Lumma-Stealer-dllhost-Hollowing-C2-Domains-Payload-Extraction-Analysis

1. Setup.exe – Privacy, Driver & Memory Strings Process Hacker memory analysis of the setup.exe dropper reveals that Lumma Stealer targets privacy settings, installs drivers, and manages memory. Key Strings Observed: Privacy Camera – Attempts to access or disable camera privacy settings. Privacy...

CVE-2026-22561: Uncontrolled Search Path Element

Uncontrolled search path elements in Anthropic Claude for Windows installer Claude Setup.exe versions prior to 1.1.3363 allow local privilege escalation via DLL search-order hijacking. The installer loads DLLs e.g., profapi.dll from its own directory after UAC elevation, enabling arbitrary code...

CVE-2024-14012: Untrusted Search Path

Potential privilege escalation issue in Revenera InstallShield version 2023 R1 running a renamed Setup.exe on Windows. When a local administrator executes a renamed Setup.exe, the MPR.dll may get loaded from an insecure location and can result in a privilege escalation. The issue has been fixed i...

EUVD-2021-29973

Malicious code in bioql PyPI...

CVE-2020-18174

A process injection vulnerability in setup.exe of AutoHotkey 1.1.32.00 allows attackers to escalate privileges...

Active Nitrogen campaign delivered via malicious ads for PuTTY, FileZilla

In the past couple of weeks, we have observed an ongoing campaign targeting system administrators with fraudulent ads for popular system utilities. The malicious ads are displayed as sponsored results on Googles search engine page and localized to North America. Victims are tricked into downloadi...

Satacom delivers browser extension that steals cryptocurrency

Satacom downloader, also known as LegionLoader, is a renowned malware family that emerged in 2019. It is known to use the technique of querying DNS servers to obtain the base64-encoded URL in order to receive the next stage of another malware family currently distributed by Satacom. The Satacom...

Veeam Backup & Replication installer fails to launch with the error: "Only one instance of Veeam Backup & Replication Setup is allowed."

Challenge When attempting to launch the Veeam Backup & Replication installer, the following error occurs: Only one instance of Veeam Backup & Replication Setup is allowed. Copy Cause Another instance of the Veeam Backup & Replication Setup.exe is already running. Solution Open Task Manager and...

CVE-2021-43019

Adobe Creative Cloud version 5.5 and earlier are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service. An unauthenticated attacker could leverage this vulnerability to remove files and escalate privileges under the context of SYSTEM . An attacker mu...

Privilege escalation

Adobe Creative Cloud version 5.5 and earlier are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service. An unauthenticated attacker could leverage this vulnerability to remove files and escalate privileges under the context of SYSTEM . An attacker mu...

CVE-2021-43019

Adobe Creative Cloud Desktop/Application installers prior to 5.6 are affected by a local privilege-escalation due to incorrect permissions on resources used by the Setup.exe service. An unauthenticated attacker who can run low-privileged code and has user interaction can escalate to SYSTEM and re...

CVE-2021-43019 Adobe Creative Cloud Incorrect Permission Assignment Privilege Escalation Vulnerability

Adobe Creative Cloud version 5.5 and earlier are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service. An unauthenticated attacker could leverage this vulnerability to remove files and escalate privileges under the context of SYSTEM . An attacker mu...

PT-2021-23720 · Adobe · Creative Cloud

Name of the Vulnerable Software and Affected Versions: Adobe Creative Cloud version 5.5 and earlier Description: The issue is related to a privilege escalation vulnerability in the resources used by the Setup.exe service. An unauthenticated attacker could exploit this to remove files and escalate...

CVE-2021-43019: Incorrect Permission Assignment for Critical Resource

Adobe Creative Cloud version 5.5 and earlier are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service. An unauthenticated attacker could leverage this vulnerability to remove files and escalate privileges under the context of SYSTEM . An attacker mu...

CVE-2020-18174

A process injection vulnerability in setup.exe of AutoHotkey 1.1.32.00 allows attackers to escalate privileges...

Design/Logic Flaw

A process injection vulnerability in setup.exe of AutoHotkey 1.1.32.00 allows attackers to escalate privileges...

CVE-2020-18174

A process injection vulnerability in setup.exe of AutoHotkey 1.1.32.00 allows attackers to escalate privileges...

CVE-2020-18174

The CVE-2020-18174 entry concerns AutoHotkey 1.1.32.00, where a process-injection issue in setup.exe enables privilege escalation. The description indicates the vulnerable component is setup.exe and the impact is escalation of privileges, with no explicit remediation details provided in the suppl...

CVE-2020-18174: Undefined Security Weakness

A process injection vulnerability in setup.exe of AutoHotkey 1.1.32.00 allows attackers to escalate privileges...

HPSBHF03633 rev.1 - Intel Rapid Storage Technology (RSTe) Driver Installer Vulnerability

Potential Security Impact Escalation of privilege VULNERABILITY SUMMARY HP has been notified of a security vulnerability with the driver pack installers for IntelR RSTe package versions before version 4.7.0.2083 that may allow an authenticated user to escalate privilege via local access. RESOLUTI...