Edit tour

Windows Analysis Report
VGsDXrDPC8.exe

Overview

General Information

Sample name:	VGsDXrDPC8.exe renamed because original name is a hash value
Original sample name:	b183b142d3c4e99ee07c3407b82858146fa61ded95be2e67ce920c8002309fb0.exe
Analysis ID:	1524356
MD5:	7cfba113342f78b5909f606c26fc1dc4
SHA1:	f9e65f0cb46128bdc218053e1549c5e584ab6cd5
SHA256:	b183b142d3c4e99ee07c3407b82858146fa61ded95be2e67ce920c8002309fb0
Tags:	exeRhysidauser-JAMESWT_MHT
Infos:

Detection

Rhysida

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Rhysida Ransomware

AI detected suspicious sample

Found API chain indicative of debugger detection

Found Tor onion address

Self deletion via cmd or bat file

Sigma detected: Suspicious Ping/Del Command Combination

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

VGsDXrDPC8.exe (PID: 6076 cmdline: "C:\Users\user\Desktop\VGsDXrDPC8.exe" MD5: 7CFBA113342F78B5909F606C26FC1DC4)

cmd.exe (PID: 1516 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\VGsDXrDPC8.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1196 cmdline: cmd.exe /c start ping 127.0.0.1 -n 2 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

PING.EXE (PID: 6084 cmdline: ping 127.0.0.1 -n 2 MD5: 2F46799D79D22AC72C241EC0322B011D)

conhost.exe (PID: 384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 408 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

Acrobat.exe (PID: 5488 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" --type=renderer /prefetch:1 "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

WerFault.exe (PID: 1576 cmdline: C:\Windows\system32\WerFault.exe -u -p 5488 -s 1308 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Rhysida		No Attribution	https://blog.talosintelligence.com/rhysida-ransomware/ https://decoded.avast.io/threatresearch/rhysida-ransomware-technical-analysis/ https://detect.fyi/rhysida-ransomware-and-the-detection-opportunities-3599e9a02bb2 https://fourcore.io/blogs/rhysida-ransomware-history-ttp-adversary-emulation https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhysida

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: VGsDXrDPC8.exe PID: 6076	JoeSecurity_rhysida	Yara detected Rhysida Ransomware	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Ping/Del Command Combination

Source: Process started

Author: Ilya Krestinichev: Data: Command: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\VGsDXrDPC8.exe", CommandLine: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\VGsDXrDPC8.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\VGsDXrDPC8.exe", ParentImage: C:\Users\user\Desktop\VGsDXrDPC8.exe, ParentProcessId: 6076, ParentProcessName: VGsDXrDPC8.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\VGsDXrDPC8.exe", ProcessId: 1516, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: VGsDXrDPC8.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: VGsDXrDPC8.exe

ReversingLabs: Detection: 70%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe

Code function: 0_2_0043E2E1 CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptAcquireContextA,

0_2_0043E2E1

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\7-Zip\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\7-Zip\Lang\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\locales\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\swiftshader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CAN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\DEU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\FRA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\JPN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\UK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ar_AE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\cs_CZ\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\da_DK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\el_GR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_AE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_GB\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_IL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\es_ES\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\en_US\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\private\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\prod\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\stage\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\fonts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\hi_contrast\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\microsoftGraph\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\2.1.15\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\misc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themeless_Reader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\ccpdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\themeless\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\CriticalBreachDetected.pdf	Jump to behavior

Source: VGsDXrDPC8.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ntkrnlmp.pdb1 6 source: VGsDXrDPC8.exe, 00000000.00000002.4223866122.0000000003F72000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysida! source: VGsDXrDPC8.exe, 00000000.00000002.4234219264.0000000004DE9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb: source: VGsDXrDPC8.exe, 00000000.00000002.4226889900.0000000004AB0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysida source: VGsDXrDPC8.exe, 00000000.00000002.4225083979.00000000040AF000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4238682522.000000000517F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222286993.0000000003D1A000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4233827173.0000000004D8B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236194283.0000000004F95000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231871296.0000000004BC2000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4237487357.000000000509D000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4235227694.0000000004EB6000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223563309.0000000003F44000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232759907.0000000004CA0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4227111239.0000000004AFA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4224331165.0000000004016000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226182498.00000000041C5000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4234219264.0000000004DE9000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222622997.0000000003DE4000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222979445.0000000003E7A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb5 source: VGsDXrDPC8.exe, 00000000.00000002.4221636473.0000000003B82000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbu source: VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbv source: VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ata\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: VGsDXrDPC8.exe, 00000000.00000002.4222505078.0000000003D9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb]UV source: VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: VGsDXrDPC8.exe, 00000000.00000002.4223970753.0000000003F97000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232816791.0000000004CB6000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223866122.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223149716.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221470128.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221636473.0000000003B82000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4227226571.0000000004B0C000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4237659303.00000000050D1000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222017503.0000000003C60000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226611227.0000000004254000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236869840.000000000502F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4238779381.0000000005191000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225813340.0000000004164000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4233677060.0000000004D64000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236134100.0000000004F7B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221829131.0000000003C0D000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222784070.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222409759.0000000003D74000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226889900.0000000004AB0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ata\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\**ser_ source: VGsDXrDPC8.exe, 00000000.00000002.4222505078.0000000003D9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbfE source: VGsDXrDPC8.exe, 00000000.00000002.4221829131.0000000003C0D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbKUV source: VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbD source: VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbF source: VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbVV% source: VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaF, source: VGsDXrDPC8.exe, 00000000.00000002.4233677060.0000000004D64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: VGsDXrDPC8.exe, 00000000.00000002.4223970753.0000000003F97000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232816791.0000000004CB6000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223866122.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223149716.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221470128.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221636473.0000000003B82000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4227226571.0000000004B0C000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4237659303.00000000050D1000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222017503.0000000003C60000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226611227.0000000004254000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236869840.000000000502F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4238779381.0000000005191000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225813340.0000000004164000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4233677060.0000000004D64000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236134100.0000000004F7B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221829131.0000000003C0D000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222784070.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222409759.0000000003D74000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226889900.0000000004AB0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbNV= source: VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaZ4m source: VGsDXrDPC8.exe, 00000000.00000002.4225813340.0000000004164000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida^ source: VGsDXrDPC8.exe, 00000000.00000002.4223149716.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaa source: VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbT source: VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaAnG source: VGsDXrDPC8.exe, 00000000.00000002.4222784070.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysida{ source: VGsDXrDPC8.exe, 00000000.00000002.4222286993.0000000003D1A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb` source: VGsDXrDPC8.exe, 00000000.00000002.4222017503.0000000003C60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb@d' source: VGsDXrDPC8.exe, 00000000.00000002.4236869840.000000000502F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida\ source: VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbWUX source: VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb1U source: VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb%?Q source: VGsDXrDPC8.exe, 00000000.00000002.4226611227.0000000004254000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbe source: VGsDXrDPC8.exe, 00000000.00000002.4221470128.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidaM source: VGsDXrDPC8.exe, 00000000.00000002.4223563309.0000000003F44000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdboU` source: VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida source: VGsDXrDPC8.exe, 00000000.00000002.4223970753.0000000003F97000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232816791.0000000004CB6000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223866122.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223149716.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4237659303.00000000050D1000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236869840.000000000502F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4238779381.0000000005191000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225813340.0000000004164000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4233677060.0000000004D64000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236134100.0000000004F7B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222784070.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222409759.0000000003D74000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbr source: VGsDXrDPC8.exe, 00000000.00000002.4237659303.00000000050D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbh source: VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbi source: VGsDXrDPC8.exe, 00000000.00000002.4221470128.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaj source: VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb, source: VGsDXrDPC8.exe, 00000000.00000002.4236134100.0000000004F7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbm source: VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidaW source: VGsDXrDPC8.exe, 00000000.00000002.4225083979.00000000040AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidav!= source: VGsDXrDPC8.exe, 00000000.00000002.4222409759.0000000003D74000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 4x nop then jmp 00430810h	0_2_0041E211
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 4x nop then lea r8, qword ptr [00000000004DAAE0h]	0_2_0042BD50
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 4x nop then lea r8, qword ptr [00000000004DA0A0h]	0_2_00428DA0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 4x nop then lea r8, qword ptr [00000000004DB100h]	0_2_0042CF10

Networking

Found Tor onion address

Source: VGsDXrDPC8.exe, 00000000.00000003.4205317664.00000000026CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion
Source: VGsDXrDPC8.exe, 00000000.00000003.4205317664.00000000026CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion
Source: VGsDXrDPC8.exe, 00000000.00000002.4214854938.00000000026CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion
Source: VGsDXrDPC8.exe, 00000000.00000002.4214854938.00000000026CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion
Source: VGsDXrDPC8.exe, 00000000.00000002.4220320045.0000000003819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: VGsDXrDPC8.exe, 00000000.00000002.4220320045.0000000003819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf24.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf24.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf289.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf289.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf84.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf84.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf270.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf270.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf216.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf216.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf154.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf154.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf77.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf77.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf167.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf167.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf66.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf66.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf130.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf130.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf120.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf120.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf310.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf310.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf231.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf231.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf134.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf134.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf207.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf207.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf176.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf176.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf339.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf339.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf229.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf229.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf192.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf192.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf224.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf224.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf102.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf102.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf168.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf168.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf5.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf5.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf155.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf155.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: CriticalBreachDetected.pdf240.0.dr	String found in binary or memory: /URI (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: CriticalBreachDetected.pdf240.0.dr	String found in binary or memory: /URI (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2

Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/275944
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/497301
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/514696
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/717501
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/775961
Source: resources.pak.rhysida.0.dr	String found in binary or memory: http://crbug.com/839189
Source: index.html.rhysida.0.dr	String found in binary or memory: http://jquery.com/
Source: index.html.rhysida.0.dr	String found in binary or memory: http://jquery.org/license
Source: VGsDXrDPC8.exe, 00000000.00000003.4205317664.00000000026CE000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4214854938.00000000026CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion
Source: VGsDXrDPC8.exe, 00000000.00000002.4220320045.0000000003819000.00000004.00000020.00020000.00000000.sdmp, CriticalBreachDetected.pdf24.0.dr, CriticalBreachDetected.pdf289.0.dr, CriticalBreachDetected.pdf84.0.dr, CriticalBreachDetected.pdf270.0.dr, CriticalBreachDetected.pdf216.0.dr, CriticalBreachDetected.pdf154.0.dr, CriticalBreachDetected.pdf77.0.dr, CriticalBreachDetected.pdf167.0.dr, CriticalBreachDetected.pdf66.0.dr, CriticalBreachDetected.pdf130.0.dr, CriticalBreachDetected.pdf120.0.dr, CriticalBreachDetected.pdf310.0.dr, CriticalBreachDetected.pdf231.0.dr, CriticalBreachDetected.pdf134.0.dr, CriticalBreachDetected.pdf207.0.dr, CriticalBreachDetected.pdf176.0.dr, CriticalBreachDetected.pdf339.0.dr, CriticalBreachDetected.pdf229.0.dr, CriticalBreachDetected.pdf192.0.dr, CriticalBreachDetected.pdf224.0.dr	String found in binary or memory: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
Source: VGsDXrDPC8.exe, 00000000.00000003.4205317664.00000000026CE000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4214854938.00000000026CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion
Source: VGsDXrDPC8.exe, 00000000.00000002.4220320045.0000000003819000.00000004.00000020.00020000.00000000.sdmp, CriticalBreachDetected.pdf24.0.dr, CriticalBreachDetected.pdf289.0.dr, CriticalBreachDetected.pdf84.0.dr, CriticalBreachDetected.pdf270.0.dr, CriticalBreachDetected.pdf216.0.dr, CriticalBreachDetected.pdf154.0.dr, CriticalBreachDetected.pdf77.0.dr, CriticalBreachDetected.pdf167.0.dr, CriticalBreachDetected.pdf66.0.dr, CriticalBreachDetected.pdf130.0.dr, CriticalBreachDetected.pdf120.0.dr, CriticalBreachDetected.pdf310.0.dr, CriticalBreachDetected.pdf231.0.dr, CriticalBreachDetected.pdf134.0.dr, CriticalBreachDetected.pdf207.0.dr, CriticalBreachDetected.pdf176.0.dr, CriticalBreachDetected.pdf339.0.dr, CriticalBreachDetected.pdf229.0.dr, CriticalBreachDetected.pdf192.0.dr, CriticalBreachDetected.pdf224.0.dr	String found in binary or memory: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
Source: index.html.rhysida.0.dr	String found in binary or memory: http://sizzlejs.com/
Source: Acrobat.exe, 0000000A.00000000.4079575066.000002D956CAB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.quicktime.com.Acrobat
Source: Acrobat.exe, 0000000A.00000000.4078116691.000002D9557B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api2.branch.io/v1/url
Source: Acrobat.exe, 0000000A.00000000.4078116691.000002D9557B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api2.branch.io/v1/urlj
Source: resources.pak.rhysida.0.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: resources.pak.rhysida.0.dr	String found in binary or memory: https://codereview.chromium.org/25305002).
Source: resources.pak.rhysida.0.dr	String found in binary or memory: https://crbug.com/1245093):
Source: resources.pak.rhysida.0.dr	String found in binary or memory: https://crbug.com/1446731
Source: Acrobat.exe, 0000000A.00000002.4323834638.000002D956E9B000.00000004.00000001.00020000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4080171109.000002D956E9B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ims-na1.adobelogin.com
Source: Acrobat.exe, 0000000A.00000002.4319639194.000002D95296B000.00000004.00000020.00020000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4075374508.000002D95296B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?view=cm&fs=1&tf=1&su=
Source: Acrobat.exe, 0000000A.00000002.4319639194.000002D95296B000.00000004.00000020.00020000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4075374508.000002D95296B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?view=cm&fs=1&tf=1&su=ge
Source: Acrobat.exe, 0000000A.00000002.4319639194.000002D95296B000.00000004.00000020.00020000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4075374508.000002D95296B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office.com/mail/deeplink/compose?mailtouri=
Source: Acrobat.exe, 0000000A.00000002.4319639194.000002D95298F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.whatsapp.com/send?text=

Source: VGsDXrDPC8.exe, 00000000.00000002.4221032620.0000000003A3C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: _WinAPI_RegisterRawInputDevices.au3

memstr_d5c05589-e

Spam, unwanted Advertisements and Ransom Demands

Yara detected Rhysida Ransomware

Source: Yara match

File source: Process Memory Space: VGsDXrDPC8.exe PID: 6076, type: MEMORYSTR

Writes many files with high entropy

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons_retina.png.rhysida entropy: 7.99405747984	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\css\main.css.rhysida entropy: 7.99559646064	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\uss-search\js\plugin.js.rhysida entropy: 7.99951455503	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png.rhysida entropy: 7.99080348169	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\dc_share_upsell_2x.png.rhysida entropy: 7.99152449603	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\dc_review_upsell_2x.png.rhysida entropy: 7.99022161834	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\req_sign_ctip_gif.gif.rhysida entropy: 7.99912345975	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\faf-main.js.rhysida entropy: 7.99970948845	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png.rhysida entropy: 7.99366512834	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\de-de\ui-strings.js.rhysida entropy: 7.99094436108	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\tr.pak.rhysida entropy: 7.99957870679	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_wob.png.rhysida entropy: 7.99635147921	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\ui-strings.js.rhysida entropy: 7.99035865481	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\ui-strings.js.rhysida entropy: 7.99053570622	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\zh-CN.pak.rhysida entropy: 7.99952955376	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\c124efa99176e538252a2ae3cef2137e.png.rhysida entropy: 7.99944418395	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\resources.pak.rhysida entropy: 7.99938955454	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\ui-strings.js.rhysida entropy: 7.99014273211	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\VisualElements\LogoCanary.png.rhysida entropy: 7.99365705323	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\VisualElements\LogoDev.png.rhysida entropy: 7.99252978956	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\sw.pak.rhysida entropy: 7.99954732497	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\sl.pak.rhysida entropy: 7.99964871702	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png.rhysida entropy: 7.99646074495	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\ui-strings.js.rhysida entropy: 7.99235094832	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\8329-chunk.js.rhysida entropy: 7.99879308118	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\zh-TW.pak.rhysida entropy: 7.99937949232	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\uk.pak.rhysida entropy: 7.99978595897	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\initial_preferences.rhysida entropy: 7.99958869324	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\pt-BR.pak.rhysida entropy: 7.99957634895	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\lv.pak.rhysida entropy: 7.99965557484	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\ms.pak.rhysida entropy: 7.99958058682	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\progress_spinner2x.gif.rhysida entropy: 7.99477699636	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\sk.pak.rhysida entropy: 7.99966362633	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\pt-PT.pak.rhysida entropy: 7.99960777826	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\nb.pak.rhysida entropy: 7.99950309107	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\it.pak.rhysida entropy: 7.99962824134	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\fr.pak.rhysida entropy: 7.99968250352	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\hi.pak.rhysida entropy: 7.99983986299	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\progress_spinner_dark2x.gif.rhysida entropy: 7.99379033011	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png.rhysida entropy: 7.99650447577	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\css\main.css.rhysida entropy: 7.9981589622	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\ja.pak.rhysida entropy: 7.99963945824	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\lt.pak.rhysida entropy: 7.9996334289	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\hr.pak.rhysida entropy: 7.99961100078	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\en-GB.pak.rhysida entropy: 7.99953122727	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\es.pak.rhysida entropy: 7.99964401681	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi.rhysida entropy: 7.99959952734	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png.rhysida entropy: 7.9922452894	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\et.pak.rhysida entropy: 7.99955604348	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\fil.pak.rhysida entropy: 7.99959942839	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\el.pak.rhysida entropy: 7.99979455832	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\ca.pak.rhysida entropy: 7.99964460247	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\license.html.rhysida entropy: 7.99413471459	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\license.html.rhysida entropy: 7.99490243805	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\license.html.rhysida entropy: 7.99466916144	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\license.html.rhysida entropy: 7.99524799335	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\license.html.rhysida entropy: 7.99491158334	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Mozilla Firefox\browser\features\formautofill@mozilla.org.xpi.rhysida entropy: 7.99864309412	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\license.html.rhysida entropy: 7.99512110065	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ca-es\ui-strings.js.rhysida entropy: 7.99172731601	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\license.html.rhysida entropy: 7.99539610549	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\license.html.rhysida entropy: 7.99519337768	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\license.html.rhysida entropy: 7.9936186237	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\license.html.rhysida entropy: 7.99440740468	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\license.html.rhysida entropy: 7.99433647326	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\ui-strings.js.rhysida entropy: 7.99218097853	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif.rhysida entropy: 7.99042005134	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\license.html.rhysida entropy: 7.99467184413	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\license.html.rhysida entropy: 7.99663326669	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\license.html.rhysida entropy: 7.99415345239	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\license.html.rhysida entropy: 7.99476137429	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\license.html.rhysida entropy: 7.99314171717	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\da-dk\ui-strings.js.rhysida entropy: 7.99102275563	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\ui-strings.js.rhysida entropy: 7.99291227491	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\license.html.rhysida entropy: 7.99403015491	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\license.html.rhysida entropy: 7.99653563838	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\license.html.rhysida entropy: 7.99200564881	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\license.html.rhysida entropy: 7.99273331071	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\ui-strings.js.rhysida entropy: 7.99206420204	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Light.eot.rhysida entropy: 7.99943626154	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Regular.eot.rhysida entropy: 7.99941525216	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Bold.eot.rhysida entropy: 7.99946936218	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Bold.woff.rhysida entropy: 7.99873463556	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Regular.woff.rhysida entropy: 7.99869993001	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\PDFSigQFormalRep.pdf.rhysida entropy: 7.9996167206	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\adobepdf.xdc.rhysida entropy: 7.99613524765	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Light.woff.rhysida entropy: 7.99861686651	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\DataMatrix.pmp.rhysida entropy: 7.99960924962	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CompareMarkers.pdf.rhysida entropy: 7.99269612587	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\AdobePDF417.pmp.rhysida entropy: 7.99802632783	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\MSRMS.api.rhysida entropy: 7.99982043459	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\plugin.js.rhysida entropy: 7.99870076068	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PDDom.api.rhysida entropy: 7.9996663691	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\WindowsMedia.mpp.rhysida entropy: 7.9991216847	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\StorageConnectors.api.rhysida entropy: 7.99972714516	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Spelling.api.rhysida entropy: 7.99955946304	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\drvDX9.x3d.rhysida entropy: 7.99966456718	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\3difr.x3d.rhysida entropy: 7.99948880346	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\MyriadCAD.otf.rhysida entropy: 7.99772834061	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\tesselate.x3d.rhysida entropy: 7.99452639762	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\2d.x3d.rhysida entropy: 7.99979346502	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\drvSOFT.x3d.rhysida entropy: 7.9990020869	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\Microsoft.VCLibs.x86.14.00.appx.rhysida entropy: 7.99970462283	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\reflow.api.rhysida entropy: 7.99957131295	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\weblink.api.rhysida entropy: 7.99952345649	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\SaveAsRTF.api.rhysida entropy: 7.99964965495	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\css\main.css.rhysida entropy: 7.99675750569	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\ui-strings.js.rhysida entropy: 7.99013595634	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\ui-strings.js.rhysida entropy: 7.99194317048	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\ui-strings.js.rhysida entropy: 7.99074952213	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\ui-strings.js.rhysida entropy: 7.99075845839	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_AddCustomPage.webm.rhysida entropy: 7.99939379842	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6665-chunk.js.rhysida entropy: 7.99314610261	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\hr-hr\ui-strings.js.rhysida entropy: 7.99001146275	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\ind_prog.gif.rhysida entropy: 7.99109420258	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\ui-strings.js.rhysida entropy: 7.99023592912	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_bow.png.rhysida entropy: 7.99563762438	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\4dddbe6058a486f7048673e4b143f7c4.png.rhysida entropy: 7.99154223431	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\ui-strings.js.rhysida entropy: 7.99168614135	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\edit-verb-object-chunk.js.rhysida entropy: 7.99583680503	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png.rhysida entropy: 7.99025790482	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-videoplayer-chunk.js.rhysida entropy: 7.99904217809	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\4109-chunk.js.rhysida entropy: 7.99373875063	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js.rhysida entropy: 7.99004896987	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\ui-strings.js.rhysida entropy: 7.99187654947	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\ui-strings.js.rhysida entropy: 7.99122442134	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-signsettings-popups-chunk.js.rhysida entropy: 7.99226318236	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\ffd2c3413726d897af82575d8596acdd.png.rhysida entropy: 7.99828615779	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons_retina.png.rhysida entropy: 7.99002465913	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\tr-tr\ui-strings.js.rhysida entropy: 7.99167821312	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\ui-strings.js.rhysida entropy: 7.99296555804	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\1901-chunk.js.rhysida entropy: 7.99196014588	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-rsfeedback-modals-chunk.js.rhysida entropy: 7.99458581035	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-enhance-popups-chunk.js.rhysida entropy: 7.99755255643	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\DropboxStorage.api.rhysida entropy: 7.99945618261	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-unifiedShare-chunk.js.rhysida entropy: 7.99976448904	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-modals-chunk.js.rhysida entropy: 7.99154936887	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\ui-strings.js.rhysida entropy: 7.99214109607	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\a56350ec5a5b310e9f4c7e10e0b6795c.png.rhysida entropy: 7.99952229488	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\Words.pdf.rhysida entropy: 7.99856417233	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-rspresendreview-modals-chunk.js.rhysida entropy: 7.99847727856	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\dc3b5d449449a5103f90189b239c0bf6.png.rhysida entropy: 7.99844310213	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\ui-strings.js.rhysida entropy: 7.99322407006	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\8479-chunk.js.rhysida entropy: 7.99497316567	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-filepicker-chunk.js.rhysida entropy: 7.99967064691	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Pointers.pdf.rhysida entropy: 7.99607569889	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-readerRhp-chunk.js.rhysida entropy: 7.99337949961	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\ui-strings.js.rhysida entropy: 7.99348266904	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\ui-strings.js.rhysida entropy: 7.9903402	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fi-fi\ui-strings.js.rhysida entropy: 7.99327448298	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\acrobat_pdf.svg.rhysida entropy: 7.99105929392	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\ui-strings.js.rhysida entropy: 7.99179571011	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\ui-strings.js.rhysida entropy: 7.99157328088	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6b0215ed0a09075330a1c6dd3dbfba1d.png.rhysida entropy: 7.99171146485	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\c6534465ea418b6c252e2b74bc9e4bbb.png.rhysida entropy: 7.99937863096	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\7279-chunk.js.rhysida entropy: 7.99807027376	Jump to dropped file
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-ccxfeedback-popups-chunk.js.rhysida entropy: 7.99404086488	Jump to dropped file

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_00425B70	0_2_00425B70
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_0043D730	0_2_0043D730
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_00449010	0_2_00449010
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_0041D080	0_2_0041D080
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_004248B0	0_2_004248B0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_00442150	0_2_00442150
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_00436170	0_2_00436170
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_00438910	0_2_00438910
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_00432190	0_2_00432190
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_0042D9B0	0_2_0042D9B0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_0041B270	0_2_0041B270
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_00426A70	0_2_00426A70
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_00425230	0_2_00425230
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_00431770	0_2_00431770
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_0044AB40	0_2_0044AB40
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_0043F370	0_2_0043F370
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_0042D600	0_2_0042D600
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_0042FBF0	0_2_0042FBF0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_00429BA0	0_2_00429BA0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_004243A0	0_2_004243A0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_0043D3A0	0_2_0043D3A0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_0041C3B0	0_2_0041C3B0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_0043DC30	0_2_0043DC30
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_00436C30	0_2_00436C30
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_004424C0	0_2_004424C0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_00438480	0_2_00438480
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_0044A480	0_2_0044A480
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_00431C90	0_2_00431C90
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_00436CA0	0_2_00436CA0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_00442D00	0_2_00442D00
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_0042D5E0	0_2_0042D5E0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_0040E5F2	0_2_0040E5F2
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_0042C5B0	0_2_0042C5B0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_00433DB0	0_2_00433DB0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_0042FEC0	0_2_0042FEC0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_0043EEF0	0_2_0043EEF0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_0041AEA0	0_2_0041AEA0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_00431770	0_2_00431770
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_0043E730	0_2_0043E730

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: String function: 0041F640 appears 255 times
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: String function: 00449C80 appears 46 times

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5488 -s 1308

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@12/1030@0/1

Source: CriticalBreachDetected.pdf67.0.dr	Initial sample: mailto:MarilynnRodriguez@onionmail.org
Source: CriticalBreachDetected.pdf67.0.dr	Initial sample: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/
Source: CriticalBreachDetected.pdf67.0.dr	Initial sample: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/
Source: CriticalBreachDetected.pdf67.0.dr	Initial sample: mailto:MerleKoepp@onionmail.org

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe

File created: C:\Program Files\CriticalBreachDetected.pdf

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5948:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:384:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5488

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9163hvp9_1ktz5jf_48g.tmp

Jump to behavior

Source: VGsDXrDPC8.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: VGsDXrDPC8.exe

ReversingLabs: Detection: 70%

Source: unknown	Process created: C:\Users\user\Desktop\VGsDXrDPC8.exe "C:\Users\user\Desktop\VGsDXrDPC8.exe"
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5488 -s 1308
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\VGsDXrDPC8.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\PING.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\VGsDXrDPC8.exe"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" --type=renderer /prefetch:1 "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\7-Zip\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\7-Zip\Lang\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\locales\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\swiftshader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\CAN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\DEU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\FRA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\JPN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\UK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ar_AE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\cs_CZ\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\da_DK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\el_GR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_AE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_GB\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_IL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\es_ES\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\en_US\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\ENU\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\private\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\prod\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\stage\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\fonts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\cef\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\files\dev\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\hi_contrast\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\hi_contrast\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app-api\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\microsoftGraph\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\require\2.1.15\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\misc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themeless_Reader\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\ccpdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\themeless\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\collect_feedback\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\he-il\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\css\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\CriticalBreachDetected.pdf	Jump to behavior

Source: VGsDXrDPC8.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ntkrnlmp.pdb1 6 source: VGsDXrDPC8.exe, 00000000.00000002.4223866122.0000000003F72000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysida! source: VGsDXrDPC8.exe, 00000000.00000002.4234219264.0000000004DE9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb: source: VGsDXrDPC8.exe, 00000000.00000002.4226889900.0000000004AB0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysida source: VGsDXrDPC8.exe, 00000000.00000002.4225083979.00000000040AF000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4238682522.000000000517F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222286993.0000000003D1A000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4233827173.0000000004D8B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236194283.0000000004F95000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231871296.0000000004BC2000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4237487357.000000000509D000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4235227694.0000000004EB6000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223563309.0000000003F44000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232759907.0000000004CA0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4227111239.0000000004AFA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4224331165.0000000004016000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226182498.00000000041C5000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4234219264.0000000004DE9000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222622997.0000000003DE4000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222979445.0000000003E7A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb5 source: VGsDXrDPC8.exe, 00000000.00000002.4221636473.0000000003B82000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbu source: VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbv source: VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ata\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: VGsDXrDPC8.exe, 00000000.00000002.4222505078.0000000003D9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb]UV source: VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: VGsDXrDPC8.exe, 00000000.00000002.4223970753.0000000003F97000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232816791.0000000004CB6000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223866122.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223149716.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221470128.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221636473.0000000003B82000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4227226571.0000000004B0C000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4237659303.00000000050D1000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222017503.0000000003C60000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226611227.0000000004254000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236869840.000000000502F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4238779381.0000000005191000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225813340.0000000004164000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4233677060.0000000004D64000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236134100.0000000004F7B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221829131.0000000003C0D000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222784070.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222409759.0000000003D74000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226889900.0000000004AB0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ata\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\**ser_ source: VGsDXrDPC8.exe, 00000000.00000002.4222505078.0000000003D9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbfE source: VGsDXrDPC8.exe, 00000000.00000002.4221829131.0000000003C0D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbKUV source: VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbD source: VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbF source: VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbVV% source: VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaF, source: VGsDXrDPC8.exe, 00000000.00000002.4233677060.0000000004D64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: VGsDXrDPC8.exe, 00000000.00000002.4223970753.0000000003F97000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232816791.0000000004CB6000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223866122.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223149716.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221470128.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221636473.0000000003B82000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4227226571.0000000004B0C000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4237659303.00000000050D1000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222017503.0000000003C60000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226611227.0000000004254000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236869840.000000000502F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4238779381.0000000005191000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225813340.0000000004164000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4233677060.0000000004D64000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236134100.0000000004F7B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4221829131.0000000003C0D000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222784070.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222409759.0000000003D74000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226889900.0000000004AB0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbNV= source: VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaZ4m source: VGsDXrDPC8.exe, 00000000.00000002.4225813340.0000000004164000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida^ source: VGsDXrDPC8.exe, 00000000.00000002.4223149716.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaa source: VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbT source: VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaAnG source: VGsDXrDPC8.exe, 00000000.00000002.4222784070.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysida{ source: VGsDXrDPC8.exe, 00000000.00000002.4222286993.0000000003D1A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb` source: VGsDXrDPC8.exe, 00000000.00000002.4222017503.0000000003C60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb@d' source: VGsDXrDPC8.exe, 00000000.00000002.4236869840.000000000502F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida\ source: VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbWUX source: VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb1U source: VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb%?Q source: VGsDXrDPC8.exe, 00000000.00000002.4226611227.0000000004254000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbe source: VGsDXrDPC8.exe, 00000000.00000002.4221470128.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidaM source: VGsDXrDPC8.exe, 00000000.00000002.4223563309.0000000003F44000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdboU` source: VGsDXrDPC8.exe, 00000000.00000002.4222238681.0000000003D08000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida source: VGsDXrDPC8.exe, 00000000.00000002.4223970753.0000000003F97000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232816791.0000000004CB6000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223866122.0000000003F72000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4223149716.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4226378578.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4237659303.00000000050D1000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225269316.00000000040D5000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4232036019.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236869840.000000000502F000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4238779381.0000000005191000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4225813340.0000000004164000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4233677060.0000000004D64000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4236134100.0000000004F7B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4231631718.0000000004B8B000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222784070.0000000003E2A000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4222409759.0000000003D74000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbr source: VGsDXrDPC8.exe, 00000000.00000002.4237659303.00000000050D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbh source: VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbi source: VGsDXrDPC8.exe, 00000000.00000002.4221470128.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaj source: VGsDXrDPC8.exe, 00000000.00000002.4235543010.0000000004EDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb, source: VGsDXrDPC8.exe, 00000000.00000002.4236134100.0000000004F7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbm source: VGsDXrDPC8.exe, 00000000.00000002.4234682329.0000000004E39000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidaW source: VGsDXrDPC8.exe, 00000000.00000002.4225083979.00000000040AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidav!= source: VGsDXrDPC8.exe, 00000000.00000002.4222409759.0000000003D74000.00000004.00000020.00020000.00000000.sdmp

Source: VGsDXrDPC8.exe

Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe

File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\uk-ua\ui-strings.js.rhysida

Jump to dropped file

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe

File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\uk-ua\ui-strings.js.rhysida

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Process created: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\VGsDXrDPC8.exe"
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Process created: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\VGsDXrDPC8.exe"			Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Acrobat.exe, 0000000A.00000002.4319639194.000002D95293A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOK.DLL

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-client-migration-replacement.man	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-drivers-migration-replacement.man	Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-migration-replacement.man	Jump to behavior

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe

Window / User API: threadDelayed 6670

Jump to behavior

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe

Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\uk-ua\ui-strings.js.rhysida

Jump to dropped file

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe TID: 6468	Thread sleep count: 6670 > 30			Jump to behavior
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe TID: 6468	Thread sleep time: -66700s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe

Code function: 0_2_004196E5 GetSystemInfo,GetSystemInfo,malloc,malloc,Sleep,Sleep,free,free,system,

0_2_004196E5

Source: VGsDXrDPC8.exe, 00000000.00000002.4216688557.00000000032D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-migration-replacement.man
Source: VGsDXrDPC8.exe, 00000000.00000002.4216688557.00000000032D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-client-migration-replacement.man
Source: VGsDXrDPC8.exe, 00000000.00000002.4216688557.00000000032D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-drivers-migration-replacement.man
Source: VGsDXrDPC8.exe, 00000000.00000002.4216688557.00000000032D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-migration-replacement.mansidaida
Source: VGsDXrDPC8.exe, 00000000.00000002.4216688557.00000000032D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-client-migration-replacement.man0
Source: Acrobat.exe, 0000000A.00000000.4080213912.000002D956EB3000.00000004.00000001.00020000.00000000.sdmp, Acrobat.exe, 0000000A.00000002.4323877167.000002D956EB3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-20748

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe

Code function: 0_2_00445A90 IsDebuggerPresent,RaiseException,

0_2_00445A90

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_004011B0 Sleep,Sleep,SetUnhandledExceptionFilter,GetStartupInfoA,	0_2_004011B0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_00447CF0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00447CF0
Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Code function: 0_2_004EE660 SetUnhandledExceptionFilter,TlsAlloc,	0_2_004EE660

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\VGsDXrDPC8.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2

Source: Acrobat.exe, 0000000A.00000000.4076576068.000002D953221000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000A.00000002.4320811293.000002D953221000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: Acrobat.exe, 0000000A.00000000.4076576068.000002D953221000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000A.00000002.4320811293.000002D953221000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: Acrobat.exe, 0000000A.00000000.4076576068.000002D953221000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000A.00000002.4320811293.000002D953221000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: Acrobat.exe, 0000000A.00000000.4076576068.000002D953221000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 0000000A.00000002.4320811293.000002D953221000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\VGsDXrDPC8.exe

Code function: 0_2_00445C60 GetSystemTimeAsFileTime,

0_2_00445C60

Source: VGsDXrDPC8.exe, 00000000.00000002.4238953779.00000000051B7000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4239068945.0000000005208000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4239447181.0000000005301000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4239295754.00000000052D3000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4239345161.00000000052E5000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4220457098.00000000038D3000.00000004.00000020.00020000.00000000.sdmp

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	12 Masquerading	11 Input Capture	1 System Time Discovery	Remote Services	11 Input Capture	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Virtualization/Sandbox Evasion	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Proxy	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	12 Process Injection	Security Account Manager	12 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	3 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Source	Detection	Scanner	Label	Link
VGsDXrDPC8.exe	70%	ReversingLabs	Win64.Ransomware.Rhysida
VGsDXrDPC8.exe	100%	Avira	TR/AVI.Ransom.usvpp

Source	Detection	Scanner	Label
http://jquery.org/license	0%	URL Reputation	safe
http://sizzlejs.com/	0%	URL Reputation	safe
http://jquery.com/	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://jquery.org/license	index.html.rhysida.0.dr	false	URL Reputation: safe	unknown
https://mail.google.com/mail/?view=cm&fs=1&tf=1&su=ge	Acrobat.exe, 0000000A.00000002.4319639194.000002D95296B000.00000004.00000020.00020000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4075374508.000002D95296B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crbug.com/717501	resources.pak.rhysida.0.dr	false		unknown
http://crbug.com/839189	resources.pak.rhysida.0.dr	false		unknown
http://sizzlejs.com/	index.html.rhysida.0.dr	false	URL Reputation: safe	unknown
https://crbug.com/1245093):	resources.pak.rhysida.0.dr	false		unknown
http://crbug.com/775961	resources.pak.rhysida.0.dr	false		unknown
https://mail.google.com/mail/?view=cm&fs=1&tf=1&su=	Acrobat.exe, 0000000A.00000002.4319639194.000002D95296B000.00000004.00000020.00020000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4075374508.000002D95296B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)	VGsDXrDPC8.exe, 00000000.00000002.4220320045.0000000003819000.00000004.00000020.00020000.00000000.sdmp, CriticalBreachDetected.pdf24.0.dr, CriticalBreachDetected.pdf289.0.dr, CriticalBreachDetected.pdf84.0.dr, CriticalBreachDetected.pdf270.0.dr, CriticalBreachDetected.pdf216.0.dr, CriticalBreachDetected.pdf154.0.dr, CriticalBreachDetected.pdf77.0.dr, CriticalBreachDetected.pdf167.0.dr, CriticalBreachDetected.pdf66.0.dr, CriticalBreachDetected.pdf130.0.dr, CriticalBreachDetected.pdf120.0.dr, CriticalBreachDetected.pdf310.0.dr, CriticalBreachDetected.pdf231.0.dr, CriticalBreachDetected.pdf134.0.dr, CriticalBreachDetected.pdf207.0.dr, CriticalBreachDetected.pdf176.0.dr, CriticalBreachDetected.pdf339.0.dr, CriticalBreachDetected.pdf229.0.dr, CriticalBreachDetected.pdf192.0.dr, CriticalBreachDetected.pdf224.0.dr	true		unknown
http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion	VGsDXrDPC8.exe, 00000000.00000003.4205317664.00000000026CE000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4214854938.00000000026CE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://codereview.chromium.org/25305002).	resources.pak.rhysida.0.dr	false		unknown
https://api2.branch.io/v1/url	Acrobat.exe, 0000000A.00000000.4078116691.000002D9557B8000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://outlook.office.com/mail/deeplink/compose?mailtouri=	Acrobat.exe, 0000000A.00000002.4319639194.000002D95296B000.00000004.00000020.00020000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4075374508.000002D95296B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crbug.com/514696	resources.pak.rhysida.0.dr	false		unknown
http://crbug.com/275944	resources.pak.rhysida.0.dr	false		unknown
http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)	VGsDXrDPC8.exe, 00000000.00000002.4220320045.0000000003819000.00000004.00000020.00020000.00000000.sdmp, CriticalBreachDetected.pdf24.0.dr, CriticalBreachDetected.pdf289.0.dr, CriticalBreachDetected.pdf84.0.dr, CriticalBreachDetected.pdf270.0.dr, CriticalBreachDetected.pdf216.0.dr, CriticalBreachDetected.pdf154.0.dr, CriticalBreachDetected.pdf77.0.dr, CriticalBreachDetected.pdf167.0.dr, CriticalBreachDetected.pdf66.0.dr, CriticalBreachDetected.pdf130.0.dr, CriticalBreachDetected.pdf120.0.dr, CriticalBreachDetected.pdf310.0.dr, CriticalBreachDetected.pdf231.0.dr, CriticalBreachDetected.pdf134.0.dr, CriticalBreachDetected.pdf207.0.dr, CriticalBreachDetected.pdf176.0.dr, CriticalBreachDetected.pdf339.0.dr, CriticalBreachDetected.pdf229.0.dr, CriticalBreachDetected.pdf192.0.dr, CriticalBreachDetected.pdf224.0.dr	true		unknown
https://crbug.com/1446731	resources.pak.rhysida.0.dr	false		unknown
https://api2.branch.io/v1/urlj	Acrobat.exe, 0000000A.00000000.4078116691.000002D9557B8000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://chromewebstore.google.com/	resources.pak.rhysida.0.dr	false		unknown
http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion	VGsDXrDPC8.exe, 00000000.00000003.4205317664.00000000026CE000.00000004.00000020.00020000.00000000.sdmp, VGsDXrDPC8.exe, 00000000.00000002.4214854938.00000000026CE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://crbug.com/497301	resources.pak.rhysida.0.dr	false		unknown
http://www.quicktime.com.Acrobat	Acrobat.exe, 0000000A.00000000.4079575066.000002D956CAB000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://ims-na1.adobelogin.com	Acrobat.exe, 0000000A.00000002.4323834638.000002D956E9B000.00000004.00000001.00020000.00000000.sdmp, Acrobat.exe, 0000000A.00000000.4080171109.000002D956E9B000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://web.whatsapp.com/send?text=	Acrobat.exe, 0000000A.00000002.4319639194.000002D95298F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://jquery.com/	index.html.rhysida.0.dr	false	URL Reputation: safe	unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524356
Start date and time:	2024-10-02 17:52:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	VGsDXrDPC8.exe renamed because original name is a hash value
Original Sample Name:	b183b142d3c4e99ee07c3407b82858146fa61ded95be2e67ce920c8002309fb0.exe
Detection:	MAL
Classification:	mal100.rans.troj.evad.winEXE@12/1030@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 12 Number of non-executed functions: 67
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Time	Type	Description
11:55:24	API Interceptor	17635x Sleep call for process: VGsDXrDPC8.exe modified
11:57:06	API Interceptor	1x Sleep call for process: WerFault.exe modified
17:56:25	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf

Process:	C:\Users\user\Desktop\VGsDXrDPC8.exe
File Type:	PDF document, version 1.4, 1 pages
Category:	dropped
Size (bytes):	113917
Entropy (8bit):	7.764619510030561
Encrypted:	false
SSDEEP:	1536:Y1cgCx69vkFBsR0M/xByy/XlEnJR6PoypIfLXbP2aXpXkDLai5191v3h1CHbWEVa:AcgCIvABlUxBvX9o3pkDm61XvR+MygX
MD5:	2D94BC3146C72F6F8CAF958EFCD32FA3
SHA1:	0BE34AACA455DAA62A296B56D025F396F066E5D5
SHA-256:	3CC02A7E8DFB12A7F0FC44C80115F8BC6E460F7B39F32B02B2185EF8424A07EC
SHA-512:	6FC7D3C2081485DD94C88CD61516D218139D330CD057316D2BA118C090833F00EA34225FB3453A25CB1F2666073567C84553E33093CC02924B3534FF360ECB9F
Malicious:	false
Reputation:	low
Preview:	%PDF-1.4.%...1 0 obj.<<./Title ()./Creator (...w.k.h.t.m.l.t.o.p.d.f. .0...1.2...5)./Producer (...Q.t. .5...1.2...8)./CreationDate (D:20240529060058-04'00').>>.endobj.2 0 obj.<<./Type /Catalog./Pages 3 0 R.>>.endobj.4 0 obj.<<./Type /ExtGState./SA true./SM 0.02./ca 1.0./CA 1.0./AIS false./SMask /None>>.endobj.5 0 obj.[/Pattern /DeviceRGB].endobj.7 0 obj.<<./Type /XObject./Subtype /Image./Width 1400./Height 600./BitsPerComponent 8./ColorSpace /DeviceGray./Length 8 0 R./Filter /FlateDecode.>>.stream.x....\|.......B.#E.PCQ.ti..R.T.(O..T..A@.,..A.JQJ....R...AJ.@.-!=9ofv7.2.N.Y....cc2s......[8..................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0497916504050797
Encrypted:	false
SSDEEP:	192:tsQzbYNq67mZ0Gddzj/lwKczuiFPZ24lO8+Iz:iQvYomm6GddzjYzuiFPY4lO8+I
MD5:	75B8D7EAFAF2F80075136B5D2876E38A
SHA1:	74777B2903477BB3DBD45DE38513430E3EB9BC2A
SHA-256:	A641725F247E4868CAE96131905B7C9D3BEAE6066D8CCED5F1572E6270F9EA04
SHA-512:	B0CF356BB7AB32D6349402F6E09B66DD04CC68712014FCBFC3FCA035530F164F54BB1F033C7FF9776377147485D9A7B10066866EE99641EA87C89D8B4BD730AC
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.3.5.8.2.0.4.5.1.3.2.7.6.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.3.5.8.2.0.5.2.4.7.6.4.4.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.0.8.6.2.e.d.0.-.c.2.a.6.-.4.b.5.4.-.a.b.2.0.-.1.3.f.4.5.7.4.a.8.1.d.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.b.5.f.b.6.2.b.-.0.1.7.8.-.4.f.5.5.-.a.8.2.3.-.6.2.3.8.1.9.4.6.c.0.a.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.A.c.r.o.b.a.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.A.c.r.o.b.a.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.7.0.-.0.0.0.1.-.0.0.1.4.-.f.d.f.4.-.9.2.a.8.e.3.1.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.e.4.2.d.8.b.7.c.d.d.3.7.d.5.3.1.b.1.7.9.8.e.3.f.e.a.c.0.7.f.f.0.0.0.0.0.9.0.4.!.0.0.0.0.5.a.f.1.d.e.2.e.2.2.6.b.7.0.b.a.5.1.a.8.4.8.f.0.3.1.5.5.f.f.9.1.0.a.c.c.3.6.7.0.!.A.c.r.o.b.a.t...e.x.e.....T.

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	859136
Entropy (8bit):	2.1049731495866113
Encrypted:	false
SSDEEP:	3072:b1vcabBgZ3Auc642UCQ+jMBD9nNrRPlTpX9bh3C/4zXHoRdfyE2F//jlx+:pvzBtC9dZ2F//W
MD5:	F9688258D002B46A72FA880CE7D30B98
SHA1:	B4D9ABCB511D532170D80B87E60FE97397050588
SHA-256:	46D71AAEE69FA37FAA29E1DC8746E2404923C32513DDF719664DAFD210AE7E2E
SHA-512:	6305DA1AF9B1F9CFE87CC05157F408256096118A091FB22ED6823372D6B5F604B196B963CEDBFD67FEAB2191F8E888D3D868ED5A0AE6C7992E80AA3CF5C1D947
Malicious:	false
Preview:	............................................................................................................................................................................-...)...A12_acrobat_multiFile_generic_dark_32.pdf...................................................................................................8...........................................................................................................%...!...A12_acrobat_parcel_generic_64.pdf...........................................................................................................9..............................................................................................................&...A12_acrobat_parcel_generic_dark_32.pdf......................................................................................................:..............................................................................................................&...A12_acrobat_parcel_generic_dark_64.pdf..............

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	5.4418129613204815
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	VGsDXrDPC8.exe
File size:	927'744 bytes
MD5:	7cfba113342f78b5909f606c26fc1dc4
SHA1:	f9e65f0cb46128bdc218053e1549c5e584ab6cd5
SHA256:	b183b142d3c4e99ee07c3407b82858146fa61ded95be2e67ce920c8002309fb0
SHA512:	9339d2b22b074f0357dd1319d02e6675394bb6c9fbd5d6ac51bc5554c95b5d0044bf05e0c3626c4f79f9c0a48dcb0a4063a32cdd99531ee8071491b661cc24d2
SSDEEP:	6144:BYdNbzC+2VEIxgYClW0ClmQzrAczJPBv7ameMF87XUPwfO+jOT:SkLClW0ClmQzrtFBv767XcoO+
TLSH:	4015335A0B8FC5FCC32BECB485C65D13EB92962A172CD686DB627DF5342286CE0F5484
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...].Vf........../..........$................@.............................. ............`... ............................

Entrypoint:	0x4014d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6656FD5D [Wed May 29 10:03:09 2024 UTC]
TLS Callbacks:	0x447e20
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1d53ebdb19fa47edf6dc307e5428a090

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xee000	0x1418	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xdf000	0x22f8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf1020	0x28	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xee4f8	0x480	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4a458	0x4a600	9d37976046099bf25e64944f2d267196	False	0.47084755777310927	data	6.373866082850124	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4c000	0x83160	0x83200	b2914396b73d208c6cef399ceecb6921	False	0.319739037178265	dBase III DBT, version number 0, next free block index 10, 1st item "\311\302q>\246\033Q\211+D\232\310\014\304QB\001V\256\263\230Vmb\005\315\373\260\371M\306\302\257\212\227^p\233-\343`@u\316\212\300#\237\031\241:\033\262\266\370\022\273\206\301h\2705\251\224\352\365f\223\3041L\331U\210\266\230\2324[\353\271p\235)\213\327\336\340-\010ZE\357\212\345\325E\002\003\001"	3.266791800059202	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xd0000	0xe8b0	0xea00	def6878f99aef5a4fefc948dda0e0537	False	0.29258480235042733	data	5.751312283345212	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0xdf000	0x22f8	0x2400	438294ca8594169db35b218d7d53f196	False	0.4767795138888889	data	5.5753638483433745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0xe2000	0x225c	0x2400	f357550081e6b723ab393c39585ac13e	False	0.18196614583333334	data	4.288571269854264	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0xe5000	0x84d0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xee000	0x1418	0x1600	d92b8a8295a7c5e66da62d153d27d2d2	False	0.30042613636363635	data	4.293624251268739	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0xf0000	0x70	0x200	d61f92ad200ef160449ee356a7bae78d	False	0.08203125	data	0.3334994142480582	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xf1000	0x68	0x200	bf8b508ac68a2b3341d119f5d6ec459b	False	0.060546875	data	0.190488766434666	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

DLL	Import
ADVAPI32.dll	CryptAcquireContextA, CryptGenRandom
KERNEL32.dll	AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateSemaphoreA, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetFileAttributesA, GetHandleInformation, GetLastError, GetModuleFileNameW, GetProcessAffinityMask, GetStartupInfoA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDebuggerPresent, LeaveCriticalSection, OpenProcess, OutputDebugStringA, QueryPerformanceCounter, RaiseException, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, RtlAddFunctionTable, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetEvent, SetLastError, SetProcessAffinityMask, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, Sleep, SuspendThread, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, UnhandledExceptionFilter, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject
msvcrt.dll	__C_specific_handler, __dllonexit, __doserrno, __getmainargs, __initenv, __iob_func, __lconv_init, __pioinfo, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthreadex, _cexit, _endthreadex, _errno, _exit, _filelengthi64, _fileno, _findclose, _findfirst64, _fmode, _fullpath, _initterm, _lock, _lseeki64, _onexit, _setjmp, _stat64, _ultoa, _unlock, _write, abort, acos, calloc, exit, fclose, fflush, fgetpos, fopen, fprintf, fread, free, frexp, fseek, fsetpos, ftell, fwprintf, fwrite, malloc, memcmp, memcpy, memmove, memset, printf, raise, rand, realloc, rename, signal, sprintf, srand, strcat, strcmp, strcpy, strlen, strncmp, strncpy, strtol, system, vfprintf, wcscpy, _time64, _snwprintf, _findnext64, longjmp, _strdup, _getcwd, _chdir
PSAPI.DLL	EnumProcesses, GetProcessMemoryInfo
USER32.dll	MessageBoxW

Target ID:	0
Start time:	11:53:18
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\VGsDXrDPC8.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\VGsDXrDPC8.exe"
Imagebase:	0x400000
File size:	927'744 bytes
MD5 hash:	7CFBA113342F78B5909F606C26FC1DC4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	11:56:34
Start date:	02/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf"
Imagebase:	0x7ff631dc0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	11:56:42
Start date:	02/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" --type=renderer /prefetch:1 "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf"
Imagebase:
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	11:56:44
Start date:	02/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 5488 -s 1308
Imagebase:	0x7ff6f3e70000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	11:56:55
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\VGsDXrDPC8.exe"
Imagebase:	0x7ff657070000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	37.8%
Total number of Nodes:	1069
Total number of Limit Nodes:	10

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report VGsDXrDPC8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\CriticalBreachDetected.pdf

C:\$WinREAgent\Scratch\CriticalBreachDetected.pdf

C:\CriticalBreachDetected.pdf

C:\Program Files\7-Zip\CriticalBreachDetected.pdf

C:\Program Files\7-Zip\Lang\CriticalBreachDetected.pdf

C:\Program Files\7-Zip\Lang\zh-cn.txt.rhysida

C:\Program Files\7-Zip\Lang\zh-tw.txt.rhysida

C:\Program Files\7-Zip\License.txt.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\license.html.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\license.html.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\license.html.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\CriticalBreachDetected.pdf

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\license.html.rhysida

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\CriticalBreachDetected.pdf

C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\license.html.rhysida

Windows Analysis Report
VGsDXrDPC8.exe

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre