Windows Analysis Report
VGsDXrDPC8.exe

Overview

General Information

Sample name: VGsDXrDPC8.exe
renamed because original name is a hash value
Original sample name: b183b142d3c4e99ee07c3407b82858146fa61ded95be2e67ce920c8002309fb0.exe
Analysis ID: 1524356
MD5: 7cfba113342f78b5909f606c26fc1dc4
SHA1: f9e65f0cb46128bdc218053e1549c5e584ab6cd5
SHA256: b183b142d3c4e99ee07c3407b82858146fa61ded95be2e67ce920c8002309fb0
Tags: exeRhysidauser-JAMESWT_MHT
Infos:

Detection

Rhysida
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Rhysida Ransomware
AI detected suspicious sample
Found API chain indicative of debugger detection
Found Tor onion address
Self deletion via cmd or bat file
Sigma detected: Suspicious Ping/Del Command Combination
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes many files with high entropy
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Contains capabilities to detect virtual machines
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains sections with non-standard names
Sample execution stops while process was sleeping (likely an evasion)
Uses Microsoft's Enhanced Cryptographic Provider

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: VGsDXrDPC8.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: VGsDXrDPC8.exe ReversingLabs: Detection: 70%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0043E2E1 CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptAcquireContextA, 0_2_0043E2E1
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\7-Zip\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\7-Zip\Lang\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\locales\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\swiftshader\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CAN\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\DEU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\FRA\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\JPN\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\UK\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ar_AE\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\cs_CZ\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\da_DK\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\el_GR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_AE\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_GB\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_IL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\es_ES\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\en_US\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\private\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\prod\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\stage\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\fonts\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\cef\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\libs\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\cef\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\libs\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\cef\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\libs\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\hi_contrast\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\microsoftGraph\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\2.1.15\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\misc\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themeless_Reader\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\ccpdf\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\themeless\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\CriticalBreachDetected.pdf Jump to behavior
Source: VGsDXrDPC8.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: ntkrnlmp.pdb1 6 source: VGsDXrDPC8.exe, 00000000.00000002.4223866122.0000000003F72000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysida! source: VGsDXrDPC8.exe, 00000000.00000002.4234219264.0000000004DE9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb: source: VGsDXrDPC8.exe, 00000000.00000002.4226889900.0000000004AB0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysida source: VGsDXrDPC8.exe, 00000000.00000002.4225083979.00000000040AF000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4238682522.000000000517F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222286993.0000000003D1A000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4233827173.0000000004D8B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236194283.0000000004F95000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231871296.0000000004BC2000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4237487357.000000000509D000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4235227694.0000000004EB6000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223563309.0000000003F44000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232759907.0000000004CA0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4227111239.0000000004AFA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4224331165.0000000004016000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226182498.00000000041C5000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4234219264.0000000004DE9000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222622997.0000000003DE4000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222979445.0000000003E7A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb5 source: VGsDXrDPC8.exe, 00000000.00000002.4221636473.0000000003B82000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbu source: VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbv source: VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ata\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: VGsDXrDPC8.exe, 00000000.00000002.4222505078.0000000003D9A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb]UV source: VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb source: VGsDXrDPC8.exe, 00000000.00000002.4223970753.0000000003F97000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232816791.0000000004CB6000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223866122.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223149716.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221470128.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221636473.0000000003B82000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4227226571.0000000004B0C000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4237659303.00000000050D1000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222017503.0000000003C60000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226611227.0000000004254000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236869840.000000000502F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4238779381.0000000005191000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225813340.0000000004164000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4233677060.0000000004D64000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236134100.0000000004F7B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221829131.0000000003C0D000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222784070.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222409759.0000000003D74000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226889900.0000000004AB0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ata\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\**ser_ source: VGsDXrDPC8.exe, 00000000.00000002.4222505078.0000000003D9A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbfE source: VGsDXrDPC8.exe, 00000000.00000002.4221829131.0000000003C0D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbKUV source: VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbD source: VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbF source: VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbVV% source: VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysidaF, source: VGsDXrDPC8.exe, 00000000.00000002.4233677060.0000000004D64000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb source: VGsDXrDPC8.exe, 00000000.00000002.4223970753.0000000003F97000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232816791.0000000004CB6000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223866122.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223149716.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221470128.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221636473.0000000003B82000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4227226571.0000000004B0C000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4237659303.00000000050D1000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222017503.0000000003C60000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226611227.0000000004254000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236869840.000000000502F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4238779381.0000000005191000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225813340.0000000004164000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4233677060.0000000004D64000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236134100.0000000004F7B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221829131.0000000003C0D000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222784070.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222409759.0000000003D74000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226889900.0000000004AB0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbNV= source: VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysidaZ4m source: VGsDXrDPC8.exe, 00000000.00000002.4225813340.0000000004164000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysida^ source: VGsDXrDPC8.exe, 00000000.00000002.4223149716.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysidaa source: VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbT source: VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysidaAnG source: VGsDXrDPC8.exe, 00000000.00000002.4222784070.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysida{ source: VGsDXrDPC8.exe, 00000000.00000002.4222286993.0000000003D1A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb` source: VGsDXrDPC8.exe, 00000000.00000002.4222017503.0000000003C60000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb@d' source: VGsDXrDPC8.exe, 00000000.00000002.4236869840.000000000502F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysida\ source: VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbWUX source: VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb1U source: VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb%?Q source: VGsDXrDPC8.exe, 00000000.00000002.4226611227.0000000004254000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbe source: VGsDXrDPC8.exe, 00000000.00000002.4221470128.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysidaM source: VGsDXrDPC8.exe, 00000000.00000002.4223563309.0000000003F44000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdboU` source: VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysida source: VGsDXrDPC8.exe, 00000000.00000002.4223970753.0000000003F97000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232816791.0000000004CB6000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223866122.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223149716.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4237659303.00000000050D1000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236869840.000000000502F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4238779381.0000000005191000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225813340.0000000004164000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4233677060.0000000004D64000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236134100.0000000004F7B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222784070.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222409759.0000000003D74000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbr source: VGsDXrDPC8.exe, 00000000.00000002.4237659303.00000000050D1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbh source: VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbi source: VGsDXrDPC8.exe, 00000000.00000002.4221470128.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysidaj source: VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb, source: VGsDXrDPC8.exe, 00000000.00000002.4236134100.0000000004F7B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbm source: VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysidaW source: VGsDXrDPC8.exe, 00000000.00000002.4225083979.00000000040AF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysidav!= source: VGsDXrDPC8.exe, 00000000.00000002.4222409759.0000000003D74000.00000004.00000020.00020000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 4x nop then jmp 00430810h 0_2_0041E211
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 4x nop then lea r8, qword ptr [00000000004DAAE0h] 0_2_0042BD50
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 4x nop then lea r8, qword ptr [00000000004DA0A0h] 0_2_00428DA0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 4x nop then lea r8, qword ptr [00000000004DB100h] 0_2_0042CF10

Networking
barindex
Found Tor onion address
Source: VGsDXrDPC8.exe, 00000000.00000003.4205317664.00000000026CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion
Source: VGsDXrDPC8.exe, 00000000.00000003.4205317664.00000000026CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion
Source: VGsDXrDPC8.exe, 00000000.00000002.4214854938.00000000026CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion
Source: VGsDXrDPC8.exe, 00000000.00000002.4214854938.00000000026CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion
Source: VGsDXrDPC8.exe, 00000000.00000002.4220320045.0000000003819000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: VGsDXrDPC8.exe, 00000000.00000002.4220320045.0000000003819000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf24.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf24.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf289.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf289.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf84.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf84.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf270.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf270.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf216.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf216.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf154.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf154.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf77.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf77.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf167.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf167.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf66.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf66.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf130.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf130.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf120.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf120.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf310.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf310.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf231.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf231.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf134.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf134.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf207.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf207.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf176.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf176.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf339.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf339.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf229.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf229.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf192.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf192.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf224.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf224.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf102.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf102.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf168.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf168.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf5.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf5.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf155.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf155.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf240.0.dr String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf240.0.dr String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Uses ping.exe to check the status of other devices and networks
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Source: resources.pak.rhysida.0.dr String found in binary or memory: http://crbug.com/275944
Source: resources.pak.rhysida.0.dr String found in binary or memory: http://crbug.com/497301
Source: resources.pak.rhysida.0.dr String found in binary or memory: http://crbug.com/514696
Source: resources.pak.rhysida.0.dr String found in binary or memory: http://crbug.com/717501
Source: resources.pak.rhysida.0.dr String found in binary or memory: http://crbug.com/775961
Source: resources.pak.rhysida.0.dr String found in binary or memory: http://crbug.com/839189
Source: index.html.rhysida.0.dr String found in binary or memory: http://jquery.com/
Source: index.html.rhysida.0.dr String found in binary or memory: http://jquery.org/license
Source: VGsDXrDPC8.exe, 00000000.00000003.4205317664.00000000026CE000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4214854938.00000000026CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion
Source: VGsDXrDPC8.exe, 00000000.00000002.4220320045.0000000003819000.00000004.00000020.00020000.00000000.sdmp, CriticalBreachDetected.pdf24.0.dr, CriticalBreachDetected.pdf289.0.dr, CriticalBreachDetected.pdf84.0.dr, CriticalBreachDetected.pdf270.0.dr, CriticalBreachDetected.pdf216.0.dr, CriticalBreachDetected.pdf154.0.dr, CriticalBreachDetected.pdf77.0.dr, CriticalBreachDetected.pdf167.0.dr, CriticalBreachDetected.pdf66.0.dr, CriticalBreachDetected.pdf130.0.dr, CriticalBreachDetected.pdf120.0.dr, CriticalBreachDetected.pdf310.0.dr, CriticalBreachDetected.pdf231.0.dr, CriticalBreachDetected.pdf134.0.dr, CriticalBreachDetected.pdf207.0.dr, CriticalBreachDetected.pdf176.0.dr, CriticalBreachDetected.pdf339.0.dr, CriticalBreachDetected.pdf229.0.dr, CriticalBreachDetected.pdf192.0.dr, CriticalBreachDetected.pdf224.0.dr String found in binary or memory: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: VGsDXrDPC8.exe, 00000000.00000003.4205317664.00000000026CE000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4214854938.00000000026CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion
Source: VGsDXrDPC8.exe, 00000000.00000002.4220320045.0000000003819000.00000004.00000020.00020000.00000000.sdmp, CriticalBreachDetected.pdf24.0.dr, CriticalBreachDetected.pdf289.0.dr, CriticalBreachDetected.pdf84.0.dr, CriticalBreachDetected.pdf270.0.dr, CriticalBreachDetected.pdf216.0.dr, CriticalBreachDetected.pdf154.0.dr, CriticalBreachDetected.pdf77.0.dr, CriticalBreachDetected.pdf167.0.dr, CriticalBreachDetected.pdf66.0.dr, CriticalBreachDetected.pdf130.0.dr, CriticalBreachDetected.pdf120.0.dr, CriticalBreachDetected.pdf310.0.dr, CriticalBreachDetected.pdf231.0.dr, CriticalBreachDetected.pdf134.0.dr, CriticalBreachDetected.pdf207.0.dr, CriticalBreachDetected.pdf176.0.dr, CriticalBreachDetected.pdf339.0.dr, CriticalBreachDetected.pdf229.0.dr, CriticalBreachDetected.pdf192.0.dr, CriticalBreachDetected.pdf224.0.dr String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: index.html.rhysida.0.dr String found in binary or memory: http://sizzlejs.com/
Source: Acrobat.exe, 0000000A.00000000.4079575066.000002D956CAB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.quicktime.com.Acrobat
Source: Acrobat.exe, 0000000A.00000000.4078116691.000002D9557B8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api2.branch.io/v1/url
Source: Acrobat.exe, 0000000A.00000000.4078116691.000002D9557B8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api2.branch.io/v1/urlj
Source: resources.pak.rhysida.0.dr String found in binary or memory: https://chromewebstore.google.com/
Source: resources.pak.rhysida.0.dr String found in binary or memory: https://codereview.chromium.org/25305002).
Source: resources.pak.rhysida.0.dr String found in binary or memory: https://crbug.com/1245093):
Source: resources.pak.rhysida.0.dr String found in binary or memory: https://crbug.com/1446731
Source: Acrobat.exe, 0000000A.00000002.4323834638.000002D956E9B000.00000004.00000001.00020000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4080171109.000002D956E9B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://ims-na1.adobelogin.com
Source: Acrobat.exe, 0000000A.00000002.4319639194.000002D95296B000.00000004.00000020.00020000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4075374508.000002D95296B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?view=cm&fs=1&tf=1&su=
Source: Acrobat.exe, 0000000A.00000002.4319639194.000002D95296B000.00000004.00000020.00020000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4075374508.000002D95296B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?view=cm&fs=1&tf=1&su=ge
Source: Acrobat.exe, 0000000A.00000002.4319639194.000002D95296B000.00000004.00000020.00020000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4075374508.000002D95296B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://outlook.office.com/mail/deeplink/compose?mailtouri=
Source: Acrobat.exe, 0000000A.00000002.4319639194.000002D95298F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.whatsapp.com/send?text=
Installs a raw input device (often for capturing keystrokes)
Source: VGsDXrDPC8.exe, 00000000.00000002.4221032620.0000000003A3C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _WinAPI_RegisterRawInputDevices.au3 memstr_d5c05589-e

Spam, unwanted Advertisements and Ransom Demands
barindex
Yara detected Rhysida Ransomware
Source: Yara match File source: Process Memory Space: VGsDXrDPC8.exe PID: 6076, type: MEMORYSTR
Writes many files with high entropy
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons_retina.png.rhysida entropy: 7.99405747984 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\css\main.css.rhysida entropy: 7.99559646064 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\uss-search\js\plugin.js.rhysida entropy: 7.99951455503 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png.rhysida entropy: 7.99080348169 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\dc_share_upsell_2x.png.rhysida entropy: 7.99152449603 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\dc_review_upsell_2x.png.rhysida entropy: 7.99022161834 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\req_sign_ctip_gif.gif.rhysida entropy: 7.99912345975 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\faf-main.js.rhysida entropy: 7.99970948845 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png.rhysida entropy: 7.99366512834 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\de-de\ui-strings.js.rhysida entropy: 7.99094436108 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\tr.pak.rhysida entropy: 7.99957870679 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_wob.png.rhysida entropy: 7.99635147921 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\ui-strings.js.rhysida entropy: 7.99035865481 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\ui-strings.js.rhysida entropy: 7.99053570622 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\zh-CN.pak.rhysida entropy: 7.99952955376 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\c124efa99176e538252a2ae3cef2137e.png.rhysida entropy: 7.99944418395 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\resources.pak.rhysida entropy: 7.99938955454 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\ui-strings.js.rhysida entropy: 7.99014273211 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\VisualElements\LogoCanary.png.rhysida entropy: 7.99365705323 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\VisualElements\LogoDev.png.rhysida entropy: 7.99252978956 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\sw.pak.rhysida entropy: 7.99954732497 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\sl.pak.rhysida entropy: 7.99964871702 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png.rhysida entropy: 7.99646074495 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\ui-strings.js.rhysida entropy: 7.99235094832 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\8329-chunk.js.rhysida entropy: 7.99879308118 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\zh-TW.pak.rhysida entropy: 7.99937949232 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\uk.pak.rhysida entropy: 7.99978595897 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\initial_preferences.rhysida entropy: 7.99958869324 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\pt-BR.pak.rhysida entropy: 7.99957634895 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\lv.pak.rhysida entropy: 7.99965557484 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\ms.pak.rhysida entropy: 7.99958058682 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\progress_spinner2x.gif.rhysida entropy: 7.99477699636 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\sk.pak.rhysida entropy: 7.99966362633 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\pt-PT.pak.rhysida entropy: 7.99960777826 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\nb.pak.rhysida entropy: 7.99950309107 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\it.pak.rhysida entropy: 7.99962824134 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\fr.pak.rhysida entropy: 7.99968250352 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\hi.pak.rhysida entropy: 7.99983986299 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\progress_spinner_dark2x.gif.rhysida entropy: 7.99379033011 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png.rhysida entropy: 7.99650447577 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\css\main.css.rhysida entropy: 7.9981589622 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\ja.pak.rhysida entropy: 7.99963945824 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\lt.pak.rhysida entropy: 7.9996334289 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\hr.pak.rhysida entropy: 7.99961100078 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\en-GB.pak.rhysida entropy: 7.99953122727 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\es.pak.rhysida entropy: 7.99964401681 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi.rhysida entropy: 7.99959952734 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png.rhysida entropy: 7.9922452894 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\et.pak.rhysida entropy: 7.99955604348 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\fil.pak.rhysida entropy: 7.99959942839 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\el.pak.rhysida entropy: 7.99979455832 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\ca.pak.rhysida entropy: 7.99964460247 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\license.html.rhysida entropy: 7.99413471459 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\license.html.rhysida entropy: 7.99490243805 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\license.html.rhysida entropy: 7.99466916144 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\license.html.rhysida entropy: 7.99524799335 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\license.html.rhysida entropy: 7.99491158334 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Mozilla Firefox\browser\features\formautofill@mozilla.org.xpi.rhysida entropy: 7.99864309412 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\license.html.rhysida entropy: 7.99512110065 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ca-es\ui-strings.js.rhysida entropy: 7.99172731601 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\license.html.rhysida entropy: 7.99539610549 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\license.html.rhysida entropy: 7.99519337768 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\license.html.rhysida entropy: 7.9936186237 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\license.html.rhysida entropy: 7.99440740468 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\license.html.rhysida entropy: 7.99433647326 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\ui-strings.js.rhysida entropy: 7.99218097853 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif.rhysida entropy: 7.99042005134 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\license.html.rhysida entropy: 7.99467184413 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\license.html.rhysida entropy: 7.99663326669 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\license.html.rhysida entropy: 7.99415345239 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\license.html.rhysida entropy: 7.99476137429 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\license.html.rhysida entropy: 7.99314171717 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\da-dk\ui-strings.js.rhysida entropy: 7.99102275563 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\ui-strings.js.rhysida entropy: 7.99291227491 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\license.html.rhysida entropy: 7.99403015491 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\license.html.rhysida entropy: 7.99653563838 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\license.html.rhysida entropy: 7.99200564881 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\license.html.rhysida entropy: 7.99273331071 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\ui-strings.js.rhysida entropy: 7.99206420204 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Light.eot.rhysida entropy: 7.99943626154 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Regular.eot.rhysida entropy: 7.99941525216 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Bold.eot.rhysida entropy: 7.99946936218 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Bold.woff.rhysida entropy: 7.99873463556 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Regular.woff.rhysida entropy: 7.99869993001 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\PDFSigQFormalRep.pdf.rhysida entropy: 7.9996167206 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\adobepdf.xdc.rhysida entropy: 7.99613524765 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Light.woff.rhysida entropy: 7.99861686651 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\DataMatrix.pmp.rhysida entropy: 7.99960924962 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CompareMarkers.pdf.rhysida entropy: 7.99269612587 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\AdobePDF417.pmp.rhysida entropy: 7.99802632783 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\MSRMS.api.rhysida entropy: 7.99982043459 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\plugin.js.rhysida entropy: 7.99870076068 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PDDom.api.rhysida entropy: 7.9996663691 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\WindowsMedia.mpp.rhysida entropy: 7.9991216847 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\StorageConnectors.api.rhysida entropy: 7.99972714516 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Spelling.api.rhysida entropy: 7.99955946304 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\drvDX9.x3d.rhysida entropy: 7.99966456718 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\3difr.x3d.rhysida entropy: 7.99948880346 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\MyriadCAD.otf.rhysida entropy: 7.99772834061 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\tesselate.x3d.rhysida entropy: 7.99452639762 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\2d.x3d.rhysida entropy: 7.99979346502 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\drvSOFT.x3d.rhysida entropy: 7.9990020869 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\Microsoft.VCLibs.x86.14.00.appx.rhysida entropy: 7.99970462283 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\reflow.api.rhysida entropy: 7.99957131295 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\weblink.api.rhysida entropy: 7.99952345649 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\SaveAsRTF.api.rhysida entropy: 7.99964965495 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\css\main.css.rhysida entropy: 7.99675750569 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\ui-strings.js.rhysida entropy: 7.99013595634 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\ui-strings.js.rhysida entropy: 7.99194317048 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\ui-strings.js.rhysida entropy: 7.99074952213 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\ui-strings.js.rhysida entropy: 7.99075845839 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_AddCustomPage.webm.rhysida entropy: 7.99939379842 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6665-chunk.js.rhysida entropy: 7.99314610261 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\hr-hr\ui-strings.js.rhysida entropy: 7.99001146275 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\ind_prog.gif.rhysida entropy: 7.99109420258 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\ui-strings.js.rhysida entropy: 7.99023592912 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_bow.png.rhysida entropy: 7.99563762438 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\4dddbe6058a486f7048673e4b143f7c4.png.rhysida entropy: 7.99154223431 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\ui-strings.js.rhysida entropy: 7.99168614135 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\edit-verb-object-chunk.js.rhysida entropy: 7.99583680503 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png.rhysida entropy: 7.99025790482 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-videoplayer-chunk.js.rhysida entropy: 7.99904217809 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\4109-chunk.js.rhysida entropy: 7.99373875063 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js.rhysida entropy: 7.99004896987 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\ui-strings.js.rhysida entropy: 7.99187654947 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\ui-strings.js.rhysida entropy: 7.99122442134 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-signsettings-popups-chunk.js.rhysida entropy: 7.99226318236 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\ffd2c3413726d897af82575d8596acdd.png.rhysida entropy: 7.99828615779 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons_retina.png.rhysida entropy: 7.99002465913 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\tr-tr\ui-strings.js.rhysida entropy: 7.99167821312 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\ui-strings.js.rhysida entropy: 7.99296555804 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\1901-chunk.js.rhysida entropy: 7.99196014588 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-rsfeedback-modals-chunk.js.rhysida entropy: 7.99458581035 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-enhance-popups-chunk.js.rhysida entropy: 7.99755255643 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\DropboxStorage.api.rhysida entropy: 7.99945618261 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-unifiedShare-chunk.js.rhysida entropy: 7.99976448904 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-modals-chunk.js.rhysida entropy: 7.99154936887 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\ui-strings.js.rhysida entropy: 7.99214109607 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\a56350ec5a5b310e9f4c7e10e0b6795c.png.rhysida entropy: 7.99952229488 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\Words.pdf.rhysida entropy: 7.99856417233 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-rspresendreview-modals-chunk.js.rhysida entropy: 7.99847727856 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\dc3b5d449449a5103f90189b239c0bf6.png.rhysida entropy: 7.99844310213 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\ui-strings.js.rhysida entropy: 7.99322407006 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\8479-chunk.js.rhysida entropy: 7.99497316567 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-filepicker-chunk.js.rhysida entropy: 7.99967064691 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Pointers.pdf.rhysida entropy: 7.99607569889 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-readerRhp-chunk.js.rhysida entropy: 7.99337949961 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\ui-strings.js.rhysida entropy: 7.99348266904 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\ui-strings.js.rhysida entropy: 7.9903402 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fi-fi\ui-strings.js.rhysida entropy: 7.99327448298 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\acrobat_pdf.svg.rhysida entropy: 7.99105929392 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\ui-strings.js.rhysida entropy: 7.99179571011 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\ui-strings.js.rhysida entropy: 7.99157328088 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6b0215ed0a09075330a1c6dd3dbfba1d.png.rhysida entropy: 7.99171146485 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\c6534465ea418b6c252e2b74bc9e4bbb.png.rhysida entropy: 7.99937863096 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\7279-chunk.js.rhysida entropy: 7.99807027376 Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-ccxfeedback-popups-chunk.js.rhysida entropy: 7.99404086488 Jump to dropped file
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00425B70 0_2_00425B70
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0043D730 0_2_0043D730
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00449010 0_2_00449010
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0041D080 0_2_0041D080
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_004248B0 0_2_004248B0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00442150 0_2_00442150
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00436170 0_2_00436170
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00438910 0_2_00438910
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00432190 0_2_00432190
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0042D9B0 0_2_0042D9B0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0041B270 0_2_0041B270
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00426A70 0_2_00426A70
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00425230 0_2_00425230
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00431770 0_2_00431770
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0044AB40 0_2_0044AB40
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0043F370 0_2_0043F370
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0042D600 0_2_0042D600
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0042FBF0 0_2_0042FBF0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00429BA0 0_2_00429BA0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_004243A0 0_2_004243A0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0043D3A0 0_2_0043D3A0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0041C3B0 0_2_0041C3B0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0043DC30 0_2_0043DC30
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00436C30 0_2_00436C30
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_004424C0 0_2_004424C0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00438480 0_2_00438480
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0044A480 0_2_0044A480
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00431C90 0_2_00431C90
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00436CA0 0_2_00436CA0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00442D00 0_2_00442D00
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0042D5E0 0_2_0042D5E0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0040E5F2 0_2_0040E5F2
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0042C5B0 0_2_0042C5B0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00433DB0 0_2_00433DB0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0042FEC0 0_2_0042FEC0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0043EEF0 0_2_0043EEF0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0041AEA0 0_2_0041AEA0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00431770 0_2_00431770
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_0043E730 0_2_0043E730
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: String function: 0041F640 appears 255 times
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: String function: 00449C80 appears 46 times
One or more processes crash
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5488 -s 1308
Source: classification engine Classification label: mal100.rans.troj.evad.winEXE@12/1030@0/1
Source: CriticalBreachDetected.pdf67.0.dr Initial sample: mailto:MarilynnRodriguez@onionmail.org
Source: CriticalBreachDetected.pdf67.0.dr Initial sample: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/
Source: CriticalBreachDetected.pdf67.0.dr Initial sample: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/
Source: CriticalBreachDetected.pdf67.0.dr Initial sample: mailto:MerleKoepp@onionmail.org
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5948:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:384:120:WilError_03
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5488
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9163hvp9_1ktz5jf_48g.tmp Jump to behavior
Source: VGsDXrDPC8.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: VGsDXrDPC8.exe ReversingLabs: Detection: 70%
Source: unknown Process created: C:\Users\user\Desktop\VGsDXrDPC8.exe "C:\Users\user\Desktop\VGsDXrDPC8.exe"
Source: unknown Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5488 -s 1308
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\VGsDXrDPC8.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c start ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\PING.EXE Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\VGsDXrDPC8.exe" Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" --type=renderer /prefetch:1 "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c start ping 127.0.0.1 -n 2 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE Section loaded: mswsock.dll
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\7-Zip\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\7-Zip\Lang\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\locales\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\swiftshader\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CAN\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\DEU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\FRA\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\JPN\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\UK\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ar_AE\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\cs_CZ\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\da_DK\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\el_GR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_AE\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_GB\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_IL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\es_ES\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\en_US\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\ENU\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\private\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\prod\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\stage\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\fonts\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\cef\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\libs\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\cef\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\libs\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\cef\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\libs\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\hi_contrast\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\microsoftGraph\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\2.1.15\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\misc\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themeless_Reader\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\ccpdf\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\themeless\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\he-il\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\css\CriticalBreachDetected.pdf Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\CriticalBreachDetected.pdf Jump to behavior
Source: VGsDXrDPC8.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: ntkrnlmp.pdb1 6 source: VGsDXrDPC8.exe, 00000000.00000002.4223866122.0000000003F72000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysida! source: VGsDXrDPC8.exe, 00000000.00000002.4234219264.0000000004DE9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb: source: VGsDXrDPC8.exe, 00000000.00000002.4226889900.0000000004AB0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysida source: VGsDXrDPC8.exe, 00000000.00000002.4225083979.00000000040AF000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4238682522.000000000517F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222286993.0000000003D1A000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4233827173.0000000004D8B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236194283.0000000004F95000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231871296.0000000004BC2000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4237487357.000000000509D000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4235227694.0000000004EB6000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223563309.0000000003F44000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232759907.0000000004CA0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4227111239.0000000004AFA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4224331165.0000000004016000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226182498.00000000041C5000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4234219264.0000000004DE9000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222622997.0000000003DE4000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222979445.0000000003E7A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb5 source: VGsDXrDPC8.exe, 00000000.00000002.4221636473.0000000003B82000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbu source: VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbv source: VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ata\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: VGsDXrDPC8.exe, 00000000.00000002.4222505078.0000000003D9A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb]UV source: VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb source: VGsDXrDPC8.exe, 00000000.00000002.4223970753.0000000003F97000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232816791.0000000004CB6000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223866122.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223149716.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221470128.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221636473.0000000003B82000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4227226571.0000000004B0C000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4237659303.00000000050D1000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222017503.0000000003C60000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226611227.0000000004254000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236869840.000000000502F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4238779381.0000000005191000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225813340.0000000004164000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4233677060.0000000004D64000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236134100.0000000004F7B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221829131.0000000003C0D000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222784070.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222409759.0000000003D74000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226889900.0000000004AB0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ata\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\**ser_ source: VGsDXrDPC8.exe, 00000000.00000002.4222505078.0000000003D9A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbfE source: VGsDXrDPC8.exe, 00000000.00000002.4221829131.0000000003C0D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbKUV source: VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbD source: VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbF source: VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbVV% source: VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysidaF, source: VGsDXrDPC8.exe, 00000000.00000002.4233677060.0000000004D64000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb source: VGsDXrDPC8.exe, 00000000.00000002.4223970753.0000000003F97000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232816791.0000000004CB6000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223866122.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223149716.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221470128.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221636473.0000000003B82000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4227226571.0000000004B0C000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4237659303.00000000050D1000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222017503.0000000003C60000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226611227.0000000004254000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236869840.000000000502F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4238779381.0000000005191000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225813340.0000000004164000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4233677060.0000000004D64000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236134100.0000000004F7B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221829131.0000000003C0D000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222784070.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222409759.0000000003D74000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226889900.0000000004AB0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbNV= source: VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysidaZ4m source: VGsDXrDPC8.exe, 00000000.00000002.4225813340.0000000004164000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysida^ source: VGsDXrDPC8.exe, 00000000.00000002.4223149716.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysidaa source: VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbT source: VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysidaAnG source: VGsDXrDPC8.exe, 00000000.00000002.4222784070.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysida{ source: VGsDXrDPC8.exe, 00000000.00000002.4222286993.0000000003D1A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb` source: VGsDXrDPC8.exe, 00000000.00000002.4222017503.0000000003C60000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb@d' source: VGsDXrDPC8.exe, 00000000.00000002.4236869840.000000000502F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysida\ source: VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbWUX source: VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb1U source: VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb%?Q source: VGsDXrDPC8.exe, 00000000.00000002.4226611227.0000000004254000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbe source: VGsDXrDPC8.exe, 00000000.00000002.4221470128.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysidaM source: VGsDXrDPC8.exe, 00000000.00000002.4223563309.0000000003F44000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdboU` source: VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysida source: VGsDXrDPC8.exe, 00000000.00000002.4223970753.0000000003F97000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232816791.0000000004CB6000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223866122.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223149716.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4237659303.00000000050D1000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236869840.000000000502F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4238779381.0000000005191000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225813340.0000000004164000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4233677060.0000000004D64000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236134100.0000000004F7B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222784070.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222409759.0000000003D74000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbr source: VGsDXrDPC8.exe, 00000000.00000002.4237659303.00000000050D1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbh source: VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbi source: VGsDXrDPC8.exe, 00000000.00000002.4221470128.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysidaj source: VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb, source: VGsDXrDPC8.exe, 00000000.00000002.4236134100.0000000004F7B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdbm source: VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winload_prod.pdb.rhysidaW source: VGsDXrDPC8.exe, 00000000.00000002.4225083979.00000000040AF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb.rhysidav!= source: VGsDXrDPC8.exe, 00000000.00000002.4222409759.0000000003D74000.00000004.00000020.00020000.00000000.sdmp
PE file contains sections with non-standard names
Source: VGsDXrDPC8.exe Static PE information: section name: .xdata
Drops PE files
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\uk-ua\ui-strings.js.rhysida Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\uk-ua\ui-strings.js.rhysida Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Self deletion via cmd or bat file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Process created: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\VGsDXrDPC8.exe"
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Process created: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\VGsDXrDPC8.exe" Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Acrobat.exe, 0000000A.00000002.4319639194.000002D95293A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ASWHOOK.DLL
Uses ping.exe to sleep
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-client-migration-replacement.man Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-drivers-migration-replacement.man Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-migration-replacement.man Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Window / User API: threadDelayed 6670 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\uk-ua\ui-strings.js.rhysida Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe TID: 6468 Thread sleep count: 6670 > 30 Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe TID: 6468 Thread sleep time: -66700s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_004196E5 GetSystemInfo,GetSystemInfo,malloc,malloc,Sleep,Sleep,free,free,system, 0_2_004196E5
Source: VGsDXrDPC8.exe, 00000000.00000002.4216688557.00000000032D8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: microsoft-hyper-v-migration-replacement.man
Source: VGsDXrDPC8.exe, 00000000.00000002.4216688557.00000000032D8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: microsoft-hyper-v-client-migration-replacement.man
Source: VGsDXrDPC8.exe, 00000000.00000002.4216688557.00000000032D8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: microsoft-hyper-v-drivers-migration-replacement.man
Source: VGsDXrDPC8.exe, 00000000.00000002.4216688557.00000000032D8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: microsoft-hyper-v-migration-replacement.mansidaida
Source: VGsDXrDPC8.exe, 00000000.00000002.4216688557.00000000032D8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: microsoft-hyper-v-client-migration-replacement.man0
Source: Acrobat.exe, 0000000A.00000000.4080213912.000002D956EB3000.00000004.00000001.00020000.00000000.sdmp, Acrobat.exe, 0000000A.00000002.4323877167.000002D956EB3000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Found API chain indicative of debugger detection
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00445A90 IsDebuggerPresent,RaiseException, 0_2_00445A90
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_004011B0 Sleep,Sleep,SetUnhandledExceptionFilter,GetStartupInfoA, 0_2_004011B0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00447CF0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00447CF0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_004EE660 SetUnhandledExceptionFilter,TlsAlloc, 0_2_004EE660
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\VGsDXrDPC8.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c start ping 127.0.0.1 -n 2 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Source: Acrobat.exe, 0000000A.00000000.4076576068.000002D953221000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000A.00000002.4320811293.000002D953221000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager
Source: Acrobat.exe, 0000000A.00000000.4076576068.000002D953221000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000A.00000002.4320811293.000002D953221000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: Acrobat.exe, 0000000A.00000000.4076576068.000002D953221000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000A.00000002.4320811293.000002D953221000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: Acrobat.exe, 0000000A.00000000.4076576068.000002D953221000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000A.00000002.4320811293.000002D953221000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe Code function: 0_2_00445C60 GetSystemTimeAsFileTime, 0_2_00445C60
AV process strings found (often used to terminate AV products)
Source: VGsDXrDPC8.exe, 00000000.00000002.4238953779.00000000051B7000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4239068945.0000000005208000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4239447181.0000000005301000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4239295754.00000000052D3000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4239345161.00000000052E5000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4220457098.00000000038D3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: MsMpEng.exe
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1524356 Sample: VGsDXrDPC8.exe Startdate: 02/10/2024 Architecture: WINDOWS Score: 100 46 Antivirus / Scanner detection for submitted sample 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected Rhysida Ransomware 2->50 52 3 other signatures 2->52 9 VGsDXrDPC8.exe 1001 2->9         started        13 Acrobat.exe 2->13 injected 15 Acrobat.exe 38 2->15         started        process3 file4 32 C:\Program Filesbehaviorgraphoogle\...\sk.pak.rhysida, DOS 9->32 dropped 34 C:\Program Filesbehaviorgraphoogle\...\lt.pak.rhysida, DOS 9->34 dropped 36 C:\Program Filesbehaviorgraphoogle\...\hi.pak.rhysida, DOS 9->36 dropped 38 157 other files (154 malicious) 9->38 dropped 56 Found Tor onion address 9->56 58 Self deletion via cmd or bat file 9->58 60 Found API chain indicative of debugger detection 9->60 62 Writes many files with high entropy 9->62 17 cmd.exe 1 9->17         started        64 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 13->64 20 WerFault.exe 21 13->20         started        signatures5 process6 signatures7 42 Uses ping.exe to sleep 17->42 44 Uses ping.exe to check the status of other devices and networks 17->44 22 cmd.exe 17->22         started        25 conhost.exe 17->25         started        process8 signatures9 54 Uses ping.exe to sleep 22->54 27 PING.EXE 22->27         started        process10 dnsIp11 40 127.0.0.1 unknown unknown 27->40 30 conhost.exe 27->30         started        process12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious

Private

IP
127.0.0.1