Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'ArkSigner' = '"%LOCALAPPDATA%\Programs\Ark\ArkSigner\ArkSignerManagement.exe" service'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im Arksigner*
- '%WINDIR%\syswow64\taskkill.exe' /f /im eNabiz*
- '%WINDIR%\syswow64\taskkill.exe' /f /im chrome.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im firefox.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im opera.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im msedge.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im ArkSignerManagement.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im ArkSignerGuncelleme.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im ArkSignerService.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im ArkSignerServiceConn.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im ArkSignerBEs.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im PW_UniversalWebSigner.exe
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name=arksignerservice-ws dir=in action=allow program=%LOCALAPPDATA%\Programs\Ark\ArkSigner\ArkSignerService.exe enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name=arksignerservice-conn dir=in action=allow program=%LOCALAPPDATA%\Programs\Ark\ArkSigner\ArkSignerServiceConn.exe enable=yes
- '%WINDIR%\syswow64\taskkill.exe' /im ArkSignerServiceConn.exe /f
- '%WINDIR%\syswow64\taskkill.exe' /im ArkSignerGuncelleme.exe /f
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies settings of Windows Internet Explorer
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = 'local.pwsigner.ark-teknoloji.com:16356; local.pwsigner.ark-teknoloji.com:16357'
Modifies file system
Creates the following files
- C:\hizirbilisim\araclar\e-imza\kur.bat
- %LOCALAPPDATA%\programs\ark\arksigner\translations\is-5t3pc.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\translations\is-f3nbg.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\translations\is-or2ki.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\translations\is-uif0e.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\translations\is-nge28.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\translations\is-ma1bf.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\translations\is-t6k9v.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\translations\is-kl3kc.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\translations\is-h6270.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\translations\is-kjpvn.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\translations\is-j92pq.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\platforms\is-2o4nf.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-argb8.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-0je6f.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-q5rtb.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-ffs1j.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\translations\is-tkukg.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-d6mee.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\translations\is-3t15h.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\chrome\com.ark.pw.websigner.json
- %LOCALAPPDATA%\programs\ark\arksigner\unins000.dat
- %LOCALAPPDATA%\programs\ark\arksigner\unins000.msg
- %APPDATA%\microsoft\windows\start menu\programs\arksigner\arksigner online test.url
- %APPDATA%\microsoft\windows\start menu\programs\arksigner\arksigner e-i̇mza uygulaması.lnk
- %LOCALAPPDATA%\programs\ark\arksigner\proxysettings\is-bpum3.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-jvv57.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\firefox\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\is-relag.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\firefox\icons\is-8q9c0.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\firefox\is-41b25.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\firefox\is-phjil.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\firefox\is-f4b2j.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\firefox\is-vtq71.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-a6sei.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-ni43a.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-2c6o4.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-cp9nu.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-k2eds.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\translations\is-3pq0f.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-a9f20.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-lor1s.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-a78f3.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-jfuvo.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-j70et.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-d6td9.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-jnikd.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-ocfd3.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-k8lt3.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-vucph.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-bsual.tmp
- %TEMP%\is-j6767.tmp\_isetup\_setup64.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-19g00.tmp
- %TEMP%\is-4lpdp.tmp\arksigner.tmp
- %TEMP%\is-km983.tmp\_isetup\_setup64.tmp
- %TEMP%\_iu14d2n.tmp
- C:\hizirbilisim\araclar\e-imza\unins000.exe
- C:\hizirbilisim\araclar\e-imza\unins000.dat
- C:\hizirbilisim\araclar\e-imza\unins000.msg
- C:\hizirbilisim\araclar\e-imza\arksigner.exe
- %LOCALAPPDATA%\programs\ark\arksigner\firefox\com.ark.pw.websigner.json
- %LOCALAPPDATA%\programs\ark\arksigner\translations\is-ead2i.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-v85q6.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-l7c25.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-olph7.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-7907j.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-m53oh.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\iconengines\is-59j8i.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\drivers\aetpkss1\windows_x86\is-rnp07.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\drivers\aetpkss1\windows_x86\is-deqbj.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\drivers\aetpkss1\windows_x86\is-plrkb.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-jrp6n.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-bp9p8.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-nlk17.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-5u03l.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-5cd5j.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-sr62e.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-ij13l.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-km6oo.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-ac52d.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-fma80.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\is-ki39r.tmp
- %LOCALAPPDATA%\programs\ark\arksigner\logs\arksigner-management.log
Deletes the following files
- C:\hizirbilisim\araclar\e-imza\unins000.dat
- C:\hizirbilisim\araclar\e-imza\unins000.msg
- C:\hizirbilisim\araclar\e-imza\unins000.exe
- %TEMP%\is-km983.tmp\_isetup\_setup64.tmp
- %TEMP%\is-j6767.tmp\_isetup\_setup64.tmp
- %TEMP%\is-4lpdp.tmp\arksigner.tmp
Moves the following files
- from %LOCALAPPDATA%\programs\ark\arksigner\is-jfuvo.tmp to %LOCALAPPDATA%\programs\ark\arksigner\unins000.exe
- from %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-0je6f.tmp to %LOCALAPPDATA%\programs\ark\arksigner\imageformats\qwbmp.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-argb8.tmp to %LOCALAPPDATA%\programs\ark\arksigner\imageformats\qwebp.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\platforms\is-2o4nf.tmp to %LOCALAPPDATA%\programs\ark\arksigner\platforms\qwindows.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\translations\is-j92pq.tmp to %LOCALAPPDATA%\programs\ark\arksigner\translations\qt_ca.qm
- from %LOCALAPPDATA%\programs\ark\arksigner\translations\is-kjpvn.tmp to %LOCALAPPDATA%\programs\ark\arksigner\translations\qt_cs.qm
- from %LOCALAPPDATA%\programs\ark\arksigner\translations\is-3pq0f.tmp to %LOCALAPPDATA%\programs\ark\arksigner\translations\qt_de.qm
- from %LOCALAPPDATA%\programs\ark\arksigner\translations\is-tkukg.tmp to %LOCALAPPDATA%\programs\ark\arksigner\translations\qt_en.qm
- from %LOCALAPPDATA%\programs\ark\arksigner\translations\is-t6k9v.tmp to %LOCALAPPDATA%\programs\ark\arksigner\translations\qt_fi.qm
- from %LOCALAPPDATA%\programs\ark\arksigner\translations\is-ma1bf.tmp to %LOCALAPPDATA%\programs\ark\arksigner\translations\qt_fr.qm
- from %LOCALAPPDATA%\programs\ark\arksigner\translations\is-nge28.tmp to %LOCALAPPDATA%\programs\ark\arksigner\translations\qt_he.qm
- from %LOCALAPPDATA%\programs\ark\arksigner\translations\is-uif0e.tmp to %LOCALAPPDATA%\programs\ark\arksigner\translations\qt_hu.qm
- from %LOCALAPPDATA%\programs\ark\arksigner\translations\is-or2ki.tmp to %LOCALAPPDATA%\programs\ark\arksigner\translations\qt_it.qm
- from %LOCALAPPDATA%\programs\ark\arksigner\translations\is-f3nbg.tmp to %LOCALAPPDATA%\programs\ark\arksigner\translations\qt_ja.qm
- from %LOCALAPPDATA%\programs\ark\arksigner\is-km6oo.tmp to %LOCALAPPDATA%\programs\ark\arksigner\opengl32sw.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\translations\is-5t3pc.tmp to %LOCALAPPDATA%\programs\ark\arksigner\translations\qt_ko.qm
- from %LOCALAPPDATA%\programs\ark\arksigner\translations\is-kl3kc.tmp to %LOCALAPPDATA%\programs\ark\arksigner\translations\qt_ru.qm
- from %LOCALAPPDATA%\programs\ark\arksigner\translations\is-3t15h.tmp to %LOCALAPPDATA%\programs\ark\arksigner\translations\qt_sk.qm
- from %LOCALAPPDATA%\programs\ark\arksigner\translations\is-ead2i.tmp to %LOCALAPPDATA%\programs\ark\arksigner\translations\qt_uk.qm
- from %LOCALAPPDATA%\programs\ark\arksigner\is-cp9nu.tmp to %LOCALAPPDATA%\programs\ark\arksigner\arksignercli.exe
- from %LOCALAPPDATA%\programs\ark\arksigner\is-2c6o4.tmp to %LOCALAPPDATA%\programs\ark\arksigner\arksignermanagementservice.exe
- from %LOCALAPPDATA%\programs\ark\arksigner\is-ni43a.tmp to %LOCALAPPDATA%\programs\ark\arksigner\arksignerserviceconn.exe
- from %LOCALAPPDATA%\programs\ark\arksigner\is-a6sei.tmp to %LOCALAPPDATA%\programs\ark\arksigner\arksignerbes.exe
- from %LOCALAPPDATA%\programs\ark\arksigner\firefox\is-vtq71.tmp to %LOCALAPPDATA%\programs\ark\arksigner\firefox\arksignerfirefoxextension@ark-teknoloji.com.xpi
- from %LOCALAPPDATA%\programs\ark\arksigner\firefox\is-f4b2j.tmp to %LOCALAPPDATA%\programs\ark\arksigner\firefox\background.js
- from %LOCALAPPDATA%\programs\ark\arksigner\firefox\is-phjil.tmp to %LOCALAPPDATA%\programs\ark\arksigner\firefox\content-script.js
- from %LOCALAPPDATA%\programs\ark\arksigner\firefox\is-41b25.tmp to %LOCALAPPDATA%\programs\ark\arksigner\firefox\manifest.json
- from %LOCALAPPDATA%\programs\ark\arksigner\firefox\icons\is-8q9c0.tmp to %LOCALAPPDATA%\programs\ark\arksigner\firefox\icons\icon-128.png
- from %LOCALAPPDATA%\programs\ark\arksigner\firefox\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\is-relag.tmp to %LOCALAPPDATA%\programs\ark\arksigner\firefox\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\arksignerfirefoxextension@ark-teknoloji.com.xpi
- from %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-ffs1j.tmp to %LOCALAPPDATA%\programs\ark\arksigner\imageformats\qtga.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-q5rtb.tmp to %LOCALAPPDATA%\programs\ark\arksigner\imageformats\qtiff.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-k2eds.tmp to %LOCALAPPDATA%\programs\ark\arksigner\imageformats\qsvg.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-a9f20.tmp to %LOCALAPPDATA%\programs\ark\arksigner\imageformats\qjpeg.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-lor1s.tmp to %LOCALAPPDATA%\programs\ark\arksigner\imageformats\qico.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\is-vucph.tmp to %LOCALAPPDATA%\programs\ark\arksigner\arksignerinstaller.exe.manifest
- from %LOCALAPPDATA%\programs\ark\arksigner\is-k8lt3.tmp to %LOCALAPPDATA%\programs\ark\arksigner\arksignermanagement.exe
- from %LOCALAPPDATA%\programs\ark\arksigner\is-ocfd3.tmp to %LOCALAPPDATA%\programs\ark\arksigner\arksignerpostinstaller.exe
- from %LOCALAPPDATA%\programs\ark\arksigner\is-jnikd.tmp to %LOCALAPPDATA%\programs\ark\arksigner\arksignerpostinstaller.exe.manifest
- from %LOCALAPPDATA%\programs\ark\arksigner\is-d6td9.tmp to %LOCALAPPDATA%\programs\ark\arksigner\d3dcompiler_47.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\is-j70et.tmp to %LOCALAPPDATA%\programs\ark\arksigner\libeay32.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\is-olph7.tmp to %LOCALAPPDATA%\programs\ark\arksigner\libegl.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\is-19g00.tmp to %LOCALAPPDATA%\programs\ark\arksigner\libgcc_s_dw2-1.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\is-v85q6.tmp to %LOCALAPPDATA%\programs\ark\arksigner\libglesv2.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\is-d6mee.tmp to %LOCALAPPDATA%\programs\ark\arksigner\libstdc++-6.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\is-ki39r.tmp to %LOCALAPPDATA%\programs\ark\arksigner\libwinpthread-1.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\is-l7c25.tmp to %LOCALAPPDATA%\programs\ark\arksigner\logo-ark.ico
- from %LOCALAPPDATA%\programs\ark\arksigner\is-fma80.tmp to %LOCALAPPDATA%\programs\ark\arksigner\msvcp100.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\is-jvv57.tmp to %LOCALAPPDATA%\programs\ark\arksigner\arksignerguncelleme.exe
- from %LOCALAPPDATA%\programs\ark\arksigner\translations\is-h6270.tmp to %LOCALAPPDATA%\programs\ark\arksigner\translations\qt_lv.qm
- from %LOCALAPPDATA%\programs\ark\arksigner\is-ac52d.tmp to %LOCALAPPDATA%\programs\ark\arksigner\msvcr100.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\is-sr62e.tmp to %LOCALAPPDATA%\programs\ark\arksigner\qt5gui.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\is-5cd5j.tmp to %LOCALAPPDATA%\programs\ark\arksigner\qt5network.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\is-5u03l.tmp to %LOCALAPPDATA%\programs\ark\arksigner\qt5svg.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\is-nlk17.tmp to %LOCALAPPDATA%\programs\ark\arksigner\qt5websockets.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\is-bp9p8.tmp to %LOCALAPPDATA%\programs\ark\arksigner\qt5widgets.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\is-jrp6n.tmp to %LOCALAPPDATA%\programs\ark\arksigner\ssleay32.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\drivers\aetpkss1\windows_x86\is-plrkb.tmp to %LOCALAPPDATA%\programs\ark\arksigner\drivers\aetpkss1\windows_x86\aetpkss1.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\drivers\aetpkss1\windows_x86\is-deqbj.tmp to %LOCALAPPDATA%\programs\ark\arksigner\drivers\aetpkss1\windows_x86\aetpksse.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\drivers\aetpkss1\windows_x86\is-rnp07.tmp to %LOCALAPPDATA%\programs\ark\arksigner\drivers\aetpkss1\windows_x86\aetpkssw.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\iconengines\is-59j8i.tmp to %LOCALAPPDATA%\programs\ark\arksigner\iconengines\qsvgicon.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-m53oh.tmp to %LOCALAPPDATA%\programs\ark\arksigner\imageformats\qdds.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-7907j.tmp to %LOCALAPPDATA%\programs\ark\arksigner\imageformats\qgif.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\imageformats\is-a78f3.tmp to %LOCALAPPDATA%\programs\ark\arksigner\imageformats\qicns.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\is-bsual.tmp to %LOCALAPPDATA%\programs\ark\arksigner\arksignerinstaller.exe
- from %LOCALAPPDATA%\programs\ark\arksigner\is-ij13l.tmp to %LOCALAPPDATA%\programs\ark\arksigner\qt5core.dll
- from %LOCALAPPDATA%\programs\ark\arksigner\proxysettings\is-bpum3.tmp to %LOCALAPPDATA%\programs\ark\arksigner\proxysettings\proxy.vbs
Modifies the HOSTS file.
Network activity
Connects to
- 'localhost':16357
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- 'C:\hizirbilisim\araclar\e-imza\unins000.exe' /VERYSILENT
- '%LOCALAPPDATA%\programs\ark\arksigner\arksignermanagement.exe' installation-mode service
- '%LOCALAPPDATA%\programs\ark\arksigner\arksignerpostinstaller.exe'
- '%WINDIR%\syswow64\wscript.exe' "%LOCALAPPDATA%\Programs\Ark\ArkSigner\ProxySettings\Proxy.vbs"
- '%TEMP%\is-4lpdp.tmp\arksigner.tmp' /SL5="$A0214,16867337,201728,C:\HIZIRBILISIM\Araclar\E-imza\ArkSigner.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- 'C:\hizirbilisim\araclar\e-imza\arksigner.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%LOCALAPPDATA%\programs\ark\arksigner\arksignerserviceconn.exe'
- '%LOCALAPPDATA%\programs\ark\arksigner\arksignerguncelleme.exe'
- '%TEMP%\_iu14d2n.tmp' /SECONDPHASE="C:\HIZIRBILISIM\Araclar\E-imza\unins000.exe" /FIRSTPHASEWND=$A020E /VERYSILENT
- '%WINDIR%\syswow64\taskkill.exe' /f /im PW_UniversalWebSigner.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im ArkSignerBEs.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im ArkSignerServiceConn.exe' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop PW_UniversalWebSignerService' (with hidden window)
- '%LOCALAPPDATA%\programs\ark\arksigner\arksignerpostinstaller.exe' ' (with hidden window)
- '%WINDIR%\syswow64\wscript.exe' "%LOCALAPPDATA%\Programs\Ark\ArkSigner\ProxySettings\Proxy.vbs"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im ArkSignerManagement.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im ArkSignerService.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im ArkSignerGuncelleme.exe' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete PW_UniversalWebSignerService' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\HIZIRBILISIM\Araclar\E-imza\kur.bat" "
- '%WINDIR%\syswow64\net.exe' user administrator /active:yes
- '%WINDIR%\syswow64\net1.exe' user administrator /active:yes
- '%WINDIR%\syswow64\msiexec.exe' /x {C914B904-09FA-4A28-BB66-201A5B9230CD} /passive
- '%WINDIR%\syswow64\msiexec.exe' /x {AB50F74B-6505-4BEA-A995-23477FD23FC6} /passive
- '%WINDIR%\syswow64\msiexec.exe' /x {B39F7EA9-BE6E-4487-BF8E-6445B1F4EADB} /passive
- '%WINDIR%\syswow64\msiexec.exe' /x {CC45E54B-EBF3-4718-AF42-82D0FE45FAC4} /passive
- '%WINDIR%\syswow64\msiexec.exe' /x {00DC6DFD-8803-409E-ACDE-4D956FD930BE} /passive
- '%WINDIR%\syswow64\msiexec.exe' /x {9D37953E-55D5-4F65-9231-2D175010D4D8} /passive
- '%WINDIR%\syswow64\msiexec.exe' /x {7180E2C6-CBD9-47FD-89AA-0AB936079764} /passive
- '%WINDIR%\syswow64\sc.exe' stop PW_UniversalWebSignerService
- '%WINDIR%\syswow64\sc.exe' delete PW_UniversalWebSignerService
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall show rule name=arksignerservice-ws
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall show rule name=arksignerservice-conn
- '%WINDIR%\syswow64\tasklist.exe' /NH /FO CSV /FI "IMAGENAME eq ArkSignerServiceConn.exe"
