Analysis
-
max time kernel
123s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
03-03-2022 10:52
Behavioral task
behavioral1
Sample
CV2022.pdf
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
CV2022.pdf
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
CV2022.pdf
-
Size
92KB
-
MD5
f119f51efbf5fdb9dabb8fcd52bc4cc0
-
SHA1
08e456480f9739ff188d7a365d75f660efebcccc
-
SHA256
ea43af3f224fe76b43ed31ca288db97e6db5d282b1eb5f055674275a783b0fc2
-
SHA512
3c39aae0b10dd33b439f6b37084e66641010447858839708afba42a93ad64d18d63cc212d06049a88ba4eb4a1a263087d153f1e6482f6dfdaa966fbc9db2b048
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
AcroRd32.exeAdobeARM.exepid process 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3532 AdobeARM.exe 3532 AdobeARM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 3468 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
AcroRd32.exeAdobeARM.exepid process 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3468 AcroRd32.exe 3532 AdobeARM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 3468 wrote to memory of 2164 3468 AcroRd32.exe RdrCEF.exe PID 3468 wrote to memory of 2164 3468 AcroRd32.exe RdrCEF.exe PID 3468 wrote to memory of 2164 3468 AcroRd32.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 1888 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe PID 2164 wrote to memory of 460 2164 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CV2022.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EA0198A6B7463433B8D6FF38F98D0A88 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5F832041B3BE3BBD9162F36D3D0CF619 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5F832041B3BE3BBD9162F36D3D0CF619 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2CA1EF1AF295971FF24634B827240A23 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2CA1EF1AF295971FF24634B827240A23 --renderer-client-id=4 --mojo-platform-channel-handle=2180 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9E773AFB874CB7B83978ECBA443F7A50 --mojo-platform-channel-handle=2564 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0CD1A6F0C6242F394D2B7313DE2F2ADF --mojo-platform-channel-handle=2576 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A476CF8E113860D48761638A7FF4599D --mojo-platform-channel-handle=1856 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FBFE3E0C12B75880CE71D60783660E08 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FBFE3E0C12B75880CE71D60783660E08 --renderer-client-id=10 --mojo-platform-channel-handle=1928 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:19.0 /MODE:32⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"3⤵