Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\softtrack adobe block firewall
Modifies file system
Creates the following files
- %TEMP%\aut2d95.tmp
- %WINDIR%\temp\temp_1\restfiles\vidbanner.mp4
- %TEMP%\aut4894.tmp
- %WINDIR%\temp\temp_1\restfiles\adobeblockfirewallai6.exe
- %TEMP%\aut4d56.tmp
- %WINDIR%\temp\temp_1\restfiles\lang.exe
- %TEMP%\softtrack adobe blocker.back(21.4).aiui
- %TEMP%\softtrack adobe blocker.back(21.4).msi
- %TEMP%\msi66dd.tmp
- %TEMP%\msi698c.tmp
- %TEMP%\softtrack adobe blocker.back(21.4)1.cab
- %ProgramFiles(x86)%\softtrack\softtrack adobe blocker firewall\adobeblockpopupfirewall.exe
- %WINDIR%\installer\{8c2414dc-910e-4db2-ad23-1c22ca4fa971}\favicon.exe
- %WINDIR%\installer\{8c2414dc-910e-4db2-ad23-1c22ca4fa971}\favicon_1.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\snelkoppeling naar adobe block firewall.lnk
- C:\users\public\desktop\snelkoppeling naar adobe block firewall.lnk
Deletes the following files
- %TEMP%\aut2d95.tmp
- %TEMP%\aut4894.tmp
- %TEMP%\aut4d56.tmp
- %TEMP%\msi66dd.tmp
- %TEMP%\msi698c.tmp
- %TEMP%\softtrack adobe blocker.back(21.4).aiui
- %TEMP%\softtrack adobe blocker.back(21.4).msi
- %TEMP%\softtrack adobe blocker.back(21.4)1.cab
Modifies the following files
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat.log1
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat
Miscellaneous
Searches for the following windows
- ClassName: 'WMPlayerApp' WindowName: ''
Creates and executes the following
- '%WINDIR%\temp\temp_1\restfiles\adobeblockfirewallai6.exe' /qn
- '%ProgramFiles(x86)%\softtrack\softtrack adobe blocker firewall\adobeblockpopupfirewall.exe' /q
Executes the following
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\Softtrack Adobe Blocker.back(21.4).msi" /qn AI_SETUPEXEPATH=%WINDIR%\Temp\Temp_1\restfiles\AdobeBlockFirewallAI6.exe SETUPEXEDIR=%WINDIR%\Temp\Temp_1\restfiles\ EXE_CMD_LINE="/exenou...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-ExecutionPolicy Bypass -scope Process -Force;(Get-NetRoute | Where-Object DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where-Object ConnectionState -eq 'Connected') -ne $null
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $ProgressPreference = 'SilentlyContinue';$r = (mount-diskimage -storagetype ISO -imagepath '<Current directory>\Deploy.db' -passthru | get-volume).driveletter;Set-Clipboard $r
- '%WINDIR%\temp\temp_1\restfiles\adobeblockfirewallai6.exe' /qn' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-ExecutionPolicy Bypass -scope Process -Force;(Get-NetRoute | Where-Object DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where-Object ConnectionState -eq 'Connected') -ne $null' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $ProgressPreference = 'SilentlyContinue';$r = (mount-diskimage -storagetype ISO -imagepath '<Current directory>\Deploy.db' -passthru | get-volume).driveletter;Set-Clipboard $r' (with hidden window)
