Windows Analysis Report local.exe

AV Detection:

Multi AV Scanner detection for submitted file

Source: local.exe	Virustotal: Detection: 49%			Perma Link
Source: local.exe	ReversingLabs: Detection: 28%

Machine Learning detection for sample

Source: local.exe

Joe Sandbox ML: detected

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\local.exe

Code function: 0_2_000F650A GetCommandLineW,CommandLineToArgvW,lstrcmpW,lstrcmpW,__wfopen_s,lstrcmpW,__wfopen_s,LocalFree,QueryPerformanceCounter,GetTickCount,GetCurrentThreadId,GetCurrentProcessId,CryptAcquireContextW,CryptAcquireContextW,GetLastError,CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,SetErrorMode,FindFirstFileExW,GetLastError,CloseHandle,

0_2_000F650A

Compliance:

Uses 32bit PE files

Source: local.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Creates a directory in C:\Program Files

Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\UNP\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\UNP\Logs\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\UNP\UpdateNotificationMgr\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\Uninstall Information\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\Microsoft Office\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\Microsoft Office\Office16\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\Microsoft Office\Office16\1033\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\Microsoft Office\Office16\OneNote\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\MSBuild\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\MSBuild\Microsoft\How to decrypt files.txt			Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: local.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Spreading:

Checks for available system drives (often done to infect USB drives)

Source: C:\Users\user\Desktop\local.exe	File opened: z:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: x:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: v:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: t:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: r:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: p:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: n:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: l:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: j:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: h:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: f:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: b:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: y:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: w:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: u:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: s:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: q:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: o:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: m:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: k:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: i:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: g:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: e:			Jump to behavior
Source: C:\Windows\System32\bcdedit.exe	File opened: c:			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File opened: a:			Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000F650A GetCommandLineW,CommandLineToArgvW,lstrcmpW,lstrcmpW,__wfopen_s,lstrcmpW,__wfopen_s,LocalFree,QueryPerformanceCounter,GetTickCount,GetCurrentThreadId,GetCurrentProcessId,CryptAcquireContextW,CryptAcquireContextW,GetLastError,CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,SetErrorMode,FindFirstFileExW,GetLastError,CloseHandle,		0_2_000F650A
Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000F50AA _malloc,wnsprintfW,FindFirstFileExW,lstrlenW,lstrcmpW,lstrcmpW,lstrcmpW,wnsprintfW,lstrcmpiW,lstrcmpiW,lstrcmpiW,StrStrIW,lstrlenW,lstrlenW,lstrcmpiW,_malloc,lstrlenW,_malloc,lstrcpyW,PostQueuedCompletionStatus,InterlockedIncrement,FindNextFileW,FindClose,wnsprintfW,GetLastError,		0_2_000F50AA

Networking:

Found Tor onion address

Source: local.exe, 00000000.00000000.331557677.000000000010E000.00000008.00020000.sdmp	String found in binary or memory: * Open link in Tor Browser http://eghv5cpdsmuj5e6tpyjk5icgq642hqubildf6yrfnqlq3rmsqk2zanid.onion/contact
Source: local.exe	String found in binary or memory: * Open link in Tor Browser http://eghv5cpdsmuj5e6tpyjk5icgq642hqubildf6yrfnqlq3rmsqk2zanid.onion/contact

Contains functionality to download additional files from the internet

Source: C:\Users\user\Desktop\local.exe

Code function: 0_2_000F1140 InternetOpenW,InternetSetOptionW,InternetConnectW,HttpOpenRequestW,InternetQueryOptionW,InternetSetOptionW,HttpSendRequestW,InternetQueryDataAvailable,_realloc,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_000F1140

URLs found in memory or binary data

Source: local.exe	String found in binary or memory: http://eghv5cpdsmuj5e6tpyjk5icgq642hqubildf6yrfnqlq3rmsqk2zanid.onion/contact
Source: local.exe	String found in binary or memory: https://www.torproject.org/

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: local.exe, 00000000.00000002.696427947.000000000102A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands:

Deletes shadow drive data (may be related to ransomware)

Source: C:\Users\user\Desktop\local.exe	Process created: C:\Windows\System32\vssadmin.exe 'C:\Windows\sysnative\vssadmin.exe' delete shadows /all /quiet
Source: local.exe, 00000000.00000002.697451338.000000000104E000.00000004.00000020.sdmp	Binary or memory string: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quietK&
Source: local.exe, 00000000.00000002.694280341.0000000000108000.00000002.00020000.sdmp	Binary or memory string: C:\HOW TO RECOVER !!.TXT\sysnative\vssadmin.exe delete shadows /all /quietopenSeTakeOwnershipPrivilegeSeDebugPrivilegeNtQueryObjectntdll.dllmap/set<T> too longvector<T> too longinvalid map/set<T> iteratorNtQuerySystemInformation\H(
Source: vssadmin.exe, 00000002.00000002.340553344.00000213EFE35000.00000004.00000040.sdmp	Binary or memory string: C:\Windows\sysnative\vssadmin.exedeleteshadows/all/quiet
Source: vssadmin.exe, 00000002.00000002.340270525.00000213EFA70000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exe"C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quietC:\Windows\sysnative\vssadmin.exeWinsta0\Default
Source: vssadmin.exe, 00000002.00000002.340270525.00000213EFA70000.00000004.00000020.sdmp	Binary or memory string: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: vssadmin.exe, 00000002.00000002.340515265.00000213EFDD0000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete ShadowStorage
Source: vssadmin.exe, 00000002.00000002.340515265.00000213EFDD0000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete Shadows /Type=ClientAccessible /For=C:
Source: vssadmin.exe, 00000002.00000002.340515265.00000213EFDD0000.00000002.00000001.sdmp	Binary or memory string: vssadmin Delete Shadows
Source: vssadmin.exe, 00000002.00000002.340515265.00000213EFDD0000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete Shadows /For=C: /Oldest
Source: vssadmin.exe, 00000002.00000002.340515265.00000213EFDD0000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete ShadowStorage /For=C: /On=D:
Source: local.exe	Binary or memory string: C:\HOW TO RECOVER !!.TXT\sysnative\vssadmin.exe delete shadows /all /quietopenSeTakeOwnershipPrivilegeSeDebugPrivilegeNtQueryObjectntdll.dllmap/set<T> too longvector<T> too longinvalid map/set<T> iteratorNtQuerySystemInformation\H(

May disable shadow drive data (uses vssadmin)

Source: C:\Users\user\Desktop\local.exe

Process created: C:\Windows\System32\vssadmin.exe 'C:\Windows\sysnative\vssadmin.exe' delete shadows /all /quiet

May drop file containing decryption instructions (likely related to ransomware)

Source: local.exe	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt
Source: local.exe, 00000000.00000003.567256365.000000000362D000.00000004.00000001.sdmp	Binary or memory string: How to decrypt files.txt

May encrypt documents and pictures (Ransomware)

Source: C:\Users\user\Desktop\local.exe	File created: c:\$recycle.bin\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\ikcxnqrikwvekzcndkdcfpkkmisqynbkorpacowjaueheragdtocbduztbqtmdggecablcf\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\onedrive\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files\unp\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files\unp\logs\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\recent\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files\unp\updatenotificationmgr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\default\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\default\desktop\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\default\documents\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\default\downloads\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\default\favorites\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\default\links\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\default\music\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\default\pictures\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\default\videos\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\public\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\default\saved games\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\public\desktop\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\public\documents\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\public\libraries\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\public\music\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\public\pictures\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\public\videos\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\public\downloads\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\jdownloader\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\jdownloader\config\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\$recycle.bin\s-1-5-21-3853321935-2125563209-4053062332-1000\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\desktop\bpmlnobvsb\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\desktop\vamydfpund\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\desktop\sqrkhnbnyn\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\documents\bpmlnobvsb\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\documents\vamydfpund\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\documents\sqrkhnbnyn\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\desktop\rayhiwgkdi\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\desktop\lsbihqfdvt\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\desktop\gaobcviqij\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\documents\rayhiwgkdi\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\documents\lsbihqfdvt\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\documents\gaobcviqij\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\desktop\curqnkvoix\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\desktop\bnagmgsplo\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\desktop\nvwzapqsql\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\documents\curqnkvoix\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\recovery\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\documents\bnagmgsplo\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\documents\nvwzapqsql\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\desktop\wkxewiotxi\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\desktop\palrgucveh\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\desktop\eivqsaotaq\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\documents\wkxewiotxi\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\documents\palrgucveh\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\documents\eivqsaotaq\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files\uninstall information\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\templates\1033\gettingstarted16\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\public\accountpictures\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\office16\1033\dataservices\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\$recycle.bin\s-1-5-21-3853321935-2125563209-4053062332-1001\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\videos\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\saved games\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\pictures\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\links\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\favorites\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\music\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\documents\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\desktop\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\users\user\downloads\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\include\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\examples\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\examples\gui\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\examples\gui\advanced\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\examples\gui\advanced\images\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\examples\gui\simple\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\examples\com\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\icons\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\aut2exe\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\aut2exe\icons\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\extras\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\extras\autoupdateit\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\extras\editors\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\extras\editors\crimson\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\extras\editors\notepad++\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\extras\editors\pspad\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\extras\editors\sublime text\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\extras\editors\textpad\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\extras\geshi\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\extras\prettify\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\scite\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\scite\api\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\autoitx\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\autoitx\examples\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\autoitx\examples\c++\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\autoitx\examples\c++\autoitx\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\autoitx\examples\vbscript\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\examples\helpfile\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\autoit3\examples\helpfile\extras\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files\microsoft office\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files\microsoft office\office16\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files\microsoft office\office16\1033\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files\microsoft office\office16\onenote\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\office16\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\office16\proof\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\office16\proof\1036\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\office16\1036\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files\msbuild\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files\msbuild\microsoft\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\msbuild\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\msbuild\microsoft\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\office16\proof\1033\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\office16\1033\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\templates\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\templates\1033\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\templates\1033\access\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\templates\1033\access\datatype\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\templates\1033\access\part\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\templates\1033\onenote\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\templates\1033\onenote\16\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\templates\1033\onenote\16\stationery\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\templates\1033\onenote\16\notebook templates\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\office16\dcf\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\office16\dcf\en\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\office16\dcf\1033\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\office16\library\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\office16\library\analysis\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\office16\library\solver\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\office16\samples\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\$recycle.bin\s-1-5-18\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\acrolayoutrecognizer\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\setup files\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\setup files\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\locale\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\locale\en_us\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\resource\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\resource\typesupport\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\resource\typesupport\unicode\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\resource\typesupport\unicode\icu\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\esl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\plug_ins3d\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\plug_ins3d\prc\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\air\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\resource\font\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\resource\font\pfm\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\legal\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\legal\enu\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\idtemplates\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\idtemplates\enu\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\acroapp\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\acroapp\enu\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\office16\addins\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\office16\forms\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\office16\forms\1033\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\stationery\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\stationery\1033\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\tracker\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\resource\saslprep\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\plug_ins\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\plug_ins\annotations\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\office16\convert\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\microsoft office\office16\convert\1033\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\acrocef\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\browser\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\browser\wcchromeextn\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\acrocef\locales\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\uithemes\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\javascripts\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\plug_ins\multimedia\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\plug_ins\multimedia\mpp\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\plug_ins\acroform\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\plug_ins\acroform\pmp\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\themes\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\themes\dark\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\themes\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\themes\dark\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\themes\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\themes\dark\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\themes\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\themes\dark\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\libs\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\libs\jquery.ui.touch-punch\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\libs\require\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\libs\require\2.1.15\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\app-api\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\app-api\dev\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\cs-cz\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\ru-ru\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\sv-se\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\sk-sk\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\zh-tw\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\he-il\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\ca-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\da-dk\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\fi-fi\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\nb-no\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\uk-ua\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\fr-ma\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\en-il\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\hr-hr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\ja-jp\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\sl-sl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\hu-hu\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\sl-si\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\ro-ro\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\ar-ae\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\es-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\eu-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\it-it\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\zh-cn\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\en-ae\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\pt-br\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\root\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\ko-kr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\tr-tr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\pl-pl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\en-gb\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\de-de\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\nl-nl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\fr-fr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\misc\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\cs-cz\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\ru-ru\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\sv-se\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\sk-sk\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\zh-tw\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\he-il\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\ca-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\da-dk\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\fi-fi\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\nb-no\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\uk-ua\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\fr-ma\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\en-il\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\hr-hr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\ja-jp\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\sl-sl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\hu-hu\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\sl-si\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\ro-ro\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\ar-ae\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\es-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\eu-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\it-it\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\zh-cn\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\en-ae\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\pt-br\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\root\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\ko-kr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\tr-tr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\pl-pl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\en-gb\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\de-de\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\nl-nl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\fr-fr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\images\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\cs-cz\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\ru-ru\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\sv-se\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\sk-sk\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\zh-tw\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\he-il\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\ca-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\da-dk\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\fi-fi\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\nb-no\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\uk-ua\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\fr-ma\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\en-il\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\hr-hr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\ja-jp\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\sl-sl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\hu-hu\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\sl-si\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\ro-ro\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\ar-ae\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\es-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\eu-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\it-it\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\zh-cn\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\en-ae\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\pt-br\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\root\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\ko-kr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\tr-tr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\pl-pl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\en-gb\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\de-de\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\nl-nl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\fr-fr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\css\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\images\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\images\themes\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\he-il\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\root\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\plugins\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\css\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\cs-cz\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\ru-ru\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\sv-se\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\sk-sk\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\zh-tw\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\he-il\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\ca-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\da-dk\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\fi-fi\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\nb-no\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\uk-ua\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\fr-ma\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\en-il\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\hr-hr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\ja-jp\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\sl-sl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\hu-hu\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\sl-si\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\ro-ro\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\ar-ae\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\es-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\eu-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\it-it\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\zh-cn\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\en-ae\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\pt-br\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\root\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\ko-kr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\tr-tr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\pl-pl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\en-gb\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\de-de\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\nl-nl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\fr-fr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\css\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-recent-files-select\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-recent-files-select\js\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-recent-files-select\css\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\themes\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\themes\dark\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\themeless\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\cs-cz\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\ru-ru\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\sv-se\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\sk-sk\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\zh-tw\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\he-il\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\ca-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\da-dk\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\fi-fi\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\nb-no\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\uk-ua\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\fr-ma\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\en-il\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\hr-hr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\ja-jp\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\sl-sl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\hu-hu\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\sl-si\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\ro-ro\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\ar-ae\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\es-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\eu-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\it-it\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\zh-cn\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\en-ae\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\pt-br\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\root\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\ko-kr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\tr-tr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\pl-pl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\en-gb\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\de-de\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\nl-nl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\fr-fr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\css\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\images\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\images\themes\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\images\themes\dark\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\ru-ru\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\sv-se\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\zh-tw\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\he-il\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\ca-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\da-dk\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\fi-fi\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\nb-no\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\en-il\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\hr-hr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\sl-sl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\sl-si\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\ar-ae\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\es-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\eu-es\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\it-it\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\zh-cn\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\en-ae\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\pt-br\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\root\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\en-gb\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\de-de\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\nl-nl\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\css\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\collect_feedback\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\collect_feedback\js\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\collect_feedback\css\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\task-handler\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\task-handler\images\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\task-handler\js\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\task-handler\js\nls\how to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	File created: c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\task-handler\js\nls\sv-se\how to decrypt files.txt			Jump to behavior

Writes many files with high entropy

Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-selector.js entropy: 7.99741048738			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt.chm entropy: 7.99996986809			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\Include\Excel.au3 entropy: 7.99457437801			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\Include\ie.au3 entropy: 7.9970447671			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\Include\Word.au3 entropy: 7.99178026352			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\Examples\GUI\msoobe.jpg entropy: 7.99050975676			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\Examples\COM\Scriptomatic.au3 entropy: 7.9900939882			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\Extras\AutoUpdateIt\AutoUpdateIt.au3 entropy: 7.99312239605			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\Extras\Editors\Notepad++\autoit.xml entropy: 7.9984974236			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\Extras\Editors\PSPad\AutoIt3.ini entropy: 7.99695142411			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\Extras\Editors\PSPad\AutoIt3.def entropy: 7.99853646032			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\Extras\Editors\Sublime Text\AutoIt.tmLanguage entropy: 7.99631498643			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\Extras\Editors\TextPad\autoit_v3.syn entropy: 7.99680602793			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\Extras\Geshi\autoit.php entropy: 7.99629273048			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\api\au3.api entropy: 7.99791292526			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX.chm entropy: 7.99899444634			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.Assembly.xml entropy: 7.99312506278			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3_DLL.lib entropy: 7.99177813099			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3_x64_DLL.lib entropy: 7.99226950181			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\Airplane.wav entropy: 7.99720139674			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\Tech.bmp entropy: 7.99789361467			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\Silverlight.png entropy: 7.99450477773			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\PROOF\MSHY7FR.LEX entropy: 7.99418997465			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\PROOF\MSSP7FR.LEX entropy: 7.99843344299			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\PROOF\msth8FR.LEX entropy: 7.99475601685			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\_Excel1.xls entropy: 7.9918714841			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\mscss7wre_en.dub entropy: 7.99451435756			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\_Excel2.xls entropy: 7.99128971155			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\PROOF\MSHY7EN.LEX entropy: 7.99664226653			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\PROOF\MSSP7EN.LEX entropy: 7.99880047689			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\accessparts.xml entropy: 7.994838572			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\1 Right.accdt entropy: 7.99113799685			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\1 Top.accdt entropy: 7.99040235586			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Right.accdt entropy: 7.99098197458			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Top.accdt entropy: 7.99019578541			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Contacts.accdt entropy: 7.99915166387			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Issues.accdt entropy: 7.99476582603			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\List.accdt entropy: 7.99144974733			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Tasks.accdt entropy: 7.99450757926			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Tabs.accdt entropy: 7.99135819423			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Users.accdt entropy: 7.99343402085			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\MSACCESS.HXS entropy: 7.9993524441			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\STSLIST.CHM entropy: 7.99954478505			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\TellMeAccess.nrr entropy: 7.9966940139			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\16\Stationery\ACADEMIC.ONE entropy: 7.99773930148			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\16\Stationery\BUSINESS.ONE entropy: 7.99722340145			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\16\Stationery\DESIGNER.ONE entropy: 7.99936585415			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\ONENOTE.HXS entropy: 7.99917927209			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\16\Stationery\PLANNERS.ONE entropy: 7.99851838021			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\PSRCHLEX.DAT entropy: 7.99786709964			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\PSRCHLTS.DAT entropy: 7.99380618315			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\PSRCHSRN.DAT entropy: 7.99994698102			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\TellMeOneNote.nrr entropy: 7.99551364329			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\DCF\en\DatabaseCompare.HxS entropy: 7.99905829828			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\DCF\en\SpreadsheetCompare.HxS entropy: 7.99910033631			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\Library\Analysis\ATPVBAEN.XLAM entropy: 7.99532489664			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Templates\1033\BloodPressureTracker.xltx entropy: 7.99353931805			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\EXCEL.HXS entropy: 7.99985991098			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\Library\Analysis\FUNCRES.XLAM entropy: 7.99882946595			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Templates\1033\LoanAmortization.xltx entropy: 7.9971264986			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Templates\1033\PersonalMonthlyBudget.xltx entropy: 7.99323452334			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\Library\Analysis\PROCDB.XLAM entropy: 7.99975005337			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Templates\1033\SalesReport.xltx entropy: 7.99558309997			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\Library\SOLVER\SOLVER.XLAM entropy: 7.99979666871			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\SAMPLES\SOLVSAMP.XLS entropy: 7.99150580203			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\TellMeExcel.nrr entropy: 7.997775418			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\GROOVE.HXS entropy: 7.9985121402			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\LYNC.HXS entropy: 7.99868603994			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\LYNC_BASIC.HXS entropy: 7.9985738625			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\LYNC_ONLINE.HXS entropy: 7.9985616823			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\SKYPEFB.HXS entropy: 7.99847379042			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\SKYPEFB_BASIC.HXS entropy: 7.99862631313			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\SKYPEFB_ONLINE.HXS entropy: 7.99829912298			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\SKYPEFB_ONLINEG.HXS entropy: 7.99852045057			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\EADOCUMENTAPPROVAL_REVIEW.XSN entropy: 7.99126348899			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\EXPTOOWS.XLA entropy: 7.99428451286			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\GR8GALRY.GRA entropy: 7.99352919339			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\GRAPH.HXS entropy: 7.99970051605			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\MSOUC.HXS entropy: 7.99901943972			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\icudt26l.dat entropy: 7.99538262249			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\MSQRY32.CHM entropy: 7.99963797612			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\MSZIP.DIC entropy: 7.99946681047			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\MyriadCAD.otf entropy: 7.99725855066			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\ReviewRouting_Review.xsn entropy: 7.99014170501			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\SETLANG.HXS entropy: 7.99865416758			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\VBAOWS10.CHM entropy: 7.99919467913			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\AdobePiStd.otf entropy: 7.99778681149			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd.otf entropy: 7.99517321862			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-Bold.otf entropy: 7.99434192117			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-BoldOblique.otf entropy: 7.99432690252			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-Oblique.otf entropy: 7.9945758586			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-Bold.otf entropy: 7.99848849598			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-BoldIt.otf entropy: 7.99822234419			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-It.otf entropy: 7.9985303631			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-Regular.otf entropy: 7.99861213781			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-Bold.otf entropy: 7.99652956195			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-BoldIt.otf entropy: 7.99697992649			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-It.otf entropy: 7.99688528474			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\SY______.PFB entropy: 7.99417834246			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\ZX______.PFB entropy: 7.99727434362			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-Regular.otf entropy: 7.99691826242			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\ZY______.PFB entropy: 7.99783629131			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf entropy: 7.9975487463			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf entropy: 7.99842939409			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf entropy: 7.9976437777			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf entropy: 7.99808599162			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf entropy: 7.9966863701			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf entropy: 7.99804415696			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf entropy: 7.99440197684			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\StorageConnectors.api entropy: 7.99813049315			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DropboxStorage.api entropy: 7.99789355861			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\COPYING.LGPLv2.1.txt entropy: 7.99079526362			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf entropy: 7.99894839089			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf entropy: 7.99668933687			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf entropy: 7.99905762787			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Microsoft.VCLibs.x86.14.00.appx entropy: 7.9996693395			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RDCNotificationClient.appx entropy: 7.9998273659			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Accessibility.api entropy: 7.9983858718			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\MakeAccessible.api entropy: 7.99893035455			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PDDom.api entropy: 7.9982087909			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\reflow.api entropy: 7.99872242025			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SaveAsRTF.api entropy: 7.99837636155			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Spelling.api entropy: 7.99816360735			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvSOFT.x3d entropy: 7.99865840549			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\2d.x3d entropy: 7.9975951481			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\3difr.x3d entropy: 7.99829446693			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvDX9.x3d entropy: 7.99841255573			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prcr.x3d entropy: 7.99899274949			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia.api entropy: 7.99868186033			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\Flash.mpp entropy: 7.99600877527			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp entropy: 7.99082242297			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp entropy: 7.99706682474			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\adobepdf.xdc entropy: 7.99535356392			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp entropy: 7.99560080454			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp entropy: 7.99044548296			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\QRCode.pmp entropy: 7.99533497752			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annots.api entropy: 7.99929114486			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Checkers.api entropy: 7.99329639064			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DVA.api entropy: 7.99742961487			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DigSig.api entropy: 7.99889031414			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\EScript.api entropy: 7.99750732824			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\IA32.api entropy: 7.99709395178			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PPKLite.api entropy: 7.99879027157			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\ReadOutLoud.api entropy: 7.99689673238			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SendMail.api entropy: 7.99914221002			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\weblink.api entropy: 7.99853417306			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\eBook.api entropy: 7.99464833755			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html entropy: 7.99475243886			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Search.api entropy: 7.99833398069			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Updater.api entropy: 7.99761513958			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png entropy: 7.99651999345			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons_retina.png entropy: 7.99729888218			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_wob.png entropy: 7.99522700526			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png entropy: 7.99349697655			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_bow.png entropy: 7.99538012433			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons.png entropy: 7.99385633746			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_highcontrast.png entropy: 7.99537318539			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_hiContrast_wob.png entropy: 7.99591894401			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_bow.png entropy: 7.99581488887			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_hiContrast_bow.png entropy: 7.99655859898			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_wob.png entropy: 7.99677873526			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb_new.png entropy: 7.99576555756			Jump to dropped file
Source: C:\Users\user\Desktop\local.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb.png entropy: 7.99715165646			Jump to dropped file

System Summary:

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\local.exe

Process Stats: CPU usage > 98%

Contains functionality to call native functions

Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000F891A __EH_prolog3_GS,_malloc,NtQuerySystemInformation,_realloc,NtQuerySystemInformation,OpenProcess,GetCurrentProcess,DuplicateHandle,CloseHandle,CloseHandle,GetFileType,_malloc,SetEvent,WaitForSingleObject,TerminateThread,CloseHandle,CreateThread,GetCurrentProcessId,CloseHandle,CloseHandle,		0_2_000F891A
Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000F5399 CreateFileW,_memset,DeviceIoControl,GetModuleHandleW,GetProcAddress,_memset,NtCreateFile,NtQueryObject,wnsprintfW,wnsprintfW,StrStrIW,wnsprintfW,_malloc,lstrlenW,_malloc,lstrcpyW,PostQueuedCompletionStatus,lstrlenW,StrCmpNIW,StrCmpNIW,lstrlenW,StrCmpNIW,StrStrIW,lstrlenW,StrCmpNIW,lstrlenW,StrCmpNIW,NtCreateFile,NtQueryObject,wnsprintfW,StrStrIW,_malloc,_malloc,PostQueuedCompletionStatus,InterlockedIncrement,DeviceIoControl,CloseHandle,		0_2_000F5399
Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000F85E4 WaitForSingleObject,NtQueryObject,SetEvent,WaitForSingleObject,		0_2_000F85E4

Contains functionality to communicate with device drivers

Source: C:\Users\user\Desktop\local.exe

Code function: 0_2_000F5399: CreateFileW,_memset,DeviceIoControl,GetModuleHandleW,GetProcAddress,_memset,NtCreateFile,NtQueryObject,wnsprintfW,wnsprintfW,StrStrIW,wnsprintfW,_malloc,lstrlenW,_malloc,lstrcpyW,PostQueuedCompletionStatus,lstrlenW,StrCmpNIW,StrCmpNIW,lstrlenW,StrCmpNIW,StrStrIW,lstrlenW,StrCmpNIW,lstrlenW,StrCmpNIW,NtCreateFile,NtQueryObject,wnsprintfW,StrStrIW,_malloc,_malloc,PostQueuedCompletionStatus,InterlockedIncrement,DeviceIoControl,CloseHandle,

0_2_000F5399

Detected potential crypto function

Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000F143A		0_2_000F143A
Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000F405A		0_2_000F405A
Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000F3C82		0_2_000F3C82
Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000F39FB		0_2_000F39FB
Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000F16EB		0_2_000F16EB
Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000F2AE2		0_2_000F2AE2
Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000F3F38		0_2_000F3F38
Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000FB731		0_2_000FB731

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\local.exe

Code function: String function: 000FBCF8 appears 41 times

Sample file is different than original file name gathered from version info

Source: local.exe, 00000000.00000002.707862138.0000000002F60000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs local.exe
Source: local.exe, 00000000.00000002.707862138.0000000002F60000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs local.exe
Source: local.exe, 00000000.00000002.699095843.0000000001270000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs local.exe

Uses 32bit PE files

Source: local.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Binary contains paths to development resources

Source: autoit.xml.0.dr

Binary or memory string: LX.vbp

Classification label

Source: classification engine

Classification label: mal100.rans.evad.winEXE@12/1025@0/0

Contains functionality to adjust token privileges (e.g. debug / backup)

Source: C:\Users\user\Desktop\local.exe

Code function: 0_2_000F48CF GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,

0_2_000F48CF

Contains functionality to check free disk space

Source: C:\Users\user\Desktop\local.exe

Code function: 0_2_000F5A2F __EH_prolog3_GS,CreateIoCompletionPort,GetSystemInfo,_malloc,CreateThread,GetLogicalDrives,wnsprintfW,wnsprintfW,GetDriveTypeW,wnsprintfW,GetDiskFreeSpaceExW,wnsprintfW,_fgetws,_fgetws,GetLogicalDrives,_malloc,wnsprintfW,GetDriveTypeW,wnsprintfW,CreateThread,CreateThread,WaitForSingleObject,CloseHandle,CreateThread,WaitForMultipleObjects,CloseHandle,OpenProcess,TerminateProcess,CloseHandle,Sleep,_malloc,lstrlenW,_malloc,lstrcpyW,PostQueuedCompletionStatus,InterlockedIncrement,Sleep,Sleep,PostQueuedCompletionStatus,WaitForMultipleObjects,CloseHandle,CloseHandle,

0_2_000F5A2F

Contains functionality to enum processes or threads

Source: C:\Users\user\Desktop\local.exe

Code function: 0_2_000F643A CreateToolhelp32Snapshot,Process32NextW,lstrcmpW,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,

0_2_000F643A

Creates files inside the program directory

Source: C:\Users\user\Desktop\local.exe

File created: C:\Program Files\How to decrypt files.txt

Jump to behavior

Creates files inside the user directory

Source: C:\Users\user\Desktop\local.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6500:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6392:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6604:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6632:120:WilError_01

PE file has an executable .text section and no other executable section

Source: local.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Windows\System32\vssadmin.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Source: local.exe	Virustotal: Detection: 49%
Source: local.exe	ReversingLabs: Detection: 28%

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\local.exe 'C:\Users\user\Desktop\local.exe'
Source: C:\Users\user\Desktop\local.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\local.exe	Process created: C:\Windows\System32\vssadmin.exe 'C:\Windows\sysnative\vssadmin.exe' delete shadows /all /quiet
Source: C:\Windows\System32\vssadmin.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\local.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\sysnative\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\local.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\sysnative\cmd.exe' /c bcdedit /set {current} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {current} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {current} bootstatuspolicy ignoreallfailures			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {current} recoveryenabled no			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\System32\vssadmin.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2C2787D-95AB-40D4-942D-298F5F757874}\InProcServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\UNP\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\UNP\Logs\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\UNP\UpdateNotificationMgr\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\Uninstall Information\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\Microsoft Office\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\Microsoft Office\Office16\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\Microsoft Office\Office16\1033\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\Microsoft Office\Office16\OneNote\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\MSBuild\How to decrypt files.txt			Jump to behavior
Source: C:\Users\user\Desktop\local.exe	Directory created: C:\Program Files\MSBuild\Microsoft\How to decrypt files.txt			Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: local.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

PE file contains a valid data directory to section mapping

Source: local.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: local.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: local.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: local.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: local.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\local.exe

Code function: 0_2_00100943 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_00100943

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000FBD3D push ecx; ret		0_2_000FBD50
Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000F6EC3 push 5900003Bh; ret		0_2_000F6ECA
Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_00106332 push ecx; ret		0_2_00106345

Persistence and Installation Behavior:

Uses bcdedit to modify the Windows boot settings

Source: C:\Users\user\Desktop\local.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\sysnative\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\local.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\sysnative\cmd.exe' /c bcdedit /set {current} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {current} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {current} bootstatuspolicy ignoreallfailures			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {current} recoveryenabled no			Jump to behavior

May use bcdedit to modify the Windows boot settings

Source: local.exe

Binary or memory string: id=%s&disksinfo=%s/c ping 127.0.0.1 && del "%s" >> NULSOFTWARE\RaccineSYSTEM\CurrentControlSet\Services\EventLog\Application\RaccineSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskshadow.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe-lr-d-pSuccessfully generated seed with CryptGenRandom.

Hooking and other Techniques for Hiding and Protection:

Creates files in the recycle bin to hide itself

Source: C:\Users\user\Desktop\local.exe

File created: C:\$Recycle.Bin\How to decrypt files.txt

Jump to behavior

Malware Analysis System Evasion:

Contains capabilities to detect virtual machines

Source: C:\Users\user\Desktop\local.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\local.exe

Code function: 0_2_000F650A rdtsc

0_2_000F650A

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Users\user\Desktop\local.exe

Code function: 0_2_000F891A __EH_prolog3_GS,_malloc,NtQuerySystemInformation,_realloc,NtQuerySystemInformation,OpenProcess,GetCurrentProcess,DuplicateHandle,CloseHandle,CloseHandle,GetFileType,_malloc,SetEvent,WaitForSingleObject,TerminateThread,CloseHandle,CreateThread,GetCurrentProcessId,CloseHandle,CloseHandle,

0_2_000F891A

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\System32\conhost.exe

Window / User API: threadDelayed 3007

Jump to behavior

Found evasive API chain (may stop execution after checking a module file name)

Source: C:\Users\user\Desktop\local.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000F650A GetCommandLineW,CommandLineToArgvW,lstrcmpW,lstrcmpW,__wfopen_s,lstrcmpW,__wfopen_s,LocalFree,QueryPerformanceCounter,GetTickCount,GetCurrentThreadId,GetCurrentProcessId,CryptAcquireContextW,CryptAcquireContextW,GetLastError,CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,SetErrorMode,FindFirstFileExW,GetLastError,CloseHandle,		0_2_000F650A
Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000F50AA _malloc,wnsprintfW,FindFirstFileExW,lstrlenW,lstrcmpW,lstrcmpW,lstrcmpW,wnsprintfW,lstrcmpiW,lstrcmpiW,lstrcmpiW,StrStrIW,lstrlenW,lstrlenW,lstrcmpiW,_malloc,lstrlenW,_malloc,lstrcpyW,PostQueuedCompletionStatus,InterlockedIncrement,FindNextFileW,FindClose,wnsprintfW,GetLastError,		0_2_000F50AA

Contains functionality to query system information

Source: C:\Users\user\Desktop\local.exe

Code function: 0_2_000F5A2F __EH_prolog3_GS,CreateIoCompletionPort,GetSystemInfo,_malloc,CreateThread,GetLogicalDrives,wnsprintfW,wnsprintfW,GetDriveTypeW,wnsprintfW,GetDiskFreeSpaceExW,wnsprintfW,_fgetws,_fgetws,GetLogicalDrives,_malloc,wnsprintfW,GetDriveTypeW,wnsprintfW,CreateThread,CreateThread,WaitForSingleObject,CloseHandle,CreateThread,WaitForMultipleObjects,CloseHandle,OpenProcess,TerminateProcess,CloseHandle,Sleep,_malloc,lstrlenW,_malloc,lstrcpyW,PostQueuedCompletionStatus,InterlockedIncrement,Sleep,Sleep,PostQueuedCompletionStatus,WaitForMultipleObjects,CloseHandle,CloseHandle,

0_2_000F5A2F

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: local.exe, 00000000.00000003.635764010.0000000004438000.00000004.00000001.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-bpa_31bf3856ad364e35_10.0.17134.1_none_84e0eedae46f7b9bone_84e0eedae46f7b9b
Source: local.exe, 00000000.00000003.592547641.00000000043BB000.00000004.00000001.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-hgs_31bf3856ad364e35_10.0.17134.1_none_8ce33edadf477e7aone_8ce33edadf477e7a<
Source: bcdedit.exe, 0000000A.00000002.340261795.000001D4C7CF0000.00000002.00000001.sdmp, bcdedit.exe, 0000000C.00000002.340610001.000001715BBF0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: local.exe, 00000000.00000003.635764010.0000000004438000.00000004.00000001.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-hgs_31bf3856ad364e35_10.0.17134.1_none_8ce33edadf477e7aone_8ce33edadf477e7a
Source: local.exe, 00000000.00000003.635764010.0000000004438000.00000004.00000001.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-kmcl_31bf3856ad364e35_10.0.17134.1_none_58d19a03c592a9cbone_58d19a03c592a9cb{
Source: bcdedit.exe, 0000000A.00000002.340261795.000001D4C7CF0000.00000002.00000001.sdmp, bcdedit.exe, 0000000C.00000002.340610001.000001715BBF0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: local.exe, 00000000.00000003.635947977.0000000003660000.00000004.00000001.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-passthru-parser_31bf3856ad364e35_10.0.17134.1_none_076f3325872ef096one_076f3325872ef096ce
Source: bcdedit.exe, 0000000A.00000002.340261795.000001D4C7CF0000.00000002.00000001.sdmp, bcdedit.exe, 0000000C.00000002.340610001.000001715BBF0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: local.exe, 00000000.00000003.635947977.0000000003660000.00000004.00000001.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-sysprep-provider_31bf3856ad364e35_10.0.17134.1_none_18c6a9392dd7eb3eone_18c6a9392dd7eb3e4
Source: local.exe, 00000000.00000003.599939028.00000000043BE000.00000004.00000001.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-kmcl_31bf3856ad364e35_10.0.17134.1_none_58d19a03c592a9cbone_58d19a03c592a9cbs
Source: local.exe, 00000000.00000003.635947977.0000000003660000.00000004.00000001.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-rdv_31bf3856ad364e35_10.0.17134.1_none_6054528c8a07dd45one_6054528c8a07dd456
Source: bcdedit.exe, 0000000A.00000002.340261795.000001D4C7CF0000.00000002.00000001.sdmp, bcdedit.exe, 0000000C.00000002.340610001.000001715BBF0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: bcdedit.exe, 0000000C.00000002.340357183.000001715B97C000.00000004.00000020.sdmp	Binary or memory string: pEFI VMware Virtual SATA CDROM Drive (0.0)

Anti Debugging:

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\local.exe

Code function: 0_2_000F650A rdtsc

0_2_000F650A

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\local.exe

Code function: 0_2_000FA8BD _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_000FA8BD

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Users\user\Desktop\local.exe

Code function: 0_2_000F891A __EH_prolog3_GS,_malloc,NtQuerySystemInformation,_realloc,NtQuerySystemInformation,OpenProcess,GetCurrentProcess,DuplicateHandle,CloseHandle,CloseHandle,GetFileType,_malloc,SetEvent,WaitForSingleObject,TerminateThread,CloseHandle,CreateThread,GetCurrentProcessId,CloseHandle,CloseHandle,

0_2_000F891A

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\local.exe

Code function: 0_2_00100943 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_00100943

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\local.exe

Code function: 0_2_0010422B CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_0010422B

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000FA8BD _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_000FA8BD
Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000FFCB5 SetUnhandledExceptionFilter,		0_2_000FFCB5
Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_001040F4 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_001040F4
Source: C:\Users\user\Desktop\local.exe	Code function: 0_2_000F9DA0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_000F9DA0

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {current} bootstatuspolicy ignoreallfailures			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {current} recoveryenabled no			Jump to behavior

Contains functionality to create a new security descriptor

Source: C:\Users\user\Desktop\local.exe

Code function: 0_2_000F4793 AllocateAndInitializeSid,CreateFileW,SetEntriesInAclW,SetNamedSecurityInfoW,LocalFree,FreeSid,

0_2_000F4793

May try to detect the Windows Explorer process (often used for injection)

Source: local.exe, 00000000.00000002.700768677.0000000001670000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: local.exe, 00000000.00000002.700768677.0000000001670000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: local.exe, 00000000.00000002.700768677.0000000001670000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: local.exe, 00000000.00000002.700768677.0000000001670000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\local.exe

Code function: GetLocaleInfoA,

0_2_00105A7F

Contains functionality to query local / system time

Source: C:\Users\user\Desktop\local.exe

Code function: 0_2_001003FD GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_001003FD