Overview
overview
6Static
static
WindowsDef...rd.wim
windows7-x64
3WindowsDef...rd.wim
windows10-1703-x64
6WindowsDef...rd.wim
windows10-2004-x64
3WindowsDef...rd.wim
android-10-x64
WindowsDef...rd.wim
android-11-x64
WindowsDef...rd.wim
android-9-x86
WindowsDef...rd.wim
macos-10.15-amd64
1WindowsDef...rd.wim
debian-9-armhf
WindowsDef...rd.wim
debian-9-mips
WindowsDef...rd.wim
debian-9-mipsel
WindowsDef...rd.wim
ubuntu-18.04-amd64
Analysis
-
max time kernel
959s -
max time network
962s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2022 07:03
Static task
static1
Behavioral task
behavioral1
Sample
WindowsDefenderApplicationGuard.wim
Resource
win7-20220812-en
windows7-x64
8 signatures
1200 seconds
Behavioral task
behavioral2
Sample
WindowsDefenderApplicationGuard.wim
Resource
win10-20220812-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral3
Sample
WindowsDefenderApplicationGuard.wim
Resource
win10v2004-20221111-en
windows10-2004-x64
10 signatures
1200 seconds
Behavioral task
behavioral4
Sample
WindowsDefenderApplicationGuard.wim
Resource
android-x64-20220823-en
android-10-x64
0 signatures
1200 seconds
Behavioral task
behavioral5
Sample
WindowsDefenderApplicationGuard.wim
Resource
android-x64-arm64-20220823-en
android-11-x64
0 signatures
1200 seconds
Behavioral task
behavioral6
Sample
WindowsDefenderApplicationGuard.wim
Resource
android-x86-arm-20220823-en
android-9-x86
0 signatures
1200 seconds
Behavioral task
behavioral7
Sample
WindowsDefenderApplicationGuard.wim
Resource
macos-20220504-en
macos-10.15-amd64
0 signatures
1200 seconds
Behavioral task
behavioral8
Sample
WindowsDefenderApplicationGuard.wim
Resource
debian9-armhf-20221111-en
debian-9-armhf
0 signatures
1200 seconds
Behavioral task
behavioral9
Sample
WindowsDefenderApplicationGuard.wim
Resource
debian9-mipsbe-20221111-en
debian-9-mips
0 signatures
1200 seconds
Behavioral task
behavioral10
Sample
WindowsDefenderApplicationGuard.wim
Resource
debian9-mipsel-20221111-en
debian-9-mipsel
0 signatures
1200 seconds
Behavioral task
behavioral11
Sample
WindowsDefenderApplicationGuard.wim
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
0 signatures
1200 seconds
General
-
Target
WindowsDefenderApplicationGuard.wim
-
Size
30.5MB
-
MD5
e069ad898b074b8cf98256516aed064c
-
SHA1
a040057d2edf90ebb14b90a52b92eeb5b5d1faa1
-
SHA256
d215f9c3834c64134eb60d6b64ae143409e76570d5d9a4f3488a1e8aba9ab8b2
-
SHA512
e86b57c2a62046e46b8b5edebdd59a4f39d4a198cf83af8086bbfb559b22ae8b586833077f6092a94627ed9a32c9fcb413106f63a160290900d725ed1535132d
-
SSDEEP
786432:M8mV0NuwtR/8+GDp9ULmz1MXxc9cy8avU5FVYiqV7pbM:M8mV0kwtR61yLmiBc9ia82I
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = ebb3b15315f6d801 iexplore.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{714CB3BF-6A43-4638-B660-3BB97EF80D28}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31004526" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{97097882-8361-11ED-919F-DAA3C5DFCF8A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "378634044" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\RepId iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1806660940" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31004526" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1806660940" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003c000000900300001c020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\wim_auto_file\shell OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\wim_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\"" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\wim_auto_file OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.wim\ = "wim_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\wim_auto_file\shell\Read\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.wim OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\wim_auto_file\shell\Read OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 896 AcroRd32.exe 896 AcroRd32.exe 896 AcroRd32.exe 896 AcroRd32.exe 896 AcroRd32.exe 896 AcroRd32.exe 896 AcroRd32.exe 896 AcroRd32.exe 896 AcroRd32.exe 896 AcroRd32.exe 896 AcroRd32.exe 896 AcroRd32.exe 896 AcroRd32.exe 896 AcroRd32.exe 896 AcroRd32.exe 896 AcroRd32.exe 896 AcroRd32.exe 896 AcroRd32.exe 896 AcroRd32.exe 896 AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2688 OpenWith.exe 3896 OpenWith.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2508 iexplore.exe 2508 iexplore.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2688 OpenWith.exe 2508 iexplore.exe 2508 iexplore.exe 3832 IEXPLORE.EXE 3832 IEXPLORE.EXE 3896 OpenWith.exe 3896 OpenWith.exe 3896 OpenWith.exe 3896 OpenWith.exe 3896 OpenWith.exe 3896 OpenWith.exe 3896 OpenWith.exe 3896 OpenWith.exe 3896 OpenWith.exe 3896 OpenWith.exe 3896 OpenWith.exe 3896 OpenWith.exe 3896 OpenWith.exe 3896 OpenWith.exe 3896 OpenWith.exe 3896 OpenWith.exe 3896 OpenWith.exe 3896 OpenWith.exe 3896 OpenWith.exe 896 AcroRd32.exe 896 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2508 2688 OpenWith.exe 93 PID 2688 wrote to memory of 2508 2688 OpenWith.exe 93 PID 2508 wrote to memory of 3832 2508 iexplore.exe 95 PID 2508 wrote to memory of 3832 2508 iexplore.exe 95 PID 2508 wrote to memory of 3832 2508 iexplore.exe 95 PID 3896 wrote to memory of 896 3896 OpenWith.exe 97 PID 3896 wrote to memory of 896 3896 OpenWith.exe 97 PID 3896 wrote to memory of 896 3896 OpenWith.exe 97 PID 896 wrote to memory of 4708 896 AcroRd32.exe 99 PID 896 wrote to memory of 4708 896 AcroRd32.exe 99 PID 896 wrote to memory of 4708 896 AcroRd32.exe 99 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 1840 4708 RdrCEF.exe 100 PID 4708 wrote to memory of 4428 4708 RdrCEF.exe 101 PID 4708 wrote to memory of 4428 4708 RdrCEF.exe 101 PID 4708 wrote to memory of 4428 4708 RdrCEF.exe 101 PID 4708 wrote to memory of 4428 4708 RdrCEF.exe 101 PID 4708 wrote to memory of 4428 4708 RdrCEF.exe 101 PID 4708 wrote to memory of 4428 4708 RdrCEF.exe 101 PID 4708 wrote to memory of 4428 4708 RdrCEF.exe 101 PID 4708 wrote to memory of 4428 4708 RdrCEF.exe 101 PID 4708 wrote to memory of 4428 4708 RdrCEF.exe 101 PID 4708 wrote to memory of 4428 4708 RdrCEF.exe 101 PID 4708 wrote to memory of 4428 4708 RdrCEF.exe 101 PID 4708 wrote to memory of 4428 4708 RdrCEF.exe 101
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\WindowsDefenderApplicationGuard.wim1⤵
- Modifies registry class
PID:4304
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\WindowsDefenderApplicationGuard.wim2⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3832
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\WindowsDefenderApplicationGuard.wim"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2A6AF1F0541D02443D8D2E426D942361 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:1840
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5DBA9C720FAE5E6E77552377C7E1E312 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5DBA9C720FAE5E6E77552377C7E1E312 --renderer-client-id=2 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job /prefetch:14⤵PID:4428
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B78EF221774790DCDBAC811D47A85C6B --mojo-platform-channel-handle=2156 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:2352
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=178165213116837787D866B9305EC3B5 --mojo-platform-channel-handle=1808 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:2160
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=895B5D5402D961A39214F371EF6B94E3 --mojo-platform-channel-handle=2000 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:1428
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6D7E62419349D06189EE7C9A54AFA89B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6D7E62419349D06189EE7C9A54AFA89B --renderer-client-id=8 --mojo-platform-channel-handle=2560 --allow-no-sandbox-job /prefetch:14⤵PID:3324
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4804
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2864