JS.SRedir.1

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{d4cecf3b-b68f-4995-8840-52ea0fab646e}' = '"%ALLUSERSPROFILE%\Package Cache\{d4cecf3b-b68f-4995-8840-52ea0fab646e}\VC_redis...

Substitutes the following executable system files

<SYSTEM32>\concrt140.dll with <SYSTEM32>\concrt140.dll
<SYSTEM32>\mfc140u.dll with <SYSTEM32>\mfc140u.dll
<SYSTEM32>\mfc140rus.dll with <SYSTEM32>\mfc140rus.dll
<SYSTEM32>\mfc140kor.dll with <SYSTEM32>\mfc140kor.dll
<SYSTEM32>\mfc140jpn.dll with <SYSTEM32>\mfc140jpn.dll
<SYSTEM32>\mfc140ita.dll with <SYSTEM32>\mfc140ita.dll
<SYSTEM32>\mfc140fra.dll with <SYSTEM32>\mfc140fra.dll
<SYSTEM32>\mfc140esn.dll with <SYSTEM32>\mfc140esn.dll
<SYSTEM32>\mfc140enu.dll with <SYSTEM32>\mfc140enu.dll
<SYSTEM32>\mfc140deu.dll with <SYSTEM32>\mfc140deu.dll
<SYSTEM32>\mfc140cht.dll with <SYSTEM32>\mfc140cht.dll
<SYSTEM32>\mfcm140.dll with <SYSTEM32>\mfcm140.dll
<SYSTEM32>\mfc140chs.dll with <SYSTEM32>\mfc140chs.dll
<SYSTEM32>\vcruntime140_1.dll with <SYSTEM32>\vcruntime140_1.dll
<SYSTEM32>\vcruntime140.dll with <SYSTEM32>\vcruntime140.dll
<SYSTEM32>\vcomp140.dll with <SYSTEM32>\vcomp140.dll
<SYSTEM32>\vccorlib140.dll with <SYSTEM32>\vccorlib140.dll
<SYSTEM32>\vcamp140.dll with <SYSTEM32>\vcamp140.dll
<SYSTEM32>\msvcp140_codecvt_ids.dll with <SYSTEM32>\msvcp140_codecvt_ids.dll
<SYSTEM32>\msvcp140_atomic_wait.dll with <SYSTEM32>\msvcp140_atomic_wait.dll
<SYSTEM32>\msvcp140_2.dll with <SYSTEM32>\msvcp140_2.dll
<SYSTEM32>\msvcp140_1.dll with <SYSTEM32>\msvcp140_1.dll
<SYSTEM32>\msvcp140.dll with <SYSTEM32>\msvcp140.dll
<SYSTEM32>\mfc140.dll with <SYSTEM32>\mfc140.dll
<SYSTEM32>\mfcm140u.dll with <SYSTEM32>\mfcm140u.dll

Infects the following executable files

<SYSTEM32>\concrt140.dll
<SYSTEM32>\mfc140u.dll
<SYSTEM32>\mfc140rus.dll
<SYSTEM32>\mfc140kor.dll
<SYSTEM32>\mfc140jpn.dll
<SYSTEM32>\mfc140ita.dll
<SYSTEM32>\mfc140fra.dll
<SYSTEM32>\mfc140esn.dll
<SYSTEM32>\mfc140enu.dll
<SYSTEM32>\mfc140deu.dll
<SYSTEM32>\mfc140cht.dll
<SYSTEM32>\mfcm140.dll
<SYSTEM32>\mfc140chs.dll
<SYSTEM32>\vcruntime140_1.dll
<SYSTEM32>\vcruntime140.dll
<SYSTEM32>\vcomp140.dll
<SYSTEM32>\vccorlib140.dll
<SYSTEM32>\vcamp140.dll
<SYSTEM32>\msvcp140_codecvt_ids.dll
<SYSTEM32>\msvcp140_atomic_wait.dll
<SYSTEM32>\msvcp140_2.dll
<SYSTEM32>\msvcp140_1.dll
<SYSTEM32>\msvcp140.dll
<SYSTEM32>\mfc140.dll
<SYSTEM32>\mfcm140u.dll

Modifies file system

Creates the following files

%TEMP%\is-b1ss1.tmp\<File name>.tmp
%WINDIR%\temp\~dfdd20a546c13c11eb.tmp
%WINDIR%\temp\~df30af6b69cc629955.tmp
%WINDIR%\temp\~df70006bc3ba24c8f4.tmp
%WINDIR%\temp\~dfbb3220412e2c6d0e.tmp
%WINDIR%\temp\~df801df6648e85eeae.tmp
%WINDIR%\temp\~df88baed614cf296fa.tmp
%WINDIR%\temp\~dfefa0f3fbf623b280.tmp
%WINDIR%\temp\~df1dd0c73ec2659760.tmp
%WINDIR%\temp\~df111743347311eadf.tmp
%WINDIR%\temp\~dfd48d5da7de2056b0.tmp
%WINDIR%\temp\~df55e7a08857ff5b69.tmp
%WINDIR%\installer\sourcehash{eae242b1-0a26-485a-bfeb-0292ee9f03cb}
%WINDIR%\temp\~dfb01c5b94b40a0284.tmp
%WINDIR%\temp\~df5e565f7bf62255b2.tmp
%WINDIR%\temp\~df9ae562240bcff248.tmp
%WINDIR%\temp\~df79d68b2c2cdb35c6.tmp
%WINDIR%\temp\~df556c1a69645240b1.tmp
%WINDIR%\temp\~dfb6f618cd48064114.tmp
%WINDIR%\temp\~df58f6b4f39c73a990.tmp
%TEMP%\dd_vcredist_amd64_20240311030745_001_vcruntimeadditional_x64.log
%WINDIR%\temp\~df6b478930dd92cfcb.tmp
%WINDIR%\temp\~dfa8a5d5ecc0c1c739.tmp
%WINDIR%\temp\~dffcc0824f45e16a02.tmp
%WINDIR%\temp\~df6e6322f54162d8da.tmp
%WINDIR%\temp\~df009c34cad338729a.tmp
%WINDIR%\temp\~df4c32eeed5b5a20e4.tmp
%WINDIR%\temp\~df2bcd8a46c1e1f704.tmp
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\wixstdba.dll
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\thm.xml
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\thm.wxl
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\logo.png
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\bootstrapperapplicationdata.xml
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\3082\license.rtf
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\3082\thm.wxl
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\2052\license.rtf
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\2052\thm.wxl
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1055\license.rtf
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1055\thm.wxl
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1049\license.rtf
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1049\thm.wxl
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1046\license.rtf
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1046\thm.wxl
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1045\license.rtf
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1045\thm.wxl
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1042\thm.wxl
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1042\license.rtf
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1041\license.rtf
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1041\thm.wxl
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1040\license.rtf
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1040\thm.wxl
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1036\license.rtf
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1036\thm.wxl
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1031\license.rtf
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1031\thm.wxl
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1029\license.rtf
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1029\thm.wxl
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1028\license.rtf
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\1028\thm.wxl
%WINDIR%\temp\{a43e0016-ac3c-488d-a339-b1e63a239d06}\.ba\license.rtf
%TEMP%\dd_vcredist_amd64_20240311030818.log
%WINDIR%\temp\~dfef7b606779ad5bf1.tmp
%WINDIR%\temp\~dfffe63219dce1765c.tmp
%WINDIR%\temp\~dfb6828fa2eb7179bc.tmp
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1041\license.rtf
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1041\thm.wxl
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1040\license.rtf
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1040\thm.wxl
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1036\license.rtf
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1036\thm.wxl
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1031\license.rtf
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1031\thm.wxl
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1029\license.rtf
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1029\thm.wxl
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1028\license.rtf
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1028\thm.wxl
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\license.rtf
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\logo.png
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\thm.wxl
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\thm.xml
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\wixstdba.dll
%WINDIR%\temp\{d1049148-1452-424f-ad77-01b09f287c94}\.cr\vc_redist.x64.exe
%LOCALAPPDATA%\windowsapp\is-l1m84.tmp
%TEMP%\is-f2e1i.tmp\is-tke4j.tmp
%LOCALAPPDATA%\windowsapp\apps-helper\is-gn134.tmp
%LOCALAPPDATA%\windowsapp\apps-helper\is-p18ls.tmp
%LOCALAPPDATA%\windowsapp\apps-helper\is-aetqs.tmp
%LOCALAPPDATA%\windowsapp\apps-helper\is-bm5lo.tmp
%TEMP%\is-f2e1i.tmp\_isetup\_setup64.tmp
%TEMP%\is-l1tt6.tmp\<File name>.tmp
%TEMP%\is-dpne5.tmp\_isetup\_setup64.tmp
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1042\thm.wxl
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1042\license.rtf
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1045\thm.wxl
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1045\license.rtf
%WINDIR%\installer\sourcehash{cf4c347d-954e-4543-88d2-ec17f07f466f}
%WINDIR%\temp\~dfc21c6ef55ac041a1.tmp
%WINDIR%\temp\~df1c136a42c85cd1dd.tmp
%WINDIR%\temp\~dfbb9ba663dcb71c35.tmp
%WINDIR%\temp\~dffdbed19c223104a1.tmp
%WINDIR%\temp\~df1c55fe5b5e187428.tmp
%WINDIR%\temp\~dfafeeaf71cf02c59f.tmp
%WINDIR%\temp\~dff97569bf22efb4df.tmp
%TEMP%\dd_vcredist_amd64_20240311030745_000_vcruntimeminimum_x64.log
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\cab2c04ddc374bd96eb5c8eb8208f2c7c92
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\cab5046a8ab272bf37297bb7928664c9503
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\vcruntimeadditional_x64
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\vcruntimeminimum_x64
%ALLUSERSPROFILE%\package cache\{d4cecf3b-b68f-4995-8840-52ea0fab646e}\vc_redist.x64.exe
%ALLUSERSPROFILE%\package cache\{d4cecf3b-b68f-4995-8840-52ea0fab646e}\state.rsm
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.be\vc_redist.x64.exe
%TEMP%\dd_vcredist_amd64_20240311030745.log
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\bootstrapperapplicationdata.xml
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\3082\license.rtf
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\3082\thm.wxl
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\2052\license.rtf
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\2052\thm.wxl
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1055\license.rtf
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1055\thm.wxl
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1049\license.rtf
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1049\thm.wxl
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1046\license.rtf
%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.ba\1046\thm.wxl
%WINDIR%\temp\~df0aa000a47c343b79.tmp
%WINDIR%\appcompat\programs\install\install_0006_bb658e12-a647-409e-8219-c4f2dccaa634.txt

Moves the following system files

from <SYSTEM32>\vcruntime140_1.dll to C:\config.msi\d1f56.rbf
from <SYSTEM32>\mfc140u.dll to C:\config.msi\d1f75.rbf
from <SYSTEM32>\mfc140rus.dll to C:\config.msi\d1f74.rbf
from <SYSTEM32>\mfc140kor.dll to C:\config.msi\d1f73.rbf
from <SYSTEM32>\mfc140jpn.dll to C:\config.msi\d1f72.rbf
from <SYSTEM32>\mfc140ita.dll to C:\config.msi\d1f71.rbf
from <SYSTEM32>\mfc140fra.dll to C:\config.msi\d1f70.rbf
from <SYSTEM32>\mfc140esn.dll to C:\config.msi\d1f6f.rbf
from <SYSTEM32>\mfc140enu.dll to C:\config.msi\d1f6e.rbf
from <SYSTEM32>\mfc140deu.dll to C:\config.msi\d1f6d.rbf
from <SYSTEM32>\mfc140cht.dll to C:\config.msi\d1f6c.rbf
from <SYSTEM32>\mfcm140.dll to C:\config.msi\d1f76.rbf
from <SYSTEM32>\mfc140chs.dll to C:\config.msi\d1f6b.rbf
from <SYSTEM32>\vcruntime140.dll to C:\config.msi\d1f61.rbf
from <SYSTEM32>\vccorlib140.dll to C:\config.msi\d1f60.rbf
from <SYSTEM32>\msvcp140.dll to C:\config.msi\d1f5f.rbf
from <SYSTEM32>\concrt140.dll to C:\config.msi\d1f5e.rbf
from <SYSTEM32>\vcomp140.dll to C:\config.msi\d1f5c.rbf
from <SYSTEM32>\vcamp140.dll to C:\config.msi\d1f5b.rbf
from <SYSTEM32>\msvcp140_codecvt_ids.dll to C:\config.msi\d1f5a.rbf
from <SYSTEM32>\msvcp140_atomic_wait.dll to C:\config.msi\d1f59.rbf
from <SYSTEM32>\msvcp140_2.dll to C:\config.msi\d1f58.rbf
from <SYSTEM32>\msvcp140_1.dll to C:\config.msi\d1f57.rbf
from <SYSTEM32>\mfc140.dll to C:\config.msi\d1f6a.rbf
from <SYSTEM32>\mfcm140u.dll to C:\config.msi\d1f77.rbf

Moves the following files

from %LOCALAPPDATA%\windowsapp\apps-helper\is-bm5lo.tmp to %LOCALAPPDATA%\windowsapp\apps-helper\manifest.json
from %LOCALAPPDATA%\windowsapp\apps-helper\is-aetqs.tmp to %LOCALAPPDATA%\windowsapp\apps-helper\service.js
from %LOCALAPPDATA%\windowsapp\apps-helper\is-p18ls.tmp to %LOCALAPPDATA%\windowsapp\apps-helper\web.js
from %LOCALAPPDATA%\windowsapp\apps-helper\is-gn134.tmp to %LOCALAPPDATA%\windowsapp\apps-helper\apps.crx
from %TEMP%\is-f2e1i.tmp\is-tke4j.tmp to %TEMP%\is-f2e1i.tmp\vc_redist.x64.exe
from %LOCALAPPDATA%\windowsapp\is-l1m84.tmp to %LOCALAPPDATA%\windowsapp\installextension.exe
from %WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\vcruntimeminimum_x64 to %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeminimum_x64
from %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeminimum_x64 to %ALLUSERSPROFILE%\package cache\{cf4c347d-954e-4543-88d2-ec17f07f466f}v14.34.31931\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi
from %WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\cab5046a8ab272bf37297bb7928664c9503 to %ALLUSERSPROFILE%\package cache\.unverified\cab5046a8ab272bf37297bb7928664c9503
from %ALLUSERSPROFILE%\package cache\.unverified\cab5046a8ab272bf37297bb7928664c9503 to %ALLUSERSPROFILE%\package cache\{cf4c347d-954e-4543-88d2-ec17f07f466f}v14.34.31931\packages\vcruntimeminimum_amd64\cab1.cab
from %WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\vcruntimeadditional_x64 to %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeadditional_x64
from %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeadditional_x64 to %ALLUSERSPROFILE%\package cache\{eae242b1-0a26-485a-bfeb-0292ee9f03cb}v14.34.31931\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi
from %WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\cab2c04ddc374bd96eb5c8eb8208f2c7c92 to %ALLUSERSPROFILE%\package cache\.unverified\cab2c04ddc374bd96eb5c8eb8208f2c7c92
from %ALLUSERSPROFILE%\package cache\.unverified\cab2c04ddc374bd96eb5c8eb8208f2c7c92 to %ALLUSERSPROFILE%\package cache\{eae242b1-0a26-485a-bfeb-0292ee9f03cb}v14.34.31931\packages\vcruntimeadditional_amd64\cab1.cab

Modifies the following files

%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\state.rsm

Miscellaneous

Searches for the following windows

ClassName: 'OleMainThreadWndClass' WindowName: ''

Creates and executes the following

'%TEMP%\is-b1ss1.tmp\<File name>.tmp' /SL5="$502A0,24626888,780800,<Full path to file>"
'%TEMP%\is-l1tt6.tmp\<File name>.tmp' /SL5="$602A0,24626888,780800,<Full path to file>" /SILENT
'%TEMP%\is-f2e1i.tmp\vc_redist.x64.exe' /install /quiet
'%WINDIR%\temp\{d1049148-1452-424f-ad77-01b09f287c94}\.cr\vc_redist.x64.exe' -burn.clean.room="%TEMP%\is-F2E1I.tmp\VC_redist.x64.exe" -burn.filehandle.attached=616 -burn.filehandle.self=624 /install /quiet
'%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.be\vc_redist.x64.exe' -q -burn.elevated BurnPipe.{5DE4243E-A3A0-460C-91CF-E19BCDC9D163} {E8CEBBE2-3FA3-4370-80BC-530F03829A23} 2784
'%LOCALAPPDATA%\windowsapp\installextension.exe' install
'%TEMP%\is-f2e1i.tmp\vc_redist.x64.exe' /install /quiet' (with hidden window)
'%WINDIR%\temp\{caa40f2f-5f3e-40e6-9681-ae718cb34348}\.be\vc_redist.x64.exe' -q -burn.elevated BurnPipe.{5DE4243E-A3A0-460C-91CF-E19BCDC9D163} {E8CEBBE2-3FA3-4370-80BC-530F03829A23} 2784' (with hidden window)
'%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\vc_redist.x64.exe' -q -burn.elevated BurnPipe.{08835E45-9E00-4724-B74A-874FA5B31E3F} {9967EE2E-260B-4D7D-B6A3-08C134EB5BF1} 2976' (with hidden window)
'%LOCALAPPDATA%\windowsapp\installextension.exe' install' (with hidden window)
'<SYSTEM32>\cmd.exe' /C ""%LOCALAPPDATA%\WindowsApp\reg.bat" install"' (with hidden window)

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\cmd.exe' /C ""%LOCALAPPDATA%\WindowsApp\reg.bat" install"

Attempts to shut down the Windows operating system.

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней