Should I block it?

60%

60% of PCs block this file from running.

Possible reason:

Performance resource utilization

Additional versions

1.701.3.3014	7.75%
1.7.4.0	32.86%
1.7.2.0	33.74%
1.7.0.0	6.61%
1.6.5.0	14.19%
1.5.7.0	3.70%
1.4.7.0	0.09%
1.4.5.0	0.26%
1.1.5.0	0.79%

PE file structure

Show functions

Import table

advapi32.dll

RegSetValueExW, RegOpenKeyExW, RegQueryValueW, RegEnumKeyW, RegDeleteKeyW, RegOpenKeyW, CryptReleaseContext, CryptDestroyHash, CryptGetHashParam, CryptHashData, CryptCreateHash, CryptAcquireContextW, QueryServiceStatusEx, CloseServiceHandle, OpenServiceW, OpenSCManagerW, RegDeleteValueW, RegCreateKeyW, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegCreateKeyExW, OpenThreadToken, DuplicateToken, CheckTokenMembership, IsValidSid, GetLengthSid, ConvertSidToStringSidW, LookupAccountNameW, CopySid, GetSidSubAuthority, InitializeSid, GetSidLengthRequired, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, GetUserNameW, RegCloseKey, RegQueryValueExW, ControlService, CreateWellKnownSid, GetTokenInformation, RegFlushKey, RegEnumValueW, RegQueryInfoKeyW

comctl32.dll

InitCommonControlsEx, _TrackMouseEvent

comdlg32.dll

GetFileTitleW

crypt32.dll

CryptDecodeObject, CryptMsgClose, CertCloseStore, CertFreeCertificateContext, CryptProtectData, CertFindCertificateInStore, CryptMsgGetParam, CryptQueryObject, CryptUnprotectData, CertGetNameStringW

gdi32.dll

ScaleWindowExtEx, GetBkColor, GetTextColor, GetRgnBox, GetMapMode, GetStockObject, GetViewportExtEx, SetWindowExtEx, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, SelectObject, Escape, PtVisible, ExtTextOutW, TextOutW, SetBkMode, RestoreDC, SaveDC, SetBkColor, SetTextColor, GetClipBox, CreateBitmap, GetDeviceCaps, GetTextExtentPoint32W, DeleteDC, ExtSelectClipRgn, GetWindowExtEx, CreateFontIndirectW, CreateRectRgnIndirect, GetObjectW, DeleteObject, SetMapMode, RectVisible

kernel32.dll

DllMain

ole32.dll

CoCreateInstance, CoInitializeEx, CoTaskMemFree, CoUninitialize, CoTaskMemAlloc, CLSIDFromProgID, CLSIDFromString, CoGetClassObject, StgOpenStorageOnILockBytes, StgCreateDocfileOnILockBytes, CreateILockBytesOnHGlobal, CoRegisterMessageFilter, OleFlushClipboard, OleIsCurrentClipboard, CoRevokeClassObject, OleInitialize, CoFreeUnusedLibraries, CoInitializeSecurity, OleUninitialize

oledlg.dll

OleUIBusyW

psapi.dll

EnumProcesses, GetModuleBaseNameW, GetModuleFileNameExW, EnumProcessModules

sensapi.dll

IsNetworkAlive

shell32.dll

ShellExecuteW, SHGetFolderPathW, SHCreateDirectoryExW, SHFileOperationW, SHAppBarMessage, Shell_NotifyIconW

shlwapi.dll

PathStripToRootW, PathIsUNCW, PathFindFileNameW, PathFindExtensionW, SHDeleteKeyW

urlmon.dll

URLDownloadToFileW

user32.dll

CharNextW, ReleaseCapture, SetCapture, GetSysColorBrush, DestroyMenu, GetDesktopWindow, CreateDialogIndirectParamW, GetNextDlgTabItem, EndDialog, EndPaint, BeginPaint, GetWindowDC, ReleaseDC, GetDC, GrayStringW, DrawTextExW, DrawTextW, TabbedTextOutW, RegisterWindowMessageW, SendDlgItemMessageA, WinHelpW, IsChild, GetCapture, GetClassLongW, GetClassNameW, SetPropW, GetPropW, RemovePropW, GetTopWindow, DestroyWindow, GetMessageTime, GetMessagePos, MapWindowPoints, TrackPopupMenu, SetMenu, ShowScrollBar, CreateWindowExW, GetClassInfoExW, GetClassInfoW, RegisterClassW, GetSysColor, AdjustWindowRectEx, ScreenToClient, EqualRect, DefWindowProcW, CallWindowProcW, CopyRect, PtInRect, GetMenu, PostThreadMessageW, IntersectRect, SystemParametersInfoA, GetWindowPlacement, GetLastActivePopup, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, LoadBitmapW, EnableMenuItem, InvalidateRgn, GetWindowTextLengthW, SetFocus, IsWindowEnabled, MoveWindow, SetWindowLongW, GetDlgCtrlID, SetWindowTextW, GetWindowLongW, IsDialogMessageW, SetDlgItemTextW, SendDlgItemMessageW, GetDlgItem, CharUpperW, UnhookWindowsHookEx, SetWindowsHookExW, CallNextHookEx, GetMessageW, TranslateMessage, DispatchMessageW, GetKeyState, ValidateRect, GetWindow, SetWindowContextHelpId, MapDialogRect, SetWindowPos, PostQuitMessage, GetMenuState, GetMenuStringW, ExitWindowsEx, EnumWindows, GetWindowTextW, IsWindowVisible, GetWindowThreadProcessId, FindWindowExW, SystemParametersInfoW, SetActiveWindow, DrawAnimatedRects, SetMenuDefaultItem, ModifyMenuW, GetMenuItemID, GetMenuItemCount, GetSubMenu, ClientToScreen, GetCursorPos, LoadMenuW, GetActiveWindow, DrawIcon, GetClientRect, RegisterClipboardFormatW, GetSystemMetrics, IsIconic, PeekMessageW, UnregisterClassW, MessageBeep, OffsetRect, GetNextDlgGroupItem, KillTimer, GetFocus, UpdateWindow, IsWindow, SetTimer, SetCursor, DrawFocusRect, InflateRect, SetRectEmpty, SendMessageW, GetWindowRect, GetParent, LoadCursorW, EnableWindow, GetForegroundWindow, PostMessageW, LoadIconW, SetForegroundWindow, MessageBoxW, InvalidateRect, SetRect, IsRectEmpty, CheckMenuItem, CopyAcceleratorTableW, ShowWindow

userenv.dll

UnloadUserProfile

version.dll

VerQueryValueW, GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeW, GetFileVersionInfoSizeA, GetFileVersionInfoW

wininet.dll

DeleteUrlCacheEntryW

winspool.drv

DocumentPropertiesW, OpenPrinterW, ClosePrinter

wintrust.dll

WinVerifyTrust

AdobeARM.exe

Adobe Reader and Acrobat Manager by Adobe Systems (Signed)

Remove AdobeARM.exe

Version:	1.1.5.0
MD5:	73bb442a717b9bb0097c243374c14a3e
SHA1:	a8624bdf847a13ff5eaf9fea5302ca5f181ae9dc
SHA256:	ec3ddaf82b317cf613857cc49adafe0c9311e5f1469e478c444bfa2c550c880b

What is AdobeARM.exe?

AdobeARM.exe is a part of new Adobe Acrobat\Reader updater. The Updater is responsible for checking for, downloading, and launching the update installer for Reader or Acrobat. The Updater primarily keeps itself up to date and downloads and extracts needed files. It does not actually install anything, as that job is handled by a separate installer. Update preferences controlled at the registry level. Log settings controlled at the registry level; log name and location is different. Checks for upd

About AdobeARM.exe (from Adobe Systems)

“Adobe Reader software is the global standard for electronic document sharing. It is the only PDF file viewer that can open and interact with all PDF documents. Use Adobe Reader to view, search, digita”

Details

File name:	AdobeARM.exe
Publisher:	Adobe Systems Incorporated
Product name:	Adobe Reader and Acrobat Manager
Typical file path:	C:\Program Files\common files\adobe\arm\1.0\adobearm.exe
File version:	1.1.5.0
Size:	926.44 KB (948,672 bytes)
Certificate
Issued to:	Adobe Systems
Authority (CA):	VeriSign
Expiration date:	Friday, September 20, 2013
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
.NET CLR:	No

More details

Programs

The following programs will install this file

Adobe Reader

Adobe Systems Incorporated

10% remove

Adobe Acrobat and Reader are a set of applications designed to view, create, manipulate, print and manage files in Portable Document Format (PDF). Acrobat and Reader are widely used as a method of presenting information with a fixed layout similar to a paper publication. Adobe also allows Acrobat plug-ins to be developed by third parties, which can add extra functions to the Acrobat program.

Junior

Philips

1% remove

Snap.Do Engine

ReSoft Ltd.

83% remove

Snap.Do Engine is an ad-supported (users may see additional banner and in-text link advertisements) cross web browser plugin for Internet Explorer (BHO) and Firefox/Chrome (plugin) and distributed through various monetization platforms during installation such as FIRSERIA via onesappz.com. The browser extension includes various features that will modify the default or custom settings of the browser including the home page, search settin...

Behaviors

Startup files (all users) run

Runs under the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'

'Adobe ARM' → "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

Scheduled tasks

The task 'Programma di aggiornamento online di Adobe' runs weekly in the path '\Programma di aggiornamento online di Adobe'
The task 'Program aktualizacji online firmy Adobe.' runs weekly in the path '\Program aktualizacji online firmy Adobe.'
The job 'Adobe 联机更新程序' runs weekly in the path '\Adobe 联机更新程序'
The task 'Adobe online aktualizační program' runs weekly in the path '\Adobe online aktualizační program'
The task 'Программа онлайн-обновления Adobe.' runs in the path '\Программа онлайн-обновления Adobe.'
The task 'Adobe 联机更新程序' runs weekly in the path '\Adobe 联机更新程序'
The job 'Programa de atualização online Adobe' runs weekly in the path '\Programa de atualização online Adobe'
The job 'Программа онлайн-обновления Adobe.' runs weekly in the path '\Программа онлайн-обновления Adobe.'
The task 'Adobe-Online-Aktualisierungsprogramm' runs weekly in the path '\Adobe-Online-Aktualisierungsprogramm'
The task 'Programme de mise à jour en ligne de Adobe' runs weekly in the path '\Programme de mise à jour en ligne de Adobe'
The task 'Adobe Reader and Acrobat Manager' runs weekly in the path '\Adobe Reader and Acrobat Manager'
The job 'Adobe ARM' runs on logon in the path '\Adobe ARM'
The job 'Programa de actualización online de Adobe' runs weekly in the path '\Programa de actualización online de Adobe'
The task 'Adobe online update program' runs weekly in the path '\Adobe online update program'
Entry path '\Программа онлайн-обновления Adobe.'
Entry path '\Programa de atualização online Adobe'
Entry path '\Adobe Reader and Acrobat Manager'
Entry path '\Programa de actualización online de Adobe'
Entry path '\Programma di aggiornamento online di Adobe'
Entry path '\Adobe-Online-Aktualisierungsprogramm'
Entry path '\Programme de mise à jour en ligne de Adobe'
Entry path '\Adobe オンライン更新プログラム'

Scheduled tasks startups

Set to load on user login (bypasses Windows UAC if enabled)

Windows firewall allowed programs

Exceptions allow programs to access to the Internet through an outbound connections

Firewall exception for 'C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe'

Network connections

Access through an approved Windows firewall exception

[UDP] listens on port 53098

[UDP] listens on port 49163

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.07939743%	0.028634%
Kernel CPU:	0.04763450%	0.013761%
User CPU:	0.03176293%	0.014873%
Kernel CPU time:	1,474 ms/min	100,923,805ms/min
CPU cycles:	2,297,080/sec	17,470,203/sec
Memory
Private memory:	8.93 MB	21.59 MB
Private (maximum):	15.9 MB
Private (minimum):	9.86 MB
Non-paged memory:	8.93 MB	21.59 MB
Virtual memory:	106.12 MB	140.96 MB
Virtual memory (peak):	115.58 MB	169.69 MB
Working set:	9.89 MB	18.61 MB
Working set (peak):	21.23 MB	37.95 MB
Page faults:	49,642/min	2,039/min
I/O
I/O read transfer:	1.94 MB/sec	1.02 MB/min
I/O read operations:	34/sec	343/min
I/O write transfer:	102.27 KB/sec	274.99 KB/min
I/O write operations:	21/sec	227/min
I/O other transfer:	134.56 KB/sec	448.09 KB/min
I/O other operations:	314/sec	1,671/min
Resource allocations
Threads:	8	12
Handles:	288	600
GUI GDI count:	16	103
GUI GDI peak:	24	142
GUI USER count:	16	49
GUI USER peak:	30	71

Process properties

Integrety level:	Undefined
Platform:	64-bit
Command lines:	"C:\Program Files\common files\adobe\arm\1.0\adobearm.exe" /producC:reader /versioC:9.0 /modC:2 "C:\Program Files\common files\adobe\arm\1.0\adobearm.exe"
Owner:	User

Threads