Analysis
-
max time kernel
135s -
max time network
111s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
15-07-2020 10:32
Static task
static1
Behavioral task
behavioral1
Sample
7430572e7416fb3c67cf21e0e4f3868bf09a6f63d5f98e83c17aeb54f709919a.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
7430572e7416fb3c67cf21e0e4f3868bf09a6f63d5f98e83c17aeb54f709919a.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
7430572e7416fb3c67cf21e0e4f3868bf09a6f63d5f98e83c17aeb54f709919a.exe
-
Size
2.8MB
-
MD5
6cea4f4cf649b100c0b0cbcd38c867b1
-
SHA1
80d905ba06843fe73896ca198c2fa369d0df889c
-
SHA256
7430572e7416fb3c67cf21e0e4f3868bf09a6f63d5f98e83c17aeb54f709919a
-
SHA512
6f0cba36780f848e69663e453fd4934ef9bd9c2260d87eea442e80f3ac6d10abeb59fa47fe68763a6c95503e6d7c33e7fe5b93890454725a27394be205c86960
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings 7430572e7416fb3c67cf21e0e4f3868bf09a6f63d5f98e83c17aeb54f709919a.exe -
Suspicious use of WriteProcessMemory 256 IoCs
description pid Process procid_target PID 1516 wrote to memory of 2068 1516 7430572e7416fb3c67cf21e0e4f3868bf09a6f63d5f98e83c17aeb54f709919a.exe 72 PID 1516 wrote to memory of 2068 1516 7430572e7416fb3c67cf21e0e4f3868bf09a6f63d5f98e83c17aeb54f709919a.exe 72 PID 1516 wrote to memory of 2068 1516 7430572e7416fb3c67cf21e0e4f3868bf09a6f63d5f98e83c17aeb54f709919a.exe 72 PID 2068 wrote to memory of 3952 2068 AcroRd32.exe 73 PID 2068 wrote to memory of 3952 2068 AcroRd32.exe 73 PID 2068 wrote to memory of 3952 2068 AcroRd32.exe 73 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3040 3952 RdrCEF.exe 74 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 3572 3952 RdrCEF.exe 75 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2968 3952 RdrCEF.exe 76 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 2588 3952 RdrCEF.exe 77 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3984 3952 RdrCEF.exe 78 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 PID 3952 wrote to memory of 3776 3952 RdrCEF.exe 79 -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2068 AcroRd32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7430572e7416fb3c67cf21e0e4f3868bf09a6f63d5f98e83c17aeb54f709919a.exe"C:\Users\Admin\AppData\Local\Temp\7430572e7416fb3c67cf21e0e4f3868bf09a6f63d5f98e83c17aeb54f709919a.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\GStart_FirstStepFr.pdf"2⤵
- Suspicious behavior: EnumeratesProcesses
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
PID:2068 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E3C22C115CFDAA63D1AF708A7453EA3A --mojo-platform-channel-handle=1648 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:3040
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E7A876FED1073E73B264FAE73BFA745F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E7A876FED1073E73B264FAE73BFA745F --renderer-client-id=2 --mojo-platform-channel-handle=1656 --allow-no-sandbox-job /prefetch:14⤵PID:3572
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7BF979ED857950D09CC1E5E8D629C4F5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7BF979ED857950D09CC1E5E8D629C4F5 --renderer-client-id=4 --mojo-platform-channel-handle=2080 --allow-no-sandbox-job /prefetch:14⤵PID:2968
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E48AC74A6C4EF1298C7002943AD8EF84 --mojo-platform-channel-handle=2476 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:2588
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EE357A8D9A8CABEAE12BA8B97EFD3ABC --mojo-platform-channel-handle=2600 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:3984
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3438D2355D734FABB3F134F110EEB7F1 --mojo-platform-channel-handle=2612 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:3776
-
-
-