Edit tour

Windows Analysis Report
zS0NQE8gev.exe

Overview

General Information

Sample name:	zS0NQE8gev.exe renamed because original name is a hash value
Original sample name:	5b3a0b1b89ca463f56984cf67ea1719f1ddee770d1e14438e3fcf9b5301f2c83.exe
Analysis ID:	1524359
MD5:	d86383882515b7a9218d5f69924feadf
SHA1:	31183640972f2bc2e6906a271a88344201d37e4d
SHA256:	5b3a0b1b89ca463f56984cf67ea1719f1ddee770d1e14438e3fcf9b5301f2c83
Tags:	exeRhysidauser-JAMESWT_MHT
Infos:

Detection

Rhysida

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Rhysida Ransomware

AI detected suspicious sample

Found API chain indicative of debugger detection

Found Tor onion address

Self deletion via cmd or bat file

Sigma detected: Suspicious Ping/Del Command Combination

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

zS0NQE8gev.exe (PID: 7024 cmdline: "C:\Users\user\Desktop\zS0NQE8gev.exe" MD5: D86383882515B7A9218D5F69924FEADF)

cmd.exe (PID: 4148 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\zS0NQE8gev.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5276 cmdline: cmd.exe /c start ping 127.0.0.1 -n 2 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

PING.EXE (PID: 7140 cmdline: ping 127.0.0.1 -n 2 MD5: 2F46799D79D22AC72C241EC0322B011D)

conhost.exe (PID: 4488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 4948 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

Acrobat.exe (PID: 1336 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" --type=renderer /prefetch:1 "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

WerFault.exe (PID: 4852 cmdline: C:\Windows\system32\WerFault.exe -u -p 1336 -s 1288 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Rhysida		No Attribution	https://blog.talosintelligence.com/rhysida-ransomware/ https://decoded.avast.io/threatresearch/rhysida-ransomware-technical-analysis/ https://detect.fyi/rhysida-ransomware-and-the-detection-opportunities-3599e9a02bb2 https://fourcore.io/blogs/rhysida-ransomware-history-ttp-adversary-emulation https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhysida

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: zS0NQE8gev.exe PID: 7024	JoeSecurity_rhysida	Yara detected Rhysida Ransomware	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Ping/Del Command Combination

Source: Process started

Author: Ilya Krestinichev: Data: Command: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\zS0NQE8gev.exe", CommandLine: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\zS0NQE8gev.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\zS0NQE8gev.exe", ParentImage: C:\Users\user\Desktop\zS0NQE8gev.exe, ParentProcessId: 7024, ParentProcessName: zS0NQE8gev.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\zS0NQE8gev.exe", ProcessId: 4148, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: zS0NQE8gev.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: zS0NQE8gev.exe

ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Source: C:\Users\user\Desktop\zS0NQE8gev.exe

Code function: 1_2_0043E2E1 CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptAcquireContextA,

1_2_0043E2E1

Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\7-Zip\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\7-Zip\Lang\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\locales\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\swiftshader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CAN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\DEU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\FRA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\JPN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\UK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ar_AE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\cs_CZ\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\da_DK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\el_GR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_AE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_GB\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_IL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\es_ES\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\en_US\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\private\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\prod\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\stage\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\fonts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\hi_contrast\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\microsoftGraph\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\2.1.15\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\misc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themeless_Reader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\ccpdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\themeless\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\CriticalBreachDetected.pdf	Jump to behavior

Source: zS0NQE8gev.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ntkrnlmp.pdb.rhysida9 source: zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb9 source: zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida; source: zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaQ source: zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\\ttings\** source: zS0NQE8gev.exe, 00000001.00000002.4775786894.0000000003FD9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: zS0NQE8gev.exe, 00000001.00000002.4781490845.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4784625692.0000000004FE6000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4785483363.000000000509D000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775266209.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4781384027.0000000004D10000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4774615689.0000000003EF6000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787924898.0000000005360000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4777565550.0000000004161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780925771.0000000004C74000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773577718.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4781046475.0000000004CBA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786594328.000000000520A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773914067.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779073978.00000000042A9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773744884.0000000003E05000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783139119.0000000004E8E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780561321.0000000004BEA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user/Local Settings/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/winload_prod.pdb.rhysidaf# source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida_ source: zS0NQE8gev.exe, 00000001.00000002.4787924898.0000000005360000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.rhysidad.pdfs source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida` source: zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdboreut source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb^` source: zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaV source: zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\* source: zS0NQE8gev.exe, 00000001.00000002.4775786894.0000000003FD9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb"` source: zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida] source: zS0NQE8gev.exe, 00000001.00000002.4786594328.000000000520A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb't source: zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb( source: zS0NQE8gev.exe, 00000001.00000002.4773744884.0000000003E05000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb! source: zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbd*o source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb`UZ source: zS0NQE8gev.exe, 00000001.00000002.4781046475.0000000004CBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida5\ source: zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb- source: zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysida source: zS0NQE8gev.exe, 00000001.00000002.4786025014.0000000005135000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4778311402.000000000420F000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787829877.000000000533C000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4784842203.000000000500A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783735083.0000000004F41000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4788103668.00000000053B8000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775786894.0000000003FD9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787290628.00000000052E2000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779148998.00000000042BB000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4772943245.0000000003CE9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780925771.0000000004C74000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4776682075.000000000409D000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783041880.0000000004E7C000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779674447.0000000004B30000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786666266.000000000521C000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4777331289.000000000412B000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4785399161.0000000005079000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4782312977.0000000004E0C000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780444300.0000000004BD3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb; source: zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb5 source: zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Videos.pdbx134kWQ source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: zS0NQE8gev.exe, 00000001.00000002.4781490845.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4784625692.0000000004FE6000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4785483363.000000000509D000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775266209.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4781384027.0000000004D10000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787924898.0000000005360000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4777565550.0000000004161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780925771.0000000004C74000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773577718.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4781046475.0000000004CBA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786594328.000000000520A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773914067.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779073978.00000000042A9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773744884.0000000003E05000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783139119.0000000004E8E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780561321.0000000004BEA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb_Z source: zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidad source: zS0NQE8gev.exe, 00000001.00000002.4783735083.0000000004F41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbz source: zS0NQE8gev.exe, 00000001.00000002.4777565550.0000000004161000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbB` source: zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidaf source: zS0NQE8gev.exe, 00000001.00000002.4772943245.0000000003CE9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.U source: zS0NQE8gev.exe, 00000001.00000002.4781046475.0000000004CBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbP source: zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidax source: zS0NQE8gev.exe, 00000001.00000002.4777331289.000000000412B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysiday source: zS0NQE8gev.exe, 00000001.00000002.4785399161.0000000005079000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbAZ source: zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaA t source: zS0NQE8gev.exe, 00000001.00000002.4779073978.00000000042A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysida(ls source: zS0NQE8gev.exe, 00000001.00000002.4775786894.0000000003FD9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb?\ source: zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: zS0NQE8gev.exe, 00000001.00000002.4772943245.0000000003CE9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbX source: zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbY source: zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\CriticalBreachDetected.pdfC source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb_tw source: zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb^ source: zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb=\ source: zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbi source: zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb` source: zS0NQE8gev.exe, 00000001.00000002.4775266209.0000000003F72000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user/Local Settings/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/CriticalBreachDetected.pdf source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.rhysidaafa: source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida source: zS0NQE8gev.exe, 00000001.00000002.4784625692.0000000004FE6000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4785483363.000000000509D000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787924898.0000000005360000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4777565550.0000000004161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780925771.0000000004C74000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786594328.000000000520A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779073978.00000000042A9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783139119.0000000004E8E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780561321.0000000004BEA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.rhysidapdfc source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbl source: zS0NQE8gev.exe, 00000001.00000002.4775266209.0000000003F72000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\CriticalBreachDetected.pdfff source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\\**{f= source: zS0NQE8gev.exe, 00000001.00000002.4772943245.0000000003CE9000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 4x nop then jmp 00430810h	1_2_0041E220
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 4x nop then lea r8, qword ptr [00000000004D9AE0h]	1_2_0042BD50
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 4x nop then lea r8, qword ptr [00000000004D90A0h]	1_2_00428DA0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 4x nop then lea r8, qword ptr [00000000004DA100h]	1_2_0042CF10

Networking

Found Tor onion address

Source: zS0NQE8gev.exe, 00000001.00000002.4761472896.000000000274E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion
Source: zS0NQE8gev.exe, 00000001.00000002.4761472896.000000000274E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion
Source: zS0NQE8gev.exe, 00000001.00000002.4770209284.0000000003899000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: zS0NQE8gev.exe, 00000001.00000002.4770209284.0000000003899000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: zS0NQE8gev.exe, 00000001.00000003.4746455440.000000000274E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion
Source: zS0NQE8gev.exe, 00000001.00000003.4746455440.000000000274E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion
Source: zS0NQE8gev.exe, 00000001.00000003.4746735644.000000000274E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion
Source: zS0NQE8gev.exe, 00000001.00000003.4746735644.000000000274E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion
Source: CriticalBreachDetected.pdf337.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf337.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf217.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf217.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf126.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf126.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf359.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf359.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf57.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf57.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf277.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf277.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf22.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf22.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf131.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf131.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf334.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf334.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf160.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf160.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf112.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf112.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf12.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf12.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf259.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf259.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf232.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf232.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf111.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf111.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf292.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf292.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf325.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf325.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf243.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf243.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf70.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf70.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf7.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf7.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf41.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf41.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf38.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf38.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf239.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf239.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf59.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf59.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf4.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf4.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf188.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf188.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf98.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf98.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf308.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf308.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf213.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf213.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf286.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf286.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf43.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf43.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf323.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf323.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf173.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf173.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf200.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf200.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf171.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf171.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf298.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf298.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf83.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf83.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf181.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf181.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf242.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf242.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf81.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf81.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf225.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf225.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf23.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf23.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf246.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf246.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf228.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf228.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf344.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf344.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf360.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf360.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf326.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf326.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf11.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf11.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf165.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf165.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf247.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf247.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf351.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf351.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf47.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf47.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf220.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf220.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf267.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf267.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf118.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf118.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf93.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf93.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf260.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf260.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf133.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf133.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf24.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf24.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf231.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf231.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf65.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf65.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf78.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf78.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf214.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf214.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf245.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf245.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf258.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf258.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf355.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf355.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf321.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf321.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf139.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf139.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf175.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf175.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf194.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf194.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf67.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf67.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf109.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf109.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf336.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf336.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf178.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf178.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf297.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf297.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf120.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf120.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf209.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf209.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf75.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf75.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf61.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf61.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf349.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf349.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf249.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf249.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf261.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf261.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf147.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf147.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf101.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf101.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf77.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf77.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf199.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf199.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf63.1.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf63.1.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2

Source: zS0NQE8gev.exe, 00000001.00000002.4761472896.000000000274E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000003.4746455440.000000000274E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000003.4746735644.000000000274E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion
Source: zS0NQE8gev.exe, 00000001.00000002.4770209284.0000000003899000.00000004.00000020.00020000.00000000.sdmp, CriticalBreachDetected.pdf337.1.dr, CriticalBreachDetected.pdf217.1.dr, CriticalBreachDetected.pdf126.1.dr, CriticalBreachDetected.pdf359.1.dr, CriticalBreachDetected.pdf57.1.dr, CriticalBreachDetected.pdf277.1.dr, CriticalBreachDetected.pdf22.1.dr, CriticalBreachDetected.pdf131.1.dr, CriticalBreachDetected.pdf334.1.dr, CriticalBreachDetected.pdf160.1.dr, CriticalBreachDetected.pdf112.1.dr, CriticalBreachDetected.pdf12.1.dr, CriticalBreachDetected.pdf259.1.dr, CriticalBreachDetected.pdf.1.dr, CriticalBreachDetected.pdf232.1.dr, CriticalBreachDetected.pdf111.1.dr, CriticalBreachDetected.pdf292.1.dr, CriticalBreachDetected.pdf325.1.dr, CriticalBreachDetected.pdf243.1.dr, CriticalBreachDetected.pdf70.1.dr	String found in binary or memory: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: zS0NQE8gev.exe, 00000001.00000002.4761472896.000000000274E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000003.4746455440.000000000274E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000003.4746735644.000000000274E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion
Source: zS0NQE8gev.exe, 00000001.00000002.4770209284.0000000003899000.00000004.00000020.00020000.00000000.sdmp, CriticalBreachDetected.pdf337.1.dr, CriticalBreachDetected.pdf217.1.dr, CriticalBreachDetected.pdf126.1.dr, CriticalBreachDetected.pdf359.1.dr, CriticalBreachDetected.pdf57.1.dr, CriticalBreachDetected.pdf277.1.dr, CriticalBreachDetected.pdf22.1.dr, CriticalBreachDetected.pdf131.1.dr, CriticalBreachDetected.pdf334.1.dr, CriticalBreachDetected.pdf160.1.dr, CriticalBreachDetected.pdf112.1.dr, CriticalBreachDetected.pdf12.1.dr, CriticalBreachDetected.pdf259.1.dr, CriticalBreachDetected.pdf.1.dr, CriticalBreachDetected.pdf232.1.dr, CriticalBreachDetected.pdf111.1.dr, CriticalBreachDetected.pdf292.1.dr, CriticalBreachDetected.pdf325.1.dr, CriticalBreachDetected.pdf243.1.dr, CriticalBreachDetected.pdf70.1.dr	String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: Acrobat.exe, 0000000A.00000000.4676972418.00000173E8885000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.quicktime.com.Acrobat
Source: Acrobat.exe, 0000000A.00000000.4675850976.00000173E6E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api2.branch.io/v1/url
Source: Acrobat.exe, 0000000A.00000000.4677562738.00000173E8A73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ims-na1.adobelogin.com
Source: Acrobat.exe, 0000000A.00000000.4673475456.00000173E40D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?view=cm&fs=1&tf=1&su=
Source: Acrobat.exe, 0000000A.00000000.4673475456.00000173E40D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?view=cm&fs=1&tf=1&su=s
Source: Acrobat.exe, 0000000A.00000000.4673475456.00000173E40D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office.com/mail/deeplink/compose?mailtouri=
Source: Acrobat.exe, 0000000A.00000002.4752491254.00000173E40FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.whatsapp.com/send?text=

Source: zS0NQE8gev.exe, 00000001.00000002.4770856741.0000000003A8D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: _WinAPI_RegisterRawInputDevices.au3

memstr_eb2f11b2-2

Spam, unwanted Advertisements and Ransom Demands

Yara detected Rhysida Ransomware

Source: Yara match

File source: Process Memory Space: zS0NQE8gev.exe PID: 7024, type: MEMORYSTR

Writes many files with high entropy

Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png.rhysida entropy: 7.9919710203	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\uss-search\js\plugin.js.rhysida entropy: 7.9995788531	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\css\main.css.rhysida entropy: 7.99447575654	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\7-Zip\7-zip.chm.rhysida entropy: 7.99839734356	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\7-Zip\History.txt.rhysida entropy: 7.99701464097	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\7-Zip\7z.sfx.rhysida entropy: 7.99917376931	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\req_sign_ctip_gif.gif.rhysida entropy: 7.99912138699	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\dc_share_upsell_2x.png.rhysida entropy: 7.99101574367	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\dc_review_upsell_2x.png.rhysida entropy: 7.99023502044	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\faf-main.js.rhysida entropy: 7.99973266242	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\ui-strings.js.rhysida entropy: 7.99014117805	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\ui-strings.js.rhysida entropy: 7.99027952731	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\ro.pak.rhysida entropy: 7.99959911533	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\ui-strings.js.rhysida entropy: 7.99051352263	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\VisualElements\LogoDev.png.rhysida entropy: 7.99245532793	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\te.pak.rhysida entropy: 7.99937037679	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\VisualElements\Logo.png.rhysida entropy: 7.99401406554	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\sr.pak.rhysida entropy: 7.99971865187	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\uk.pak.rhysida entropy: 7.99975986723	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\ui-strings.js.rhysida entropy: 7.99206341426	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\nl.pak.rhysida entropy: 7.99955592689	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\zh-TW.pak.rhysida entropy: 7.99957808139	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\sl.pak.rhysida entropy: 7.99958346577	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\fa.pak.rhysida entropy: 7.99977656867	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\css\main.css.rhysida entropy: 7.9978445239	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\lv.pak.rhysida entropy: 7.99968564653	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\ja.pak.rhysida entropy: 7.99963202127	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\progress_spinner_dark2x.gif.rhysida entropy: 7.99389314331	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\hu.pak.rhysida entropy: 7.99962324652	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\pt-PT.pak.rhysida entropy: 7.99962403869	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\gu.pak.rhysida entropy: 7.99982148523	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\nb.pak.rhysida entropy: 7.99949003747	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Mozilla Firefox\browser\features\webcompat-reporter@mozilla.org.xpi.rhysida entropy: 7.99471649186	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png.rhysida entropy: 7.99211726261	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Mozilla Firefox\browser\features\formautofill@mozilla.org.xpi.rhysida entropy: 7.99858324559	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\fr.pak.rhysida entropy: 7.9996272438	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\progress_spinner2x.gif.rhysida entropy: 7.99530765004	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\en-US.pak.rhysida entropy: 7.99942021481	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\hr.pak.rhysida entropy: 7.99951997898	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi.rhysida entropy: 7.99950740733	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\bg.pak.rhysida entropy: 7.99976638435	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\en-GB.pak.rhysida entropy: 7.9994595416	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\da.pak.rhysida entropy: 7.99957467459	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\et.pak.rhysida entropy: 7.99957876819	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\ar.pak.rhysida entropy: 7.99971109944	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\license.html.rhysida entropy: 7.99517178596	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\license.html.rhysida entropy: 7.99427149746	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\license.html.rhysida entropy: 7.99475613805	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\license.html.rhysida entropy: 7.99494917733	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\cs.pak.rhysida entropy: 7.99956376811	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\license.html.rhysida entropy: 7.99491202396	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\license.html.rhysida entropy: 7.99437067003	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\license.html.rhysida entropy: 7.9943919137	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\license.html.rhysida entropy: 7.99310299658	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\license.html.rhysida entropy: 7.99488476858	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\license.html.rhysida entropy: 7.99375550668	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif.rhysida entropy: 7.99146066042	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\license.html.rhysida entropy: 7.9946205065	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\license.html.rhysida entropy: 7.9966319863	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\license.html.rhysida entropy: 7.99421358309	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\license.html.rhysida entropy: 7.99397465259	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\license.html.rhysida entropy: 7.99339887253	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\license.html.rhysida entropy: 7.99699798067	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\license.html.rhysida entropy: 7.99217549256	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\license.html.rhysida entropy: 7.99371538687	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\license.html.rhysida entropy: 7.99294341122	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Bold.eot.rhysida entropy: 7.99940931877	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\acrobat_pdf.svg.rhysida entropy: 7.99076026141	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Regular.eot.rhysida entropy: 7.99944658967	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Light.eot.rhysida entropy: 7.99947481358	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\PDFSigQFormalRep.pdf.rhysida entropy: 7.99958113986	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Bold.woff.rhysida entropy: 7.9985692301	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Regular.woff.rhysida entropy: 7.99871654974	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Light.woff.rhysida entropy: 7.99879684393	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\DataMatrix.pmp.rhysida entropy: 7.99965529647	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\AdobePDF417.pmp.rhysida entropy: 7.99825034484	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CompareMarkers.pdf.rhysida entropy: 7.99289051768	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\QRCode.pmp.rhysida entropy: 7.99744269587	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Accessibility.api.rhysida entropy: 7.9997636163	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\MSRMS.api.rhysida entropy: 7.99981286694	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\plugin.js.rhysida entropy: 7.99848745533	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\eBook.api.rhysida entropy: 7.99692354894	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PDDom.api.rhysida entropy: 7.99960053992	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\WindowsMedia.mpp.rhysida entropy: 7.99918337323	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\StorageConnectors.api.rhysida entropy: 7.99970599723	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Updater.api.rhysida entropy: 7.9989307396	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\2d.x3d.rhysida entropy: 7.9997827649	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\3difr.x3d.rhysida entropy: 7.99936467088	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\drvDX9.x3d.rhysida entropy: 7.9996237685	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\MyriadCAD.otf.rhysida entropy: 7.99753451254	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\tesselate.x3d.rhysida entropy: 7.99432910868	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\drvSOFT.x3d.rhysida entropy: 7.9989613434	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Spelling.api.rhysida entropy: 7.99958196284	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\weblink.api.rhysida entropy: 7.9994585178	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\Microsoft.VCLibs.x86.14.00.appx.rhysida entropy: 7.99971709625	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\reflow.api.rhysida entropy: 7.99967418681	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Search.api.rhysida entropy: 7.99969195453	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\css\main.css.rhysida entropy: 7.99634978569	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\ui-strings.js.rhysida entropy: 7.99288025037	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\es-es\ui-strings.js.rhysida entropy: 7.99080541173	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\fi-fi\ui-strings.js.rhysida entropy: 7.9902278387	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-ma\ui-strings.js.rhysida entropy: 7.99101159724	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_bow.png.rhysida entropy: 7.99508419316	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\ui-strings.js.rhysida entropy: 7.99061718569	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\ui-strings.js.rhysida entropy: 7.99237591381	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\ui-strings.js.rhysida entropy: 7.99271313834	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-readerRhp-chunk.js.rhysida entropy: 7.99239775691	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\tr-tr\ui-strings.js.rhysida entropy: 7.9907668004	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\ui-strings.js.rhysida entropy: 7.99314599922	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-filepicker-chunk.js.rhysida entropy: 7.99959826904	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\04ddbdff6396d98807bc0b6a4af1938c.png.rhysida entropy: 7.99080934038	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png.rhysida entropy: 7.99327907444	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_wob.png.rhysida entropy: 7.99593778666	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\Flash.mpp.rhysida entropy: 7.99889793534	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons_retina.png.rhysida entropy: 7.99092723556	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\4109-chunk.js.rhysida entropy: 7.99376126486	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\selector.js.rhysida entropy: 7.99183912283	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\plugin.js.rhysida entropy: 7.999303802	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\c6534465ea418b6c252e2b74bc9e4bbb.png.rhysida entropy: 7.99933685734	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9b1662bee64658ff8dd184737a056510.png.rhysida entropy: 7.997622721	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-ccxfeedback-popups-chunk.js.rhysida entropy: 7.99425032387	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\8172-chunk.js.rhysida entropy: 7.99719436871	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\92bfb68adb54a6ec950196b4d39ccf3e.png.rhysida entropy: 7.99457030044	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf.rhysida entropy: 7.99792868813	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\83bf4cfa63b712c6973a0d510a7b2c99.png.rhysida entropy: 7.99947928017	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\b961cde276c90015f1db51975a470747.png.rhysida entropy: 7.99110818855	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9216-chunk.js.rhysida entropy: 7.99480441965	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9488-chunk.js.rhysida entropy: 7.9925571094	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\7363-chunk.js.rhysida entropy: 7.99742717198	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6823bdac587ae224bf36689600281a69.png.rhysida entropy: 7.99046061114	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\7ec969a62598fbfa1ee1eb8827a0f2e5.png.rhysida entropy: 7.99872920531	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Faces.pdf.rhysida entropy: 7.99444540622	Jump to dropped file
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9066745ff44b689b5cc89c3d73970f01.png.rhysida entropy: 7.99861378906	Jump to dropped file

Source: C:\Users\user\Desktop\zS0NQE8gev.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_0041D080	1_2_0041D080
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_00425B70	1_2_00425B70
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_0043D730	1_2_0043D730
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_00449010	1_2_00449010
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_004248B0	1_2_004248B0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_00442150	1_2_00442150
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_00436170	1_2_00436170
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_00438910	1_2_00438910
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_00432190	1_2_00432190
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_0042D9B0	1_2_0042D9B0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_0041B270	1_2_0041B270
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_00426A70	1_2_00426A70
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_00425230	1_2_00425230
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_00431770	1_2_00431770
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_0044AB40	1_2_0044AB40
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_0043F370	1_2_0043F370
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_0042D600	1_2_0042D600
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_0042FBF0	1_2_0042FBF0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_00429BA0	1_2_00429BA0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_004243A0	1_2_004243A0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_0043D3A0	1_2_0043D3A0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_0041C3B0	1_2_0041C3B0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_0043DC30	1_2_0043DC30
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_00436C30	1_2_00436C30
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_004424C0	1_2_004424C0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_00438480	1_2_00438480
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_0044A480	1_2_0044A480
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_00431C90	1_2_00431C90
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_00436CA0	1_2_00436CA0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_00442D00	1_2_00442D00
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_0042D5E0	1_2_0042D5E0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_0040E5F2	1_2_0040E5F2
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_0042C5B0	1_2_0042C5B0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_00433DB0	1_2_00433DB0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_0042FEC0	1_2_0042FEC0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_0043EEF0	1_2_0043EEF0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_0041AEA0	1_2_0041AEA0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_00431770	1_2_00431770
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_0043E730	1_2_0043E730

Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: String function: 0041F640 appears 255 times
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: String function: 00449C80 appears 46 times

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1336 -s 1288

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@12/1030@0/1

Source: CriticalBreachDetected.pdf66.1.dr	Initial sample: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/
Source: CriticalBreachDetected.pdf66.1.dr	Initial sample: mailto:TericaFay@onionmail.org
Source: CriticalBreachDetected.pdf66.1.dr	Initial sample: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/
Source: CriticalBreachDetected.pdf66.1.dr	Initial sample: mailto:JamesMosciski@onionmail.org

Source: C:\Users\user\Desktop\zS0NQE8gev.exe

File created: C:\Program Files\CriticalBreachDetected.pdf

Jump to behavior

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1336
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7080:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4488:120:WilError_03

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9qmdam3_14h75iz_114.tmp

Jump to behavior

Source: zS0NQE8gev.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\zS0NQE8gev.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: zS0NQE8gev.exe

ReversingLabs: Detection: 63%

Source: unknown	Process created: C:\Users\user\Desktop\zS0NQE8gev.exe "C:\Users\user\Desktop\zS0NQE8gev.exe"
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1336 -s 1288
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\zS0NQE8gev.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\PING.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\zS0NQE8gev.exe"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" --type=renderer /prefetch:1 "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2

Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\7-Zip\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\7-Zip\Lang\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\locales\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\swiftshader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CAN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\DEU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\FRA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\JPN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\UK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ar_AE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\cs_CZ\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\da_DK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\el_GR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_AE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_GB\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_IL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\es_ES\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\en_US\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\private\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\prod\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\stage\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\fonts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\hi_contrast\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\microsoftGraph\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\2.1.15\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\misc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themeless_Reader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\ccpdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\themeless\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\CriticalBreachDetected.pdf	Jump to behavior

Source: zS0NQE8gev.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ntkrnlmp.pdb.rhysida9 source: zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb9 source: zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida; source: zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaQ source: zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\\ttings\** source: zS0NQE8gev.exe, 00000001.00000002.4775786894.0000000003FD9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: zS0NQE8gev.exe, 00000001.00000002.4781490845.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4784625692.0000000004FE6000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4785483363.000000000509D000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775266209.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4781384027.0000000004D10000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4774615689.0000000003EF6000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787924898.0000000005360000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4777565550.0000000004161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780925771.0000000004C74000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773577718.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4781046475.0000000004CBA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786594328.000000000520A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773914067.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779073978.00000000042A9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773744884.0000000003E05000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783139119.0000000004E8E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780561321.0000000004BEA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user/Local Settings/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/winload_prod.pdb.rhysidaf# source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida_ source: zS0NQE8gev.exe, 00000001.00000002.4787924898.0000000005360000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.rhysidad.pdfs source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida` source: zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdboreut source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb^` source: zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaV source: zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\* source: zS0NQE8gev.exe, 00000001.00000002.4775786894.0000000003FD9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb"` source: zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida] source: zS0NQE8gev.exe, 00000001.00000002.4786594328.000000000520A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb't source: zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb( source: zS0NQE8gev.exe, 00000001.00000002.4773744884.0000000003E05000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb! source: zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbd*o source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb`UZ source: zS0NQE8gev.exe, 00000001.00000002.4781046475.0000000004CBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida5\ source: zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb- source: zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysida source: zS0NQE8gev.exe, 00000001.00000002.4786025014.0000000005135000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4778311402.000000000420F000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787829877.000000000533C000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4784842203.000000000500A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783735083.0000000004F41000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4788103668.00000000053B8000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775786894.0000000003FD9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787290628.00000000052E2000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779148998.00000000042BB000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4772943245.0000000003CE9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780925771.0000000004C74000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4776682075.000000000409D000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783041880.0000000004E7C000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779674447.0000000004B30000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786666266.000000000521C000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4777331289.000000000412B000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4785399161.0000000005079000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4782312977.0000000004E0C000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780444300.0000000004BD3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb; source: zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb5 source: zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Videos.pdbx134kWQ source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: zS0NQE8gev.exe, 00000001.00000002.4781490845.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4784625692.0000000004FE6000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4785483363.000000000509D000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775266209.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4781384027.0000000004D10000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787924898.0000000005360000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4777565550.0000000004161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780925771.0000000004C74000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773577718.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4781046475.0000000004CBA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786594328.000000000520A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773914067.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779073978.00000000042A9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4773744884.0000000003E05000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783139119.0000000004E8E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780561321.0000000004BEA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb_Z source: zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidad source: zS0NQE8gev.exe, 00000001.00000002.4783735083.0000000004F41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbz source: zS0NQE8gev.exe, 00000001.00000002.4777565550.0000000004161000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbB` source: zS0NQE8gev.exe, 00000001.00000002.4774540027.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidaf source: zS0NQE8gev.exe, 00000001.00000002.4772943245.0000000003CE9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.U source: zS0NQE8gev.exe, 00000001.00000002.4781046475.0000000004CBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbP source: zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidax source: zS0NQE8gev.exe, 00000001.00000002.4777331289.000000000412B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysiday source: zS0NQE8gev.exe, 00000001.00000002.4785399161.0000000005079000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbAZ source: zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaA t source: zS0NQE8gev.exe, 00000001.00000002.4779073978.00000000042A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysida(ls source: zS0NQE8gev.exe, 00000001.00000002.4775786894.0000000003FD9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb?\ source: zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: zS0NQE8gev.exe, 00000001.00000002.4772943245.0000000003CE9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbX source: zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbY source: zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\CriticalBreachDetected.pdfC source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb_tw source: zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb^ source: zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb=\ source: zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbi source: zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb` source: zS0NQE8gev.exe, 00000001.00000002.4775266209.0000000003F72000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user/Local Settings/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/CriticalBreachDetected.pdf source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.rhysidaafa: source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida source: zS0NQE8gev.exe, 00000001.00000002.4784625692.0000000004FE6000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4776602383.000000000408A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4785483363.000000000509D000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4775693927.0000000003FC7000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787224691.00000000052D0000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4788190062.00000000053FA000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4787924898.0000000005360000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779829813.0000000004B54000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4782498797.0000000004E1E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4777565550.0000000004161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780925771.0000000004C74000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4778392583.0000000004221000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783784592.0000000004F53000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786120650.0000000005161000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4786594328.000000000520A000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4779073978.00000000042A9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4783139119.0000000004E8E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4780561321.0000000004BEA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.rhysidapdfc source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbl source: zS0NQE8gev.exe, 00000001.00000002.4775266209.0000000003F72000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\CriticalBreachDetected.pdfff source: zS0NQE8gev.exe, 00000001.00000002.4760405323.00000000007FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\\**{f= source: zS0NQE8gev.exe, 00000001.00000002.4772943245.0000000003CE9000.00000004.00000020.00020000.00000000.sdmp

Source: zS0NQE8gev.exe

Static PE information: section name: .xdata

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Process created: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\zS0NQE8gev.exe"
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Process created: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\zS0NQE8gev.exe"			Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Acrobat.exe, 0000000A.00000002.4752491254.00000173E4080000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOK.DLL

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2

Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-client-migration-replacement.man	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-drivers-migration-replacement.man	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-migration-replacement.man	Jump to behavior

Source: C:\Users\user\Desktop\zS0NQE8gev.exe

Window / User API: threadDelayed 6081

Jump to behavior

Source: C:\Users\user\Desktop\zS0NQE8gev.exe TID: 5204	Thread sleep count: 6081 > 30	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe TID: 5204	Thread sleep time: -60810s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zS0NQE8gev.exe TID: 7124	Thread sleep count: 260 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\zS0NQE8gev.exe

Code function: 1_2_004196E5 GetSystemInfo,GetSystemInfo,malloc,malloc,Sleep,Sleep,free,free,free,system,

1_2_004196E5

Source: zS0NQE8gev.exe, 00000001.00000002.4762537425.0000000003358000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-drivers-migration-replacement.man'
Source: zS0NQE8gev.exe, 00000001.00000002.4762537425.0000000003358000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-migration-replacement.man
Source: zS0NQE8gev.exe, 00000001.00000002.4762537425.0000000003358000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-migration-replacement.manhysida
Source: zS0NQE8gev.exe, 00000001.00000002.4762537425.0000000003358000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-client-migration-replacement.man
Source: zS0NQE8gev.exe, 00000001.00000002.4762537425.0000000003358000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-drivers-migration-replacement.man
Source: zS0NQE8gev.exe, 00000001.00000002.4762537425.0000000003358000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-client-migration-replacement.mansida
Source: Acrobat.exe, 0000000A.00000000.4677604206.00000173E8A8B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll!

Source: C:\Users\user\Desktop\zS0NQE8gev.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\zS0NQE8gev.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_1-20940

Source: C:\Users\user\Desktop\zS0NQE8gev.exe

Code function: 1_2_00445A90 IsDebuggerPresent,RaiseException,

1_2_00445A90

Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_004011B0 Sleep,Sleep,SetUnhandledExceptionFilter,GetStartupInfoA,		1_2_004011B0
Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Code function: 1_2_00447CF0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		1_2_00447CF0

Source: C:\Users\user\Desktop\zS0NQE8gev.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\zS0NQE8gev.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2

Source: Acrobat.exe, 0000000A.00000002.4754374061.00000173E4AA0000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4674572441.00000173E4AA1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: IProgram Manager
Source: Acrobat.exe, 0000000A.00000002.4754374061.00000173E4AA0000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4674572441.00000173E4AA1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: Acrobat.exe, 0000000A.00000002.4754374061.00000173E4AA0000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4674572441.00000173E4AA1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: Acrobat.exe, 0000000A.00000002.4754374061.00000173E4AA0000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4674572441.00000173E4AA1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\zS0NQE8gev.exe

Code function: 1_2_00445C60 GetSystemTimeAsFileTime,

1_2_00445C60

Source: zS0NQE8gev.exe, 00000001.00000002.4773173371.0000000003D22000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4772475212.0000000003C59000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4772681968.0000000003CA3000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4772865323.0000000003CD7000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4772632578.0000000003C91000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4771961063.0000000003BB0000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4772182827.0000000003C08000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4772048094.0000000003BCB000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4772943245.0000000003CE9000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000002.4770367349.0000000003954000.00000004.00000020.00020000.00000000.sdmp

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	2 Masquerading	11 Input Capture	1 System Time Discovery	Remote Services	11 Input Capture	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Virtualization/Sandbox Evasion	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Proxy	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	12 Process Injection	Security Account Manager	12 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	3 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Source	Detection	Scanner	Label	Link
zS0NQE8gev.exe	63%	ReversingLabs	Win64.Ransomware.Rhysida
zS0NQE8gev.exe	100%	Avira	TR/AVI.Ransom.qybug

Name	Source	Malicious	Reputation
http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion	zS0NQE8gev.exe, 00000001.00000002.4761472896.000000000274E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000003.4746455440.000000000274E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000003.4746735644.000000000274E000.00000004.00000020.00020000.00000000.sdmp	true	unknown
https://mail.google.com/mail/?view=cm&fs=1&tf=1&su=	Acrobat.exe, 0000000A.00000000.4673475456.00000173E40D9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)	zS0NQE8gev.exe, 00000001.00000002.4770209284.0000000003899000.00000004.00000020.00020000.00000000.sdmp, CriticalBreachDetected.pdf337.1.dr, CriticalBreachDetected.pdf217.1.dr, CriticalBreachDetected.pdf126.1.dr, CriticalBreachDetected.pdf359.1.dr, CriticalBreachDetected.pdf57.1.dr, CriticalBreachDetected.pdf277.1.dr, CriticalBreachDetected.pdf22.1.dr, CriticalBreachDetected.pdf131.1.dr, CriticalBreachDetected.pdf334.1.dr, CriticalBreachDetected.pdf160.1.dr, CriticalBreachDetected.pdf112.1.dr, CriticalBreachDetected.pdf12.1.dr, CriticalBreachDetected.pdf259.1.dr, CriticalBreachDetected.pdf.1.dr, CriticalBreachDetected.pdf232.1.dr, CriticalBreachDetected.pdf111.1.dr, CriticalBreachDetected.pdf292.1.dr, CriticalBreachDetected.pdf325.1.dr, CriticalBreachDetected.pdf243.1.dr, CriticalBreachDetected.pdf70.1.dr	true	unknown
http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)	zS0NQE8gev.exe, 00000001.00000002.4770209284.0000000003899000.00000004.00000020.00020000.00000000.sdmp, CriticalBreachDetected.pdf337.1.dr, CriticalBreachDetected.pdf217.1.dr, CriticalBreachDetected.pdf126.1.dr, CriticalBreachDetected.pdf359.1.dr, CriticalBreachDetected.pdf57.1.dr, CriticalBreachDetected.pdf277.1.dr, CriticalBreachDetected.pdf22.1.dr, CriticalBreachDetected.pdf131.1.dr, CriticalBreachDetected.pdf334.1.dr, CriticalBreachDetected.pdf160.1.dr, CriticalBreachDetected.pdf112.1.dr, CriticalBreachDetected.pdf12.1.dr, CriticalBreachDetected.pdf259.1.dr, CriticalBreachDetected.pdf.1.dr, CriticalBreachDetected.pdf232.1.dr, CriticalBreachDetected.pdf111.1.dr, CriticalBreachDetected.pdf292.1.dr, CriticalBreachDetected.pdf325.1.dr, CriticalBreachDetected.pdf243.1.dr, CriticalBreachDetected.pdf70.1.dr	true	unknown
http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion	zS0NQE8gev.exe, 00000001.00000002.4761472896.000000000274E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000003.4746455440.000000000274E000.00000004.00000020.00020000.00000000.sdmp, zS0NQE8gev.exe, 00000001.00000003.4746735644.000000000274E000.00000004.00000020.00020000.00000000.sdmp	true	unknown
http://www.quicktime.com.Acrobat	Acrobat.exe, 0000000A.00000000.4676972418.00000173E8885000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://api2.branch.io/v1/url	Acrobat.exe, 0000000A.00000000.4675850976.00000173E6E92000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://ims-na1.adobelogin.com	Acrobat.exe, 0000000A.00000000.4677562738.00000173E8A73000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://outlook.office.com/mail/deeplink/compose?mailtouri=	Acrobat.exe, 0000000A.00000000.4673475456.00000173E40D9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://web.whatsapp.com/send?text=	Acrobat.exe, 0000000A.00000002.4752491254.00000173E40FA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://mail.google.com/mail/?view=cm&fs=1&tf=1&su=s	Acrobat.exe, 0000000A.00000000.4673475456.00000173E40D9000.00000004.00000020.00020000.00000000.sdmp	false	unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524359
Start date and time:	2024-10-02 17:56:30 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	zS0NQE8gev.exe renamed because original name is a hash value
Original Sample Name:	5b3a0b1b89ca463f56984cf67ea1719f1ddee770d1e14438e3fcf9b5301f2c83.exe
Detection:	MAL
Classification:	mal100.rans.troj.evad.winEXE@12/1030@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 14 Number of non-executed functions: 66
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Time	Type	Description
12:00:18	API Interceptor	17222x Sleep call for process: zS0NQE8gev.exe modified
12:01:46	API Interceptor	1x Sleep call for process: WerFault.exe modified
18:01:27	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf

Process:	C:\Users\user\Desktop\zS0NQE8gev.exe
File Type:	PDF document, version 1.4, 1 pages
Category:	dropped
Size (bytes):	113702
Entropy (8bit):	7.763777829825265
Encrypted:	false
SSDEEP:	1536:W1cgCx69vkFBsR0M/xByy/XlEnJR6PoypIfLXbP2aXpXkDLai519XL91MeeW65/3:ucgCIvABlUxBvX9o3pkDm61N72qu
MD5:	0ADF25893C1BC2799EE640267FFBB792
SHA1:	DB68F3F821FB345B840BCDF0884AE99A6B76B462
SHA-256:	578185D1CB7DF8BFDF1CBDCD04367830C817C37BCA16C962DD6B355EEBAD2594
SHA-512:	E68994A4A58BDAAB8BFB1277997999297AF997DBEA3A066DEF2CC5CAFE6F22616333DE7149253F619528AFB6928019F210DFCD38A7E9F618CF47B8BD1B01D6D9
Malicious:	false
Reputation:	low
Preview:	%PDF-1.4.%...1 0 obj.<<./Title ()./Creator (...w.k.h.t.m.l.t.o.p.d.f. .0...1.2...5)./Producer (...Q.t. .5...1.2...8)./CreationDate (D:20240622032204-04'00').>>.endobj.2 0 obj.<<./Type /Catalog./Pages 3 0 R.>>.endobj.4 0 obj.<<./Type /ExtGState./SA true./SM 0.02./ca 1.0./CA 1.0./AIS false./SMask /None>>.endobj.5 0 obj.[/Pattern /DeviceRGB].endobj.7 0 obj.<<./Type /XObject./Subtype /Image./Width 1400./Height 600./BitsPerComponent 8./ColorSpace /DeviceGray./Length 8 0 R./Filter /FlateDecode.>>.stream.x....\|.......B.#E.PCQ.ti..R.T.(O..T..A@.,..A.JQJ....R...AJ.@.-!=9ofv7.2.N.Y....cc2s......[8..................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0499342186009906
Encrypted:	false
SSDEEP:	192:JR40NqNj0aD8IZbTj/lwKczuiFJZ24lO8+Iz:f40oNQaD8IZXjYzuiFJY4lO8+I
MD5:	6B44F743ECBE4C9BB9D9DEEFD2424432
SHA1:	E6EC670AC5E0FFD1D5725512B4A03415962230F1
SHA-256:	1C35D9CE5064957947A25D475171CB1FEAF9D3574809C516567357978FF24FAE
SHA-512:	C1FDCD0A4872044DB32A373665A00CC0F3DA1235A2A411CE2F9E4A7A43013FD6F1DFDAB648F6269E8B58E54B95D4594FBB097838D7D4285CDAC83057E5EFF7D8
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.3.5.8.5.0.0.6.1.0.2.3.9.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.3.5.8.5.0.1.1.8.8.3.4.9.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.6.4.6.4.5.7.8.-.3.d.8.a.-.4.4.d.f.-.8.f.b.e.-.7.6.5.e.8.f.4.1.e.0.b.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.2.4.2.4.d.4.2.-.c.a.c.3.-.4.2.f.9.-.b.4.d.0.-.7.7.2.7.3.a.1.5.c.c.a.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.A.c.r.o.b.a.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.A.c.r.o.b.a.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.3.8.-.0.0.0.1.-.0.0.1.5.-.a.4.6.2.-.d.7.5.b.e.4.1.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.e.4.2.d.8.b.7.c.d.d.3.7.d.5.3.1.b.1.7.9.8.e.3.f.e.a.c.0.7.f.f.0.0.0.0.0.9.0.4.!.0.0.0.0.5.a.f.1.d.e.2.e.2.2.6.b.7.0.b.a.5.1.a.8.4.8.f.0.3.1.5.5.f.f.9.1.0.a.c.c.3.6.7.0.!.A.c.r.o.b.a.t...e.x.e.....T.

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	859136
Entropy (8bit):	2.0989845304023613
Encrypted:	false
SSDEEP:	3072:b1vcabhnmYiEeg6MWoZy7RZxbd3JjVfhrNnuA1qU1CD+zHosh2bv5XRVx:pvztAkMH32bv5J
MD5:	4B088091CEC2A89685345C12A253619B
SHA1:	5E8FF2DE5E8BC1CBFF9AD574D0BA866B9268E75A
SHA-256:	0D325EF8205316912174869D34645E1FB1841473CEBB5F48278C1D0B8CC115DE
SHA-512:	28F040A04A26F77DBCA715AE4CC24E13FC8E059C0132DA97DA4B6E26E14C18B9E26AC4F89ED2C66688082CA8CB7F3E7381CE1B27B853FB0E64F4FC7B6916A840
Malicious:	false
Preview:	............................................................................................................................................................................-...)...A12_acrobat_multiFile_generic_dark_32.pdf...................................................................................................8...........................................................................................................%...!...A12_acrobat_parcel_generic_64.pdf...........................................................................................................9..............................................................................................................&...A12_acrobat_parcel_generic_dark_32.pdf......................................................................................................:..............................................................................................................&...A12_acrobat_parcel_generic_dark_64.pdf..............

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	5.444789155880519
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	zS0NQE8gev.exe
File size:	926'720 bytes
MD5:	d86383882515b7a9218d5f69924feadf
SHA1:	31183640972f2bc2e6906a271a88344201d37e4d
SHA256:	5b3a0b1b89ca463f56984cf67ea1719f1ddee770d1e14438e3fcf9b5301f2c83
SHA512:	f1761c4a3f4615f046644777c101545d86ff485eb01ce73d4042d0954368d32a651b3bc803b76f231d7d9beec1dc390e3732e4d310855e0f39ff3843e06cc757
SSDEEP:	6144:gI99bj5oxq4KhAQSdl70vRK/fMCmJZ/76jOMFMqnUqW5V4GVzOTeE:zbSdl70vRK/Ez/7tqnsD42XE
TLSH:	DD15225A0B8FC6FCC32BECB485C65D13EBD2962A172CD685DB627DB5342286CE0F5484
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....\|vf........../.......... ................@......................................G....`... ............................

Entrypoint:	0x4014d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x66767C15 [Sat Jun 22 07:24:05 2024 UTC]
TLS Callbacks:	0x447e20
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1d53ebdb19fa47edf6dc307e5428a090

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xed000	0x1418	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xde000	0x22f8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf0020	0x28	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xed4f8	0x480	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4a458	0x4a600	91cdf37963c4942ac8211b9cac54902e	False	0.47083771008403363	data	6.373153074072335	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4c000	0x82d80	0x82e00	7389e4b7c997a95c40d01c24eff7ea31	False	0.3198778504059217	data	3.2664759868416122	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xcf000	0xe8b0	0xea00	0167eec445795b08811e25375633826d	False	0.29246794871794873	data	5.751491918830142	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0xde000	0x22f8	0x2400	ecfcc4aa6398cb346aede7b3bd814cc1	False	0.4767795138888889	data	5.571402669989436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0xe1000	0x225c	0x2400	f357550081e6b723ab393c39585ac13e	False	0.18196614583333334	data	4.288571269854264	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0xe4000	0x84d0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xed000	0x1418	0x1600	791d929a3536ebafd08dceff10230294	False	0.30042613636363635	data	4.289556590440325	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0xef000	0x70	0x200	d61f92ad200ef160449ee356a7bae78d	False	0.08203125	data	0.3334994142480582	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xf0000	0x68	0x200	6d192e92c071a863a36ba7a216f07d43	False	0.060546875	data	0.1755262916558982	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

DLL	Import
ADVAPI32.dll	CryptAcquireContextA, CryptGenRandom
KERNEL32.dll	AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateSemaphoreA, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetFileAttributesA, GetHandleInformation, GetLastError, GetModuleFileNameW, GetProcessAffinityMask, GetStartupInfoA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDebuggerPresent, LeaveCriticalSection, OpenProcess, OutputDebugStringA, QueryPerformanceCounter, RaiseException, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, RtlAddFunctionTable, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetEvent, SetLastError, SetProcessAffinityMask, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, Sleep, SuspendThread, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, UnhandledExceptionFilter, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject
msvcrt.dll	__C_specific_handler, __dllonexit, __doserrno, __getmainargs, __initenv, __iob_func, __lconv_init, __pioinfo, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthreadex, _cexit, _endthreadex, _errno, _exit, _filelengthi64, _fileno, _findclose, _findfirst64, _fmode, _fullpath, _initterm, _lock, _lseeki64, _onexit, _setjmp, _stat64, _ultoa, _unlock, _write, abort, acos, calloc, exit, fclose, fflush, fgetpos, fopen, fprintf, fread, free, frexp, fseek, fsetpos, ftell, fwprintf, fwrite, malloc, memcmp, memcpy, memmove, memset, printf, raise, rand, realloc, rename, signal, sprintf, srand, strcat, strcmp, strcpy, strlen, strncmp, strncpy, strtol, system, vfprintf, wcscpy, _time64, _snwprintf, _findnext64, longjmp, _strdup, _getcwd, _chdir
PSAPI.DLL	EnumProcesses, GetProcessMemoryInfo
USER32.dll	MessageBoxW

Target ID:	1
Start time:	11:58:09
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\zS0NQE8gev.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\zS0NQE8gev.exe"
Imagebase:	0x400000
File size:	926'720 bytes
MD5 hash:	D86383882515B7A9218D5F69924FEADF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	12:01:35
Start date:	02/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf"
Imagebase:	0x7ff6a6ed0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	12:01:38
Start date:	02/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" --type=renderer /prefetch:1 "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf"
Imagebase:
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	12:01:40
Start date:	02/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1336 -s 1288
Imagebase:	0x7ff692070000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	41.5%
Total number of Nodes:	901
Total number of Limit Nodes:	12

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report zS0NQE8gev.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\CriticalBreachDetected.pdf

C:\$WinREAgent\Scratch\CriticalBreachDetected.pdf

C:\CriticalBreachDetected.pdf

C:\Program Files\7-Zip\7-zip.chm.rhysida

C:\Program Files\7-Zip\7z.sfx.rhysida

C:\Program Files\7-Zip\CriticalBreachDetected.pdf

C:\Program Files\7-Zip\History.txt.rhysida

C:\Program Files\7-Zip\Lang\CriticalBreachDetected.pdf

C:\Program Files\7-Zip\descript.ion.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\license.html.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\CriticalBreachDetected.pdf

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\license.html.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\CriticalBreachDetected.pdf

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\license.html.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\CriticalBreachDetected.pdf

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\license.html.rhysida

Windows Analysis Report
zS0NQE8gev.exe

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre