Analysis
- max time kernel
120s - max time network
141s - platform
windows10_x64 - resource
win10 - submitted
25/08/2020, 14:45
Static task
static1
Behavioral task
behavioral1
Sample
British High Commission Peter Emmerson.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
British High Commission Peter Emmerson.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target British High Commission Peter Emmerson.exe
- Size 1006KB
- Sample200825-dbdy6lnjf6
- SHA256 c9cdd5a5b0701a4d311e0264f5bcec49fa500dde81ff8dbaa081be032b0c0446
- MD5 c19114fc0d83113a32c5b22b8863dcc1
- SHA1 3d3e58b4009c10d3a842a45925132e7482cfcdac
- SHA512 c8973c8055ea42c2ca50dffa743bde646de55eda3bc1c4b669cff05ac0f9cef5edccb9c735e5a2e9d88d2f9fd0e2c0e7b4cf538405cea39463e6a4a0feffd997
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1776 rnthiavesa.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings British High Commission Peter Emmerson.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3440 AcroRd32.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe 3440 AcroRd32.exe - Suspicious use of WriteProcessMemory 258 IoCs
description pid Process procid_target PID 3828 wrote to memory of 3440 3828 British High Commission Peter Emmerson.exe 67 PID 3828 wrote to memory of 3440 3828 British High Commission Peter Emmerson.exe 67 PID 3828 wrote to memory of 3440 3828 British High Commission Peter Emmerson.exe 67 PID 3828 wrote to memory of 1776 3828 British High Commission Peter Emmerson.exe 68 PID 3828 wrote to memory of 1776 3828 British High Commission Peter Emmerson.exe 68 PID 3440 wrote to memory of 3996 3440 AcroRd32.exe 69 PID 3440 wrote to memory of 3996 3440 AcroRd32.exe 69 PID 3440 wrote to memory of 3996 3440 AcroRd32.exe 69 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 2340 3996 RdrCEF.exe 70 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 3716 3996 RdrCEF.exe 71 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 908 3996 RdrCEF.exe 72 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1284 3996 RdrCEF.exe 73 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 1956 3996 RdrCEF.exe 74 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75 PID 3996 wrote to memory of 2648 3996 RdrCEF.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\British High Commission Peter Emmerson.exe"C:\Users\Admin\AppData\Local\Temp\British High Commission Peter Emmerson.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Documents\British High Commission Peter Emmerson-03-.pdf"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=460DAB8CEA4B241F084BE3D5E6B2AEB6 --mojo-platform-channel-handle=1624 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:2340
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4D95D38B98085720DCA23C0427FA4DCF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4D95D38B98085720DCA23C0427FA4DCF --renderer-client-id=2 --mojo-platform-channel-handle=1636 --allow-no-sandbox-job /prefetch:14⤵PID:3716
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=85E9AC995A85BA7569CD2658CD99ED7D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=85E9AC995A85BA7569CD2658CD99ED7D --renderer-client-id=4 --mojo-platform-channel-handle=2236 --allow-no-sandbox-job /prefetch:14⤵PID:908
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7053AFBF56C0B706FAF8DB26D3981B8C --mojo-platform-channel-handle=2468 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:1284
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EF1F05114C23999A74B0DDCB41DA98B5 --mojo-platform-channel-handle=2264 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:1956
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E17DBE35312274924ABAD8C9C45915D1 --mojo-platform-channel-handle=2732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:2648
-
-
-
-
C:\ProgramData\Hanthavra\rnthiavesa.exe"C:\ProgramData\Hanthavra\rnthiavesa.exe"2⤵
- Executes dropped EXE
PID:1776
-