Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %WINDIR%\tasks\d24dda4d-5cf1-4441-ae07-acc94ae70b28-10_user.job
- <SYSTEM32>\tasks\d24dda4d-5cf1-4441-ae07-acc94ae70b28-10_user
- %WINDIR%\tasks\temp_d24dda4d-5cf1-4441-ae07-acc94ae70b28-10_user.job
- <SYSTEM32>\tasks\temp_d24dda4d-5cf1-4441-ae07-acc94ae70b28-10_user
- %WINDIR%\tasks\d24dda4d-5cf1-4441-ae07-acc94ae70b28-3.job
- <SYSTEM32>\tasks\d24dda4d-5cf1-4441-ae07-acc94ae70b28-3
- %WINDIR%\tasks\globalupdateupdatetaskmachinecore.job
- <SYSTEM32>\tasks\globalupdateupdatetaskmachinecore
- %WINDIR%\tasks\globalupdateupdatetaskmachineua.job
- <SYSTEM32>\tasks\globalupdateupdatetaskmachineua
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\globalUpdate] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\globalUpdate] 'ImagePath' = '%ProgramFiles(x86)%\globalUpdate\Update\globalupdate.exe /svc'
- [HKLM\System\CurrentControlSet\Services\globalUpdatem] 'ImagePath' = '%ProgramFiles(x86)%\globalUpdate\Update\globalupdate.exe /medsvc'
Creates the following services
- 'globalUpdate' %ProgramFiles(x86)%\globalUpdate\Update\globalupdate.exe /svc
- 'globalUpdatem' %ProgramFiles(x86)%\globalUpdate\Update\globalupdate.exe /medsvc
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\nsf46d0.tmp\riprdh.dll
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\376.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\4.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\281.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\242.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\390.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\91.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\200.js
- %WINDIR%\syswow64\029b560a371f4e00ab32838ebc01b9e7
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\354.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\253.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\255.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\385.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\28.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\180.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\183.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\339.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\manifest.xml
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\manifest.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\icons\icon128.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\icons\icon16.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\icons\actions\1.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\icons\icon48.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\background.html
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\chromecorefilesindex.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\popup.html
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\fed4e0d593bfb9a766ff4e8d9c03521c.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\api\100f06c0debbdff71dbeb8fe7ce69644.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\api\006be7e84a3d122908472316a6e7bc57.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\api\fb3f825df91830fb3eeda47d153de298.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\api\86067240139eb8190fc5dcbe3d286ca0.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\21.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\345.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\usercode\extension.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\207.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\13.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\47.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\17.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\78.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\102.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\193.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\288.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\80.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\184.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\72.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\223.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\64.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\220.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\lib\42e088e2237d1b6ea9c5d3a8319ddfb4.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\246.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\379.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\22.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\177.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\252.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\14.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\391.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\9.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\19.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\182.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\195.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\1.js
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012024082420240825\index.dat
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\7.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\api\pageaction.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\api\51c89d48dd2e028c48bde17404c6e065.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\lib\def148ba5e6c9ce0d5fc7f605b4e1500.js
- %TEMP%\comh.7329\npglobalupdateupdate4.dll
- %TEMP%\comh.7329\goopdateres_en.dll
- %TEMP%\comh.7329\goopdate.dll
- %TEMP%\comh.7329\globalupdateondemand.exe
- %TEMP%\comh.7329\globalupdatehelper.msi
- %TEMP%\comh.7329\globalupdatebroker.exe
- %TEMP%\comh.7329\globalupdate.exe
- %TEMP%\comh.7329\globalupdatecrashhandler.exe
- %ProgramFiles(x86)%\app lid\d24dda4d-5cf1-4441-ae07-acc94ae70b28-10.exe
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_d99ef00b-ccd3-4f1d-9980-90ac453b0b47
- %ProgramFiles(x86)%\app lid\uninstallbrw.exe
- %ProgramFiles(x86)%\app lid\uninstall.exe
- %TEMP%\nsv67c9.tmp\386455
- %TEMP%\nsv67c9.tmp\153801
- %ProgramFiles(x86)%\app lid\utils.exe
- %TEMP%\nsv67c9.tmp\lwxmbjbv.dll
- %TEMP%\nsv67c9.tmp\system.dll
- %TEMP%\nsv67c9.tmp\zlsaakimw.dll
- %TEMP%\nsv67c9.tmp\xmjqv.dll
- %TEMP%\nsv67c9.tmp\eqdbi.dll
- %TEMP%\nsv67c9.tmp\vmpsblcd.dll
- %TEMP%\nsv67c9.tmp\riprdh.dll
- %TEMP%\nsv67c9.tmp\vflqfjw.dll
- %TEMP%\nsv677a.tmp
- %TEMP%\nsf46d0.tmp\vflqfjw.dll
- %TEMP%\nsf46d0.tmp\fshdoqdnltne.exe
- %TEMP%\nsf46d0.tmp\gegbewmoy.dll
- %TEMP%\nsf46d0.tmp\pbnra.tmp
- %TEMP%\comh.7329\psuser.dll
- %ProgramFiles(x86)%\globalupdate\update\1.3.25.0\globalupdate.exe
- %TEMP%\comh.7329\psmachine.dll
- %ProgramFiles(x86)%\globalupdate\update\1.3.25.0\goopdate.dll
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\lib\79834867881627c8b8584a2a7613f4dc.js
- %ProgramFiles(x86)%\globalupdate\update\1.3.25.0\globalupdatecrashhandler.exe
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\lib\4327bc6e1cd8e2598cc0b16ba2dba2cb.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\lib\5e1bc0fc71bed6ebcdad95f9a44f9119.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\lib\01c0f268e8d0ff6f626824b3943e8a9d.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\lib\4e59f6202ca9e53d82d56fd3afb74cd1.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\lib\792f97fabacfce108f2c7d4d9225e97d.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\lib\8cc02d96c37081b882aec86edf1e04aa.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\lib\installer.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\lib\c3239a793230b98c45d795cf0de13158.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\lib\b0f73b19b747f2536ee8b768c26e472a.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\lib\app_api.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\lib\886023e19c4b0c58cbfcfe6289a67a2f.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\lib\ed98a676de5c8a70c8792e8a03561eb5.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\lib\popupresource\newpopup.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\plugins\97.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\extensiondata\usercode\background.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\lib\c1794dd1901f33dc5fa569a90fc2accb.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\32b093cf67887e8e50dcf0d57656667c.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\main.js
- %TEMP%\nsv67c9.tmp\fspjoc.dll
- %ProgramFiles(x86)%\app lid\d24dda4d-5cf1-4441-ae07-acc94ae70b28-3.exe
- %ProgramFiles(x86)%\app lid\0a0e887c-26ac-44eb-983d-fde5e91e5768.crx
- %ProgramFiles(x86)%\globalupdate\update\1.3.25.0\globalupdateondemand.exe
- %ProgramFiles(x86)%\globalupdate\update\1.3.25.0\globalupdatebroker.exe
- %ProgramFiles(x86)%\globalupdate\update\1.3.25.0\npglobalupdateupdate4.dll
- %ProgramFiles(x86)%\globalupdate\update\globalupdate.exe
- %ProgramFiles(x86)%\globalupdate\update\1.3.25.0\psmachine.dll
- %ProgramFiles(x86)%\globalupdate\update\1.3.25.0\psuser.dll
- %ProgramFiles(x86)%\globalupdate\update\1.3.25.0\globalupdatehelper.msi
- %ProgramFiles(x86)%\globalupdate\update\1.3.25.0\goopdateres_en.dll
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\js\lib\popupresource\popup.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aemgobnhmjkokaanfjcikbeddfpfbcce\1.26.83_0\settings.json
Deletes the following files
- %TEMP%\nsv67c9.tmp\386455
- %WINDIR%\tasks\temp_d24dda4d-5cf1-4441-ae07-acc94ae70b28-10_user.job
- <SYSTEM32>\tasks\temp_d24dda4d-5cf1-4441-ae07-acc94ae70b28-10_user
Modifies the following files
Substitutes the following files
- %TEMP%\nsv67c9.tmp\386455
Network activity
Connects to
- 'er####.bitkeymap.com':80
- 'ip###api.com':80
- 'st###.bitkeymap.com':80
- 'lo##.#itkeymap.com':80
- 'no###.bitkeymap.com':80
- 'go###eapis.com':443
TCP
HTTP GET requests
- http://er####.bitkeymap.com/utility.gif?re##########################################################################
- http://st###.bitkeymap.com/installer.gif?ac######################################################################################################################################################...
- http://er####.bitkeymap.com/installer-error.gif?ac###############################################################################################################################################...
- http://lo##.#itkeymap.com/monetization.gif?ev####################################################################################################################################################...
- http://er####.bitkeymap.com/utility.gif?re########################################################################
- http://er####.bitkeymap.com/utility.gif?re############################################################################
- http://er####.bitkeymap.com/utility.gif?re#####################################################################################
- http://er####.bitkeymap.com/utility.gif?re#########################################################################################
- http://er####.bitkeymap.com/utility.gif?re##################################################################################
- http://er####.bitkeymap.com/utility.gif?re###############################################################################
- http://lo##.#itkeymap.com/monetization.gif?ev#####################################################################################################################################
- http://no###.bitkeymap.com/notf_sys/index.html?rn######
- http://er####.bitkeymap.com/utility.gif?ac#######################################################################################################################################################...
Other
- 'go###eapis.com':443
UDP
- DNS ASK er####.bitkeymap.com
- DNS ASK ip###api.com
- DNS ASK st###.bitkeymap.com
- DNS ASK lo##.#itkeymap.com
- DNS ASK no###.bitkeymap.com
- DNS ASK go###eapis.com
Miscellaneous
Searches for the following windows
- ClassName: 'F45B9051-20DA-486D-B646-88FDF29D63A0_bg_AppLid' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\nsf46d0.tmp\fshdoqdnltne.exe'
- '%ProgramFiles(x86)%\app lid\d24dda4d-5cf1-4441-ae07-acc94ae70b28-10.exe' /rawdata=czcJnoImZO7TpQIi/Oe8ubCChYqdtUueVvvOxf1QR1MBsIt0jJNBLj5P083GJX+LCu/gQVTiLqhKNM9021EuggRYAzeagA7zlKqCQHEilM/URaMaS/OWvGxO/DsUnqo7s9uRXvz61UmNmoVfmwb2Db6UYzqXaxJFkrnNSCY9QtY+apBRlUL/hOGA...
- '%TEMP%\comh.7329\globalupdate.exe' /silent /install "appguid={06c48cfa-e4fb-4d6e-8117-4ea1a272f5b0}&appname=2391ac11-2e3f-4085-b848-5ffd5cfc99d2&needsadmin=True&lang=en"
- '%ProgramFiles(x86)%\globalupdate\update\globalupdate.exe' /regsvc
- '%ProgramFiles(x86)%\app lid\d24dda4d-5cf1-4441-ae07-acc94ae70b28-3.exe' /rawdata=qwhfmbV2sA9It69UQIApIabUfHy4sH39TwNMteBDvKPu0TvYUivkGhE8cF8iUvptCmfH9KR0H/zHnAb+TISmFB/wAB7Aw6NKxb8zTW8T23SgWQbyXRlCZAv3gT3WjGjJ/FOiPbcUlBxoL4WQrLXXuyNX3nTzOYSiwmulhegZDi8O8F+bQ/bO5pue...
- '%ProgramFiles(x86)%\globalupdate\update\globalupdate.exe' /regserver
- '%ProgramFiles(x86)%\globalupdate\update\globalupdate.exe' /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMjUuMCIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InsyNTcwODkwQS0yNTRBLTRDOUItOTlEQi1CNDg3NTY3NTg...
- '%ProgramFiles(x86)%\globalupdate\update\globalupdate.exe' /handoff "appguid={06c48cfa-e4fb-4d6e-8117-4ea1a272f5b0}&appname=2391ac11-2e3f-4085-b848-5ffd5cfc99d2&needsadmin=True&lang=en" /installsource otherinstallcmd /sessionid "{2570890A-254A-4C9B-99D...
- '%ProgramFiles(x86)%\globalupdate\update\globalupdate.exe' /svc
Executes the following
- '<SYSTEM32>\taskeng.exe' {F5FA0695-2C4B-42AB-B842-EA5765826F07} S-1-5-21-3150914307-1777937420-491476919-1000:esizqabfyky\user:Interactive:[1]
- '%ProgramFiles(x86)%\app lid\d24dda4d-5cf1-4441-ae07-acc94ae70b28-10.exe' /rawdata=czcJnoImZO7TpQIi/Oe8ubCChYqdtUueVvvOxf1QR1MBsIt0jJNBLj5P083GJX+LCu/gQVTiLqhKNM9021EuggRYAzeagA7zlKqCQHEilM/URaMaS/OWvGxO/DsUnqo7s9uRXvz61UmNmoVfmwb2Db6UYzqXaxJFkrnNSCY9QtY+apBRlUL/hOGA...' (with hidden window)
- '%ProgramFiles(x86)%\app lid\d24dda4d-5cf1-4441-ae07-acc94ae70b28-3.exe' /rawdata=qwhfmbV2sA9It69UQIApIabUfHy4sH39TwNMteBDvKPu0TvYUivkGhE8cF8iUvptCmfH9KR0H/zHnAb+TISmFB/wAB7Aw6NKxb8zTW8T23SgWQbyXRlCZAv3gT3WjGjJ/FOiPbcUlBxoL4WQrLXXuyNX3nTzOYSiwmulhegZDi8O8F+bQ/bO5pue...' (with hidden window)
