CmdID

CmdID / Files

AdobeARMHelper.exe

Adobe Reader and Acrobat Manager Helper file version info

Program on Windows 1 known copy with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real AdobeARMHelper.exe?

file version info and known copies
Installed inC:\ProgramData\Adobe\ARM\Acrobat_10.1.12\23913\
Signed byAdobe Systems
DescriptionAdobe Reader and Acrobat Manager Helper

1 known copy

1.801.10.4720 · C:\ProgramData\Adobe\ARM\Acrobat_10.1.12\23913\AdobeARMHelper.exe · signed by Adobe Systems

0ed27c1c59e4ac96b704f423ab836589effaec2b4615f534eefff104893adc36

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names AdobeARMHelper.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.