Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '0e48ba1e19125bfe4d23115e2514d03d' = '"%TEMP%\Windows Defender SmartScreen.exe" ..'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '0e48ba1e19125bfe4d23115e2514d03d' = '"%TEMP%\Windows Defender SmartScreen.exe" ..'
- %APPDATA%\microsoft\windows\start menu\programs\startup\0e48ba1e19125bfe4d23115e2514d03d.exe
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\Windows Defender SmartScreen.exe" "Windows Defender SmartScreen.exe" ENABLE
- %TEMP%\windows defender smartscreen.exe
- <Full path to file>
- %TEMP%\windows defender smartscreen.exe
- 'localhost':5552
- DNS ASK hk####.codns.com
- '%TEMP%\windows defender smartscreen.exe'
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\Windows Defender SmartScreen.exe" "Windows Defender SmartScreen.exe" ENABLE' (with hidden window)