Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'crypto_cash_sec.exe' = '%APPDATA%\Adobe86\crypto_cash_sec.exe'
- %APPDATA%\Adobe86\crypto_cash_sec.exe
- <LS_APPDATA>\Adobe (x86)\AcroRd32.exe
- '<LS_APPDATA>\Adobe (x86)\AcroRd32.exe' <Full path to file>