Windows Analysis Report
zS0NQE8gev.exe

Overview

General Information

Sample name: zS0NQE8gev.exe
renamed because original name is a hash value
Original sample name: 5b3a0b1b89ca463f56984cf67ea1719f1ddee770d1e14438e3fcf9b5301f2c83.exe
Analysis ID: 1524359
MD5: d86383882515b7a9218d5f69924feadf
SHA1: 31183640972f2bc2e6906a271a88344201d37e4d
SHA256: 5b3a0b1b89ca463f56984cf67ea1719f1ddee770d1e14438e3fcf9b5301f2c83
Tags: exeRhysidauser-JAMESWT_MHT
Infos:

Detection

Rhysida
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Rhysida Ransomware
AI detected suspicious sample
Found API chain indicative of debugger detection
Found Tor onion address
Self deletion via cmd or bat file
Sigma detected: Suspicious Ping/Del Command Combination
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes many files with high entropy
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Contains capabilities to detect virtual machines
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains sections with non-standard names
Sample execution stops while process was sleeping (likely an evasion)
Uses Microsoft's Enhanced Cryptographic Provider

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: zS0NQE8gev.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: zS0NQE8gev.exe ReversingLabs: Detection: 63%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.6% probability
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0043E2E1 CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptAcquireContextA, 1_2_0043E2E1
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\7-Zip\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\7-Zip\Lang\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\locales\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\swiftshader\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CAN\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\DEU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\FRA\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\JPN\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\UK\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ar_AE\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\cs_CZ\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\da_DK\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\el_GR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_AE\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_GB\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_IL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\es_ES\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\en_US\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\private\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\prod\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\stage\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\fonts\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\cef\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\libs\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\cef\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\libs\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\cef\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\libs\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\hi_contrast\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\microsoftGraph\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\2.1.15\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\misc\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themeless_Reader\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\ccpdf\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\themeless\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\CriticalBreachDetected.pdf Jump to behavior
Source: zS0NQE8gev.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: ntkrnlmp.pdb.rhysida9 source: zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb9 source: zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysida; source: zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysidaQ source: zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\*\*ttings\** source: zS0NQE8gev.exe, 00000001.00000002.4775786894.0000000003FD9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb source: zS0NQE8gev.exe, 00000001.00000002.4781490845.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4784625692.0000000004FE6000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4785483363.000000000509D000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775266209.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4781384027.0000000004D10000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4774615689.0000000003EF6000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787924898.0000000005360000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4777565550.0000000004161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780925771.0000000004C74000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773577718.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4781046475.0000000004CBA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786594328.000000000520A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773914067.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779073978.00000000042A9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773744884.0000000003E05000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783139119.0000000004E8E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780561321.0000000004BEA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:/Users/user/Local Settings/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/winload_prod.pdb.rhysidaf# source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysida_ source: zS0NQE8gev.exe, 00000001.00000002.4787924898.0000000005360000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.rhysidad.pdfs source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysida` source: zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdboreut source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb^` source: zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysidaV source: zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\* source: zS0NQE8gev.exe, 00000001.00000002.4775786894.0000000003FD9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb"` source: zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysida] source: zS0NQE8gev.exe, 00000001.00000002.4786594328.000000000520A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb't source: zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb( source: zS0NQE8gev.exe, 00000001.00000002.4773744884.0000000003E05000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb! source: zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbd*o source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb`UZ source: zS0NQE8gev.exe, 00000001.00000002.4781046475.0000000004CBA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysida5\ source: zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb- source: zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysida source: zS0NQE8gev.exe, 00000001.00000002.4786025014.0000000005135000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4778311402.000000000420F000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787829877.000000000533C000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4784842203.000000000500A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783735083.0000000004F41000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4788103668.00000000053B8000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775786894.0000000003FD9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787290628.00000000052E2000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779148998.00000000042BB000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4772943245.0000000003CE9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780925771.0000000004C74000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4776682075.000000000409D000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783041880.0000000004E7C000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779674447.0000000004B30000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786666266.000000000521C000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4777331289.000000000412B000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4785399161.0000000005079000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4782312977.0000000004E0C000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780444300.0000000004BD3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb; source: zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb5 source: zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\Videos.pdbx134kWQ source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb source: zS0NQE8gev.exe, 00000001.00000002.4781490845.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4784625692.0000000004FE6000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4785483363.000000000509D000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775266209.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4781384027.0000000004D10000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787924898.0000000005360000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4777565550.0000000004161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780925771.0000000004C74000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773577718.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4781046475.0000000004CBA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786594328.000000000520A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773914067.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779073978.00000000042A9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773744884.0000000003E05000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783139119.0000000004E8E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780561321.0000000004BEA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb_Z source: zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysidad source: zS0NQE8gev.exe, 00000001.00000002.4783735083.0000000004F41000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbz source: zS0NQE8gev.exe, 00000001.00000002.4777565550.0000000004161000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbB` source: zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysidaf source: zS0NQE8gev.exe, 00000001.00000002.4772943245.0000000003CE9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.U source: zS0NQE8gev.exe, 00000001.00000002.4781046475.0000000004CBA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbP source: zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysidax source: zS0NQE8gev.exe, 00000001.00000002.4777331289.000000000412B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysiday source: zS0NQE8gev.exe, 00000001.00000002.4785399161.0000000005079000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbAZ source: zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysidaA t source: zS0NQE8gev.exe, 00000001.00000002.4779073978.00000000042A9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysida(ls source: zS0NQE8gev.exe, 00000001.00000002.4775786894.0000000003FD9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb?\ source: zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: zS0NQE8gev.exe, 00000001.00000002.4772943245.0000000003CE9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbX source: zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbY source: zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\CriticalBreachDetected.pdfC source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb_tw source: zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb^ source: zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb=\ source: zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbi source: zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb` source: zS0NQE8gev.exe, 00000001.00000002.4775266209.0000000003F72000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:/Users/user/Local Settings/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/CriticalBreachDetected.pdf source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.rhysidaafa: source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysida source: zS0NQE8gev.exe, 00000001.00000002.4784625692.0000000004FE6000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4785483363.000000000509D000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787924898.0000000005360000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4777565550.0000000004161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780925771.0000000004C74000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786594328.000000000520A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779073978.00000000042A9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783139119.0000000004E8E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780561321.0000000004BEA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.rhysidapdfc source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbl source: zS0NQE8gev.exe, 00000001.00000002.4775266209.0000000003F72000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\CriticalBreachDetected.pdfff source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*e\*\**{f= source: zS0NQE8gev.exe, 00000001.00000002.4772943245.0000000003CE9000.00000004.00000020.00020000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 4x nop then jmp 00430810h 1_2_0041E220
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 4x nop then lea r8, qword ptr [00000000004D9AE0h] 1_2_0042BD50
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 4x nop then lea r8, qword ptr [00000000004D90A0h] 1_2_00428DA0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 4x nop then lea r8, qword ptr [00000000004DA100h] 1_2_0042CF10

Networking
barindex
Found Tor onion address
Source: zS0NQE8gev.exe, 00000001.00000002.4761472896.000000000274E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion
Source: zS0NQE8gev.exe, 00000001.00000002.4761472896.000000000274E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion
Source: zS0NQE8gev.exe, 00000001.00000002.4770209284.0000000003899000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: zS0NQE8gev.exe, 00000001.00000002.4770209284.0000000003899000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: zS0NQE8gev.exe, 00000001.00000003.4746455440.000000000274E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion
Source: zS0NQE8gev.exe, 00000001.00000003.4746455440.000000000274E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion
Source: zS0NQE8gev.exe, 00000001.00000003.4746735644.000000000274E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion
Source: zS0NQE8gev.exe, 00000001.00000003.4746735644.000000000274E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion
Source: CriticalBreachDetected.pdf337.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf337.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf217.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf217.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf126.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf126.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf359.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf359.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf57.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf57.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf277.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf277.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf22.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf22.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf131.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf131.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf334.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf334.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf160.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf160.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf112.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf112.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf12.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf12.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf259.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf259.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf232.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf232.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf111.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf111.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf292.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf292.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf325.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf325.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf243.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf243.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf70.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf70.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf7.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf7.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf41.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf41.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf38.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf38.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf239.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf239.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf59.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf59.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf4.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf4.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf188.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf188.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf98.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf98.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf308.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf308.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf213.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf213.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf286.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf286.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf43.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf43.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf323.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf323.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf173.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf173.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf200.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf200.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf171.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf171.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf298.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf298.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf83.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf83.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf181.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf181.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf242.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf242.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf81.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf81.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf225.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf225.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf23.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf23.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf246.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf246.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf228.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf228.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf344.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf344.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf360.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf360.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf326.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf326.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf11.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf11.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf165.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf165.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf247.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf247.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf351.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf351.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf47.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf47.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf220.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf220.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf267.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf267.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf118.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf118.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf93.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf93.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf260.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf260.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf133.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf133.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf24.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf24.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf231.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf231.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf65.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf65.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf78.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf78.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf214.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf214.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf245.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf245.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf258.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf258.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf355.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf355.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf321.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf321.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf139.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf139.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf175.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf175.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf194.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf194.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf67.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf67.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf109.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf109.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf336.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf336.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf178.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf178.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf297.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf297.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf120.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf120.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf209.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf209.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf75.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf75.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf61.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf61.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf349.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf349.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf249.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf249.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf261.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf261.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf147.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf147.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf101.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf101.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf77.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf77.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf199.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf199.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf63.1.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf63.1.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Uses ping.exe to check the status of other devices and networks
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Source: zS0NQE8gev.exe, 00000001.00000002.4761472896.000000000274E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000003.4746455440.000000000274E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000003.4746735644.000000000274E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion
Source: zS0NQE8gev.exe, 00000001.00000002.4770209284.0000000003899000.00000004.00000020.00020000.00000000.sdmp, CriticalBreachDetected.pdf337.1.dr, CriticalBreachDetected.pdf217.1.dr, CriticalBreachDetected.pdf126.1.dr, CriticalBreachDetected.pdf359.1.dr, CriticalBreachDetected.pdf57.1.dr, CriticalBreachDetected.pdf277.1.dr, CriticalBreachDetected.pdf22.1.dr, CriticalBreachDetected.pdf131.1.dr, CriticalBreachDetected.pdf334.1.dr, CriticalBreachDetected.pdf160.1.dr, CriticalBreachDetected.pdf112.1.dr, CriticalBreachDetected.pdf12.1.dr, CriticalBreachDetected.pdf259.1.dr, CriticalBreachDetected.pdf.1.dr, CriticalBreachDetected.pdf232.1.dr, CriticalBreachDetected.pdf111.1.dr, CriticalBreachDetected.pdf292.1.dr, CriticalBreachDetected.pdf325.1.dr, CriticalBreachDetected.pdf243.1.dr, CriticalBreachDetected.pdf70.1.dr String found in binary or memory: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: zS0NQE8gev.exe, 00000001.00000002.4761472896.000000000274E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000003.4746455440.000000000274E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000003.4746735644.000000000274E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion
Source: zS0NQE8gev.exe, 00000001.00000002.4770209284.0000000003899000.00000004.00000020.00020000.00000000.sdmp, CriticalBreachDetected.pdf337.1.dr, CriticalBreachDetected.pdf217.1.dr, CriticalBreachDetected.pdf126.1.dr, CriticalBreachDetected.pdf359.1.dr, CriticalBreachDetected.pdf57.1.dr, CriticalBreachDetected.pdf277.1.dr, CriticalBreachDetected.pdf22.1.dr, CriticalBreachDetected.pdf131.1.dr, CriticalBreachDetected.pdf334.1.dr, CriticalBreachDetected.pdf160.1.dr, CriticalBreachDetected.pdf112.1.dr, CriticalBreachDetected.pdf12.1.dr, CriticalBreachDetected.pdf259.1.dr, CriticalBreachDetected.pdf.1.dr, CriticalBreachDetected.pdf232.1.dr, CriticalBreachDetected.pdf111.1.dr, CriticalBreachDetected.pdf292.1.dr, CriticalBreachDetected.pdf325.1.dr, CriticalBreachDetected.pdf243.1.dr, CriticalBreachDetected.pdf70.1.dr String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: Acrobat.exe, 0000000A.00000000.4676972418.00000173E8885000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.quicktime.com.Acrobat
Source: Acrobat.exe, 0000000A.00000000.4675850976.00000173E6E92000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api2.branch.io/v1/url
Source: Acrobat.exe, 0000000A.00000000.4677562738.00000173E8A73000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://ims-na1.adobelogin.com
Source: Acrobat.exe, 0000000A.00000000.4673475456.00000173E40D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?view=cm&fs=1&tf=1&su=
Source: Acrobat.exe, 0000000A.00000000.4673475456.00000173E40D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?view=cm&fs=1&tf=1&su=s
Source: Acrobat.exe, 0000000A.00000000.4673475456.00000173E40D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://outlook.office.com/mail/deeplink/compose?mailtouri=
Source: Acrobat.exe, 0000000A.00000002.4752491254.00000173E40FA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.whatsapp.com/send?text=
Installs a raw input device (often for capturing keystrokes)
Source: zS0NQE8gev.exe, 00000001.00000002.4770856741.0000000003A8D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _WinAPI_RegisterRawInputDevices.au3 memstr_eb2f11b2-2

Spam, unwanted Advertisements and Ransom Demands
barindex
Yara detected Rhysida Ransomware
Source: Yara match File source: Process Memory Space: zS0NQE8gev.exe PID: 7024, type: MEMORYSTR
Writes many files with high entropy
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png.rhysida entropy: 7.9919710203 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\uss-search\js\plugin.js.rhysida entropy: 7.9995788531 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\css\main.css.rhysida entropy: 7.99447575654 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\7-Zip\7-zip.chm.rhysida entropy: 7.99839734356 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\7-Zip\History.txt.rhysida entropy: 7.99701464097 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\7-Zip\7z.sfx.rhysida entropy: 7.99917376931 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\req_sign_ctip_gif.gif.rhysida entropy: 7.99912138699 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\dc_share_upsell_2x.png.rhysida entropy: 7.99101574367 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\dc_review_upsell_2x.png.rhysida entropy: 7.99023502044 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\faf-main.js.rhysida entropy: 7.99973266242 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\ui-strings.js.rhysida entropy: 7.99014117805 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\ui-strings.js.rhysida entropy: 7.99027952731 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\ro.pak.rhysida entropy: 7.99959911533 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\ui-strings.js.rhysida entropy: 7.99051352263 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\VisualElements\LogoDev.png.rhysida entropy: 7.99245532793 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\te.pak.rhysida entropy: 7.99937037679 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\VisualElements\Logo.png.rhysida entropy: 7.99401406554 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\sr.pak.rhysida entropy: 7.99971865187 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\uk.pak.rhysida entropy: 7.99975986723 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\ui-strings.js.rhysida entropy: 7.99206341426 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\nl.pak.rhysida entropy: 7.99955592689 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\zh-TW.pak.rhysida entropy: 7.99957808139 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\sl.pak.rhysida entropy: 7.99958346577 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\fa.pak.rhysida entropy: 7.99977656867 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\css\main.css.rhysida entropy: 7.9978445239 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\lv.pak.rhysida entropy: 7.99968564653 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\ja.pak.rhysida entropy: 7.99963202127 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\progress_spinner_dark2x.gif.rhysida entropy: 7.99389314331 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\hu.pak.rhysida entropy: 7.99962324652 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\pt-PT.pak.rhysida entropy: 7.99962403869 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\gu.pak.rhysida entropy: 7.99982148523 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\nb.pak.rhysida entropy: 7.99949003747 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Mozilla Firefox\browser\features\webcompat-reporter@mozilla.org.xpi.rhysida entropy: 7.99471649186 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png.rhysida entropy: 7.99211726261 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Mozilla Firefox\browser\features\formautofill@mozilla.org.xpi.rhysida entropy: 7.99858324559 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\fr.pak.rhysida entropy: 7.9996272438 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\progress_spinner2x.gif.rhysida entropy: 7.99530765004 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\en-US.pak.rhysida entropy: 7.99942021481 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\hr.pak.rhysida entropy: 7.99951997898 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi.rhysida entropy: 7.99950740733 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\bg.pak.rhysida entropy: 7.99976638435 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\en-GB.pak.rhysida entropy: 7.9994595416 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\da.pak.rhysida entropy: 7.99957467459 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\et.pak.rhysida entropy: 7.99957876819 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\ar.pak.rhysida entropy: 7.99971109944 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\license.html.rhysida entropy: 7.99517178596 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\license.html.rhysida entropy: 7.99427149746 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\license.html.rhysida entropy: 7.99475613805 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\license.html.rhysida entropy: 7.99494917733 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\cs.pak.rhysida entropy: 7.99956376811 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\license.html.rhysida entropy: 7.99491202396 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\license.html.rhysida entropy: 7.99437067003 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\license.html.rhysida entropy: 7.9943919137 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\license.html.rhysida entropy: 7.99310299658 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\license.html.rhysida entropy: 7.99488476858 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\license.html.rhysida entropy: 7.99375550668 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif.rhysida entropy: 7.99146066042 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\license.html.rhysida entropy: 7.9946205065 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\license.html.rhysida entropy: 7.9966319863 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\license.html.rhysida entropy: 7.99421358309 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\license.html.rhysida entropy: 7.99397465259 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\license.html.rhysida entropy: 7.99339887253 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\license.html.rhysida entropy: 7.99699798067 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\license.html.rhysida entropy: 7.99217549256 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\license.html.rhysida entropy: 7.99371538687 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\license.html.rhysida entropy: 7.99294341122 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Bold.eot.rhysida entropy: 7.99940931877 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\acrobat_pdf.svg.rhysida entropy: 7.99076026141 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Regular.eot.rhysida entropy: 7.99944658967 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Light.eot.rhysida entropy: 7.99947481358 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\PDFSigQFormalRep.pdf.rhysida entropy: 7.99958113986 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Bold.woff.rhysida entropy: 7.9985692301 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Regular.woff.rhysida entropy: 7.99871654974 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Light.woff.rhysida entropy: 7.99879684393 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\DataMatrix.pmp.rhysida entropy: 7.99965529647 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\AdobePDF417.pmp.rhysida entropy: 7.99825034484 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CompareMarkers.pdf.rhysida entropy: 7.99289051768 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\QRCode.pmp.rhysida entropy: 7.99744269587 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Accessibility.api.rhysida entropy: 7.9997636163 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\MSRMS.api.rhysida entropy: 7.99981286694 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\plugin.js.rhysida entropy: 7.99848745533 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\eBook.api.rhysida entropy: 7.99692354894 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PDDom.api.rhysida entropy: 7.99960053992 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\WindowsMedia.mpp.rhysida entropy: 7.99918337323 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\StorageConnectors.api.rhysida entropy: 7.99970599723 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Updater.api.rhysida entropy: 7.9989307396 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\2d.x3d.rhysida entropy: 7.9997827649 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\3difr.x3d.rhysida entropy: 7.99936467088 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\drvDX9.x3d.rhysida entropy: 7.9996237685 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\MyriadCAD.otf.rhysida entropy: 7.99753451254 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\tesselate.x3d.rhysida entropy: 7.99432910868 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\drvSOFT.x3d.rhysida entropy: 7.9989613434 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Spelling.api.rhysida entropy: 7.99958196284 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\weblink.api.rhysida entropy: 7.9994585178 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\Microsoft.VCLibs.x86.14.00.appx.rhysida entropy: 7.99971709625 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\reflow.api.rhysida entropy: 7.99967418681 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Search.api.rhysida entropy: 7.99969195453 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\css\main.css.rhysida entropy: 7.99634978569 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\ui-strings.js.rhysida entropy: 7.99288025037 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\es-es\ui-strings.js.rhysida entropy: 7.99080541173 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\fi-fi\ui-strings.js.rhysida entropy: 7.9902278387 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-ma\ui-strings.js.rhysida entropy: 7.99101159724 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_bow.png.rhysida entropy: 7.99508419316 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\ui-strings.js.rhysida entropy: 7.99061718569 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\ui-strings.js.rhysida entropy: 7.99237591381 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\ui-strings.js.rhysida entropy: 7.99271313834 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-readerRhp-chunk.js.rhysida entropy: 7.99239775691 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\tr-tr\ui-strings.js.rhysida entropy: 7.9907668004 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\ui-strings.js.rhysida entropy: 7.99314599922 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-filepicker-chunk.js.rhysida entropy: 7.99959826904 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\04ddbdff6396d98807bc0b6a4af1938c.png.rhysida entropy: 7.99080934038 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png.rhysida entropy: 7.99327907444 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_wob.png.rhysida entropy: 7.99593778666 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\Flash.mpp.rhysida entropy: 7.99889793534 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons_retina.png.rhysida entropy: 7.99092723556 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\4109-chunk.js.rhysida entropy: 7.99376126486 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\selector.js.rhysida entropy: 7.99183912283 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\plugin.js.rhysida entropy: 7.999303802 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\c6534465ea418b6c252e2b74bc9e4bbb.png.rhysida entropy: 7.99933685734 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9b1662bee64658ff8dd184737a056510.png.rhysida entropy: 7.997622721 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-ccxfeedback-popups-chunk.js.rhysida entropy: 7.99425032387 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\8172-chunk.js.rhysida entropy: 7.99719436871 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\92bfb68adb54a6ec950196b4d39ccf3e.png.rhysida entropy: 7.99457030044 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf.rhysida entropy: 7.99792868813 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\83bf4cfa63b712c6973a0d510a7b2c99.png.rhysida entropy: 7.99947928017 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\b961cde276c90015f1db51975a470747.png.rhysida entropy: 7.99110818855 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9216-chunk.js.rhysida entropy: 7.99480441965 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9488-chunk.js.rhysida entropy: 7.9925571094 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\7363-chunk.js.rhysida entropy: 7.99742717198 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6823bdac587ae224bf36689600281a69.png.rhysida entropy: 7.99046061114 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\7ec969a62598fbfa1ee1eb8827a0f2e5.png.rhysida entropy: 7.99872920531 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Faces.pdf.rhysida entropy: 7.99444540622 Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9066745ff44b689b5cc89c3d73970f01.png.rhysida entropy: 7.99861378906 Jump to dropped file
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0041D080 1_2_0041D080
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00425B70 1_2_00425B70
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0043D730 1_2_0043D730
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00449010 1_2_00449010
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_004248B0 1_2_004248B0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00442150 1_2_00442150
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00436170 1_2_00436170
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00438910 1_2_00438910
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00432190 1_2_00432190
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0042D9B0 1_2_0042D9B0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0041B270 1_2_0041B270
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00426A70 1_2_00426A70
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00425230 1_2_00425230
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00431770 1_2_00431770
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0044AB40 1_2_0044AB40
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0043F370 1_2_0043F370
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0042D600 1_2_0042D600
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0042FBF0 1_2_0042FBF0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00429BA0 1_2_00429BA0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_004243A0 1_2_004243A0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0043D3A0 1_2_0043D3A0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0041C3B0 1_2_0041C3B0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0043DC30 1_2_0043DC30
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00436C30 1_2_00436C30
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_004424C0 1_2_004424C0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00438480 1_2_00438480
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0044A480 1_2_0044A480
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00431C90 1_2_00431C90
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00436CA0 1_2_00436CA0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00442D00 1_2_00442D00
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0042D5E0 1_2_0042D5E0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0040E5F2 1_2_0040E5F2
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0042C5B0 1_2_0042C5B0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00433DB0 1_2_00433DB0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0042FEC0 1_2_0042FEC0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0043EEF0 1_2_0043EEF0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0041AEA0 1_2_0041AEA0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00431770 1_2_00431770
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_0043E730 1_2_0043E730
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: String function: 0041F640 appears 255 times
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: String function: 00449C80 appears 46 times
One or more processes crash
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1336 -s 1288
Source: classification engine Classification label: mal100.rans.troj.evad.winEXE@12/1030@0/1
Source: CriticalBreachDetected.pdf66.1.dr Initial sample: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/
Source: CriticalBreachDetected.pdf66.1.dr Initial sample: mailto:TericaFay@onionmail.org
Source: CriticalBreachDetected.pdf66.1.dr Initial sample: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/
Source: CriticalBreachDetected.pdf66.1.dr Initial sample: mailto:JamesMosciski@onionmail.org
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File created: C:\Program Files\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1336
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7080:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4488:120:WilError_03
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9qmdam3_14h75iz_114.tmp Jump to behavior
Source: zS0NQE8gev.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: zS0NQE8gev.exe ReversingLabs: Detection: 63%
Source: unknown Process created: C:\Users\user\Desktop\zS0NQE8gev.exe "C:\Users\user\Desktop\zS0NQE8gev.exe"
Source: unknown Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1336 -s 1288
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\zS0NQE8gev.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c start ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\PING.EXE Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\zS0NQE8gev.exe" Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" --type=renderer /prefetch:1 "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c start ping 127.0.0.1 -n 2 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE Section loaded: mswsock.dll
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\7-Zip\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\7-Zip\Lang\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\locales\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\swiftshader\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CAN\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\DEU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\FRA\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\JPN\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\UK\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ar_AE\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\cs_CZ\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\da_DK\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\el_GR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_AE\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_GB\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_IL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\es_ES\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\en_US\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\private\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\prod\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\stage\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\fonts\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\cef\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\libs\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\cef\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\libs\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\cef\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\libs\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\hi_contrast\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\microsoftGraph\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\2.1.15\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\misc\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themeless_Reader\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\ccpdf\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\themeless\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\CriticalBreachDetected.pdf Jump to behavior
Source: zS0NQE8gev.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: ntkrnlmp.pdb.rhysida9 source: zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb9 source: zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysida; source: zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysidaQ source: zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\*\*ttings\** source: zS0NQE8gev.exe, 00000001.00000002.4775786894.0000000003FD9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb source: zS0NQE8gev.exe, 00000001.00000002.4781490845.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4784625692.0000000004FE6000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4785483363.000000000509D000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775266209.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4781384027.0000000004D10000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4774615689.0000000003EF6000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787924898.0000000005360000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4777565550.0000000004161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780925771.0000000004C74000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773577718.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4781046475.0000000004CBA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786594328.000000000520A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773914067.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779073978.00000000042A9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773744884.0000000003E05000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783139119.0000000004E8E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780561321.0000000004BEA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:/Users/user/Local Settings/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/winload_prod.pdb.rhysidaf# source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysida_ source: zS0NQE8gev.exe, 00000001.00000002.4787924898.0000000005360000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.rhysidad.pdfs source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysida` source: zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdboreut source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb^` source: zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysidaV source: zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\* source: zS0NQE8gev.exe, 00000001.00000002.4775786894.0000000003FD9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb"` source: zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysida] source: zS0NQE8gev.exe, 00000001.00000002.4786594328.000000000520A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb't source: zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb( source: zS0NQE8gev.exe, 00000001.00000002.4773744884.0000000003E05000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb! source: zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbd*o source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb`UZ source: zS0NQE8gev.exe, 00000001.00000002.4781046475.0000000004CBA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysida5\ source: zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb- source: zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysida source: zS0NQE8gev.exe, 00000001.00000002.4786025014.0000000005135000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4778311402.000000000420F000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787829877.000000000533C000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4784842203.000000000500A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783735083.0000000004F41000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4788103668.00000000053B8000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775786894.0000000003FD9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787290628.00000000052E2000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779148998.00000000042BB000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4772943245.0000000003CE9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780925771.0000000004C74000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4776682075.000000000409D000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783041880.0000000004E7C000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779674447.0000000004B30000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786666266.000000000521C000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4777331289.000000000412B000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4785399161.0000000005079000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4782312977.0000000004E0C000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780444300.0000000004BD3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb; source: zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb5 source: zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\Videos.pdbx134kWQ source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb source: zS0NQE8gev.exe, 00000001.00000002.4781490845.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4784625692.0000000004FE6000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4785483363.000000000509D000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775266209.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4781384027.0000000004D10000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787924898.0000000005360000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4777565550.0000000004161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780925771.0000000004C74000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773577718.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4781046475.0000000004CBA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786594328.000000000520A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773914067.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779073978.00000000042A9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773744884.0000000003E05000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783139119.0000000004E8E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780561321.0000000004BEA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb_Z source: zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysidad source: zS0NQE8gev.exe, 00000001.00000002.4783735083.0000000004F41000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbz source: zS0NQE8gev.exe, 00000001.00000002.4777565550.0000000004161000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbB` source: zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysidaf source: zS0NQE8gev.exe, 00000001.00000002.4772943245.0000000003CE9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.U source: zS0NQE8gev.exe, 00000001.00000002.4781046475.0000000004CBA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbP source: zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysidax source: zS0NQE8gev.exe, 00000001.00000002.4777331289.000000000412B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysiday source: zS0NQE8gev.exe, 00000001.00000002.4785399161.0000000005079000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbAZ source: zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysidaA t source: zS0NQE8gev.exe, 00000001.00000002.4779073978.00000000042A9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysida(ls source: zS0NQE8gev.exe, 00000001.00000002.4775786894.0000000003FD9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb?\ source: zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: zS0NQE8gev.exe, 00000001.00000002.4772943245.0000000003CE9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbX source: zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbY source: zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\CriticalBreachDetected.pdfC source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb_tw source: zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb^ source: zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb=\ source: zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbi source: zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb` source: zS0NQE8gev.exe, 00000001.00000002.4775266209.0000000003F72000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:/Users/user/Local Settings/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/CriticalBreachDetected.pdf source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.rhysidaafa: source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysida source: zS0NQE8gev.exe, 00000001.00000002.4784625692.0000000004FE6000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4785483363.000000000509D000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787924898.0000000005360000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4777565550.0000000004161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780925771.0000000004C74000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786594328.000000000520A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779073978.00000000042A9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783139119.0000000004E8E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780561321.0000000004BEA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.rhysidapdfc source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbl source: zS0NQE8gev.exe, 00000001.00000002.4775266209.0000000003F72000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\CriticalBreachDetected.pdfff source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*e\*\**{f= source: zS0NQE8gev.exe, 00000001.00000002.4772943245.0000000003CE9000.00000004.00000020.00020000.00000000.sdmp
PE file contains sections with non-standard names
Source: zS0NQE8gev.exe Static PE information: section name: .xdata

Hooking and other Techniques for Hiding and Protection
barindex
Self deletion via cmd or bat file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Process created: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\zS0NQE8gev.exe"
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Process created: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\zS0NQE8gev.exe" Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Acrobat.exe, 0000000A.00000002.4752491254.00000173E4080000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ASWHOOK.DLL
Uses ping.exe to sleep
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-client-migration-replacement.man Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-drivers-migration-replacement.man Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-migration-replacement.man Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Window / User API: threadDelayed 6081 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\zS0NQE8gev.exe TID: 5204 Thread sleep count: 6081 > 30 Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe TID: 5204 Thread sleep time: -60810s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe TID: 7124 Thread sleep count: 260 > 30 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_004196E5 GetSystemInfo,GetSystemInfo,malloc,malloc,Sleep,Sleep,free,free,free,system, 1_2_004196E5
Source: zS0NQE8gev.exe, 00000001.00000002.4762537425.0000000003358000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: microsoft-hyper-v-drivers-migration-replacement.man'
Source: zS0NQE8gev.exe, 00000001.00000002.4762537425.0000000003358000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: microsoft-hyper-v-migration-replacement.man
Source: zS0NQE8gev.exe, 00000001.00000002.4762537425.0000000003358000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: microsoft-hyper-v-migration-replacement.manhysida
Source: zS0NQE8gev.exe, 00000001.00000002.4762537425.0000000003358000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: microsoft-hyper-v-client-migration-replacement.man
Source: zS0NQE8gev.exe, 00000001.00000002.4762537425.0000000003358000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: microsoft-hyper-v-drivers-migration-replacement.man
Source: zS0NQE8gev.exe, 00000001.00000002.4762537425.0000000003358000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: microsoft-hyper-v-client-migration-replacement.mansida
Source: Acrobat.exe, 0000000A.00000000.4677604206.00000173E8A8B000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll!
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Found API chain indicative of debugger detection
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00445A90 IsDebuggerPresent,RaiseException, 1_2_00445A90
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_004011B0 Sleep,Sleep,SetUnhandledExceptionFilter,GetStartupInfoA, 1_2_004011B0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00447CF0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_00447CF0
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\zS0NQE8gev.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c start ping 127.0.0.1 -n 2 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Source: Acrobat.exe, 0000000A.00000002.4754374061.00000173E4AA0000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4674572441.00000173E4AA1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: IProgram Manager
Source: Acrobat.exe, 0000000A.00000002.4754374061.00000173E4AA0000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4674572441.00000173E4AA1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: Acrobat.exe, 0000000A.00000002.4754374061.00000173E4AA0000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4674572441.00000173E4AA1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: Acrobat.exe, 0000000A.00000002.4754374061.00000173E4AA0000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4674572441.00000173E4AA1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: C:\Users\user\Desktop\zS0NQE8gev.exe Code function: 1_2_00445C60 GetSystemTimeAsFileTime, 1_2_00445C60
AV process strings found (often used to terminate AV products)
Source: zS0NQE8gev.exe, 00000001.00000002.4773173371.0000000003D22000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4772475212.0000000003C59000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4772681968.0000000003CA3000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4772865323.0000000003CD7000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4772632578.0000000003C91000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4771961063.0000000003BB0000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4772182827.0000000003C08000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4772048094.0000000003BCB000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4772943245.0000000003CE9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4770367349.0000000003954000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: MsMpEng.exe
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1524359 Sample: zS0NQE8gev.exe Startdate: 02/10/2024 Architecture: WINDOWS Score: 100 46 Antivirus / Scanner detection for submitted sample 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected Rhysida Ransomware 2->50 52 3 other signatures 2->52 9 zS0NQE8gev.exe 1001 2->9         started        13 Acrobat.exe 2->13 injected 15 Acrobat.exe 38 2->15         started        process3 file4 32 C:\...\AdobeClean-Regular.eot.rhysida, DOS 9->32 dropped 34 C:\Program Files\...\license.html.rhysida, COM 9->34 dropped 36 C:\...\webcompat@mozilla.org.xpi.rhysida, data 9->36 dropped 38 137 other files (130 malicious) 9->38 dropped 56 Found Tor onion address 9->56 58 Self deletion via cmd or bat file 9->58 60 Found API chain indicative of debugger detection 9->60 62 Writes many files with high entropy 9->62 17 cmd.exe 1 9->17         started        64 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 13->64 20 WerFault.exe 21 13->20         started        signatures5 process6 signatures7 42 Uses ping.exe to sleep 17->42 44 Uses ping.exe to check the status of other devices and networks 17->44 22 cmd.exe 17->22         started        25 conhost.exe 17->25         started        process8 signatures9 54 Uses ping.exe to sleep 22->54 27 PING.EXE 22->27         started        process10 dnsIp11 40 127.0.0.1 unknown unknown 27->40 30 conhost.exe 27->30         started        process12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious

Private

IP
127.0.0.1