Suspicious Acrobat Reader Execution from Temp Directory

Kaung Khant Ko@kaungkhantko

•updated Sep 19, 2026•0•0•5

Detects Adobe Acrobat (Acrobat.exe) launched by a suspicious parent process (GRrte.exe) while opening a specific PDF document from the user's temporary directory. This pattern is indicative of a potential malicious document lure often associated with malware delivery.