\user\AppData\Local\Temp\cab2BAE.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 18672 bytes, 2 files, at 0x4c "APASixthEditionOfficeOnline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
                        Category:dropped
                        Size (bytes):34816
                        Entropy (8bit):7.840826397575377
                        Encrypted:false
                        SSDEEP:768:i3R9VYnIYfPYmqX0CnF1SRHVnLG8Pi61YbEIFO:ih9VjYfPYlk+F1SJxP71YbEIFO
                        MD5:62863124CDCDA135ECC0E722782CB888
                        SHA1:2543B8A9D3B2304BB73D2ADBEC60DB040B732055
                        SHA-256:23CCFB7206A8F77A13080998EC6EF95B59B3C3E12B72B2D2AD4E53B0B26BB8C3
                        SHA-512:2734D1119DC14B7DFB417F217867EF8CE8E73D69C332587278C0896B91247A40C289426A1A53F1796CCB42190001273D35525FCEA8BA2932A69A581972A1EF00
                        Malicious:false
                        Preview:MSCF.....H......L............................H...?...................G......................APASixthEditionOfficeOnline.xsl.H...............Content.inf..h;.....[...Q..\..3S.5..oVP!i/Z.Ls...]q$...xY..+W.qm..B..y/.5.s..x$../K./.x.$.....}.......\........LNf..Hd.&."Ip.L.Mr-@.D..kW~i...^.....F.....T.U....../..0..2.{.q.T.`'{.00.{.B...>.R..2....1.~_.f..s...........~....~[..v..w..v....$[K.r$#[6...d;[...#.9.-...G..Z..eAR.0")%JI?&....$..$.H..$(........f.> k....hP...p...!j.T......l7..../3..(2^V...#..T9...3.@[0...le:...........E....YP.\.....au1...\.S|..-.duN.Z..g.O......X8....1.....|,.f/..w.|Wk]zJz.g'./7h..+.....}............x....s.2Z\..W.{...O....W.{j.U..Q....uO=.p.M k.E.S{SUd.@....S.Syo8>......r......8..............Z?>.mUAg....?o....f.7..W.n...P..........d.S?...\..W`...c.ua..........#.Y...45...F(d.o\09^..[.}...BsT.SD..[l.8..uw.7l..S.9T.KR..o......V..]...M .....t.r...:P...M....4.F.....@..t.1t..S...k.2.|5...i.%H..<.J..*.0n.....lZ.....?.*?.~..O .)..

                        C:\Users\user\AppData\Local\Temp\cab2BC1.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 15691 bytes, 2 files, at 0x4c "gb.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
                        Category:dropped
                        Size (bytes):31835
                        Entropy (8bit):7.81952379746457
                        Encrypted:false
                        SSDEEP:768:ltJDH8NmUekomvNufaqA8Pi6x5q3KQIGu:lvINukgzP7x5mRIGu
                        MD5:92A819D434A8AAEA2C65F0CC2F33BB3A
                        SHA1:85C3F1801EFFEA1EA10A8429B0875FC30893F2C8
                        SHA-256:5D13F9907AC381D19F0A7552FD6D9FC07C9BD42C0F9CE017FFF75587E1890375
                        SHA-512:01339E04130E08573DF7DBDFE25D82ED1D248B8D127BB90D536ECF4A26F5554E793E51E1A1800F61790738CC386121E443E942544246C60E47E25756F0C810A3
                        Malicious:false
                        Preview:MSCF....K=......L...........................K=...?..................q<......................gb.xsl.................Content.inf.EF/.....[...A....3D.4..oVP!i/......t.6..l&9r0.8......c..q.^........$/..(./H ...^_Z0\4.42WU......P.F..9.._....'.D..<H@..E.b,K..9o..wo..v|..[.{7m.......|}aI..|g....IF2au?.1,..3.H.......ed....-.........m....$..8&0..w........2....s....z..d.Z.e.....@$r[..r..4...."E.Q@...Hh.B"b>...$.L.$.P.._..~.?./T..@..F..?.~G...MS..O%Z3*k..:..._...!GF..U...!..W..$..7...j......xy0..../.j..~4......8...YV....Fe.LU..J.B.k%BT5.X.q.w.a4....5..r...W.6.u...]i...t.....e.\.K............#t.c5.6....j...?#..{.m3.L9...E/....B[R.k(.'....S.'.}!j.tL..v....L....{<.m4......d_kD..D.....4`aC....rg..S..F.b..^........g;.`?,......\..T.\.H.8W.!V...1.T1.....|.Uh....T..yD'..R.......,.`h..~.....=......4..6E..x#XcVlc_S54 ..Q.4!V..P...{w..z.*..u.v....DC...W.(>4..a..h.t.F.Z...C.....&..%v...kt....n..2....+.@...EW.GE..%.:R`,}v.%.nx.P.#.f.......:.5(...]...n3{...v........Q..

                        C:\Users\user\AppData\Local\Temp\cab2BC2.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 27509 bytes, 2 files, at 0x4c "Equations.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
                        Category:dropped
                        Size (bytes):43653
                        Entropy (8bit):7.899157106666598
                        Encrypted:false
                        SSDEEP:768:+bjfeR1OOZvv439PlDe5/QzhgFSo0UEDmJwkqTA8Pi63Bsgn66w:IM3CN9ZzhFbUUwaP73BsB6w
                        MD5:DA3380458170E60CBEA72602FDD0D955
                        SHA1:1D059F8CFD69F193D363DA337C87136885018F0F
                        SHA-256:6F8FFB225F3B8C7ADE31A17A02F941FC534E4F7B5EE678B21CD9060282034701
                        SHA-512:17080110000C66DF2282FF4B8FD332467AF8CEFFA312C617E958FDFEBEE8EEA9E316201E8ABC8B30797BB6124A5CC7F649119A9C496316434B5AB23D2FBD5BB8
                        Malicious:false
                        Preview:MSCF....uk......L...........................uk...?...................j......r...............Equations.dotx.................Content.inf.94v..R..[..... .............v........." Vw.w..r.....D.V5.p...W......b;....\x.....f.-...............l.....L.F..*..@..BnF.I.....%1..0....&.X.......X-.\.\.>..A....@..:...N .G./.Sp.A0.0.`.....q....b... ......S.{K...V....J............>\....\.E.#.,$.hxu.F.Fo....<...{..6../..#..l>d...w...&...S.....L.].....^..L......;~l.......qw.o. .....v.u.W`.4Z.A.....dC..Q)9.c..qgtfJ..G.(.J....q4V.).mK4;..zY..b.5&....V...0X.].Z..U.Lx..^..:8XQh.....7yy.._5............c.W...c...xY..%..G.$....kg^.1g.9.....z^.'...q."..K)a[.pW .LS.:Q8.....2..._q.os....y...d11.*.m....8.,.^.4_?i.e.u.,....._y.....zZZA.D.D<..+....{....Sfnv...t.....0...vV..y.r..3..%.<.t......;.h.wh.-.g.>..5...R...........y..]^..R..<...>$~.'...kk.n..H.EN.eQ.Q.O./='....)t.l0,/].....FNN......?...&..'.eS....K.K.v".^L..x=.^......1x|....=}@...B.kq;_a..C.q?..Y9.v......Q..u.G..V.

                        C:\Users\user\AppData\Local\Temp\cab2BC3.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 19375 bytes, 2 files, at 0x4c "turabian.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
                        Category:dropped
                        Size (bytes):35519
                        Entropy (8bit):7.846686335981972
                        Encrypted:false
                        SSDEEP:768:2LFougzHaUdBKUsM+Z56zBjA8Pi6bo+ld8IX:MFodzHaULR9P7bo+l6IX
                        MD5:53EE9DA49D0B84357038ECF376838D2E
                        SHA1:AB03F46783B2227F312187DD84DC0C517510DE20
                        SHA-256:9E46B8BA0BAD6E534AF33015C86396C33C5088D3AE5389217A5E90BA68252374
                        SHA-512:751300C76ECE4901801B1F9F51EACA7A758D5D4E6507E227558AAAAF8E547C3D59FA56153FEA96B6B2D7EB08C7AF2E4D5568ACE7E798D1A86CEDE363EFBECF7C
                        Malicious:false
                        Preview:MSCF.....K......L............................K...?...................J.......@..............turabian.xsl."...............Content.inf._.......[...T.....C4.5...E0B.]...+.-f....rc.[52.$...a..I....{z...`hx.r...!.. $...l..\....#3EF..r..c;<p...&n.\b..K..0Y..c+.2...i..B..wwY..77,...........}.q.C.......n..,.....prrx.QHy.B#..,.'....3....%1.``..hf...~...[.[n.v.s..y.vw....;..s.G293G&H....$E......m.&^..iy/.4.C...D...".(H&..&.I4._...!...... ........q.k1.d.....qc.3.c.....;.5.......y}...}&...+.WAN.,zVY.Q....V.Tz........g..H..c...E2jY...4g?.yf<....V.M.s.$..k.Id....+..?..._.\.s.k..9..I%;.yWQ..S..]..*.n<.7........=......"Q.*E.....MG..j.Yt..!U....Q.j...v.h-.~b..e&.......;...\.....:.....=..Xv1&q........6\...xw.%*.VdS..H...o...s.....+..%[../>.t..I....F.....".G|.....=....[..S..3..a.C.ZZ...tK.6N..b........)>........I..m..QE.M.nv.MVl.....vCG>,.suP.gqo.rr....J`m....J.b..},[F*....e.A.]..r....C4.?JJs6..l.].9...Q.B.~.......\d%.X ...8A....rH....&?#...^.....4.h.{>

                        C:\Users\user\AppData\Local\Temp\cab2BD4.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 10800 bytes, 2 files, at 0x44 "ConvergingText.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
                        Category:dropped
                        Size (bytes):26944
                        Entropy (8bit):7.7574645319832225
                        Encrypted:false
                        SSDEEP:384:sbUX16g8/atF4NB3TJOvqeMRD/8svIZj/OwgbA8E0GftpBjEYwFLrHRN7mYll7PY:sbhg8yY4nMZK2hA8Pi6Yum4IVR
                        MD5:F913DD84915753042D856CEC4E5DABA5
                        SHA1:FB1E423C8D09388C3F0B6D44364D94D786E8CF53
                        SHA-256:AA03AFB681A76C86C1BD8902EE2BBA31A644841CE6BCB913C8B5032713265578
                        SHA-512:C48850522C809B18208403B3E721ABEB1187F954045CE2F8C48522368171CC8FAF5F30FA44F6762AFDE130EC72284BB2E74097A35FE61F056656A27F9413C6B6
                        Malicious:false
                        Preview:MSCF....0*......D...........................0*...?..................t,..............ConvergingText.glox.....t,..........Content.inf..C..)t-[.....@.........=...xxA. ...E^....x.x.^.......x..^^...DF.......s..d.P.....5.;..]...2.t.w.....O9.G..;.'.T....@I.,.q.u.3..P...9... ....`J.......g.(....).,.h0.....$.3..;.._.....~.de.jj.....U..K.0....`.@.H.1.x.Z.@..q....?....x.wW.....+am8A".....I..)..]...s..-z.2S+|.Cb.t6f],.n.LV......OVg....O.at|..-..x.....:....]s...u..g}.P..v.3....^.".%..%...#.2.....l00...n.......r8.p.....^.....n.)..,..t.^$b...b.q.W...F..R...n.-.+..'........Aw=._OwH....8.:s..{.#..{N.hW..`.._........Wy....>U.?....-.8tg...=..y..@.,.v|......l...t..l#{...H....9..|......~...De..#@y.&K....U...q.c.zK..D.<pV.....Ql..&Y...=#...w....r.`#2....Ug.J(..T...KmW.@...!....j:......M......!..E.7#s.t..F.aU..N....-.i......|w.lr..G.n.,.......=Kl.-m.?F.....v]?.......{q.U.t...<.|..u.....3R.`.t.T.>;v.....KQ...S...7..1...N.kN.y.)v.....3H:..D.{.+.(......u..^W&.

                        C:\Users\user\AppData\Local\Temp\cab2BE5.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 9170 bytes, 2 files, at 0x44 "InterconnectedBlockProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
                        Category:dropped
                        Size (bytes):25314
                        Entropy (8bit):7.729848360340861
                        Encrypted:false
                        SSDEEP:384:75V23GNhfG/YvmBqWDP7G8E0GftpBjEB1vrFLrHRN7mKll7PK/pRU0:LS/Yvc7TG8Pi6BLm6IS0
                        MD5:C47E3430AF813DF8B02E1CB4829DD94B
                        SHA1:35F1F1A18AA4FD2336A4EA9C6005DBE70013C7FC
                        SHA-256:F2DB1E60533F0D108D5FB1004904C1F2E8557D4493F3B251A1B3055F8F1507A3
                        SHA-512:6F8904E658EB7D04C6880F7CC3EC63FCFE31EF2C3A768F4ECF40B115314F23774DAEE66DCE9C55FAF0AD31075A3AC27C8967FD341C23C953CA28BDC120997287
                        Malicious:false
                        Preview:MSCF.....#......D............................#...?...................#..............InterconnectedBlockProcess.glox......#..........Content.inf...<.:#.$[......O..........5f.P.5CU..6..jT..U..U..UM.T.........h................-... .......6...`.....G...........'.,DN:........... "..4..1u.....%.u..{{,....@lp..}..`.......Z...K.....Z..... Z4.<?..C.BF.....k.!Hl...]...Tvf..g....)...vny6.'..f....Z.R.`.......+....!..!.....:..4fj....."q..f..E..^!k.....M.c....R...B......g...~.........o.'.7,.e.,..7.R.e,(.+..+:....Q....f...P.H.I..U.....Jl...l...z.]7...C...<...L.,..@...i.{..e]K...2..KRW..7.-'.G.l!.n7..J.v.C...%/.....q...@..l..e..$..N..sg8]oo.(q(_.?.X.s...Ua..r0...Rz.o.eT.j...b*..}",n.qou..M.[.;%../c.x.4.z.2*.U.]..D...h...-R.$.=\3..P......N.mP......J...}BPn...g]d.5k..C.ee.ml...\.g...[.......<..6$.%.I#S9..I...6.i........_..P.n....c$.3..zw.hF......_{.+...o...[.&........&...M..m.....;....0....D7...4nQ.=/.._`._.nh.D.m..h.+....8..p..q.4.w.\...iy...*...lN6F..c.

                        C:\Users\user\AppData\Local\Temp\cab2BE8.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 30269 bytes, 2 files, at 0x4c "Text Sidebar (Annual Report Red and Black design).docx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
                        Category:dropped
                        Size (bytes):46413
                        Entropy (8bit):7.9071408623961394
                        Encrypted:false
                        SSDEEP:768:WaxA0CH65GY3+fvCXCttfR8JEBrkquwDn+QV5V+vNWBatX/xG8Pi65sMuMjvU+mQ:hne65GYOfKXMSEBrBtDnzFAI4JxP75sM
                        MD5:C455C4BC4BEC9E0DA67C4D1E53E46D5A
                        SHA1:7674600C387114B0F98EC925BE74E811FB25C325
                        SHA-256:40E9AF9284FF07FDB75C33A11A794F5333712BAA4A6CF82FA529FBAF5AD0FED0
                        SHA-512:08166F6CB3F140E4820F86918F59295CAD8B4A17240C206DCBA8B46088110BDF4E4ADBAB9F6380315AD4590CA7C8ECDC9AFAC6BD1935B17AFB411F325FE81720
                        Malicious:false
                        Preview:MSCF....=v......L...........................=v...?..................5u......................Text Sidebar (Annual Report Red and Black design).docx.v...............Content.inf..C,.zd..[............... .w.....b...wwww]r..W\ww...... .hh...........o.nz.....Ku.7..-.oH...h;.N..#.._.D,}......!Q$..Un.tI11..$w.r3... ..p...=.1....""..n...*/....h.A...Y..c,.Q.,......",..b.1.w..$.....l../;..J.....~.. ....+.R#....7.-..1.x.feH.@.......u...(.DQ%.wL.N|.xh...R..#....C...'X.m.....I{W.....5.C.....\....z.Y.)w..i...%....M..n.p.....{..-G9..k.bT.6........7....).....6..ys.....R.e.....0.Xk`.3..X\xL..4J"#.f...:....r..2..Y.uW..052.n.+ ..o..o..f&u.v.&9y.P..6.K..in.DU.#.~....4i..6;.5.w..i...g.(....../..0*Vh...C..//....W..:w......7.6....]....4.*9...sL.0k...zHh..2N.H...*..]..(.x.:..........Y.+...-.....&.*^..Q.sW...v..w.....k.L.e.^.W4iFS..u.....l.g'...b~:Zm...S.2.|......5S..=.............l.../|....G|.9 ..#.q...W.Q...G=.."W..'.6....I....D._.{.g.47....V.1._..<?....m............)..T.

                        C:\Users\user\AppData\Local\Temp\cab2BE9.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 4410 bytes, 2 files, at 0x44 "PictureFrame.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
                        Category:dropped
                        Size (bytes):20554
                        Entropy (8bit):7.612044504501488
                        Encrypted:false
                        SSDEEP:384:zEAH676iPi8+IS5iqn7G8E0GftpBjExDxIHFLrHRN7Ke/ll7PK/pGaz6:zEhG8+ISrG8Pi6xDxCKoIGaz6
                        MD5:486CBCB223B873132FFAF4B8AD0AD044
                        SHA1:B0EC82CD986C2AB5A51C577644DE32CFE9B12F92
                        SHA-256:B217393FD2F95A11E2C594E736067870212E3C5242A212D6F9539450E8684616
                        SHA-512:69A48BF2B1DB64348C63FC0A50B4807FB9F0175215E306E60252FFFD792B1300128E8E847A81A0E24757B5F999875DA9E662C0F0D178071DB4F9E78239109060
                        Malicious:false
                        Preview:MSCF....:.......D...........................:....?..................................PictureFrame.glox.................Content.inf........[.... '.q..@.........<./..+./. ...."o.o./..{^a.7^.D.HA....^J... ...........T%q..b...+pz.n.=....jT.+M..=H..A...py.3.........H...N...[..%..~....>.%....3.r...wx.....0.....7..94..2..45..7f.......D.. ...[...f.:H..../N..4.....8.....:x.I....u|.`."...\..N..%.M#..^v$.*....T.m.....?.-.wki.X..8..F.G..Y.^8...-....+.&.+&.No...e!.#.8.....YF.......<w.....=.Q.S..7....MW....M..9A.3..c..L....|.E-Y....]n".|....b9..l@.d.T...a.f...~.&k.[..yS..q..]L}..)w.....$.@..v...[9..X....V...a.NK....m9.5.....Kq.;9`.U.e...8.<..)Y.H........z.G...3n.yWa.g.>.w!e.B8:......f..h..z....o.1<.RT..WK...?g .N..+..p.B.|...1pR_......@...a....aA......ye..8...+M.l..(.d..f.;....g........8R.\.w.:ba....%...|p....`lrA.|....a.U.m=ld......7....#..?Dq..D.....(.5.K.a..c.G..7..]hF..%:}......}J.j$.....4...l];..v>.&j........Y.vk..$1.@X$...k...9..?...z..![..../...).a.=....aZ^.3?....

                        C:\Users\user\AppData\Local\Temp\cab2BEA.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 6005 bytes, 2 files, at 0x44 "HexagonRadial.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
                        Category:dropped
                        Size (bytes):22149
                        Entropy (8bit):7.659898883631361
                        Encrypted:false
                        SSDEEP:384:b98FG/zdCbf7BOEawSi8E0GftpBjEPTFPxFLrHRN7S5ll7PK/pA2:N/zAbDae8Pi6PFPSRIA2
                        MD5:66C5199CF4FB18BD4F9F3F2CCB074007
                        SHA1:BA9D8765FFC938549CC19B69B3BF5E6522FB062E
                        SHA-256:4A7DC4ED098E580C8D623C51B57C0BC1D601C45F40B60F39BBA5F063377C3C1F
                        SHA-512:94C434A131CDE47CB64BCD2FB8AF442482F8ECFA63D958C832ECA935DEB10D360034EF497E2EBB720C72B4C1D7A1130A64811D362054E1D52A441B91C46034B0
                        Malicious:false
                        Preview:MSCF....u.......D...........................u....?..................................HexagonRadial.glox.................Content.inf.........[.....`........./.mT.T6...CP..z5...0.PcUmCUSUCU.Q.P.0..f............^...H..2e.[..8...ld......*F.%.j.w!R..NA.L............ .r..z....$&.........P.=.r...O...e..dfv_.i%.C....^......?..x...+d..].B.3..EU...|Cc..z.`lQp..fr.....8!;.8.p.ZwH\.........~..T.t..]..H.]..S.2..Vt.....r.H../..-8........!:.Y&..|A..J.U...-.%..k..U...4m.. .q../..b.8.vc~......_q1.?..Bh.v.....L..I.$I..s.".u.. Y....I^5.v...3.......].^)b.t.j...=...Ze~.O...|.}T.._9c........L....BV.^......X..?.....{.>.j..5.m...d.7........g[..f.nST...i..t..|.T.jjS..4p.Pxu..*..W...|.A)..|9;....H.e.^.8D..S...M..Lj.|...M.m+..H.....8.&-....=.L.....n.v..M.9...l....=r......K.F.j.(.(xD.3..r'9.K..-...5..Z..x....._....a[...J...`.b_a\\j.ed..\.3.5....S.T...ms.....E...Xl.y.LH=...}..0.T...04.4..B[..H.....B{B9.h..=.8Mn.*.TL.c..y.s.?.c9$l...).h).6..;.X../_>Pl...O...U.R..v.dy$A

                        C:\Users\user\AppData\Local\Temp\cab2BFA.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 14939 bytes, 2 files, at 0x44 "CircleProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
                        Category:dropped
                        Size (bytes):31083
                        Entropy (8bit):7.814202819173796
                        Encrypted:false
                        SSDEEP:384:0XbSq3W46TVZb5fOFo1HtZwGqtRT44hS+nyBoiuFgbA8E0GftpBjEcBFLrHRN7Ku:0XpOflfOFo1DMr/iuuA8Pi6cfKjW66b
                        MD5:89A9818E6658D73A73B642522FF8701F
                        SHA1:E66C95E957B74E90B444FF16D9B270ADAB12E0F4
                        SHA-256:F747DD8B79FC69217FA3E36FAE0AB417C1A0759C28C2C4F8B7450C70171228E6
                        SHA-512:321782B0B633380DA69BD7E98AA05BE7FA5D19A131294CC7C0A598A6A1A1AEF97AB1068427E4223AA30976E3C8246FF5C3C1265D4768FE9909B37F38CBC9E60D
                        Malicious:false
                        Preview:MSCF....[:......D...........................[:...?...................A..............CircleProcess.glox......A..........Content.inf......9.B[.....@*........!...(A.D..K.W.wwpwJj\.K\w...]...K.!.....@0..?,...}won`... ....&I..(;.....X.u..^.R..^......_:....W>f\....T...B..i`|q.....................i.5....(........0q7@.@..F...?A.`.....,L.......5.+../56..a`....1C5..9.*I.N.......@|<+./......... .ya....>l.,t.......y.y5...FF.,F..jCA...SA..H....8u.L..eM?.w8.......~^.Mr.[...(.._......u..+.......j..TJ.:<.3.X`...U.bz...[...r-...[...+..B.......}...\'.i...C.8.B_...c.8</..s.....VQ.Y..m.,.j~;y ...2.5.VQ...K..jP..2..r-...HA...."..9).7.....5.E._.wq.......!.+n+.f...s].4M'.1&...5....4..k..NV.M1.7`a..<.P4.|.mrd.i.R...u...............v.}..n\.C$.....[..2c.^..W..g..._.0.C.o....%.z.!.;.@y.`\..UO#i.)...Q...........L. .\:_..H.{.W...@...T.4..A.a...Wo?o$4.....#.V.s8M.Gh..p?A...Y.....)...........r|...!..o9...8..%#.[....;...3<Z...g....~.Z....,.(...qA.'x#..xC..@...HOuW.[.[....c.........

                        C:\Users\user\AppData\Local\Temp\cab2C0C.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 7453 bytes, 2 files, at 0x44 "pictureorgchart.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
                        Category:dropped
                        Size (bytes):23597
                        Entropy (8bit):7.692965575678876
                        Encrypted:false
                        SSDEEP:384:y6aR//q0bJi/Uj+957G8E0GftpBj/4YOFLrHRN7LxhKll7PK/ph:y6I/Li/UjmVG8PiZ4YsLxh6Ih
                        MD5:7C645EC505982FE529D0E5035B378FFC
                        SHA1:1488ED81B350938D68A47C7F0BCE8D91FB1673E2
                        SHA-256:298FD9DADF0ACEBB2AA058A09EEBFAE15E5D1C5A8982DEE6669C63FB6119A13D
                        SHA-512:9F410DA5DB24B0B72E7774B4CF4398EDF0D361B9A79FBE2736A1DDD770AFE280877F5B430E0D26147CCA0524A54EA8B41F88B771F3598C2744A7803237B314B2
                        Malicious:false
                        Preview:MSCF............D................................?..................................pictureorgchart.glox.................Content.inf.W..y....[.............../.jC....U.CUUUTU.5...jjPU..MP....T..0*....o0.......Y.=....P.({.3.p..."pA!>r../3.q..7...........!...TO....(..%......6...3E?....~......CZmndse.Qy....p....h....=.:5...F..%.E.&.v.`I~. ..%._..b]..Y..Q..R.........nN.q8c..a..L..X/.M...PP.q..SpZ.K]>D"Pf..B.c....0..|I.Q.,.g/..Kev.../..=......w..}3.....(....+#T.....K`N.u..Z.....rriK.(...(...6.<R.%.]..NX..b..].C.u....++......Ia.x. .7....J.#............w>....7..R...H>....@%....~.yA.......~.UB..*. .P..$...-...v.....=M."....hw..b....{.....2pR....].C..u@=G."Y..;..gc/N.N.YB.Z.q.#....$....j.D.*.P..!.)S.{..c....&'E.lJ%.|O.a...FG.|.....A..h.=c7.)d.5...D...L...IQ..TTE.*NL-.*M..>..p0.`......m..,.w#rZ..wR\@.Wn..@Q...}..&...E...0K.NY....M.71..`.M./:.>..._L..m...,U.l....._fi...nj9..,..w.s.kJ.m.s.M.vmw.!.....B.s.%.-').h.....)c.l....F..`3r...-.....0..7..&N.....n.#H...<7

                        C:\Users\user\AppData\Local\Temp\cab2C33.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 5647 bytes, 2 files, at 0x44 "RadialPictureList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
                        Category:dropped
                        Size (bytes):21791
                        Entropy (8bit):7.65837691872985
                        Encrypted:false
                        SSDEEP:384:PWew5RNDcvPgbA8E0GftpBjE0hsyaFLrHRN7BD9lI66YR:P3GRNDcEA8Pi60hsyABDo66g
                        MD5:7BF88B3CA20EB71ED453A3361908E010
                        SHA1:F75F86557051160507397F653D7768836E3B5655
                        SHA-256:E555A610A61DB4F45A29A7FB196A9726C25772594252AD534453E69F05345283
                        SHA-512:2C3DFB0F8913D1D8FF95A55E1A1FD58CE1F9D034268CD7BC0D2BF2DCEFEA8EF05DD62B9AFDE1F983CACADD0529538381632ADFE7195EAC19CE4143414C44DBE3
                        Malicious:false
                        Preview:MSCF............D................................?..................................RadialPictureList.glox.................Content.inf....8....[.... $nq......C...../U..........a......S.Q...Q....j............(..z,.g.........^...Y..D... #i.TH5.<.=N..$..7.p".7.............`.3..1~,=,(.d8.Z.1....4'G.....!W^gClf._j.-N..&k.....Y3` =.(S..B^...i.zB.U....0O..h...I.(.......L...5.X.8.Sc<=>w.=.?&.....mR.......x.......mpW.T..^.FU...SN.C)......vsa.,x......,....E..i>..[g...#t...M..GR.9..$/4.:..q.bc9..x{bC.0..K.)..t.Y.&.v.d.16.B..c..or..W.,.B.........O.0..k.v........*F+..U.w...d...o8......A).}...#......L.!?.U.r.^.$...e.(..PG)8..+.9.5.l}.)..b.7+. 4....-.lC...|..j..Q.,.....7.W...|;j...%...:...|H..........<..%...K.....Fy.q$.k..}..8.9.M.u.?$].......r.....e.|..._..iT.;Dq5[....f.s..P.......e.T....!Y{.....t.wm..A..w-..7...3..T.:8.4.a[.Oo.. V.l.@.}..........E.&..J.....+..+.9)9<.._R.Hb.....V..Qu....:v.t.Li.0..J..V..b...!..N....-mD..c..(.[&o>.M.b..H.q..lk../..........W.8..z..B...

                        C:\Users\user\AppData\Local\Temp\cab2C34.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 3749 bytes, 2 files, at 0x44 "TabbedArc.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
                        Category:dropped
                        Size (bytes):19893
                        Entropy (8bit):7.592090622603185
                        Encrypted:false
                        SSDEEP:384:v3Zh3VlkpSIcgbA8E0GftpBjEmm3UFLrHRN7GYvlvQyUTL2mTAp:v31qp/A8Pi6mUqGGvU+mcp
                        MD5:EF9CB8BDFBC08F03BEF519AD66BA642F
                        SHA1:D98C275E9402462BF52A4D28FAF57DF0D232AF6B
                        SHA-256:93A2F873ACF5BEAD4BC0D1CC17B5E89A928D63619F70A1918B29E5230ABEAD8E
                        SHA-512:4DFBDF389730370FA142DCFB6F7E1AC1C0540B5320FA55F94164C0693DB06C21E6D4A1316F0ABE51E51BCBDAB3FD33AE882D9E3CFDB4385AB4C3AF4C2536B0B3
                        Malicious:false
                        Preview:MSCF............D................................?..................c...............TabbedArc.glox.....c...........Content.inf.;....Y.[.........B.....?.T..ZD...........^C...U.R<Z....z+.I.....Z..-.V...f.....lB..\P.....=.-p....w ...\.kD..x'v..T..A..............".8...d.........FD.ZL.h..T...bp.)9B.v..i..VX...&..\..7.s..qy...l........Rty.Y...rU..>.9...8....L..\.^x.kDU.|TJ..{kN.G..E..$.kvy?.. mv......P..4.....q.1.6<u....e..dD...4.1E..Xi.5.=....1.P.c.K~S...YMO:.?..cL.g.tq\.(b1....E..0A.i..C...BT.m.S......:...}.&U..#QL..O.O../..K......=..........0a..O............BYP......>f.......iu...7.K..;QO~.t....%N.s.]>~#../7YN.....C..9.=cY.......y..U5.....,.....u.....#_..SG.`NR*.....?*..d.R.k.rX$...&.... ..h.4T.D^k-xA...............Hz..ep)e..4..P."fo Ne...o.....0n.Exr.........H..v...A.."..%)2......5...".}j.o8...E.HRQ;}.. .._L.+.jz....{.U..}...=B.o.^..vZ.:5.Z.M....y{\(...N..9...EB*MG...!N.vy..^...nE..2..@.;.4..C..t.4....h..O.8.=.m./...|Lu.|mCU..b.^.n39.h[M...%D{..w.1

                        C:\Users\user\AppData\Local\Temp\cab2C35.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 6450 bytes, 2 files, at 0x44 "ThemePictureAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
                        Category:dropped
                        Size (bytes):22594
                        Entropy (8bit):7.674816892242868
                        Encrypted:false
                        SSDEEP:384:L7d2l8FbHaaIKbtv1gDISi8E0GftpBjEZRFLrHRN74bUll7PK/pd:LUlCIOt/8Pi6Zv4bMId
                        MD5:EE0129C7CC1AC92BBC3D6CB0F653FCAE
                        SHA1:4ABAA858176B349BDAB826A7C5F9F00AC5499580
                        SHA-256:345AA5CA2496F975B7E33C182D5E57377F8B740F23E9A55F4B2B446723947B72
                        SHA-512:CDDABE701C8CBA5BD5D131ABB85F9241212967CE6924E34B9D78D6F43D76A8DE017E28302FF13CE800456AD6D1B5B8FFD8891A66E5BE0C1E74CF19DF9A7AD959
                        Malicious:false
                        Preview:MSCF....2.......D...........................2....?..................0...............ThemePictureAccent.glox.....0...........Content.inf.o.@D..8.[.........B.....?. $...K.....~....aZ.WA"...k.......Z......."......"..X.fpB 2@d..87.[.A......p..e.'......F..P^%.%.RK...........T%0..........9..+8 ...&.q.....+.......^.fad^^n...d.....s1..... .3j.c-c7..y<.....6........C5n.KG...Rs[lt..ZkwI.!..Uj.ez_!A^: /.;.Rl4....^..<6..N...'.YY.n*.E{.`..s.7..z.......L.y.Y.....q.kx.....[5.+<to......1...L.r.m..kC.q.k.1..o.w8s.....xh.@.b.`l\...}z1.6..Y.</DY...Z5..D...0..4.;..XAA..0qD..E.....h...C..hH......S..Z.\.VBu......Rxs.+:RKzD......{......a..=......).<.....d.SM.......c!t.4.h..A=J~.>q?Hw.^.....?.....[..`....v.nl..A.u...S!...............c......b.J.I.....D...._?}..or.g.JZ#*."_``.>.....{...w......s...R.iXR..'z....S.z.\..f.....>7m..0q.c-8\..nZw.q..J.l....+..V....ZTs{.[yh..~..c........9;..D...V.s...#...JX~t8%......cP^...!.t......?..'.(.kT.T.y.I ...:..Y3..[Up.m...%.~

                        C:\Users\user\AppData\Local\Temp\cab2C49.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 4967 bytes, 2 files, at 0x44 "TabList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
                        Category:dropped
                        Size (bytes):21111
                        Entropy (8bit):7.6297992466897675
                        Encrypted:false
                        SSDEEP:384:wWZsOvbMZGgbA8E0GftpBjEtnFLrHRN7Dfll7PK/pirk:xZRvuzA8Pi6t9DPISk
                        MD5:D30AD26DBB6DECA4FDD294F48EDAD55D
                        SHA1:CA767A1B6AF72CF170C9E10438F61797E0F2E8CE
                        SHA-256:6B1633DD765A11E7ED26F8F9A4DD45023B3E4ADB903C934DF3917D07A3856BFF
                        SHA-512:7B519F5D82BA0DA3B2EFFAD3029C7CAB63905D534F3CF1F7EA3446C42FA2130665CA7569A105C18289D65FA955C5624009C1D571E8960D2B7C52E0D8B42BE457
                        Malicious:false
                        Preview:MSCF....g.......D...........................g....?..........}.......................TabList.glox.................Content.inf....t....[......@..C...../.U5...........6...`.....T..>3.................=..09`..t......a..Y..BI.Z....=.'0...%...T..........H...>.:A.r......n..p...Pf.h...I.8... ....M.]&.#.vv'.....[c......g....>"......<c..f....i...sb!Z..iu<.%|......q.....G28.h-...7.....W.v...RtdK..F~.0.3.'.e..b7.c......a.3.....a\..]...gp8.+.u/}.w.qF........8.=.=|....\~..S.-q}]0...q.B.H.^J...!...a'.2Tn!..."..%........=.e_-.....{o..%o...a`.w..L.5..r.....e.8...pO..RE.Wgr..b.%.E...O.......8s...E....Um].C..M.....[...H.FZ..4...eZI.$..v.3<]..r....B..............8i......e<.D...Q4.q.^S.....H.b.......r.q..0o.......2..PP,."...JI...xU`.6f..K..Q9.Q..h..t....AI.S6...7............X..`dv..r..S....),7ES....#.....(...\.nh...X.ps%l..F...."<_....q....v........_.e.....P.........|&..fi..4..@..^0..v.]7.......^. ."..}(...w.g.X...=<....p.......L...P..XV....@:....N...Y....

                        C:\Users\user\AppData\Local\Temp\cab2C5A.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 3144 bytes, 2 files, at 0x44 "VaryingWidthList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
                        Category:dropped
                        Size (bytes):19288
                        Entropy (8bit):7.570850633867256
                        Encrypted:false
                        SSDEEP:384:5ZII4Hf+7G8E0GftpBjCwBFLrHRN7bcClvQyUTL2mH:pG8PicgbcAvU+mH
                        MD5:B9A6FF715719EE9DE16421AB983CA745
                        SHA1:6B3F68B224020CD4BF142D7EDAAEC6B471870358
                        SHA-256:E3BE3F1E341C0FA5E9CB79E2739CF0565C6EA6C189EA3E53ACF04320459A7070
                        SHA-512:062A765AC4602DB64D0504B79BE7380C14C143091A09F98A5E03E18747B2166BD862CE7EF55403D27B54CEB397D95BFAE3195C15D5516786FEBDAC6CD5FBF9CD
                        Malicious:false
                        Preview:MSCF....H.......D...........................H....?..................................VaryingWidthList.glox.................Content.inf...O.....[.... v.q......R.....>.%i.I.HhD.V...qt.....'....N...!..aw$(J.%(..A..h......l|.D.p9`..Y09.:.u....p. :,.*.YD=0.p. ......w.........*..<..;.....u.."......7[....8.....?^........-..;q.|.....B....PJ....r.K#.#.0'...}.........+gpR...T....5.iu.^I...A\..gK....}..z.B.nT.../.m.......N....E'1.E.\..o.....W..R.#.#...8.7...R.SbW-...%......$.obj.F..W_@....sY!........s.O..."k. ..b....j....v...P.\....7d...|"J.T...2p..m.&..r..,2.).....X.`...xt].U...b.h..V.....|L..N.Z.O#....o...1R.w30.g..?;..C.T.:$..MGY.C"i\.f..#..<.k...m..s.w. ..Ga].....wt.h|.Ta<.......(SO.]9.%a..Z... r._JH.=O...P.9a.v.....Kj.".T...m...4.?...F...$...y.....hbW.UA..u.&)....py.C{.=t.....n...}|H3A9.=..W..JJ..y./Y.E.M9..Z..w. .HB.YoIi..i.e..9;n...SpHw,....f....d>..g.m..z...... ...f...KP.M..U.....~vFD.fQ.P?......2!.n.....`@C!G...XI.].s,.X.'...u.E.o..f

                        C:\Users\user\AppData\Local\Temp\cab2C5D.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 5731 bytes, 2 files, at 0x44 "ThemePictureAlternatingAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
                        Category:dropped
                        Size (bytes):21875
                        Entropy (8bit):7.6559132103953305
                        Encrypted:false
                        SSDEEP:384:k73HRpZA6B3ulrnxtRT7G8E0GftpBjEdHqlFLrHRN7uhFlvQyUTL2m4c:k7XRgIkrG8Pi6dmuNvU+mp
                        MD5:E532038762503FFA1371DF03FA2E222D
                        SHA1:F343B559AE21DAEF06CBCD8B2B3695DE1B1A46F0
                        SHA-256:5C70DD1551EB8B9B13EFAFEEAF70F08B307E110CAEE75AD9908A6A42BBCCB07E
                        SHA-512:E0712B481F1991256A01C3D02ED56645F61AA46EB5DE47E5D64D5ECD20052CDA0EE7D38208B5EE982971CCA59F2717B7CAE4DFCF235B779215E7613AA5DCD976
                        Malicious:false
                        Preview:MSCF....c.......D...........................c....?..................................ThemePictureAlternatingAccent.glox.................Content.inf...3.....[.... .qq...........\<.^......o."......f.o...x.{..q..^.MH^...........{0.K....4pX.i...@6A4X.P.01d....'p.......zA.......... .......7.......a. `.=!@- ......>G.s.k~@.a.lfha:m....1...@.,G`....{....W..N..qs.......j.+TrsT.l.9..L...1+...d..-u..-.......).#u&...3......k.&C...DdZ.'.......8..<PF..r.eq.X6...u..v...s5.m.Q.l.G%.<.]....RV<...S..Dv..s.r.......dh.N.3-.Hf'.....3.GZ..E.kt.5......h...|...?!.L....~.)..v....:2.../F.,....o.qi.i7..E.|.mh.R_.@A.FO@i.....Feo...x.l...{E.\W9|V...=#..3..(......tP.:i....Ox.U.N...%6...p.6&.....<zh.z.|.<Z.?.k....y7m...F.Z$-.:.l.h...{T..7....?..T...d,r...z?../...`/Z......a.v@)....u......V..v.:.._.|.'..[..O.s.OAt-."b.In"..I...J*.~H.:-...?..uV....dZ;z:.l.{.E.,.Q..i]:.0r.I.y..f...../j.wN...^R.....u....>..}....f.f...]A..C~;/....%..^#..N.a..........99.....`.....%..iS....S......$....)

                        C:\Users\user\AppData\Local\Temp\cab2C6E.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 6196 bytes, 2 files, at 0x44 "ThemePictureGrid.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
                        Category:dropped
                        Size (bytes):22340
                        Entropy (8bit):7.668619892503165
                        Encrypted:false
                        SSDEEP:384:GByvLdFHny7G8E0GftpBjE8upFLrHRN778lvQyUTL2mm2y:Oy3HkG8Pi6887mvU+ma
                        MD5:8B29FAB506FD65C21C9CD6FE6BBBC146
                        SHA1:CE1B8A57BB3C682F6A0AFC32955DAFD360720FDF
                        SHA-256:773AC516C9B9B28058128EC9BE099F817F3F90211AC70DC68077599929683D6F
                        SHA-512:AFA82CCBC0AEF9FAE4E728E4212E9C6EB2396D7330CCBE57F8979377D336B4DACF4F3BF835D04ABCEBCDB824B9A9147B4A7B5F12B8ADDADF42AB2C34A7450ADE
                        Malicious:false
                        Preview:MSCF....4.......D...........................4....?..................1...............ThemePictureGrid.glox.....1...........Content.inf....K..5.[.... V.q......B.....?.h.i.J.D...Z...>.....i~...A...Z....H.hy.D..X.....>...L.I..`. z w0}.K`.C{h....W\../.U..p\%...B...;............9..8.^M.....].lP.p...|..?..M....E..S.`..-n........Q'.'.o..C}=..?`.bQ...J"0f.. ....k3n..F.Pu..#...w].`<...."D.].-.#+):..fe..=<.M...4..s.q.f._.=.*T.M..U.[R.kbw.,......t6_I...~.X..$_.q....}2..BR...).[...<.l.3........h%....2.$`>..hG...0.6.S......._3.d~1.c.2g....7tTO..F.D.f.Y..WCG.B..T....Gg&.U'....u.S/......&6w..[bc.4....R.e..f.,....l."........I....J.=~...$x.&2...+,-.;.v.'.AQ.fc...v._..rZ..TYR...g?..Z..!.3mP dj...../...+...q.....>..../...]P.z?DW&.p..GZ....R5n......,..]{].0m.9...o.{...e."...8VH....w"%;.g\.K..p.}....#r.u..l.vS...Y.7U.N*-E@.....~....E...x.....C.......{NP....5Ymk.*._.K...Z...f..;.......b.....,._@B..\.S..d.'\rs..].}.5"XJU.J..'.zk}.+P.)C.X.?9sx.D....(K....P^N_D...Z.........

                        C:\Users\user\AppData\Local\Temp\cab2C70.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 5213 bytes, 2 files, at 0x44 "rings.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
                        Category:dropped
                        Size (bytes):21357
                        Entropy (8bit):7.641082043198371
                        Encrypted:false
                        SSDEEP:384:zdx+NRrogu6fzCI7Th7G8E0GftpBjEzZq4FLrHRN7/Oll7PK/pB:/+NRrFf/G8Pi6zZb/GIB
                        MD5:97F5B7B7E9E1281999468A5C42CB12E7
                        SHA1:99481B2FA609D1D80A9016ADAA3D37E7707A2ED1
                        SHA-256:1CF5C2D0F6188FFFF117932C424CC55D1459E0852564C09D7779263ABD116118
                        SHA-512:ACE9718D724B51FE04B900CE1D2075C0C05C80243EA68D4731A63138F3A1287776E80BD67ECB14C323C69AA1796E9D8774A3611FE835BA3CA891270DE1E7FD1F
                        Malicious:false
                        Preview:MSCF....].......D...........................]....?..........{.......................rings.glox.................Content.inf..|^.....[......P........<.$.."..0R..xa.Ax#B..d... ....K,.....^.H.....H.........&.j.\f.. ..,....,..!k..R..e..!...E...........................><.RB.....~h...........Q................g..M|,...x.....qV7.u..\...F-N.{-..X..&Zig.~..{.A.p.Z...X..{,-n............`$.%.ND.....>].6cvZ.%d..*a.$..-.K.Hf....L..;.#...H....U,........P.@.*-$C.,.g...%YJE..$.jP........b...Y<..[U...MF]F.K...1... x.}3w.o.#,.}T.....w5+...=.=...c.F^....OM.=.......G_{n.*...WC.w!......{/.~.}..s..6_......)..Xy...4.....<..XZJ........#~._i....%..fM.V.?.q...q.....7...B..sVt...(.:..c....~.e...kGZ...C..(J..o...`...?.)-.T.l....&...gR.$.....g.:...2.e%F.....x....z0...K..a8B...........D..]....7....~.".DR...r)...}b)e.>.\h~f...(}.c........Q...o5H.........C.KC.(.L.l................R..a.pg{..\.......-b........}.C......qTS..%..r.lG..Q.1..Z.>a.D...tC..LV...Rs.C.M18x.:......%O.

                        C:\Users\user\AppData\Local\Temp\cab2D6F.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 291188 bytes, 2 files, at 0x44 +A "Banded.thmx" +A "content.inf", flags 0x4, ID 56338, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
                        Category:dropped
                        Size (bytes):307348
                        Entropy (8bit):7.996451393909308
                        Encrypted:true
                        SSDEEP:6144:7vH3uG+yiWx0eVJyORloyyDqnHefzOs81MrXLXx7:b36yiWH/LRS2CJl1
                        MD5:0EBC45AA0E67CC435D0745438371F948
                        SHA1:5584210C4A8B04F9C78F703734387391D6B5B347
                        SHA-256:3744BFA286CFCFF46E51E6A68823A23F55416CD6619156B5929FED1F7778F1C7
                        SHA-512:31761037C723C515C1A9A404E235FE0B412222CB239B86162D17763565D0CCB010397376FB9B61B38A6AEBDD5E6857FD8383045F924AF8A83F2C9B9AF6B81407
                        Malicious:false
                        Preview:MSCF....tq......D...........................tq.. ?..........|..................Mn. .Banded.thmx............Mn. .content.inf..;.u.i..[...............?....^.j.{j.B...$M/!...W....{!..^0x/.6...&............w......$.B..J.?a.$=...P..L...d..........+./.\..E:h.....-.$..u-.I..L\.M.r..Y..:rtX:....8...........+8.}{......&.-..f.f..s3-P.''.r...Z-"/E../...^%^N(,.$..$.H..O........q>...|.|......y..m.)u....`.....z.n..-.[.5....xL....M...O..3uCX..=4.....7.yh...dg.;..c.x.4..6..e..p.e"..,.!.St{..E..^I.9j....;..`.Y..#.0..f...G.....9~./....QCz.93..u%hz.........t9.""........)..7K.c~E!..x.E.p...[......o..O.j.c.......6.t{...".....t9V;xv....n<.F.S2.gI.#6...u..O..F.9.[.L.....K....#..zL..I...o....k...qog.......V..BKM..#.bET.)..&4..m.w...*....E.a[.Q.y.B...w...r.nd...)...<..#..r[4.y...#.z.....m?.2K.^...R{..m..f......r?]..>@...ra$...C+..l].9...."..rM9=......]".'...b&2e...y..a..4....ML..f...f"..l..&.Rv=2LL..4...3t_x...G....w..I.K....s.t.....).......{ur.y2...O3.K*f.*P(..F..-.y.Z...

                        C:\Users\user\AppData\Local\Temp\cab2D80.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 26644 bytes, 2 files, at 0x4c "Element design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
                        Category:dropped
                        Size (bytes):42788
                        Entropy (8bit):7.89307894056
                        Encrypted:false
                        SSDEEP:768:Hx+UzBiwDQTXgBm029ClGn4BZz6i5kIew/jG8Pi6lYJz1gH:0ZXc29eGn2n5klwjxP7l2z1gH
                        MD5:21A4B7B71631C2CCDA5FBBA63751F0D2
                        SHA1:DE65DC641D188062EF9385CC573B070AAA8BDD28
                        SHA-256:AE0C5A2C8377DBA613C576B1FF73F01AE8EF4A3A4A10B078B5752FB712B3776C
                        SHA-512:075A9E95C6EC7E358EA8942CF55EFB72AC797DEE1F1FFCD27AD60472ED38A76048D356638EF6EAC22106F94AFEE9D543B502D5E80B964471FA7419D288867D5D
                        Malicious:false
                        Preview:MSCF.....h......L............................h...?..................@g......o...............Element design set.dotx.................Content.inf.Y/..Re..[......f........,..]....D.],....]..X.......XC4pE.....p........2..u;L.N.....]G..d.^d.$).e.=..;..Kb.../.../....H.."...w$._I..5.....a..4.Gd5p......v.8..1..%H..\..e...3.e..A..).d*.. . (.8.".......(>..<...@...~*v&.f..LWhqk]+Uep.d..%...o.....k.......e...nNN.&_.>.d.?H`"...r?..Z.p..q..<M.N.t....{*.y]#...._XW"qI...x.......}.. .N...;.}:..m8...[.r.F....^?...o...u..*...J3.V....~...~tn#.Kf6.s.|*..,s...M.$.f..?Yu.pE.1_wU...%....._..'..Z......y:.{.J5..7..Q.w}/.~.-3~Ctw=..IT.....mI.u@...y.M....2.%...y...Y..j.k<-.Q.r...7m..b...+.6..|.....U..}[...,....^....5..D..qW...[3).p.Y<.Hh..t...%cw=Z..W.~W.F....zr.4.g...O...P.g_^..3.-............3s...S..y...u...N...EsJz....tT../..c[w{cG....../6.....:.W<d5}.q..s..K"$........Ne..5..#.v'..n4.rj....Fc=....5..VN.....6..9`....|..........WX..-?..........W.)^`1.......].R2..s6...H.......

                        C:\Users\user\AppData\Local\Temp\cab2DF0.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 259074 bytes, 2 files, at 0x44 +A "content.inf" +A "Dividend.thmx", flags 0x4, ID 58359, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
                        Category:dropped
                        Size (bytes):276650
                        Entropy (8bit):7.995561338730199
                        Encrypted:true
                        SSDEEP:6144:H2a+HFkDF8gpmMt4kzwVVqhSYO6DITxPWgJl1CFExwXyo7N:mlZgFtIVVTuDExeWuv7N
                        MD5:84D8F3848E7424CBE3801F9570E05018
                        SHA1:71D7F2621DA8B295CE6885F8C7C81016D583C6B1
                        SHA-256:B4BC3CD34BD328AAF68289CC0ED4D5CF8167F1EE1D7BE20232ED4747FF96A80A
                        SHA-512:E27873BFD95E464CB58B3855F2DA404858B935530CF74C7F86FF8B3FC3086C2FAEA09FA479F0CA7B04D87595ED8C4D07D104426FF92DFB31BED405FA7A017DA8
                        Malicious:false
                        Preview:MSCF............D................................D..........~..................M. .content.inf............M. .Dividend.thmx..).}.b..[.....`.........?.R...T../..............4..yy....{...f.h..\U......sy.gV0Q.@..A..@..3a.A}........7.q.......8......R....sJ)E..ENr.S*B.1..).s.r.J.D.b."..........(.....E$.V........y.5.L....;gY..QK/nni..x..3.<..Q.Q..K.I.....T.z.,F.....{.p.....;8._.&../...........X...}.;[Gk..._.i`m.u.?...s.w...4.....m......l....5..n.?..c..m...,.....{.k.?......sC.............e..1....oL.8./......1._.K:.]..&......O............qo.....Dd/c...6.q.*......V.v........h....L..h..C+..V..;O.(7Z]{I%....S3.{h....\...b.......5.ES......Z.4...o.c`..YA....9i....M.s....Z3.oq`....>.i..@.@n.a...x.3.zp.<....vU/.|^CvE...aD.P&mhvM>.p..B~....."._.......v-.m..w..?._..=...:...k....i.}x.6....Y.i..n....h...j......LZ.....fk..f0.y.T..Vl.;...s.......B6.f.'z.c.\W?...4U)..aJ.;O....L.d7.J.V#Q.....\J.F.?].d}!..y].6..%..~....|......5...'N.#.....t6.,.E.O."..0fyz....

                        C:\Users\user\AppData\Local\Temp\cab2DF1.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 279287 bytes, 2 files, at 0x44 +A "Basis.thmx" +A "content.inf", flags 0x4, ID 55632, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
                        Category:dropped
                        Size (bytes):295527
                        Entropy (8bit):7.996203550147553
                        Encrypted:true
                        SSDEEP:6144:nwVaEqsf23c9shf6UyOGgDWDn/p3fd+zkPWnvGL3n9bQnkmVheyqtkl:MlPfW6sVEDn/pPdhWnvGL36zyyqal
                        MD5:9A07035EF802BF89F6ED254D0DB02AB0
                        SHA1:9A48C1962B5CF1EE37FEEC861A5B51CE11091E78
                        SHA-256:6CB03CEBAB2C28BF5318B13EEEE49FBED8DCEDAF771DE78126D1BFE9BD81C674
                        SHA-512:BE13D6D88C68FA16390B04130838D69CDB6169DC16AF0E198C905B22C25B345C541F8FCCD4690D88BE89383C19943B34EDC67793F5EB90A97CD6F6ECCB757F87
                        Malicious:false
                        Preview:MSCF.....B......D...............P............B..p?..........{.................M.. .Basis.thmx...........M.. .content.inf.`g..td..[...............5..$..WM.....R.......H\.+\./^...x.^..h..MU..\........v........+......g...$.......g.....~....U].7..T..1k.H...1...c.P.rp.6K..&......,.............U4.WoG.w.....;.....v..922.;]..5_-]..%E]b..5]... (..H..II..ttA4Q..BI!|...H.7J.2D....R.......CXhi`n....6..G.~&.[..N...v..Z"t.a..K..3..).w...._@.}.}.v.......4......h....R;.8.c&.F...B^....Q.....!Bm2...F.`.......M;...#.{....c...?...e...6t..C.-.E.V.v%I..H.....m.n...$D.....vU'.....=6}~...Gw...Y..?.@......G.....k......z...5d.h......1.}..O*;e..t......Y.0...3.v).X.-.2.....~....14.[.w=I....hN....eD..7G.u.z..7.do..!....d..o.wQ.:....@/.^..<e.-..=\.....6.C.'.rW$..Cp.M3.u6z......Q.F.9.5....juc..I...m4]7L....+n......).t......2[.3.p.:.....O5y..wA........^..!..H....{..S.3w.!&.'.;...(..|m.x.S..Z.j..3...n..WU...../w.......xe=.+.D...x..qy.S.....E..... ...uu.`.,..<.6[p

                        C:\Users\user\AppData\Local\Temp\cab2E11.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 243642 bytes, 2 files, at 0x44 +A "content.inf" +A "Metropolitan.thmx", flags 0x4, ID 19054, number 1, extra bytes 20 in head, 24 datablocks, 0x1503 compression
                        Category:dropped
                        Size (bytes):261258
                        Entropy (8bit):7.99541965268665
                        Encrypted:true
                        SSDEEP:6144:9blShNYrHNn0JU+D+kh8CIjXHWC7X0nZLC9Ge2KY/WfI:9ZSTYrtn0Sk+CIDHWC7chVKYx
                        MD5:65828DC7BE8BA1CE61AD7142252ACC54
                        SHA1:538B186EAF960A076474A64F508B6C47B7699DD3
                        SHA-256:849E2E915AA61E2F831E54F337A745A5946467D539CCBD0214B4742F4E7E94FF
                        SHA-512:8C129F26F77B4E73BF02DE8F9A9F432BB7E632EE4ABAD560A331C2A12DA9EF5840D737BFC1CE24FDCBB7EF39F30F98A00DD17F42C51216F37D0D237145B8DE15
                        Malicious:false
                        Preview:MSCF............D...............nJ...............D.................."..........M. .content.inf....."......M. .Metropolitan.thmx...cVtP..[.....`Q..B.....=.T.....h.."...Z..|..}hZK.V....Z..Z................?..v...[S$."...H......^u.%.@...>....... f.........1.5......*&lm.tZ.msz:...Noc....1....D .........b..... ..3#pVp....}oo]{m......H*[%i.GNHB1D<......(*# ....H"....DP..b(B.<.....v......_..`.7..;.}............/.p}.:vp....~l0..].........S....G?.....}..U.;......dNi..?........-c..J.z....Z...._.O.....C..o.,......z....F....sOs$..w9......2G..:@...'....=.....M..am.....S......(`.._....'......[..K"....BD...D...^1k.....xi...Gt....{k@.W.....AZ+(,...+..o......I.+.....D..b. T.:..{..v.....g..........L.H.`...uU~C.d...{...4.N.N..m8..v.7..3.`.....,...W...s.;.fo.8.Y...2.i...T&.-...v8..v.U.Y=...8..F.hk..E.PlI.t.8......A.R....+.]lOei..2...... gS*.......%8H.....<.U.D..s.....>.....D_...../....l.......5O1S~.........B.g.++cV.z.f .R.Z.......@6....(..t^5"...#G...

                        C:\Users\user\AppData\Local\Temp\cab2E12.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 252241 bytes, 2 files, at 0x44 +A "content.inf" +A "Frame.thmx", flags 0x4, ID 34169, number 1, extra bytes 20 in head, 16 datablocks, 0x1503 compression
                        Category:dropped
                        Size (bytes):271273
                        Entropy (8bit):7.995547668305345
                        Encrypted:true
                        SSDEEP:6144:zfdvQnJMwXse4Vradf3mrC7woyWbjKlCVC7K:zfJwJse4VrS1AK
                        MD5:21437897C9B88AC2CB2BB2FEF922D191
                        SHA1:0CAD3D026AF2270013F67E43CB44F0568013162D
                        SHA-256:372572DCBAD590F64F5D18727757CBDF9366DDE90955C79A0FCC9F536DAB0384
                        SHA-512:A74DA3775C19A7AF4A689FA4D920E416AB9F40A8BDA82CCF651DDB3EACBC5E932A120ABF55F855474CEBED0B0082F45D091E211AAEA6460424BFD23C2A445CC7
                        Malicious:false
                        Preview:MSCF....Q.......D...............y...........Q...XJ..........{..................M.. .content.inf.(..........M.. .Frame.thmx.1....b..[.........B.....6....ZZ}....BH..-D..}..V.V-........Z..O.....H.f..........;..@d.`......!..=;.,bp..K.q....s.y....D.qZ)p......D...r.S....s=B.4.).8B....4.a6 ...~........."....#.....}....n.Q.1cH.%c/.U....E..E...!..Da*.p....X..G..:.....1.@.....W.'...._........W.c...<.v.k.....&.8......?.h.>d._:-.X.......9..tL}........3.;.N3.D~......>.^?..|:...}......oT.z.......w..[..}:...._fu........Kk.......L..9..p..e..^......K.%...Mapqhvv..E&.^.....[...9|"l...9...U......!..w..Nya...~C.yx...w.K..q.z.j.W?t.......DY.x.S2.....]..na.Qj...X.K..^...S.hK.W...Z....s.0...NF...8C.......j.'Zc...k.%...l....S.....OW..o.Qf.x...X.;<.rO].....W.m.e....T.1.6........".....Q.3........l..v.."..I...&......w..4vE...c.s[.3.m..8.q$.....a...)...&:6..,..#..?....;.!.....~.UP.r=.}h.&U......X...]..X.e\u.G<....E....lG.@.*Z...10.D@.]....z+-.S....p..Y.PK.:.S..p.....1E`..-

                        C:\Users\user\AppData\Local\Temp\cab7E5E.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 30269 bytes, 2 files, at 0x4c "Text Sidebar (Annual Report Red and Black design).docx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
                        Category:dropped
                        Size (bytes):46413
                        Entropy (8bit):7.9071408623961394
                        Encrypted:false
                        SSDEEP:768:WaxA0CH65GY3+fvCXCttfR8JEBrkquwDn+QV5V+vNWBatX/xG8Pi65sMuMjvU+mQ:hne65GYOfKXMSEBrBtDnzFAI4JxP75sM
                        MD5:C455C4BC4BEC9E0DA67C4D1E53E46D5A
                        SHA1:7674600C387114B0F98EC925BE74E811FB25C325
                        SHA-256:40E9AF9284FF07FDB75C33A11A794F5333712BAA4A6CF82FA529FBAF5AD0FED0
                        SHA-512:08166F6CB3F140E4820F86918F59295CAD8B4A17240C206DCBA8B46088110BDF4E4ADBAB9F6380315AD4590CA7C8ECDC9AFAC6BD1935B17AFB411F325FE81720
                        Malicious:false
                        Preview:MSCF....=v......L...........................=v...?..................5u......................Text Sidebar (Annual Report Red and Black design).docx.v...............Content.inf..C,.zd..[............... .w.....b...wwww]r..W\ww...... .hh...........o.nz.....Ku.7..-.oH...h;.N..#.._.D,}......!Q$..Un.tI11..$w.r3... ..p...=.1....""..n...*/....h.A...Y..c,.Q.,......",..b.1.w..$.....l../;..J.....~.. ....+.R#....7.-..1.x.feH.@.......u...(.DQ%.wL.N|.xh...R..#....C...'X.m.....I{W.....5.C.....\....z.Y.)w..i...%....M..n.p.....{..-G9..k.bT.6........7....).....6..ys.....R.e.....0.Xk`.3..X\xL..4J"#.f...:....r..2..Y.uW..052.n.+ ..o..o..f&u.v.&9y.P..6.K..in.DU.#.~....4i..6;.5.w..i...g.(....../..0*Vh...C..//....W..:w......7.6....]....4.*9...sL.0k...zHh..2N.H...*..]..(.x.:..........Y.+...-.....&.*^..Q.sW...v..w.....k.L.e.^.W4iFS..u.....l.g'...b~:Zm...S.2.|......5S..=.............l.../|....G|.9 ..#.q...W.Q...G=.."W..'.6....I....D._.{.g.47....V.1._..<?....m............)..T.

                        C:\Users\user\AppData\Local\Temp\cab7F1C.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 206792 bytes, 2 files, at 0x44 +A "content.inf" +A "View.thmx", flags 0x4, ID 33885, number 1, extra bytes 20 in head, 15 datablocks, 0x1503 compression
                        Category:dropped
                        Size (bytes):222992
                        Entropy (8bit):7.994458910952451
                        Encrypted:true
                        SSDEEP:6144:k8/c2cF9GTLqsTmYstUdx+dwb2ooiVOfiI17zWbQ:jbzqGdpbZ/Mf3h68
                        MD5:26BEAB9CCEAFE4FBF0B7C0362681A9D2
                        SHA1:F63DD970040CA9F6CFCF5793FF7D4F1F4A69C601
                        SHA-256:217EC1B6E00A24583B166026DEC480D447FB564CF3BCA81984684648C272F767
                        SHA-512:2BBEA62360E21E179014045EE95C7B330A086014F582439903F960375CA7E9C0CF5C0D5BB24E94279362965CA9D6A37E6AAA6A7C5969FC1970F6C50876582BE1
                        Malicious:false
                        Preview:MSCF.....'......D...............]............'..H?..........z..................M{. .content.inf..l.........M{. .View.thmx......R..[...........@...G...I..(J.....B....Q!....}Ju..(BR..._|.5.%.....6m...........?.w{.rm,....#....;Ba#.:v...Dv.."u.v{!...f}......!......:.S.......".z.f.......==.n.0Km0eh.Kbm.C.r.6.........d..h.....{..w..}....2sb...rvm..x...0(..B... ...BH.r#.@..d".*..F+...Q.sx.....?...d.d.eZ2W2.2d...q.I....4.e4....#.....K...3...1.p.y......>.~V....cm....n^..b.{..._D?..AG...'...k.L&..h}=p.....Wl....(.......>.~.].....'.4.W{......../......7.....'.s...w...6..hn..e.2.).l]u.v4...GF.X..X..X....G.i.\..y.g&.<&ti......Sp,j.....>I..S..%.y..........S..-).+...>...D..............[...d...jt.~<x.a(.MDW..a..ZI.;+..!,.$...~>#...).R4...K.$.Zm......b...........{..._..A{.}..r...X...T.ZI.T.).J...$.".U,.9...r.z.)......}...()<....m....QS.p...;?..5.W~2r.EZu..P.1.%'l.........+/6.Mm.|2....Ty..f.o.S.....3J.._...X,..m....:..1.<GqFy.QA9W4.=....n...ZP...O.\.[...:8.%.^..H.....

                        C:\Users\user\AppData\Local\Temp\cab7F3C.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 214772 bytes, 2 files, at 0x44 +A "content.inf" +A "Parcel.thmx", flags 0x4, ID 26500, number 1, extra bytes 20 in head, 19 datablocks, 0x1503 compression
                        Category:dropped
                        Size (bytes):230916
                        Entropy (8bit):7.994759087207758
                        Encrypted:true
                        SSDEEP:6144:OTIPtMXmJWnzPS3pqnkeuJXW+FNx1a72rLiQxEBTR:750nz63/FJRFLISnp+Bt
                        MD5:93FA9F779520AB2D22AC4EA864B7BB34
                        SHA1:D1E9F53A0E012A89978A3C9DED73FB1D380A9D8A
                        SHA-256:6A3801C1D4CF0C19A990282D93AC16007F6CACB645F0E0684EF2EDAC02647833
                        SHA-512:AA91B4565C88E5DA0CF294DC4A2C91EAEB6D81DCA96069DB032412E1946212A13C3580F5C0143DD28B33F4849D2C2DF2214CE1E20598D634E78663D20F03C4E6
                        Malicious:false
                        Preview:MSCF.....F......D................g...........F...?..........|..................L.. .content.inf.zG.........L.. .Parcel.thmx.>2...R..[...0...........7....B+...BH....{...^.../.....B{...1....+".....<.....$........{.......sD"..j...}... P..w..U..f...6.x8. ...C..F.q.7....T.6p......B.P..L..g......A..43.W`.....{{...u.4...:.bb.4"X..m..)$..@(H. H.tBPTF..,.&.B.'...6..2...n..c%...Z@.(.@.......(.<i.i....P......?......o.......F.M.L......i.....C..7..../.....MQ.0..l.U.s.Fu.......1...p.;.(.}..ogd..<.._.Z......._.......O.J......97...~<...4.c....i..........'k.5.......Q.$..C..E... ..5.7....N.a.[ns6hi..kM....?....X......*9q...!O\....0....n.^s.9.6..............;. ..r...rf..C6z..v #.H...O...v/.sl....J.m%.L.Dp.e....*uO..g.y....f...].5.*........W.....h^[..w.|.=.ru.|.M..+.-.B...D.Ma....o.<X SnI....l...{..G..,..y5\W.@..y.;.y ...M..l.....e..A...d.e!.E..3.......k1.......6gY).../....pQ..?..s.W.)+R.S5..../.0..vz.^.......k.....v..9..A.NG...N~#..$.B...*s,(.o.@.ar.!.J.....

                        C:\Users\user\AppData\Local\Temp\cab8087.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 533290 bytes, 2 files, at 0x44 +A "content.inf" +A "Parallax.thmx", flags 0x4, ID 64081, number 1, extra bytes 20 in head, 29 datablocks, 0x1503 compression
                        Category:dropped
                        Size (bytes):550906
                        Entropy (8bit):7.998289614787931
                        Encrypted:true
                        SSDEEP:12288:N4Ar9NyDhUQM0Hk86V1YnOIxQ9e6SJbj2OjK:jAG8wa5Qw6SZ2Oj
                        MD5:1C12315C862A745A647DAD546EB4267E
                        SHA1:B3FA11A511A634EEC92B051D04F8C1F0E84B3FD6
                        SHA-256:4E2E93EBAC4AD3F8690B020040D1AE3F8E7905AB7286FC25671E07AA0282CAC0
                        SHA-512:CA8916694D42BAC0AD38B453849958E524E9EED2343EBAA10DF7A8ACD13DF5977F91A4F2773F1E57900EF044CFA7AF8A94B3E2DCE734D7A467DBB192408BC240
                        Malicious:false
                        Preview:MSCF....*#......D...............Q...........*#...D..........~..................M{. .content.inf............M{. .Parallax.thmx.9... y..[......(..b.P...E.Q*.R.".RTH.%.T..F......u.{.*+.P.....FK*0].F...a{...D4`D..V.../.P,....2.Mx...u......0...E...{A-"J...)jl_.A..T......u.Y....ZG:....V.A.#~.. ..6..............o..X..<.... .......C.ce.f!nA.).p...p........n..................'6w6H6s.j....l...{?.h..........]..l.....v....%..l}A..................3...W_73.j......6...F.../..qG.?........H..).........7.&km....`m2..m.W.q.<../~<..6*.78..X~.e+..CC*w...T...6....AB..l..._.f......s.e....2....H..r.R.Z....a.,..\Q.q..._SJJ....7.S.R....=f..>....9=....NnC.....].-...\..Z..q..j...q.....Nj..^'..k...Zl.~PRvpz.J..+.C...k.z.w=l.#.............n...C..s.kM.@B{..vL.e....E..(/......f...g..=..V...}...).=s.....y!.,...X.[..[.....\31}..D%...%..+G66.j.v./.e9...P;.o.y..U+...g.g.S.../..B._L..h...Oi.._...:..5ls>>........n6.F.Q..v>..P.r:.a..Z....a...x..D....N...i..=L.u......<;Nv.X/*.

                        C:\Users\user\AppData\Local\Temp\cab8098.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 624532 bytes, 2 files, at 0x44 +A "content.inf" +A "Quotable.thmx", flags 0x4, ID 13510, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
                        Category:dropped
                        Size (bytes):640684
                        Entropy (8bit):7.99860205353102
                        Encrypted:true
                        SSDEEP:12288:eV7ivfl+kbkIrWu+2aoRjwv/cSUWauGPo2v65s4QqcT3ZCCz6CSj8aC:fdhr1+3y4MWaC2CO4V+3ZCCDsO
                        MD5:F93364EEC6C4FFA5768DE545A2C34F07
                        SHA1:166398552F6B7F4509732E148F93E207DD60420B
                        SHA-256:296B915148B29751E68687AE37D3FAFD9FFDDF458C48EB059A964D8F2291E899
                        SHA-512:4F0965B4C5F543B857D9A44C7A125DDD3E8B74837A0FDD80C1FDC841BF22FC4CE4ADB83ACA8AA65A64F8AE6D764FA7B45B58556F44CFCE92BFAC43762A3BC5F4
                        Malicious:false
                        Preview:MSCF............D................4...............?..........~..................M. .content.inf."..........M. .Quotable.thmx..^.u.n..[...............&...U..F.......UU.M.T5.UUQS..j..#>43fD.....`....Vr......19'...P..j.-...6n.0c....4$.c....$.4.k3aQ$.lCN.#.[.."qc....,Z...,Qt@!.@...... ...H.......9.9.y.{....[.`..s3.5.....B....W.g.d...[uv.UW..............P.8.(.?......3.....'/F...0...8.P. .O..B....K...g..L.......#s...%..|4.i....?.3b.".....g...?.........2.O23..'..O~.+..{...C.n.L......3......Y.L...?K...o......g....@.]...T..sU.....<.._.<G.......Tu.U2..v.&..<..^..e.].cY;..9.%..}...I.y.;...WM...3>.:.=.|.-.AtT2OJ.I.#...#.y....A....\]$r...lM.%5.."...+7M..J.....c...".&$.... Y.r.B;..81B. +H...b....@7K.*.F.Z...v..=..ES.f.~.."...f..ho.X.E.a`~*...C>.&..@\.[....(.....h..]...9&...sd.H .1.x.2..t.rj..o..A..^qF.S9.5.....E.{...C|.w.c/V...0Q.M...........O.7;A4u...R..Z.B.7a.C`....p.z.....f!|.u.3t....2e.wWH..'7p....E_...e.._;..k....*&E.^.f=V..{*..al.y:.4a...+.g...-..>e

                        C:\Users\user\AppData\Local\Temp\cab80F9.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Cabinet archive data, many, 682092 bytes, 2 files, at 0x44 +A "Berlin.thmx" +A "content.inf", flags 0x4, ID 46672, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
                        Category:dropped
                        Size (bytes):698244
                        Entropy (8bit):7.997838239368002
                        Encrypted:true
                        SSDEEP:12288:bUfKzAwwP7XAMWtr4FvMRt4lX0hnBdThiSb32+TdysrQgn7v4EemC6:sr7AMkJ34xu1bm4ZrQaY6
                        MD5:E29CE2663A56A1444EAA3732FFB82940
                        SHA1:767A14B51BE74D443B5A3FEFF4D870C61CB76501
                        SHA-256:3732EB6166945DB2BF792DA04199B5C4A0FB3C96621ECBFDEAF2EA1699BA88EE
                        SHA-512:6BC420F3A69E03D01A955570DC0656C83C9E842C99CF7B429122E612E1E54875C61063843D8A24DB7EC2035626F02DDABF6D84FC3902184C1EFF3583DBB4D3D8
                        Malicious:false
                        Preview:MSCF....lh......D...............P...........lh...?..........|..................M. .Berlin.thmx............M. .content.inf..lH.lj..[...............7.I..)........P..5x.B/^y5.xk^^......D.F........s....y...?D.....*.....&....".o..pl..Q.jm?_...6......=%.p.{.)S..y...$......,4..>#.........)..."-....K....4.E...L=.......4..p.c..nQ.0..ZO.#.....e.N..`U......oS....V..X[t.E)|.h..R....$..}.{.F.7....^.....w.,...5rBR.....{.......mi...h.b......w+..;.hV......q..(.7&.Z.l...C."j........[-E4h.....v&..~.p$|\X...8.....Fj'%,.)6w...u|C..,y..E..`*Up../(....2.(....Z.....,.'...d..s..Z....5.g.?Nq..04...f...D.x....q+.b.."v`{.NL....C..... ..n......1N+.I.{W9....2r.0...BaC.....O..=...k..."..8.D\jK.B...Aj....6,B..2...I.. B..^.4..1.K+.....DP...Mr....9..x[...>........?.Zd..'._2.._..>..'.F..#.w...2..~.|........q_Wy.W.....~..Qex.km/..f......t.q..p..gm.|.x.... ,.#\Z....p....a.}...%..v.J.Es......I.b.P?...0......F.x....E..j..6.%..E..-O.k...b .^.h.Cv...Z....D.n.d:.d.F..x...[1...B..

                        C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):30
                        Entropy (8bit):1.2389205950315936
                        Encrypted:false
                        SSDEEP:3:A1v:A1
                        MD5:3A6A792813A460121CA12D954B472DAE
                        SHA1:D234C96A48534C9769DB70BBE5ACAB638CF2942E
                        SHA-256:ED9299D2F3EE7A66C41914C95E188C9435A38AE2C5CE9FFF4140FA00F45569B9
                        SHA-512:21A31771ED21EBD2EAA35D541670417DB48E531839000E93F6A46AFB18165819585BD3333EB0975B005AD86F0F2EBC99227D64FDC55C47C2F624C7B25149E294
                        Malicious:false
                        Preview:....7.........................

                        C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Directory, ctime=Thu Oct 31 08:19:32 2024, mtime=Thu Oct 31 08:19:52 2024, atime=Thu Oct 31 08:19:52 2024, length=0, window=hide
                        Category:dropped
                        Size (bytes):1161
                        Entropy (8bit):4.658081696995167
                        Encrypted:false
                        SSDEEP:12:84ANTicmUQXpDuCiCHkPFlzKnJis/IQz7a0/P5tLwmT5iXe1ykK0VlejA2OHSuTJ:8DFhKlwgVH55b6n0aAouTQJo3qygm
                        MD5:C6D4284FEBCB0F084494C0B88F79479E
                        SHA1:489198428BF4DD45AFE20C4D287C8A03B3B88187
                        SHA-256:CEFC3B57FD42DB5B2EC3BBDDE0F5EBC077218A26C2D37AD3DE77B81D45BF7C7A
                        SHA-512:67340E1CB797BFF9FE33283DB53A8991D6D36683E6E21AB25EB2F05E6736F5772FBA86CCD89354A4C164AAF98F9491CEE5F36AAD0A5A608E459CAD7A83510C73
                        Malicious:false
                        Preview:L..................F.........+'.u+..w...v+...f..v+..........................Y....P.O. .:i.....+00.../C:\...................x.1.....FW,I..Users.d......OwH_YcJ....................:.........U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....N.1....._YjJ..user..:......FW.H_YlJ............................A.c.a.l.i.....V.1.....FW.H..AppData.@......FW.H_YcJ..............................A.p.p.D.a.t.a.....V.1....._YjJ..Roaming.@......FW.H_YjJ............................=.R.o.a.m.i.n.g.....\.1....._YqJ..MICROS~1..D......FW.H_YqJ............................R.M.i.c.r.o.s.o.f.t.....\.1....._YyJ..TEMPLA~1..D......_YqJ_YyJ...........................6\.T.e.m.p.l.a.t.e.s.......`...............-......._............F.......C:\Users\user\AppData\Roaming\Microsoft\Templates........\.....\.T.e.m.p.l.a.t.e.s...........................>.e.L.:..er.=....`.......X.......305090...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.............1SPS.XF.L8C....&.m.q............/...S.-.

                        C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):28
                        Entropy (8bit):4.351823225551765
                        Encrypted:false
                        SSDEEP:3:bDuMJlv:bCy
                        MD5:4E30A3397E81DD38A188E78FC94E5A77
                        SHA1:95E2EFA493065E02C7370BEFBE5A4BC1340CF5EF
                        SHA-256:DDD0B5A9B8BD9275DDD6BD1D9D033C56734A5BB184B4371E50C2200B903397CB
                        SHA-512:6D9BA51003C7C056E2628F8C435029C8A62E4A7E9A40B59C952AF160B91449AA4B9E5E4084A275E1825C6BE0CD1C8EE22709BEB1C13839BE8B29C63B2509DF53
                        Malicious:false
                        Preview:[folders]..Templates.LNK=0..

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):562113
                        Entropy (8bit):7.67409707491542
                        Encrypted:false
                        SSDEEP:12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
                        MD5:4A1657A3872F9A77EC257F41B8F56B3D
                        SHA1:4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
                        SHA-256:C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
                        SHA-512:7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
                        Malicious:false
                        Preview:PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):558035
                        Entropy (8bit):7.696653383430889
                        Encrypted:false
                        SSDEEP:12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
                        MD5:3B5E44DDC6AE612E0346C58C2A5390E3
                        SHA1:23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
                        SHA-256:9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
                        SHA-512:2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
                        Malicious:false
                        Preview:PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):570901
                        Entropy (8bit):7.674434888248144
                        Encrypted:false
                        SSDEEP:6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
                        MD5:D676DE8877ACEB43EF0ED570A2B30F0E
                        SHA1:6C8922697105CEC7894966C9C5553BEB64744717
                        SHA-256:DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
                        SHA-512:F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
                        Malicious:false
                        Preview:PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):523048
                        Entropy (8bit):7.715248170753013
                        Encrypted:false
                        SSDEEP:6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
                        MD5:C276F590BB846309A5E30ADC35C502AD
                        SHA1:CA6D9D6902475F0BE500B12B7204DD1864E7DD02
                        SHA-256:782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
                        SHA-512:B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
                        Malicious:false
                        Preview:PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):777647
                        Entropy (8bit):7.689662652914981
                        Encrypted:false
                        SSDEEP:6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
                        MD5:B30D2EF0FC261AECE90B62E9C5597379
                        SHA1:4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
                        SHA-256:BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
                        SHA-512:2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
                        Malicious:false
                        Preview:PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~|.?"....|.{.[..e^7E......Gi..V.by..G..|.......U..t.|..mW...m..|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):924687
                        Entropy (8bit):7.824849396154325
                        Encrypted:false
                        SSDEEP:12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
                        MD5:97EEC245165F2296139EF8D4D43BBB66
                        SHA1:0D91B68CCB6063EB342CFCED4F21A1CE4115C209
                        SHA-256:3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
                        SHA-512:8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
                        Malicious:false
                        Preview:PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r..*.M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qd*w>.O.{h...|w..5.]..'.CS<.:8C}.g.|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):966946
                        Entropy (8bit):7.8785200658952
                        Encrypted:false
                        SSDEEP:24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
                        MD5:F03AB824395A8F1F1C4F92763E5C5CAD
                        SHA1:A6E021918C3CEFFB6490222D37ECEED1FC435D52
                        SHA-256:D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
                        SHA-512:0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
                        Malicious:false
                        Preview:PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):486596
                        Entropy (8bit):7.668294441507828
                        Encrypted:false
                        SSDEEP:6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
                        MD5:0E37AECABDB3FDF8AAFEDB9C6D693D2F
                        SHA1:F29254D2476DF70979F723DE38A4BF41C341AC78
                        SHA-256:7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
                        SHA-512:DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
                        Malicious:false
                        Preview:PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~|.?"....|.{.[..e^7E......Gi..V.by..G..|.......U..t.|..mW...m..|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):976001
                        Entropy (8bit):7.791956689344336
                        Encrypted:false
                        SSDEEP:24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
                        MD5:9E563D44C28B9632A7CF4BD046161994
                        SHA1:D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
                        SHA-256:86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
                        SHA-512:8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
                        Malicious:false
                        Preview:PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~|.?"....|.{.[..e^7E......Gi..V.by..G..|.......U..t.|..mW...m..|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/|c.

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):608122
                        Entropy (8bit):7.729143855239127
                        Encrypted:false
                        SSDEEP:6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
                        MD5:8BA551EEC497947FC39D1D48EC868B54
                        SHA1:02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
                        SHA-256:DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
                        SHA-512:CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
                        Malicious:false
                        Preview:PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):5783
                        Entropy (8bit):7.88616857639663
                        Encrypted:false
                        SSDEEP:96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
                        MD5:8109B3C170E6C2C114164B8947F88AA1
                        SHA1:FC63956575842219443F4B4C07A8127FBD804C84
                        SHA-256:F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
                        SHA-512:F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
                        Malicious:false
                        Preview:PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..|. 1^......&..|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):4026
                        Entropy (8bit):7.809492693601857
                        Encrypted:false
                        SSDEEP:96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
                        MD5:5D9BAD7ADB88CEE98C5203883261ACA1
                        SHA1:FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
                        SHA-256:8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
                        SHA-512:7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
                        Malicious:false
                        Preview:PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..|. 1^......&..|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.|.."v....q..|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....*D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`|..0xH}......L.|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x*.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):4243
                        Entropy (8bit):7.824383764848892
                        Encrypted:false
                        SSDEEP:96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
                        MD5:7BC0A35807CD69C37A949BBD51880FF5
                        SHA1:B5870846F44CAD890C6EFF2F272A037DA016F0D8
                        SHA-256:BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
                        SHA-512:B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
                        Malicious:false
                        Preview:PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..|. 1^......&..|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.|.........|.&3.o.....S..K.T5g.U....g..n.f....T*.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,*....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):16806
                        Entropy (8bit):7.9519793977093505
                        Encrypted:false
                        SSDEEP:384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
                        MD5:950F3AB11CB67CC651082FEBE523AF63
                        SHA1:418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
                        SHA-256:9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
                        SHA-512:D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
                        Malicious:false
                        Preview:PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):11380
                        Entropy (8bit):7.891971054886943
                        Encrypted:false
                        SSDEEP:192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
                        MD5:C9F9364C659E2F0C626AC0D0BB519062
                        SHA1:C4036C576074819309D03BB74C188BF902D1AE00
                        SHA-256:6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
                        SHA-512:173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
                        Malicious:false
                        Preview:PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...|...pr.q

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):6024
                        Entropy (8bit):7.886254023824049
                        Encrypted:false
                        SSDEEP:96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
                        MD5:20621E61A4C5B0FFEEC98FFB2B3BCD31
                        SHA1:4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
                        SHA-256:223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
                        SHA-512:BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
                        Malicious:false
                        Preview:PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....|C/N..K\}.....#..".

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):9191
                        Entropy (8bit):7.93263830735235
                        Encrypted:false
                        SSDEEP:192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
                        MD5:08D3A25DD65E5E0D36ADC602AE68C77D
                        SHA1:F23B6DDB3DA0015B1D8877796F7001CABA25EA64
                        SHA-256:58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
                        SHA-512:77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
                        Malicious:false
                        Preview:PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..|8..\uo.......K...._.Y..E6.|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):4326
                        Entropy (8bit):7.821066198539098
                        Encrypted:false
                        SSDEEP:96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
                        MD5:D32E93F7782B21785424AE2BEA62B387
                        SHA1:1D5589155C319E28383BC01ED722D4C2A05EF593
                        SHA-256:2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
                        SHA-512:5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
                        Malicious:false
                        Preview:PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\*....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..*oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)...*.]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^..*....C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...|...l..\M..8p$]..poX-/.2}..}z\.|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..|)..q4.Z.b..PP....U.K..|.i.$v

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):7370
                        Entropy (8bit):7.9204386289679745
                        Encrypted:false
                        SSDEEP:192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
                        MD5:586CEBC1FAC6962F9E36388E5549FFE9
                        SHA1:D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
                        SHA-256:1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
                        SHA-512:68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
                        Malicious:false
                        Preview:PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..|. 1^......&..|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):5596
                        Entropy (8bit):7.875182123405584
                        Encrypted:false
                        SSDEEP:96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
                        MD5:CDC1493350011DB9892100E94D5592FE
                        SHA1:684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
                        SHA-256:F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
                        SHA-512:3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
                        Malicious:false
                        Preview:PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):3683
                        Entropy (8bit):7.772039166640107
                        Encrypted:false
                        SSDEEP:96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
                        MD5:E8308DA3D46D0BC30857243E1B7D330D
                        SHA1:C7F8E54A63EB254C194A23137F269185E07F9D10
                        SHA-256:6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
                        SHA-512:88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
                        Malicious:false
                        Preview:PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.*. .<%.BD..E....x... ..@...v.7f.Y......N.|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2..*....UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):4888
                        Entropy (8bit):7.8636569313247335
                        Encrypted:false
                        SSDEEP:96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
                        MD5:0A4CA91036DC4F3CD8B6DBF18094CF25
                        SHA1:6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
                        SHA-256:E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
                        SHA-512:7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
                        Malicious:false
                        Preview:PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?...*..DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....*J.#J.... .P...P.1...!.#&...?A..&.."..|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):6448
                        Entropy (8bit):7.897260397307811
                        Encrypted:false
                        SSDEEP:192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
                        MD5:42A840DC06727E42D42C352703EC72AA
                        SHA1:21AAAF517AFB76BF1AF4E06134786B1716241D29
                        SHA-256:02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
                        SHA-512:8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
                        Malicious:false
                        Preview:PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g*5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~..*.l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..|f.n...H.=.|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):5630
                        Entropy (8bit):7.87271654296772
                        Encrypted:false
                        SSDEEP:96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
                        MD5:2F8998AA9CF348F1D6DE16EAB2D92070
                        SHA1:85B13499937B4A584BEA0BFE60475FD4C73391B6
                        SHA-256:8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
                        SHA-512:F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
                        Malicious:false
                        Preview:PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.|8.!b.C..v..|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..|...!..q;;.w.".D..lt.".l.4".mt...E..mt

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Category:dropped
                        Size (bytes):6193
                        Entropy (8bit):7.855499268199703
                        Encrypted:false
                        SSDEEP:192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
                        MD5:031C246FFE0E2B623BBBD231E414E0D2
                        SHA1:A57CA6134779D54691A4EFD344BC6948E253E0BA
                        SHA-256:2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
                        SHA-512:6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
                        Malicious:false
                        Preview:PK........X..<..Zn|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.*S=.$......T_6..I...6...d.NJ....r.p.p.........|.z.K.M..L.T.(........<..ks.......o...t}...P..*.7...`.+.[...H..._..X.u.....N....n....n|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j.*.?..mxk..n..|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6*.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow|&4>...d.O.|.|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):3075
                        Entropy (8bit):7.716021191059687
                        Encrypted:false
                        SSDEEP:48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
                        MD5:67766FF48AF205B771B53AA2FA82B4F4
                        SHA1:0964F8B9DC737E954E16984A585BDC37CE143D84
                        SHA-256:160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
                        SHA-512:AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
                        Malicious:false
                        Preview:PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..|. 1^......&..|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft OOXML
                        Category:dropped
                        Size (bytes):5151
                        Entropy (8bit):7.859615916913808
                        Encrypted:false
                        SSDEEP:96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
                        MD5:6C24ED9C7C868DB0D55492BB126EAFF8
                        SHA1:C6D96D4D298573B70CF5C714151CF87532535888
                        SHA-256:48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
                        SHA-512:A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
                        Malicious:false
                        Preview:PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..|. 1^......&..|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............|.c..x{_._..^0e.|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.|>YK.....o.|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..|..O>o.|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851216[[fn=apasixtheditionofficeonline]].xsl (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):333258
                        Entropy (8bit):4.654450340871081
                        Encrypted:false
                        SSDEEP:6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
                        MD5:5632C4A81D2193986ACD29EADF1A2177
                        SHA1:E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
                        SHA-256:06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
                        SHA-512:676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851217[[fn=chicago]].xsl (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):296658
                        Entropy (8bit):5.000002997029767
                        Encrypted:false
                        SSDEEP:6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
                        MD5:9AC6DE7B629A4A802A41F93DB2C49747
                        SHA1:3D6E929AA1330C869D83F2BF8EBEBACD197FB367
                        SHA-256:52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
                        SHA-512:5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):268317
                        Entropy (8bit):5.05419861997223
                        Encrypted:false
                        SSDEEP:6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
                        MD5:51D32EE5BC7AB811041F799652D26E04
                        SHA1:412193006AA3EF19E0A57E16ACF86B830993024A
                        SHA-256:6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
                        SHA-512:5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851219[[fn=gostname]].xsl (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):255948
                        Entropy (8bit):5.103631650117028
                        Encrypted:false
                        SSDEEP:6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
                        MD5:9888A214D362470A6189DEFF775BE139
                        SHA1:32B552EB3C73CD7D0D9D924C96B27A86753E0F97
                        SHA-256:C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
                        SHA-512:8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851220[[fn=gosttitle]].xsl (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):251032
                        Entropy (8bit):5.102652100491927
                        Encrypted:false
                        SSDEEP:6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
                        MD5:F425D8C274A8571B625EE66A8CE60287
                        SHA1:29899E309C56F2517C7D9385ECDBB719B9E2A12B
                        SHA-256:DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
                        SHA-512:E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):284415
                        Entropy (8bit):5.00549404077789
                        Encrypted:false
                        SSDEEP:6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
                        MD5:33A829B4893044E1851725F4DAF20271
                        SHA1:DAC368749004C255FB0777E79F6E4426E12E5EC8
                        SHA-256:C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
                        SHA-512:41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLouserzed">.. <xsl:choose>.. <xsl:when test="b:StyleNameLouserzed/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLouserzed/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851222[[fn=ieee2006officeonline]].xsl (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):294178
                        Entropy (8bit):4.977758311135714
                        Encrypted:false
                        SSDEEP:6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
                        MD5:0C9731C90DD24ED5CA6AE283741078D0
                        SHA1:BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
                        SHA-256:ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
                        SHA-512:A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLouserzed">.. <xsl:choose>.. <xsl:when test="b:StyleNameLouserzed/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLouserzed/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):270198
                        Entropy (8bit):5.073814698282113
                        Encrypted:false
                        SSDEEP:6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
                        MD5:FF0E07EFF1333CDF9FC2523D323DD654
                        SHA1:77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
                        SHA-256:3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
                        SHA-512:B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851224[[fn=iso690nmerical]].xsl (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):217137
                        Entropy (8bit):5.068335381017074
                        Encrypted:false
                        SSDEEP:6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
                        MD5:3BF8591E1D808BCCAD8EE2B822CC156B
                        SHA1:9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
                        SHA-256:7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
                        SHA-512:D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851225[[fn=mlaseventheditionofficeonline]].xsl (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):254875
                        Entropy (8bit):5.003842588822783
                        Encrypted:false
                        SSDEEP:6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
                        MD5:377B3E355414466F3E3861BCE1844976
                        SHA1:0B639A3880ACA3FD90FA918197A669CC005E2BA4
                        SHA-256:4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
                        SHA-512:B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851226[[fn=turabian]].xsl (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):344303
                        Entropy (8bit):5.023195898304535
                        Encrypted:false
                        SSDEEP:6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
                        MD5:F079EC5E2CCB9CD4529673BCDFB90486
                        SHA1:FBA6696E6FA918F52997193168867DD3AEBE1AD6
                        SHA-256:3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
                        SHA-512:4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):250983
                        Entropy (8bit):5.057714239438731
                        Encrypted:false
                        SSDEEP:6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
                        MD5:F883B260A8D67082EA895C14BF56DD56
                        SHA1:7954565C1F243D46AD3B1E2F1BAF3281451FC14B
                        SHA-256:EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
                        SHA-512:D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Word 2007+
                        Category:dropped
                        Size (bytes):51826
                        Entropy (8bit):5.541375256745271
                        Encrypted:false
                        SSDEEP:384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
                        MD5:2AB22AC99ACFA8A82742E774323C0DBD
                        SHA1:790F8B56DF79641E83A16E443A75A66E6AA2F244
                        SHA-256:BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
                        SHA-512:E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
                        Malicious:false
                        Preview:PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~|.?"....|.{.[..e^7E......Gi..V.by..G..|.......U..t.|..mW...m..|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b....*..w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Word 2007+
                        Category:dropped
                        Size (bytes):47296
                        Entropy (8bit):6.42327948041841
                        Encrypted:false
                        SSDEEP:768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
                        MD5:5A53F55DD7DA8F10A8C0E711F548B335
                        SHA1:035E685927DA2FECB88DE9CAF0BECEC88BC118A7
                        SHA-256:66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
                        SHA-512:095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
                        Malicious:false
                        Preview:PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~|.?"....|.{.[..e^7E......Gi..V.by..G..|.......U..t.|..mW...m..|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Word 2007+
                        Category:dropped
                        Size (bytes):34415
                        Entropy (8bit):7.352974342178997
                        Encrypted:false
                        SSDEEP:768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
                        MD5:7CDFFC23FB85AD5737452762FA36AAA0
                        SHA1:CFBC97247959B3142AFD7B6858AD37B18AFB3237
                        SHA-256:68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
                        SHA-512:A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
                        Malicious:false
                        Preview:PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~|.?"....|.{.[..e^7E......Gi..V.by..G..|.......U..t.|..mW...m..|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b....*..w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&.*...Y.....4.u.., !po....9W....g..F...*+1....d,'...L.M[-~.Ey. ......[

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\Normal.dotm (copy)

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Word 2007+
                        Category:dropped
                        Size (bytes):19348
                        Entropy (8bit):7.469900377546533
                        Encrypted:false
                        SSDEEP:384:Jrt+BNxt/ZtNNUhoAAdWloVdMrEqc4HdPWt9YmHA:VAxllN4mWloK+/A
                        MD5:0CC5C5F36543A50D4900C14A86BA36C8
                        SHA1:0CB66DE254F91D40D97C4D024CD3089354332A9A
                        SHA-256:5FB4F17BFF3611F79845B6249DE5071C009F4458B8F41A27E4D70345C8F2EA33
                        SHA-512:ACDC2E14A0F79414EBF3F0D53AB48DF1B3C19FCE8E5B2EFF68B035183D7915204370025AE90BC78034B32D075CA9675F713F12B541C6B51014215AAD14F28501
                        Malicious:false
                        Preview:PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R*.D.g..3.H....M!`.l.....J.j;*...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):162
                        Entropy (8bit):4.749422345031142
                        Encrypted:false
                        SSDEEP:3:8lZlYl1Aq8EmDmJryQjevRfYDEZUMlGU/iaaZF:0ZivAq8Em65YoMlGUxaZF
                        MD5:9DB08A28204A69672CDA2359B38AF7BE
                        SHA1:3790CB1296228500242891B41A605BB53083AB07
                        SHA-256:C2FA321FC954EDD018A437B88B0C9CC9AD06FB0743406A9C1FB10FB1242A6BAB
                        SHA-512:6E88DE002E58665D63B623657818B88B75405635E3EDD416377067BC7AC54AD35C20ED02AA272F01804F1A78E3B9B1251EA12471AFD1E6111C2BFEF4C0C5C1D3
                        Malicious:false
                        Preview:.user...................................................c.a.l.i.....qR.k....$.,.%].X!l....~._....e....Ld4.}y.2!#.......^-M.i..v+........+R$...}..j.........=.j

                        C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        File Type:Microsoft Word 2007+
                        Category:dropped
                        Size (bytes):19348
                        Entropy (8bit):7.469900377546533
                        Encrypted:false
                        SSDEEP:384:Jrt+BNxt/ZtNNUhoAAdWloVdMrEqc4HdPWt9YmHA:VAxllN4mWloK+/A
                        MD5:0CC5C5F36543A50D4900C14A86BA36C8
                        SHA1:0CB66DE254F91D40D97C4D024CD3089354332A9A
                        SHA-256:5FB4F17BFF3611F79845B6249DE5071C009F4458B8F41A27E4D70345C8F2EA33
                        SHA-512:ACDC2E14A0F79414EBF3F0D53AB48DF1B3C19FCE8E5B2EFF68B035183D7915204370025AE90BC78034B32D075CA9675F713F12B541C6B51014215AAD14F28501
                        Malicious:false
                        Preview:PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R*.D.g..3.H....M!`.l.....J.j;*...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

                        Static File Info

                        General

                        File type:Zip archive data, at least v2.0 to extract, compression method=deflate
                        Entropy (8bit):7.998802731505721
                        TrID:
                        • ZIP compressed archive (8000/1) 100.00%
                        File name:MDE_File_Sample_a3e5f36a6c6aa8d153a311c66de474a8b21a6684.zip
                        File size:146'315 bytes
                        MD5:0d8df8a956ab6a852b9deb175968ce71
                        SHA1:9a063d5d313a72c097d40b15810f763d575c9a00
                        SHA256:4b2d3d66b3890cb3e2a5a978b3271791a088ef54d1da8c0d5d2d63d831701825
                        SHA512:0d8325d95f06ca399182c167cb349af8d400b8f7bd7ba56eea7112a6e12ab33152c9dea6491900043ca40d48470ebecd495eb0a63399791dbad2e7f35809380f
                        SSDEEP:3072:3aUp97owscmsPW8NYzqYrKScXpjMECSzKbN1cc:TpyCpu8NYzFrejMECce1b
                        TLSH:C1E312D82651D0F2A05AFC55ED81F1EF81DFA2128FB2298BD2E9E10F3C6B05943467B5
                        File Content Preview:PK.........I_Y.]p..:...e....$.74980.docx.. ..........(!.u+...(!.u+...(!.u+...4..C.m.K..U@..u7..(c...n._..R.?..g.g....i.i5t.!....;...).%....`.......A8.....u.....".^.`21h.S....^.%I.X5..%R....{".^r...<...z].....]....O.{.....)[....m.T.....*.....W.oS.'...H...H

                        File Icon

                        Icon Hash:1c1c1e4e4ececedc

                        Network Behavior

                        Network Port Distribution

                        TCP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Oct 31, 2024 10:20:16.629424095 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:16.629482985 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:16.629590034 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:16.630884886 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:16.630899906 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:17.381392956 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:17.381499052 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:17.382997036 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:17.383011103 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:17.383220911 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:17.436662912 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:17.474467993 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:17.519344091 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.252978086 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.253009081 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.253015995 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.253051996 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.253068924 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.253077030 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.253127098 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.253160000 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.253176928 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.253199100 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.253344059 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.254857063 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.254875898 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.254992008 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.254992008 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.255002975 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.255362988 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.368766069 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.368792057 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.368901014 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.368920088 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.369064093 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.369848967 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.369864941 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.370085001 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.370091915 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.370168924 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.371684074 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.371701956 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.371818066 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.371825933 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.371952057 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.411392927 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.411413908 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.411560059 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.411561012 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.411573887 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.412266970 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.484838963 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.484862089 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.484967947 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.484987974 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.485024929 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.485198021 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.485610962 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.485630035 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.486155987 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.486162901 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.486582041 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.486603022 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.486620903 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.486628056 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.486696005 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.486797094 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.487261057 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.487276077 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.487382889 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.487390995 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.487451077 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.491252899 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.491269112 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.491601944 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.491609097 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.491745949 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.492109060 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.492125988 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.492203951 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.492203951 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.492211103 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.492274046 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.600007057 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.600033998 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.600208998 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.600208998 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.600219965 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.600410938 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.600429058 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.600496054 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.600496054 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.600502968 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.601150990 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.601169109 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.601197004 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.601202965 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.601217031 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.601236105 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.601558924 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.601579905 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.601598024 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.601604939 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.601624012 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.601677895 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.601677895 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.602031946 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.602047920 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.602119923 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.602119923 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.602127075 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.602493048 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.602514029 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.602530003 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.602535963 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.602549076 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.603768110 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.715558052 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.715583086 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.715826035 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.715836048 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.715914965 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.715935946 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.716031075 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.716031075 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.716037989 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.716253042 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.716270924 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.716295004 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.716301918 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.716315031 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.716340065 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.716463089 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.716559887 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.716577053 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.716990948 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.716998100 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.717034101 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.717055082 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.717067957 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.717072964 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.717135906 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.717135906 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.717444897 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.717464924 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.717626095 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.717633009 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.717763901 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.717957020 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.717978001 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.718070984 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.718070984 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.718079090 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.718178034 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.830920935 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.830954075 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.831198931 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.831221104 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.831338882 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.831495047 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.831516981 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.831614971 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.831614971 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.831621885 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.831712008 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.831932068 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.831954956 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.832082987 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.832128048 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.832130909 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.832149029 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.832171917 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.832273960 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.832510948 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.832536936 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.832612991 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.832612991 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.832619905 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.832804918 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.832843065 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.832921028 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.832921028 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.832927942 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.833292007 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.833308935 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.833393097 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.833405972 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.884824038 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.946495056 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.946521044 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.946835995 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.946845055 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.946921110 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.946942091 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.946960926 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.946965933 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.946979046 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.947113037 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.947124004 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.947127104 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.947140932 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.947210073 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.947210073 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.947799921 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.947818041 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.947957039 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.947962999 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.948023081 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.948040962 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.948059082 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.948065042 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.948091030 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.948278904 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.948292017 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.948292017 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.948306084 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.948370934 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.948370934 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.948451042 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.948463917 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.949661016 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.949666977 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.955029964 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.988878965 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.988909960 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.989090919 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:18.989100933 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:18.989248037 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.062941074 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.062968969 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.063081980 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.063107967 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.063122988 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.063148975 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.063730001 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.063749075 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.063812017 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.063819885 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.063878059 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.064358950 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.064378023 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.064439058 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.064445972 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.064493895 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.064625025 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.064641953 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.064701080 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.064707994 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.064754963 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.065196991 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.065216064 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.065278053 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.065284967 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.065337896 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.065594912 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.065610886 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.065684080 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.065696001 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.065757036 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.066062927 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.066081047 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.066140890 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.066148043 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.066195965 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.106400013 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.106431007 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.106662989 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.106679916 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.106734037 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.177819014 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.177845001 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.177970886 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.177993059 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.178073883 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.178184986 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.178204060 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.178266048 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.178273916 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.178322077 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.178491116 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.178519011 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.178569078 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.178576946 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.178599119 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.178620100 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.178790092 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.178812981 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.178870916 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.178877115 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.178926945 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.179327011 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.179346085 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.179398060 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.179404974 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.179452896 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.179516077 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.179531097 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.179585934 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.179593086 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.179619074 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.179647923 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.180088997 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.180108070 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.180165052 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.180172920 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.180217981 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.219989061 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.220012903 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.220205069 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.220217943 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.220293045 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.293250084 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.293273926 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.293373108 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.293381929 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.293446064 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.293488026 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.293504000 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.293559074 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.293565035 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.293611050 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.293806076 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.293822050 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.293888092 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.293895006 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.293942928 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.294145107 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.294167042 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.294219017 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.294224977 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.294250965 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.294262886 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.294404984 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.294420004 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.294482946 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.294491053 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.294538975 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.294795990 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.294811010 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.294871092 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.294878006 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.294923067 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.295564890 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.295588970 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.295659065 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.295665979 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.295718908 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.295815945 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.295833111 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.295891047 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.295897961 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.295944929 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.335555077 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.335576057 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.335791111 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.335798979 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.335864067 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.409194946 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.409218073 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.409411907 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.409423113 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.409446955 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.409509897 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.409548044 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.410335064 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.410356998 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.410420895 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.410428047 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.410629034 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.410649061 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.410693884 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.410701036 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.410712004 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.410852909 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.410867929 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.410928011 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.410934925 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.411096096 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.411129951 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.411164045 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.411170959 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.411184072 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.411276102 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.411290884 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.411351919 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.411360025 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.411632061 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.411653042 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.411700964 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.411712885 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.411725998 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.451133966 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.451159000 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.451361895 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.451375008 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.505712032 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.524642944 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.524669886 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.524769068 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.524777889 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.524826050 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.524964094 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.524983883 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.525055885 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.525063038 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.525114059 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.525258064 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.525273085 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.525345087 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.525351048 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.525403976 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.526669979 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.526721001 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.526752949 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.526760101 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.526786089 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.526812077 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.526974916 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.526993036 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:19.527003050 CET49788443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:19.527007103 CET4434978813.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:22.845895052 CET49789443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:22.845936060 CET4434978913.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:22.846025944 CET49789443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:22.846225023 CET49789443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:22.846237898 CET4434978913.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:23.607075930 CET4434978913.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:23.607690096 CET49789443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:23.607711077 CET4434978913.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:23.608568907 CET49789443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:23.608573914 CET4434978913.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:23.755197048 CET4434978913.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:23.755228996 CET4434978913.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:23.755296946 CET4434978913.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:23.755341053 CET49789443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:23.755367994 CET49789443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:23.755708933 CET49789443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:23.755728006 CET4434978913.107.253.45192.168.2.16
                        Oct 31, 2024 10:20:23.755738974 CET49789443192.168.2.1613.107.253.45
                        Oct 31, 2024 10:20:23.755743980 CET4434978913.107.253.45192.168.2.16

                        DNS Answers

                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                        Oct 31, 2024 10:19:49.863529921 CET1.1.1.1192.168.2.160x941eNo error (0)templatesmetadata.office.nettemplatesmetadata.office.net.edgekey.netCNAME (Canonical name)IN (0x0001)false
                        Oct 31, 2024 10:20:10.928699970 CET1.1.1.1192.168.2.160xf0b0No error (0)templatesmetadata.office.nettemplatesmetadata.office.net.edgekey.netCNAME (Canonical name)IN (0x0001)false
                        Oct 31, 2024 10:20:16.620426893 CET1.1.1.1192.168.2.160xd1bbNo error (0)shed.dual-low.s-part-0017.t-0009.t-msedge.netazurefd-t-fb-prod.trafficmanager.netCNAME (Canonical name)IN (0x0001)false
                        Oct 31, 2024 10:20:16.620426893 CET1.1.1.1192.168.2.160xd1bbNo error (0)dual.s-part-0017.t-0009.fb-t-msedge.nets-part-0017.t-0009.fb-t-msedge.netCNAME (Canonical name)IN (0x0001)false
                        Oct 31, 2024 10:20:16.620426893 CET1.1.1.1192.168.2.160xd1bbNo error (0)s-part-0017.t-0009.fb-t-msedge.net13.107.253.45A (IP address)IN (0x0001)false

                        HTTP Request Dependency Graph

                        • otelrules.azureedge.net

                        HTTPS Proxied Packets

                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        0192.168.2.164978813.107.253.454432424C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        TimestampBytes transferredDirectionData
                        2024-10-31 09:20:17 UTC220OUTGET /rules/winword.exe-Production-v19.bundle HTTP/1.1
                        Connection: Keep-Alive
                        Accept-Encoding: gzip
                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.16827; Pro)
                        Host: otelrules.azureedge.net
                        2024-10-31 09:20:18 UTC542INHTTP/1.1 200 OK
                        Date: Thu, 31 Oct 2024 09:20:17 GMT
                        Content-Type: text/plain
                        Content-Length: 1276352
                        Connection: close
                        Vary: Accept-Encoding
                        Vary: Accept-Encoding
                        Vary: Accept-Encoding
                        Vary: Accept-Encoding
                        Cache-Control: public
                        Last-Modified: Wed, 30 Oct 2024 23:56:08 GMT
                        ETag: "0x8DCF93E6C896597"
                        x-ms-request-id: e8bc755e-001e-0046-4b76-2bda4b000000
                        x-ms-version: 2018-03-28
                        x-azure-ref: 20241031T092017Z-17fbfdc98bblzxqcphe71tp4qw00000004u0000000000mf2
                        x-fd-int-roxy-purgeid: 0
                        X-Cache: TCP_MISS
                        Accept-Ranges: bytes
                        2024-10-31 09:20:18 UTC15842INData Raw: 31 30 30 30 34 32 76 32 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 34 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 55 58 2e 44 65 73 6b 74 6f 70 2e 4f 66 66 69 63 65 54 68 65 6d 65 2e 41 70 70 2e 49 6e 69 74 22 20 41 54 54 3d 22 63 34 33 38 38 63 39 37 37 32 39 37 34 31 33 62 62 30 35 34 62 61 64 31 61 63 66 30 61 64 65 31 2d 63 63 35 38 65 35 33 65 2d 66 35 61 34 2d 34 66 33 37 2d 62 30 64 32 2d 39 61 38 30 37 39 65 33 34 34 32 30 2d 36 38 37 39 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 63 6d 39 79 35
                        Data Ascii: 100042v2+<?xml version="1.0" encoding="utf-8"?><R Id="100042" V="2" DC="SM" EN="Office.UX.Desktop.OfficeTheme.App.Init" ATT="c4388c977297413bb054bad1acf0ade1-cc58e53e-f5a4-4f37-b0d2-9a8079e34420-6879" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="cm9y5
                        2024-10-31 09:20:18 UTC16384INData Raw: 22 20 46 3d 22 41 75 74 68 6f 72 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 30 31 31 37 76 30 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 31 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 38 79 6c 6c 66 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22
                        Data Ascii: " F="AuthorCount" /> </C> <T> <S T="1" /> </T></R><$!#>100117v0+<?xml version="1.0" encoding="utf-8"?><R Id="100117" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="8yllf" /> </S> <C T="W" I="0" O="false"
                        2024-10-31 09:20:18 UTC16384INData Raw: 20 20 3c 41 20 54 3d 22 53 55 4d 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 41 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 37 38 31 76 31 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 37 38 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 67 6f 34 74 22 20 2f 3e 0d 0a
                        Data Ascii: <A T="SUM"> <S T="1" F="11" /> </A> </C> <T> <S T="2" /> <S T="3" /> </T></R><$!#>10781v1+<?xml version="1.0" encoding="utf-8"?><R Id="10781" V="1" DC="SM" T="Subrule" xmlns=""> <S> <UTS T="1" Id="bgo4t" />
                        2024-10-31 09:20:18 UTC16384INData Raw: 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 30 30 30 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d
                        Data Ascii: </O> </F> <F T="6"> <O T="AND"> <L> <O T="GT"> <L> <S T="1" F="0" /> </L> <R> <V V="1000" T="U32" /> </R> </O> </L>
                        2024-10-31 09:20:18 UTC16384INData Raw: 20 20 20 20 20 3c 53 20 54 3d 22 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 56 69 64 65 6f 43 61 6c 6c 56 69 64 65 6f 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 36 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 33 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 53 61 53 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 34 22 20 4f
                        Data Ascii: <S T="25" /> </C> </C> <C T="U32" I="22" O="false" N="FlyoutVideoCallVideo"> <C> <S T="26" /> </C> </C> <C T="U32" I="23" O="false" N="FlyoutSaS"> <C> <S T="27" /> </C> </C> <C T="U32" I="24" O
                        2024-10-31 09:20:18 UTC16384INData Raw: 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 39 30 37 76 30 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 39 30 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 4e 44 42 2e 55 6e 6b 6e 6f 77 6e 2e 43 6f 72 72 75 70 74 69 6f 6e 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 53 3d 22 31 30 30 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d
                        Data Ascii: </T></R><$!#>10907v0+<?xml version="1.0" encoding="utf-8"?><R Id="10907" V="0" DC="SM" EN="Office.Outlook.Desktop.NDB.Unknown.Corruption" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" S="100" DCa="PSU" xmlns="">
                        2024-10-31 09:20:18 UTC16384INData Raw: 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 41 6c 77 61 79 73 53 61 76 65 45 6e 61 62 6c 65 64 53 74 61 74 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 61 6c 77 61 79 73 53 61 76 65 45 6e 61 62 6c 65 64 53 74 61 74 65 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 42 6b 67 53 61 76 65 44 69 73 61 6c 6c 6f 77 52 65 61 73 6f 6e 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 42 6b 67 53 61 76 65 44 69 73 61 6c 6c 6f 77 52 65 61 73 6f 6e 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e
                        Data Ascii: ="9" O="true" N="AlwaysSaveEnabledState"> <S T="2" F="alwaysSaveEnabledState" M="Ignore" /> </C> <C T="U32" I="10" O="true" N="BkgSaveDisallowReason"> <S T="2" F="BkgSaveDisallowReason" M="Ignore" /> </C> <C T="U32" I="11" O="true" N
                        2024-10-31 09:20:18 UTC16384INData Raw: 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 31 30 30 38 32 76 30 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 31 30 30 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 41 43 53 20 54 3d 22 31 22 20 53 3d 22 41 73 73 65 72 74 22 20 2f 3e 0d 0a 20 20 20 20 3c 45 74 77 20 54 3d 22 32 22 20 45 3d 22 31 32 33 22 20 47 3d 22 7b 64 61 66 30 62 39 31 34 2d 39 63 31 63 2d 34
                        Data Ascii: </C> </C> <T> <S T="3" /> <S T="4" /> </T></R><$!#>110082v0+<?xml version="1.0" encoding="utf-8"?><R Id="110082" V="0" DC="SM" T="Subrule" xmlns=""> <S> <UACS T="1" S="Assert" /> <Etw T="2" E="123" G="{daf0b914-9c1c-4
                        2024-10-31 09:20:18 UTC16384INData Raw: 22 55 36 34 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 44 6f 63 49 64 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 44 6f 63 49 64 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 49 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 61 72 74 54 79 70 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 50 61 72 74 54 79 70 65 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 49 36 34 22 20 49 3d 22 32 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 42 75 73 42 61 72 43 6c 69 65 6e 74 49 64 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 43 6c 69 65 6e 74 49 64 22 20 4d 3d 22 49 67 6e 6f 72 65
                        Data Ascii: "U64" I="0" O="true" N="DocId"> <S T="1" F="DocId" M="Ignore" /> </C> <C T="I32" I="1" O="true" N="PartType"> <S T="1" F="PartType" M="Ignore" /> </C> <C T="I64" I="2" O="true" N="BusBarClientId"> <S T="1" F="ClientId" M="Ignore
                        2024-10-31 09:20:18 UTC16384INData Raw: 67 6f 72 79 22 20 2f 3e 0d 0a 20 20 20 20 20 20 3c 46 20 4e 3d 22 45 54 57 5f 54 72 61 63 6b 62 61 63 6b 54 61 67 22 20 2f 3e 0d 0a 20 20 20 20 20 20 3c 46 20 4e 3d 22 45 72 72 49 64 4f 70 74 69 6f 6e 61 6c 22 20 2f 3e 0d 0a 20 20 20 20 20 20 3c 46 20 4e 3d 22 48 52 4f 70 74 69 6f 6e 61 6c 22 20 2f 3e 0d 0a 20 20 20 20 20 20 3c 46 20 4e 3d 22 49 6e 66 6f 4f 70 74 44 65 63 69 22 20 2f 3e 0d 0a 20 20 20 20 20 20 3c 46 20 4e 3d 22 49 6e 66 6f 4f 70 74 48 65 78 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 46 20 4e 3d 22 55 4c 53 5f 43 61 74 65 67 6f 72 79 22 20 2f 3e 0d 0a 20 20 20 20 20 20 3c 46 20 4e 3d 22 45 54 57 5f 54 72 61 63 6b 62 61 63 6b 54 61 67 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                        Data Ascii: gory" /> <F N="ETW_TrackbackTag" /> <F N="ErrIdOptional" /> <F N="HROptional" /> <F N="InfoOptDeci" /> <F N="InfoOptHex" /> </S> <S T="3"> <F N="ULS_Category" /> <F N="ETW_TrackbackTag" />


                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        1192.168.2.164978913.107.253.454432424C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        TimestampBytes transferredDirectionData
                        2024-10-31 09:20:23 UTC206OUTGET /rules/rule120603v8s19.xml HTTP/1.1
                        Connection: Keep-Alive
                        Accept-Encoding: gzip
                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.16827; Pro)
                        Host: otelrules.azureedge.net
                        2024-10-31 09:20:23 UTC563INHTTP/1.1 200 OK
                        Date: Thu, 31 Oct 2024 09:20:23 GMT
                        Content-Type: text/xml
                        Content-Length: 2128
                        Connection: close
                        Vary: Accept-Encoding
                        Vary: Accept-Encoding
                        Vary: Accept-Encoding
                        Vary: Accept-Encoding
                        Cache-Control: public, max-age=604800, immutable
                        Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT
                        ETag: "0x8DC582BA41F3C62"
                        x-ms-request-id: 84a1d713-001e-00a2-4ba7-26d4d5000000
                        x-ms-version: 2018-03-28
                        x-azure-ref: 20241031T092023Z-17fbfdc98bb9cv5m0pampz446s00000008t0000000002gtc
                        x-fd-int-roxy-purgeid: 0
                        X-Cache: TCP_HIT
                        Accept-Ranges: bytes
                        2024-10-31 09:20:23 UTC2128INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 33 22 20 56 3d 22 38 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 64 64 69 74 69 6f 6e 61 6c 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 45 3d 22 66 61 6c 73 65 22 20 44 4c 3d
                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120603" V="8" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAdditional" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" E="false" DL=


                        Statistics

                        CPU Usage

                        Click to jump to process

                        Memory Usage

                        Click to jump to process

                        High Level Behavior Distribution

                        Click to dive into process behavior distribution

                        Behavior

                        Click to jump to process

                        System Behavior

                        General

                        Target ID:0
                        Start time:05:19:26
                        Start date:31/10/2024
                        Path:C:\Windows\System32\rundll32.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                        Imagebase:0x7ff677110000
                        File size:71'680 bytes
                        MD5 hash:EF3179D498793BF4234F708D3BE28633
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        General

                        Target ID:3
                        Start time:05:19:32
                        Start date:31/10/2024
                        Path:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        Wow64 process (32bit):true
                        Commandline:"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_a3e5f36a6c6aa8d153a311c66de474a8b21a6684.zip\74980.docx" /o ""
                        Imagebase:0x440000
                        File size:1'620'872 bytes
                        MD5 hash:1A0C2C2E7D9C4BC18E91604E9B0C7678
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        General

                        Target ID:11
                        Start time:05:19:53
                        Start date:31/10/2024
                        Path:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        Wow64 process (32bit):true
                        Commandline:"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_a3e5f36a6c6aa8d153a311c66de474a8b21a6684.zip\74980.docx" /o ""
                        Imagebase:0x440000
                        File size:1'620'872 bytes
                        MD5 hash:1A0C2C2E7D9C4BC18E91604E9B0C7678
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        General

                        Target ID:13
                        Start time:05:20:15
                        Start date:31/10/2024
                        Path:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                        Wow64 process (32bit):true
                        Commandline:"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_a3e5f36a6c6aa8d153a311c66de474a8b21a6684.zip\74980.docx" /o ""
                        Imagebase:0x440000
                        File size:1'620'872 bytes
                        MD5 hash:1A0C2C2E7D9C4BC18E91604E9B0C7678
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        Disassembly

                        ⊘No disassembly