examples:

• description: "Execute Adobe CC Setup and observe the unusual behavior" command: "Adobe CC Setup"

Adobe CC Setup

Adobe performs...process injection??

Adobe Creative Cloud setup spawns and injects code to explorer.exe for deleting itself. The injected function calls WaitForSingleObject(INFINITE) on the injector's process duplicated handle, then CloseHandle it, follows to loop over DeleteFileW to retry while it fails with an inner Sleep(1000) until success, then calls ExitProcess(0).

Contributed by Freddy Ouzan (@falsneg), John Harrison (@Cratez)