Edit tour

Windows Analysis Report
4X4uE1AuTX.exe

Overview

General Information

Sample name:	4X4uE1AuTX.exe renamed because original name is a hash value
Original sample name:	3c3db3c02a4d04dcafdc71adb8779b787d31142ffeb9ae0e638f979594897cbf.exe
Analysis ID:	1524363
MD5:	93be893ff74816c49f2706f222789027
SHA1:	80de2a5d57c25794a4a379f592621336465edb32
SHA256:	3c3db3c02a4d04dcafdc71adb8779b787d31142ffeb9ae0e638f979594897cbf
Tags:	exeRhysidauser-JAMESWT_MHT
Infos:

Detection

Rhysida

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Rhysida Ransomware

AI detected suspicious sample

Contains functionality to clear event logs

Deletes shadow drive data (may be related to ransomware)

Found API chain indicative of debugger detection

Found Tor onion address

Machine Learning detection for sample

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

4X4uE1AuTX.exe (PID: 6768 cmdline: "C:\Users\user\Desktop\4X4uE1AuTX.exe" MD5: 93BE893FF74816C49F2706F222789027)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Rhysida		No Attribution	https://blog.talosintelligence.com/rhysida-ransomware/ https://decoded.avast.io/threatresearch/rhysida-ransomware-technical-analysis/ https://detect.fyi/rhysida-ransomware-and-the-detection-opportunities-3599e9a02bb2 https://fourcore.io/blogs/rhysida-ransomware-history-ttp-adversary-emulation https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhysida

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
4X4uE1AuTX.exe	JoeSecurity_rhysida	Yara detected Rhysida Ransomware	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: 4X4uE1AuTX.exe PID: 6768	JoeSecurity_rhysida	Yara detected Rhysida Ransomware	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 4X4uE1AuTX.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 4X4uE1AuTX.exe

ReversingLabs: Detection: 78%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.1% probability

Machine Learning detection for sample

Source: 4X4uE1AuTX.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\4X4uE1AuTX.exe

Code function: 0_2_0043E071 CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptAcquireContextA,

0_2_0043E071

Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\7-Zip\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\7-Zip\Lang\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\locales\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\swiftshader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CAN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\DEU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\FRA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\JPN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\UK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ar_AE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\cs_CZ\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\da_DK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\el_GR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_AE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_GB\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_IL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\es_ES\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\en_US\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\private\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\prod\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\stage\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\fonts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\hi_contrast\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\microsoftGraph\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\2.1.15\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\misc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themeless_Reader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\ccpdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\themeless\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\CriticalBreachDetected.pdf	Jump to behavior

Source: 4X4uE1AuTX.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 4x nop then jmp 004305A0h	0_2_0041E020
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 4x nop then lea r8, qword ptr [0000000000473F80h]	0_2_0042BAE0
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 4x nop then lea r8, qword ptr [0000000000473540h]	0_2_00428B30
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 4x nop then lea r8, qword ptr [00000000004745A0h]	0_2_0042CCA0

Networking

Found Tor onion address

Source: 4X4uE1AuTX.exe, 00000000.00000002.3248717490.000000000044D000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: 4X4uE1AuTX.exe, 00000000.00000000.1993692272.000000000044C000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: 4X4uE1AuTX.exe	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf24.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf289.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf84.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf270.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf216.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf397.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf154.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf77.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf167.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf66.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf130.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf120.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf367.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf381.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf310.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf368.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf404.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf231.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf134.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf374.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf207.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf176.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf339.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf229.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf192.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf224.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf102.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf168.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf378.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf5.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf155.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf240.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf245.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf348.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf239.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf1.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf242.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf299.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf107.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf202.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf346.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf351.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf92.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf402.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf294.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf162.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf99.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf118.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf55.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf358.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf73.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf330.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf98.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf287.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf33.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf297.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf301.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: tse1.mm.bing.net

Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/275944
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/497301
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/514696
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/717501
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/775961
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/839189
Source: index.html.rhysida.0.dr	String found in binary or memory: http://jquery.com/
Source: index.html.rhysida.0.dr	String found in binary or memory: http://jquery.org/license
Source: 4X4uE1AuTX.exe, CriticalBreachDetected.pdf24.0.dr, CriticalBreachDetected.pdf289.0.dr, CriticalBreachDetected.pdf84.0.dr, CriticalBreachDetected.pdf270.0.dr, CriticalBreachDetected.pdf216.0.dr, CriticalBreachDetected.pdf397.0.dr, CriticalBreachDetected.pdf154.0.dr, CriticalBreachDetected.pdf77.0.dr, CriticalBreachDetected.pdf167.0.dr, CriticalBreachDetected.pdf66.0.dr, CriticalBreachDetected.pdf130.0.dr, CriticalBreachDetected.pdf120.0.dr, CriticalBreachDetected.pdf367.0.dr, CriticalBreachDetected.pdf381.0.dr, CriticalBreachDetected.pdf310.0.dr, CriticalBreachDetected.pdf368.0.dr, CriticalBreachDetected.pdf404.0.dr, CriticalBreachDetected.pdf231.0.dr, CriticalBreachDetected.pdf134.0.dr, CriticalBreachDetected.pdf374.0.dr	String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: index.html.rhysida.0.dr	String found in binary or memory: http://sizzlejs.com/
Source: resources.pak.rhysida.0.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: nacl_irt_x86_64.nexe.rhysida.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/nacl-llvm-project-v10.git
Source: resources.pak.rhysida.0.dr	String found in binary or memory: https://codereview.chromium.org/25305002).
Source: resources.pak.rhysida.0.dr	String found in binary or memory: https://crbug.com/1245093):
Source: resources.pak.rhysida.0.dr	String found in binary or memory: https://crbug.com/1446731
Source: 4X4uE1AuTX.exe, CriticalBreachDetected.pdf24.0.dr, CriticalBreachDetected.pdf289.0.dr, CriticalBreachDetected.pdf84.0.dr, CriticalBreachDetected.pdf270.0.dr, CriticalBreachDetected.pdf216.0.dr, CriticalBreachDetected.pdf397.0.dr, CriticalBreachDetected.pdf154.0.dr, CriticalBreachDetected.pdf77.0.dr, CriticalBreachDetected.pdf167.0.dr, CriticalBreachDetected.pdf66.0.dr, CriticalBreachDetected.pdf130.0.dr, CriticalBreachDetected.pdf120.0.dr, CriticalBreachDetected.pdf367.0.dr, CriticalBreachDetected.pdf381.0.dr, CriticalBreachDetected.pdf310.0.dr, CriticalBreachDetected.pdf368.0.dr, CriticalBreachDetected.pdf404.0.dr, CriticalBreachDetected.pdf231.0.dr, CriticalBreachDetected.pdf134.0.dr, CriticalBreachDetected.pdf374.0.dr	String found in binary or memory: https://www.torproject.org/download/)

Source: 4X4uE1AuTX.exe, 00000000.00000002.3255429295.000000000323C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: C:/Program Files (x86)/autoit3/Examples/Helpfile/_WinAPI_RegisterRawInputDevices.au3

memstr_6ce81638-6

Spam, unwanted Advertisements and Ransom Demands

Yara detected Rhysida Ransomware

Source: Yara match	File source: 4X4uE1AuTX.exe, type: SAMPLE
Source: Yara match	File source: Process Memory Space: 4X4uE1AuTX.exe PID: 6768, type: MEMORYSTR

Contains functionality to clear event logs

Source: C:\Users\user\Desktop\4X4uE1AuTX.exe

Code function: cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"

0_2_00419018

Deletes shadow drive data (may be related to ransomware)

Source: 4X4uE1AuTX.exe	Binary or memory string: cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
Source: 4X4uE1AuTX.exe, 00000000.00000000.1993719656.0000000000469000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
Source: 4X4uE1AuTX.exe, 00000000.00000000.1993719656.0000000000469000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: C:/Windows/Fonts/Arial.ttfC:/Users/Public/bg.jpgcmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /fcmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /fcmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /fcmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /fcmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /fcmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /fcmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /fcmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /frundll32.exe user32.dll,UpdatePerUserSystemParameters/$Recycle.Bin/Boot/Documents and Settings/PerfLogs/ProgramData/Recovery/System Volume Information/Windows/$RECYCLE.BIN/ApzData.bat.bin.cab.cmd.com.cur.diagcab.diagcfg.diagpkg.drv.dll.exe.hlp.hta.ico.msi.ocx.ps1.psm1.scr.sys.iniThumbs.db.url...rrb+rbaeschc_hash%c:/cmd.exe /c vssadmin.exe Delete Shadows /All /Quietcmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
Source: 4X4uE1AuTX.exe	Binary or memory string: cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
Source: 4X4uE1AuTX.exe	Binary or memory string: C:/Windows/Fonts/Arial.ttfC:/Users/Public/bg.jpgcmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /fcmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /fcmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /fcmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /fcmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /fcmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /fcmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /fcmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /frundll32.exe user32.dll,UpdatePerUserSystemParameters/$Recycle.Bin/Boot/Documents and Settings/PerfLogs/ProgramData/Recovery/System Volume Information/Windows/$RECYCLE.BIN/ApzData.bat.bin.cab.cmd.com.cur.diagcab.diagcfg.diagpkg.drv.dll.exe.hlp.hta.ico.msi.ocx.ps1.psm1.scr.sys.iniThumbs.db.url...rrb+rbaeschc_hash%c:/cmd.exe /c vssadmin.exe Delete Shadows /All /Quietcmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"

Writes many files with high entropy

Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\pt-br\NativeRS.webm.rhysida entropy: 7.99975652671	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\en-us\Q3_2022_ExperienceStreamlinedAcrobat_Old_Pro.webm.rhysida entropy: 7.9990747819	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\fr-fr\NativeRS.webm.rhysida entropy: 7.99972209814	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\en-us\Q3_2022_AccessToolsEasily_Old_Pro.webm.rhysida entropy: 7.99951008566	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\7-Zip\History.txt.rhysida entropy: 7.99668858648	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\7-Zip\7-zip.chm.rhysida entropy: 7.99805642907	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\en-us\Q3_2022_GetWorkDoneFaster_Old_Pro.webm.rhysida entropy: 7.99956025294	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\css\faf-main.css.rhysida entropy: 7.99960720223	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\en-us\Q3_2022_AccessToolsEasily_Old_Reader.webm.rhysida entropy: 7.9995178878	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\de-de\NativeRS.webm.rhysida entropy: 7.99978797301	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\en-us\NativeRS.webm.rhysida entropy: 7.99975451438	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\AppStore_icon.svg.rhysida entropy: 7.99315632426	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\AppStore_icon.svg.rhysida entropy: 7.99135187538	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\progress_spinner_dark2x.gif.rhysida entropy: 7.99371235472	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\core_icons_retina.png.rhysida entropy: 7.99106121593	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view-2x.png.rhysida entropy: 7.99338301081	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\ind_prog.gif.rhysida entropy: 7.99098367926	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png.rhysida entropy: 7.99118888174	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons_retina.png.rhysida entropy: 7.99419633344	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\AppStore_icon.svg.rhysida entropy: 7.99112003	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_zh_cn_135x40.svg.rhysida entropy: 7.99023460085	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_pt_135x40.svg.rhysida entropy: 7.9911288217	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_bow.png.rhysida entropy: 7.99552532764	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\progress_spinner2x.gif.rhysida entropy: 7.99537590986	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\faf-main.js.rhysida entropy: 7.99969961957	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\ui-strings.js.rhysida entropy: 7.99034891221	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\chrome_100_percent.pak.rhysida entropy: 7.9997628555	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\dc3b5d449449a5103f90189b239c0bf6.png.rhysida entropy: 7.99857428459	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-unifiedShare-chunk.js.rhysida entropy: 7.99973919933	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_wob.png.rhysida entropy: 7.99589335582	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-enhance-popups-chunk.js.rhysida entropy: 7.9976153228	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\zh-CN.pak.rhysida entropy: 7.99955223175	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\a56350ec5a5b310e9f4c7e10e0b6795c.png.rhysida entropy: 7.99949347617	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-rspresendreview-modals-chunk.js.rhysida entropy: 7.99834884769	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\chrome_200_percent.pak.rhysida entropy: 7.99915879635	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\VisualElements\LogoDev.png.rhysida entropy: 7.9908574924	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\initial_preferences.rhysida entropy: 7.99969217337	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-help-chunk.js.rhysida entropy: 7.99918793534	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png.rhysida entropy: 7.99312123918	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\resources.pak.rhysida entropy: 7.9993811646	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\VisualElements\LogoCanary.png.rhysida entropy: 7.99419102101	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\zh-TW.pak.rhysida entropy: 7.99953146747	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\tr.pak.rhysida entropy: 7.9996537483	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\uk.pak.rhysida entropy: 7.99976790566	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\sw.pak.rhysida entropy: 7.99954141575	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\sl.pak.rhysida entropy: 7.99956241923	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\pt-PT.pak.rhysida entropy: 7.99963665002	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\pt-BR.pak.rhysida entropy: 7.99958867636	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\nb.pak.rhysida entropy: 7.99947021299	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\license.html.rhysida entropy: 7.99578411401	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\7-Zip\7z.sfx.rhysida entropy: 7.99912079979	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\sk.pak.rhysida entropy: 7.99962438746	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\license.html.rhysida entropy: 7.99317416115	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\lt.pak.rhysida entropy: 7.99961149912	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\ja.pak.rhysida entropy: 7.99969036297	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\it.pak.rhysida entropy: 7.99953243987	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\hr.pak.rhysida entropy: 7.9995820314	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\hi.pak.rhysida entropy: 7.9998161326	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\lv.pak.rhysida entropy: 7.99962090417	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\license.html.rhysida entropy: 7.99410267324	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\license.html.rhysida entropy: 7.99502380947	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\license.html.rhysida entropy: 7.99416034371	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\license.html.rhysida entropy: 7.99427980892	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\ms.pak.rhysida entropy: 7.99956866181	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\license.html.rhysida entropy: 7.9940847945	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\et.pak.rhysida entropy: 7.99962239603	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\es.pak.rhysida entropy: 7.99956286985	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi.rhysida entropy: 7.99954943285	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\fr.pak.rhysida entropy: 7.99964012564	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\css\main.css.rhysida entropy: 7.99786419559	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\fil.pak.rhysida entropy: 7.9995917074	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\license.html.rhysida entropy: 7.99428326175	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\license.html.rhysida entropy: 7.99745423222	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\license.html.rhysida entropy: 7.99487781908	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\license.html.rhysida entropy: 7.99352508203	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\license.html.rhysida entropy: 7.99399796413	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\license.html.rhysida entropy: 7.99417825273	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\license.html.rhysida entropy: 7.99275039671	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\license.html.rhysida entropy: 7.99264659521	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\license.html.rhysida entropy: 7.9964322154	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\images\powered_by_adobe_sign_old.svg.rhysida entropy: 7.99451969181	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Light.eot.rhysida entropy: 7.9994683126	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Regular.eot.rhysida entropy: 7.99943823994	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Bold.eot.rhysida entropy: 7.9995142779	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Bold.woff.rhysida entropy: 7.99871889417	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Regular.woff.rhysida entropy: 7.99883736188	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\PDFSigQFormalRep.pdf.rhysida entropy: 7.99962516884	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Light.woff.rhysida entropy: 7.9987985309	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Accessibility.api.rhysida entropy: 7.99977437299	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\QRCode.pmp.rhysida entropy: 7.99723724021	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\AdobePDF417.pmp.rhysida entropy: 7.99767922738	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\DataMatrix.pmp.rhysida entropy: 7.99966282728	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\MSRMS.api.rhysida entropy: 7.99985154093	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\eBook.api.rhysida entropy: 7.99724533665	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Checkers.api.rhysida entropy: 7.99308083375	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Standard.pdf.rhysida entropy: 7.99829512483	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf.rhysida entropy: 7.99660309693	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\plugin.js.rhysida entropy: 7.99862733473	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\StorageConnectors.api.rhysida entropy: 7.99975524198	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\MyriadCAD.otf.rhysida entropy: 7.99695182223	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\tesselate.x3d.rhysida entropy: 7.99479898712	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\2d.x3d.rhysida entropy: 7.9997732396	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Spelling.api.rhysida entropy: 7.99954502164	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\drvDX9.x3d.rhysida entropy: 7.99960255943	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\Microsoft.VCLibs.x86.14.00.appx.rhysida entropy: 7.99965863873	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\ui-strings.js.rhysida entropy: 7.99084895973	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\css\main.css.rhysida entropy: 7.99671280118	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\ui-strings.js.rhysida entropy: 7.9919778265	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\pt-br\ui-strings.js.rhysida entropy: 7.99005410623	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\8479-chunk.js.rhysida entropy: 7.99586163568	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\ui-strings.js.rhysida entropy: 7.99036964143	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ca-es\ui-strings.js.rhysida entropy: 7.99015809871	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\ui-strings.js.rhysida entropy: 7.9913008266	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\7279-chunk.js.rhysida entropy: 7.99808298256	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-readerRhp-chunk.js.rhysida entropy: 7.99324735909	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\ui-strings.js.rhysida entropy: 7.99088754207	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\57686c0e32e1983d524fb6f8d46ca8c7.png.rhysida entropy: 7.99941262475	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6b0215ed0a09075330a1c6dd3dbfba1d.png.rhysida entropy: 7.99182494967	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-editsettings-popups-chunk.js.rhysida entropy: 7.99603900722	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\8329-chunk.js.rhysida entropy: 7.99892599698	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\cs-cz\ui-strings.js.rhysida entropy: 7.99560708845	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\db3460ac8568d0137d4556570169e475.png.rhysida entropy: 7.99631911609	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\5251-chunk.js.rhysida entropy: 7.99422698269	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ca-es\ui-strings.js.rhysida entropy: 7.99505744291	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-filepicker-chunk.js.rhysida entropy: 7.99957073838	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\es-es\ui-strings.js.rhysida entropy: 7.99007091574	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\ui-strings.js.rhysida entropy: 7.99056385317	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9b1662bee64658ff8dd184737a056510.png.rhysida entropy: 7.99770076691	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\b99178ba996d2b4a255b0f163dcb88ce.png.rhysida entropy: 7.99698870131	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png.rhysida entropy: 7.99290271594	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Mozilla Firefox\browser\features\formautofill@mozilla.org.xpi.rhysida entropy: 7.99864805955	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\el.pak.rhysida entropy: 7.99977359	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\83bf4cfa63b712c6973a0d510a7b2c99.png.rhysida entropy: 7.99932206452	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-ccxfeedback-popups-chunk.js.rhysida entropy: 7.99316153422	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9216-chunk.js.rhysida entropy: 7.99541968906	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9488-chunk.js.rhysida entropy: 7.99230017265	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\es-es\ui-strings.js.rhysida entropy: 7.99518601919	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-ma\ui-strings.js.rhysida entropy: 7.9956103493	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\de-de\ui-strings.js.rhysida entropy: 7.99582604353	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hr-hr\ui-strings.js.rhysida entropy: 7.99466337577	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ko-kr\ui-strings.js.rhysida entropy: 7.99501159753	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\4049-chunk.js.rhysida entropy: 7.9975315455	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ja-jp\ui-strings.js.rhysida entropy: 7.99532662741	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\it-it\ui-strings.js.rhysida entropy: 7.99593572486	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6665-chunk.js.rhysida entropy: 7.99186161999	Jump to dropped file
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pt-br\ui-strings.js.rhysida entropy: 7.99536399748	Jump to dropped file

Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00425900	0_2_00425900
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0043D4C0	0_2_0043D4C0
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0041CE80	0_2_0041CE80
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0041B070	0_2_0041B070
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00426800	0_2_00426800
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00431500	0_2_00431500
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0042D390	0_2_0042D390
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0044A8C0	0_2_0044A8C0
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0043F100	0_2_0043F100
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00429930	0_2_00429930
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00424130	0_2_00424130
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0043D130	0_2_0043D130
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0043D9C0	0_2_0043D9C0
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_004369C0	0_2_004369C0
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0042F980	0_2_0042F980
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0041C1B0	0_2_0041C1B0
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00442250	0_2_00442250
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0044A200	0_2_0044A200
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00438210	0_2_00438210
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00431A20	0_2_00431A20
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00436A30	0_2_00436A30
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00442A90	0_2_00442A90
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0042D370	0_2_0042D370
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0042C340	0_2_0042C340
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00433B40	0_2_00433B40
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0042FC50	0_2_0042FC50
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0043E4C0	0_2_0043E4C0
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0043EC80	0_2_0043EC80
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0041ACA0	0_2_0041ACA0
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00431500	0_2_00431500
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0040E5F2	0_2_0040E5F2
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00448D90	0_2_00448D90
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00424640	0_2_00424640
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00441EE0	0_2_00441EE0
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_004386A0	0_2_004386A0
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0042D740	0_2_0042D740
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00435F00	0_2_00435F00
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00431F20	0_2_00431F20
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00424FC0	0_2_00424FC0

Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: String function: 0041F440 appears 252 times
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: String function: 00449A00 appears 46 times

Source: classification engine

Classification label: mal92.rans.evad.winEXE@1/1025@1/0

Source: CriticalBreachDetected.pdf69.0.dr	Initial sample: mailto:StevieWalker@onionmail.org
Source: CriticalBreachDetected.pdf69.0.dr	Initial sample: mailto:LynwoodWalker@onionmail.org
Source: CriticalBreachDetected.pdf69.0.dr	Initial sample: https://www.torproject.org/download/
Source: CriticalBreachDetected.pdf69.0.dr	Initial sample: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/

Source: C:\Users\user\Desktop\4X4uE1AuTX.exe

File created: C:\Program Files\CriticalBreachDetected.pdf

Jump to behavior

Source: 4X4uE1AuTX.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-client-migration-replacement.man	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-drivers-migration-replacement.man	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-migration-replacement.man	Jump to behavior

Source: C:\Users\user\Desktop\4X4uE1AuTX.exe TID: 3396	Thread sleep count: 6886 > 30	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe TID: 3396	Thread sleep time: -68860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe TID: 6804	Thread sleep count: 326 > 30	Jump to behavior

Source: 4X4uE1AuTX.exe, 00000000.00000002.3250245516.00000000026AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-migration-replacement.man
Source: 4X4uE1AuTX.exe, 00000000.00000002.3250245516.00000000026AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-migration-replacement.manf.rhysida
Source: 4X4uE1AuTX.exe, 00000000.00000002.3250245516.00000000026AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-client-migration-replacement.man
Source: 4X4uE1AuTX.exe, 00000000.00000002.3250245516.00000000026AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-drivers-migration-replacement.man
Source: 4X4uE1AuTX.exe, 00000000.00000002.3250245516.00000000026AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-client-migration-replacement.maneR
Source: 4X4uE1AuTX.exe, 00000000.00000002.3250245516.00000000026AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-drivers-migration-replacement.manida

Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_004011B0 Sleep,Sleep,SetUnhandledExceptionFilter,GetStartupInfoA,	0_2_004011B0
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00443E50 TlsGetValue,CloseHandle,CloseHandle,CloseHandle,TlsSetValue,RtlRemoveVectoredExceptionHandler,CloseHandle,CloseHandle,CloseHandle,RtlAddVectoredExceptionHandler,	0_2_00443E50
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0044B039 SetUnhandledExceptionFilter,	0_2_0044B039
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_00447A70 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00447A70
Source: C:\Users\user\Desktop\4X4uE1AuTX.exe	Code function: 0_2_0048761C SetUnhandledExceptionFilter,WaitForSingleObject,	0_2_0048761C

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Masquerading	11 Input Capture	1 System Time Discovery	Remote Services	11 Input Capture	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	12 Virtualization/Sandbox Evasion	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	12 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Proxy	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner	Label
4X4uE1AuTX.exe	79%	ReversingLabs	Win64.Ransomware.Rhysida
4X4uE1AuTX.exe	100%	Avira	TR/Redcap.uegfj
4X4uE1AuTX.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://jquery.org/license	0%	URL Reputation	safe
http://sizzlejs.com/	0%	URL Reputation	safe
http://jquery.com/	0%	URL Reputation	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ax-0001.ax-msedge.net	150.171.27.10	true	false		unknown
tse1.mm.bing.net	unknown	unknown	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
http://crbug.com/275944	resources.pak.rhysida.0.dr	false		unknown
https://chromium.googlesource.com/a/native_client/nacl-llvm-project-v10.git	nacl_irt_x86_64.nexe.rhysida.0.dr	false		unknown
http://jquery.org/license	index.html.rhysida.0.dr	false	URL Reputation: safe	unknown
https://crbug.com/1446731	resources.pak.rhysida.0.dr	false		unknown
http://crbug.com/717501	resources.pak.rhysida.0.dr	false		unknown
http://crbug.com/839189	resources.pak.rhysida.0.dr	false		unknown
http://sizzlejs.com/	index.html.rhysida.0.dr	false	URL Reputation: safe	unknown
https://crbug.com/1245093):	resources.pak.rhysida.0.dr	false		unknown
https://chromewebstore.google.com/	resources.pak.rhysida.0.dr	false		unknown
http://crbug.com/775961	resources.pak.rhysida.0.dr	false		unknown
http://crbug.com/497301	resources.pak.rhysida.0.dr	false		unknown
http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)	4X4uE1AuTX.exe, CriticalBreachDetected.pdf24.0.dr, CriticalBreachDetected.pdf289.0.dr, CriticalBreachDetected.pdf84.0.dr, CriticalBreachDetected.pdf270.0.dr, CriticalBreachDetected.pdf216.0.dr, CriticalBreachDetected.pdf397.0.dr, CriticalBreachDetected.pdf154.0.dr, CriticalBreachDetected.pdf77.0.dr, CriticalBreachDetected.pdf167.0.dr, CriticalBreachDetected.pdf66.0.dr, CriticalBreachDetected.pdf130.0.dr, CriticalBreachDetected.pdf120.0.dr, CriticalBreachDetected.pdf367.0.dr, CriticalBreachDetected.pdf381.0.dr, CriticalBreachDetected.pdf310.0.dr, CriticalBreachDetected.pdf368.0.dr, CriticalBreachDetected.pdf404.0.dr, CriticalBreachDetected.pdf231.0.dr, CriticalBreachDetected.pdf134.0.dr, CriticalBreachDetected.pdf374.0.dr	true		unknown
https://codereview.chromium.org/25305002).	resources.pak.rhysida.0.dr	false		unknown
https://www.torproject.org/download/)	4X4uE1AuTX.exe, CriticalBreachDetected.pdf24.0.dr, CriticalBreachDetected.pdf289.0.dr, CriticalBreachDetected.pdf84.0.dr, CriticalBreachDetected.pdf270.0.dr, CriticalBreachDetected.pdf216.0.dr, CriticalBreachDetected.pdf397.0.dr, CriticalBreachDetected.pdf154.0.dr, CriticalBreachDetected.pdf77.0.dr, CriticalBreachDetected.pdf167.0.dr, CriticalBreachDetected.pdf66.0.dr, CriticalBreachDetected.pdf130.0.dr, CriticalBreachDetected.pdf120.0.dr, CriticalBreachDetected.pdf367.0.dr, CriticalBreachDetected.pdf381.0.dr, CriticalBreachDetected.pdf310.0.dr, CriticalBreachDetected.pdf368.0.dr, CriticalBreachDetected.pdf404.0.dr, CriticalBreachDetected.pdf231.0.dr, CriticalBreachDetected.pdf134.0.dr, CriticalBreachDetected.pdf374.0.dr	false		unknown
http://jquery.com/	index.html.rhysida.0.dr	false	URL Reputation: safe	unknown
http://crbug.com/514696	resources.pak.rhysida.0.dr	false		unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524363
Start date and time:	2024-10-02 18:08:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4X4uE1AuTX.exe renamed because original name is a hash value
Original Sample Name:	3c3db3c02a4d04dcafdc71adb8779b787d31142ffeb9ae0e638f979594897cbf.exe
Detection:	MAL
Classification:	mal92.rans.evad.winEXE@1/1025@1/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 14 Number of non-executed functions: 68
Cookbook Comments:	Found application associated with file extension: .exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ax-0001.ax-msedge.net	MBD573792309-CGO7238929273-XDG02823929.exe	Get hash	malicious	AgentTesla	Browse	150.171.28.10
	https://www.cognitoforms.com/f/rADrEGHdv0GgqbomuoObjQ/1	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	https://trello.com/c/2T5XVROV	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	https://42yr.rescindq.com/wqtyZAFZzF3hXgsogboKg/	Get hash	malicious	Tycoon2FA	Browse	150.171.28.10
	Audio_Msg..00299229202324Transcript.html	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://wetransfer.com/downloads/fc718a7028ccd1e273879a61c0883fe420241001145250/8110e2eb5f5a56cc2015d1b3243d9b3120241001145309/33d289?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgrid	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	https://pt9w4x.nauleacepr.com/9QLzRhIr/#Ygovernment.relations@rolls-royce.com	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	https://www.canva.com/design/DAGSL2lLp_4/lQGTdiRa89y3fkgkaFc-uQ/edit?utm_content=DAGSL2lLp_4&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	https://app.getresponse.com/change_details.html?x=a62b&m=BrgFNl&s=BW9rcZD&u=C3YQM&z=EMkQID6&pt=change_details	Get hash	malicious	Unknown	Browse	150.171.28.10
	https://u47113775.ct.sendgrid.net/ls/click?upn=u001.NLjCc2NrF5-2Fl1RHefgLH74dDCI-2FlQUMQCuknF0akr34-3DPZ74_Bz-2FoIC9YMuvgy8ZsoekpZ-2Fn96y0OCAueT5LjwQn-2FX25AbFWdd2iGOJMfOUDymLwSDnjLWUuKOfyExMHrLPQc6sWuvBEF4PT9PwlcB-2BK9NQmoQucfLOeGSzPQg4J-2Bvn2C-2FT7DBGI3L6HQml9TPdefbzANw58o8IwtiN3AMNw21dRhcIy1JE5InQL6ZhzyniB-2FPrKB2Vn9uUJ7Mm1QrvUZh95-2FIqg1tkHnn-2FLCgLCOHUCdp1zwu5x-2Fprfv3kPHwI33RA9-2FJGY9xYPl-2BGH4uHP30vXeaFOwuVkWjx1bpQcAiato1uxhbL8AJAqpgT-2Bg5yQp7xXBACsCORIJr0VehkYFdFdFkgZPx7KSQblwloMm5OUc-2B9bb1d0siCBq5u36Pp2iCgmhq5PmipxmWr1HvrLZkdUUXJjpaRdjjEopb-2Fhw3b-2BUOpmNbUIJywjWyMBcUA9ScKtkpotTga2qo5ZaX-2B7AVyqz8KXtUfTb8SopobzuOWPiU-2BhBa8i7lRIGGQBQZmYU1TWv5mQ8uRPPf-2FWdH9RREF8cMLDET4k24yu8dJdqteeATx8Jfw8MWOWehX6ZTxJWGswooAVOvW116fDJmFNO-2F-2BecR-2Fd9NmRwCYnnK4Bh3IM-3D	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10

Process:	C:\Users\user\Desktop\4X4uE1AuTX.exe
File Type:	PDF document, version 1.4, 1 pages
Category:	dropped
Size (bytes):	114076
Entropy (8bit):	7.764515741104239
Encrypted:	false
SSDEEP:	1536:X1cgCx69vkFBsR0M/xByy/XlEnJR6PoypIfLXbP2aXpXkDLai5192s5GytZCW0vN:FcgCIvABlUxBvX9o3pkDm61oK9Z49mH8
MD5:	B74C9FFD0AC9D966FFD617B69F838F2D
SHA1:	15746A2E8174EA1431006B2F3324B9E01C811387
SHA-256:	2641E49B7F2FA2DFD705A557890E2E4F2F517177BA478CDC0A9F9D5AB00DD332
SHA-512:	0854F66923E8AB5C17431B6E10E5DF103079BF7428E072872B7E93812AA670A1B85114134EA3854164082AEB803811C181B49CDC6840E85D0EB2C2A71E67E52A
Malicious:	false
Reputation:	low
Preview:	%PDF-1.4.%...1 0 obj.<<./Title ()./Creator (...w.k.h.t.m.l.t.o.p.d.f. .0...1.2...5)./Producer (...Q.t. .5...1.2...8)./CreationDate (D:20231108032328-05'00').>>.endobj.2 0 obj.<<./Type /Catalog./Pages 3 0 R.>>.endobj.4 0 obj.<<./Type /ExtGState./SA true./SM 0.02./ca 1.0./CA 1.0./AIS false./SMask /None>>.endobj.5 0 obj.[/Pattern /DeviceRGB].endobj.7 0 obj.<<./Type /XObject./Subtype /Image./Width 1400./Height 600./BitsPerComponent 8./ColorSpace /DeviceGray./Length 8 0 R./Filter /FlateDecode.>>.stream.x....\|.......B.#E.PCQ.ti..R.T.(O..T..A@.,..A.JQJ....R...AJ.@.-!=9ofv7.2.N.Y....cc2s......[8..................................................................................................................................................................................................................................................................................................................................................................................................................

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.895641368172484
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	4X4uE1AuTX.exe
File size:	508'928 bytes
MD5:	93be893ff74816c49f2706f222789027
SHA1:	80de2a5d57c25794a4a379f592621336465edb32
SHA256:	3c3db3c02a4d04dcafdc71adb8779b787d31142ffeb9ae0e638f979594897cbf
SHA512:	ce3abd5176e6d36daab4144c434e0ab51ecc7d8b7e772cfc4b0f8843684a80a167c1399e37b2524dbff3d2099e7a20d291f643fb65ff378e9e5ac9dc527499c7
SSDEEP:	6144:6gVoyb9e9BhzGcIo6gCJv47raqMFdiksMi9agtuMf9opaiYOmDdnT:Vom47ciTt9agUG9oCOmD
TLSH:	87B47C17D6A3566DC12781706F4766736F31BC4C01B0F9AF0291CEA26F61B706BAE329
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....EKe........../...........................@...........................................`... ............................

Entrypoint:	0x4014d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x654B45F0 [Wed Nov 8 08:25:20 2023 UTC]
TLS Callbacks:	0x447ba0
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3e5f19d10bbdbe11ac872f983491b498

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x87000	0x1358	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x78000	0x22c8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x8a020	0x28	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4a1c8	0x4a200	9d14062c8e7e6c328c4e32947ed89011	False	0.4711477655986509	data	6.376693820004082	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4c000	0x1cee0	0x1d000	b71d905120b292ee8af934f16132dc21	False	0.8444655845905172	dBase III DBT, version number 0, next free block index 10, 1st item "1\327K<m#\212\230\247\0114h\243\355P\035\334\263+\374\222\255_c\3135!\261S\272%\240HN\021Gv\225\341 \336\031y\306\334#L\303o\257\325\222\222\351\010\313\017$@<j&\250;2\335\026V\356\311\260/Z\320\241>a\373\334\211\277g\334%\036G\272}\325\253\372\332\023\225\216L$zZ\354D\031\3736\213<\361IRVZ\261\377g$\030>F9Y\314\242K,\244\206\302"	7.745039542747407	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x69000	0xed30	0xee00	6efe5a515b8d9772a5efe33071fd00cb	False	0.29351037289915966	data	5.773055625182381	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x78000	0x22c8	0x2400	d8fc1233174a749a8e18868dcf44cb85	False	0.4754774305555556	data	5.566158809848945	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x7b000	0x222c	0x2400	f5aea3cda9fc66286a066f8873644acc	False	0.1802300347222222	data	4.2738233249504525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x7e000	0x8420	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x87000	0x1358	0x1400	bc12238334550f6aa7ab2c57ff5fc9bb	False	0.2623046875	data	3.9944923193772657	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x89000	0x70	0x200	ee27721499572230106b20a1537a9cf0	False	0.080078125	data	0.3349738039007212	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x8a000	0x68	0x200	2b44d5ad9285129549fe74740bb49421	False	0.060546875	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

DLL	Import
KERNEL32.DLL	AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateSemaphoreA, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetFileAttributesA, GetHandleInformation, GetLastError, GetModuleFileNameW, GetProcessAffinityMask, GetStartupInfoA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDebuggerPresent, LeaveCriticalSection, OutputDebugStringA, QueryPerformanceCounter, RaiseException, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, RtlAddFunctionTable, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetEvent, SetLastError, SetProcessAffinityMask, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, Sleep, SuspendThread, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, UnhandledExceptionFilter, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject
ADVAPI32.dll	CryptAcquireContextA, CryptGenRandom
msvcrt.dll	__C_specific_handler, __dllonexit, __doserrno, __getmainargs, __initenv, __iob_func, __lconv_init, __pioinfo, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthreadex, _cexit, _endthreadex, _errno, _exit, _filelengthi64, _fileno, _findclose, _findfirst64, _fmode, _fullpath, _initterm, _lock, _lseeki64, _onexit, _setjmp, _stat64, _ultoa, _unlock, _write, abort, acos, calloc, exit, fclose, fflush, fgetpos, fopen, fprintf, fread, free, frexp, fseek, fsetpos, ftell, fwprintf, fwrite, malloc, memcmp, memcpy, memmove, memset, printf, raise, rand, realloc, rename, signal, sprintf, srand, strcat, strcmp, strcpy, strlen, strncmp, strncpy, system, vfprintf, wcscpy, _time64, _snwprintf, _findnext64, longjmp, _strdup, _getcwd, _chdir
USER32.dll	MessageBoxW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 18:10:24.333265066 CEST	53	58840	162.159.36.2	192.168.2.4
Oct 2, 2024 18:10:24.872417927 CEST	53	51833	1.1.1.1	192.168.2.4
Oct 2, 2024 18:11:31.442681074 CEST	51734	53	192.168.2.4	1.1.1.1

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 18:11:31.450422049 CEST	1.1.1.1	192.168.2.4	0xb103	No error (0)	tse1.mm.bing.net	mm-mm.bing.net.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 18:11:31.450422049 CEST	1.1.1.1	192.168.2.4	0xb103	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:11:31.450422049 CEST	1.1.1.1	192.168.2.4	0xb103	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	12:09:39
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\4X4uE1AuTX.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\4X4uE1AuTX.exe"
Imagebase:	0x400000
File size:	508'928 bytes
MD5 hash:	93BE893FF74816C49F2706F222789027
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4X4uE1AuTX.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\CriticalBreachDetected.pdf

C:\$WinREAgent\Scratch\CriticalBreachDetected.pdf

C:\CriticalBreachDetected.pdf

C:\Program Files\7-Zip\7-zip.chm.rhysida

C:\Program Files\7-Zip\7z.sfx.rhysida

C:\Program Files\7-Zip\CriticalBreachDetected.pdf

C:\Program Files\7-Zip\History.txt.rhysida

C:\Program Files\7-Zip\Lang\CriticalBreachDetected.pdf

C:\Program Files\7-Zip\Lang\ar.txt.rhysida

C:\Program Files\7-Zip\Lang\be.txt.rhysida

C:\Program Files\7-Zip\Lang\ca.txt.rhysida

C:\Program Files\7-Zip\Lang\da.txt.rhysida

C:\Program Files\7-Zip\Lang\eo.txt.rhysida

C:\Program Files\7-Zip\descript.ion.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\license.html.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\CriticalBreachDetected.pdf

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\license.html.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\CriticalBreachDetected.pdf

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\license.html.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\CriticalBreachDetected.pdf

Windows Analysis Report
4X4uE1AuTX.exe

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	43.4%
Total number of Nodes:	910
Total number of Limit Nodes:	11

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre