She sent me a file purporting to be a PDF
The file was actually a .scr executable.
After exploring the exectuable with notepad++ I found the following
InstallPath="%APPDATA%\\Microsoft\\Windows\\System32"
RunProgram="hidcon:Run.bat"
This is designed to run a hidden batch file on start up
A quick google will tell you I am right
https://www.google.co.uk/search?q=InstallPath%3D%22%25APPDATA%25%5C%5CMicrosoft%5C%5CWindows%5C%5CSystem32%22RunProgram%3D%22hidcon%3ARun.bat%22&rlz=1C1FDUM_enGB486GB486&oq=InstallPath%3D%22%25APPDATA%25%5C%5CMicrosoft%5C%5CWindows%5C%5CSystem32%22RunProgram%3D%22hidcon%3ARun.bat%22&aqs=chrome..69i57.958j0j4&sourceid=chrome&espv=210&es_sm=93&ie=UTF-8#q=Windows%5C%5CSystem32%22RunProgram%3D%22hidcon%3ARun.bat%22&safe=off
and
7zip FX mod is a trojan
https://www.virustotal.com/en/file/95d3ee7541202ac8e7313623cc32e5c47f675be0488e1a7255d33baa32025374/analysis/
This user is not to be trusted.