Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    05/06/2023, 14:44

General

  • Target

    pautomation-setup.exe

  • Size

    1.0MB

  • MD5

    c452d47fbbe0df86f30908b32842539d

  • SHA1

    fd56ce24a09e2f41584872808538e8a579d2306a

  • SHA256

    b3f5752541186bae8a929dafd06f95de7e006a064ca411dd135b4047a018d5eb

  • SHA512

    9d0fdd042a209c7b591358b25629a12a640b7731636b2683dd18c285b3d5ae7a30f7f0572521f35c405ae53458b88096f4fa16194636b8e69d475d0e9c91f844

  • SSDEEP

    24576:lKS859qT1kVYUxEvuUt5WN7q5O0w5gkwC0aoQpsosbrID:4X59YWhEvdyxBfrpso+o

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 19 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 23 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\pautomation-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\pautomation-setup.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1324
    • C:\Program Files (x86)\Perfect Automation\pautomation.exe
      "C:\Program Files (x86)\Perfect Automation\pautomation.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1788
      • C:\Program Files (x86)\Perfect Automation\pautomation.exe
        "C:\Program Files (x86)\Perfect Automation\pautomation.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1908
      • C:\Program Files (x86)\Perfect Automation\script.exe
        "C:\Program Files (x86)\Perfect Automation\script.exe" "C:\Users\Admin\AppData\Roaming\Perfect Automation\solutions\programs\UTF-8 tool.pa"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates system info in registry
        PID:1336
      • C:\Program Files (x86)\Perfect Automation\script.exe
        "C:\Program Files (x86)\Perfect Automation\script.exe" "C:\Users\Admin\AppData\Roaming\Perfect Automation\solutions\programs\Customize Open & Save dialogs.pa"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates system info in registry
        PID:1324
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RedoSwitch.gif
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      PID:360

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Perfect Automation\LICENSE.rtf

          Filesize

          9KB

          MD5

          ca206ad18263a55f0ace3d018803ae6a

          SHA1

          5f05bc976a6c5a5896379009dc5f73f620523f1d

          SHA256

          dc46b017ef669bf5577039a321d208018b2fdc989abff4f17290872af40cb7fa

          SHA512

          29b2353871f08aed795f487bab722ca01c1401d3ace11efbd6ed1a0afb5acfcf7be111a1a226ae0c093829f0518df5b01472650ba59afb7631a8dec366859112

        • C:\Program Files (x86)\Perfect Automation\gentee.dll

          Filesize

          115KB

          MD5

          8559da5b839b7fb7865bbbecd5403343

          SHA1

          7a1f74afa80ad2b2c45bb668fd99190874464eaf

          SHA256

          18df26817de00dbaab3394bd709e0dadbb75a6a7bccc31708e1410b5f394587b

          SHA512

          5c2825becbf7cf08e5050e29d577c18c9d1af49314012ae82e8fa82bbd22419dcb34451cc5ba065e3ee2e1b2e4fedd634e1d2b6dc130631fd0aca116ae4857e7

        • C:\Program Files (x86)\Perfect Automation\images\default\cmds\fldclose.ico

          Filesize

          3KB

          MD5

          5f986396aee5372809ce05adbd45e1cf

          SHA1

          f2f4c6b8013502ec09afc06c3240a69363195f18

          SHA256

          5e644fef6b9f289ee9a9ba3eddf4fdf07e6c7fa0c76230deccd396037a3e6740

          SHA512

          5ecac62704b64783bbdf0427b7effb9ab71fbd97098695c629c5a3ce503a1489e012e331a5574318b8e6e5d8c18c7ad59619ae6490c6a33da2e74c77d0957add

        • C:\Program Files (x86)\Perfect Automation\images\default\cmds\fldopen.ico

          Filesize

          3KB

          MD5

          74d67fbe31f7528a119084cf8086bb76

          SHA1

          8cbcd0d014ca1bbfebd73ae8d42134a15fdf65fb

          SHA256

          5030a358cd602ce66e7b5c2545e5f972783d08047b601486b6ab4479f7db1c9c

          SHA512

          6c0286a0bba87377044182a4fcd2a5ef6f9f09792b1339877e40e52916dc62aea4a1b1fd8c7de0bdcf555adea15725005c7d71840cafc27ead776936c1a30c27

        • C:\Program Files (x86)\Perfect Automation\images\default\cmds\item.ico

          Filesize

          4KB

          MD5

          0d4ac0b8169a733906c915c355ec00ed

          SHA1

          7af7fba0f0a01888fd705ef947ea60f675da60c7

          SHA256

          4fc75fb08bdbc415c30b8ce168f2a943da81817755d9b85d0dd0bab11ca1511f

          SHA512

          12dc3bb3d8eb1689313eb8b0b5b079733664cddb10c23c4aec0f885c47db01c8b33dc103b7e2d825ae08fca8b409602e74ddf3c4ce00c76f7135b17f9f9e0fc3

        • C:\Program Files (x86)\Perfect Automation\images\default\cmds\registry.ico

          Filesize

          1KB

          MD5

          154454cf9850165a61ba32f91375a389

          SHA1

          824ff7a8725974c9ab0d8881cb385bf8e15b20a4

          SHA256

          1b45f685fdc5592f873e4e618474d433b75cf99229a10e9db5db722fb05592ba

          SHA512

          3be5f176aa6a0b085255b07f9d7c5c4dfd007dd0093d78543a583c2a161638d91e9ea3154adc6e1c788f523e0be3862801902906316b77953a5944d179ee2cc2

        • C:\Program Files (x86)\Perfect Automation\images\default\cmds\unsup.ico

          Filesize

          3KB

          MD5

          3cdfae083ab1300aa22114e57523e590

          SHA1

          b865578402c067c139fd36fc2d3737254e90907c

          SHA256

          3900db75ee7b4dfe7aad132c9172edbba6f7f7dab98313f597409047659abbf9

          SHA512

          473c0cfa021152bf846c05bd54ef6bd656bb79578dd148ac8ca9c72563bd813dadd73923db0bf65d5a85d395c33328137be0a10dbc1fac3564e6a07b07ada17b

        • C:\Program Files (x86)\Perfect Automation\images\default\exe\error.ico

          Filesize

          3KB

          MD5

          e92aab79b2d5483a4f65ce5ff73dcc90

          SHA1

          c3029e57fd4f5b8a415969dea8bba2c8fcfe9205

          SHA256

          c02be618d1543bc6cf2e602d3c314525bdd95918dad45829684f0c070875080a

          SHA512

          e7f0452d05d3733e9b01e8a44c16bb36a4fcf9457cf45e754553253222b441bd934c6d7459c42489340d2fccfde82a661fbf2166f9ef8f0c5684316510021efc

        • C:\Program Files (x86)\Perfect Automation\images\default\exe\error32.ico

          Filesize

          2KB

          MD5

          5128242b260c96bacec719bd1595bc36

          SHA1

          6c922e7ee081c6585f0dabb92df8568107453d07

          SHA256

          8498e1d8f7e25c377b07d687c5c5f6baf5089627c6e788c2a65308dbd0de1bfa

          SHA512

          f53f40b64a249631ee0a4f3a54db6fea58fc3dcd53ce0838ad6c9ecee2dc19beb21cc6ef448bab5c69b02c30e5657831980b71185009cc5c5ac8c95df138814c

        • C:\Program Files (x86)\Perfect Automation\images\default\exe\exe.ico

          Filesize

          3KB

          MD5

          a610ebf71ae613b0de693c86b83ec9b9

          SHA1

          40dd4ee091cb2a87b04bda17aa2efa47a17eb046

          SHA256

          ed45c0a8221f1238b1efb5f6bc7184231c8e5e3b299e64201151082d9bbedc77

          SHA512

          57dbd35277d004f4ccbd61af74577eeef964227620c3c53d409ba16aad0e59fa16482d00a8d0e35475c9c0df7c608efa6618afa82a781b9a3d0ba41858ebcae2

        • C:\Program Files (x86)\Perfect Automation\images\default\exe\info.ico

          Filesize

          3KB

          MD5

          c4f3caff6956849e70b0b2bded01223f

          SHA1

          06dd97f659ad7783883973128180cf0c57a4285a

          SHA256

          ea419ed34b74f55afb5f8669861108b478858143e21a94188fb3c20846a09860

          SHA512

          b59210d8c16502094688d49f219a931ce53837d90d608aa30e2761e0d568517d2a3a9b1b1bc46aaadd11e07cd1ebfda67d2e80dea90392704cb8ac1c263e5c1f

        • C:\Program Files (x86)\Perfect Automation\images\default\exe\info32.ico

          Filesize

          2KB

          MD5

          e5cc32943c871faadb1c5b7dedad57cc

          SHA1

          5660e9b156262ae58d79faaf7359cecd6546a4fd

          SHA256

          93abd73539489505fe96daf670c023bb7f62cf32c61e46e42937a142227220e3

          SHA512

          a048633d07134a5c35ed4e332edd45f428946367be5bea9b06a3788c52afbb149844560ed03eb573e741554b9d560b5d2452e0b7c9c105aca8407f21383dd169

        • C:\Program Files (x86)\Perfect Automation\images\default\exe\openfile.ico

          Filesize

          1KB

          MD5

          9ddf9ba8b7ee9dc0de97f3d415db7df2

          SHA1

          ca3e3141088e0d5420887109495cbd87578ce53f

          SHA256

          bb280e871ec2c7ffd8b835483191421bf4314d027ca269a03d84835648b06fbf

          SHA512

          127853c144cb6ea7c02951609ef03e158980c0d14908b0d195b2a0741b87a302e7eaa2c4a0c2b08aae1f2642faf946b5c1a3736109aca048d4313a81e29c968c

        • C:\Program Files (x86)\Perfect Automation\images\default\exe\openfolder.ico

          Filesize

          1KB

          MD5

          f3372adfdc1a39b86b4054357836e3c4

          SHA1

          e8f6588d10a64467e9f91e991a1b377a5d09c433

          SHA256

          515a9fd1d05886e1a12bf360406597ffbedae8dcb80ebf8cb6162b641cacaf6f

          SHA512

          e80be521416faf1848cdf6e59473307821e2010db630f53cf04e76708edbad87b354219e3d89b441b6e5284679101ef771522b71ff3a2746573144a947daa024

        • C:\Program Files (x86)\Perfect Automation\images\default\exe\quest.ico

          Filesize

          3KB

          MD5

          668fd78a5c01bba92691f4f0b5f5a7dc

          SHA1

          ce4c2cf22175566a340a8e9ceace60b8e11bed7d

          SHA256

          daee8f2ce51a835d61381d04b8bec33d66ea3c1bebda2b46913020059b08d8b3

          SHA512

          52f9da6c875b3d8c8fed9fd3cc2ea5fbbdc13e932922e2b435ee42a9d40ede872a8e98d29f28b909cec2d906121c4aec541bc44f404ce9825115d426fb3d5f92

        • C:\Program Files (x86)\Perfect Automation\images\default\exe\quest32.ico

          Filesize

          2KB

          MD5

          8da01ab45a572308503c522b02f7fa32

          SHA1

          51327fc6a580b4e70b13ba0b5f31310ba95a5d60

          SHA256

          c6ff2b0febbc861b20533826049e2a7c698bb78de6896647d789e695f0c507c7

          SHA512

          c1c32069cd9df3374922df9667958972018f34b701c29e2afd7164c8d2f1049214e16f73b45aaa3bcc09ba00adc004afe79083a44ad54940dff4ed25d759f7b2

        • C:\Program Files (x86)\Perfect Automation\images\default\exe\warning.ico

          Filesize

          3KB

          MD5

          538ffd5c00487f1b343ac02f7898552c

          SHA1

          0a21f90450ba2a3fa5a8bb9cd5bd04ee26fcd8bc

          SHA256

          3c01631b0c46b959759a1cbe7e7e892a3e2993a48d73bc81550a6d2c17be4bed

          SHA512

          c18806b79089b2b3a2f974f23f9451931440ee4bc77f96b1f3068cb73ab27be510bffa463c5d47407e79230422fd727aa1fa61f0e21b0030895b1565cb372b0e

        • C:\Program Files (x86)\Perfect Automation\images\default\exe\warning32.ico

          Filesize

          2KB

          MD5

          beda501a347a1108b384f57a5361ca95

          SHA1

          d1b65049671e6c3e05b7071df569ace6edd4e4e5

          SHA256

          85613ff92e9f3f2bd953f2d7da2a03be69e99769a9d44fbe2fd03a3903d7fe28

          SHA512

          fd173268f504fe33c6360be3c1d2a62a1eb19221c806a16d48f90eee18a6f3770286bbc4e7a40186a4a2fdce3f180ddb3362b37f4621b0fa4f0b85c69689d3f6

        • C:\Program Files (x86)\Perfect Automation\images\default\groups\fav.ico

          Filesize

          1KB

          MD5

          19ec098fa8082a5914f25461cfd37817

          SHA1

          ce2ff2630e0ac56ffddef88d35c19374dddcba2c

          SHA256

          da11b5d3997b6aeeab48556c4146252f0f7b07b1e1178e982ef820df2fafb46e

          SHA512

          82ba8a38019a192fd431308217bcd5e1d7cc6faa7dbb4a9b68f26e09056b8461d742842c02f825c43e74ad05d610bb122eae928bfca8c5c0376576f9cdbca7d9

        • C:\Program Files (x86)\Perfect Automation\images\default\groups\fldclose.ico

          Filesize

          3KB

          MD5

          5f986396aee5372809ce05adbd45e1cf

          SHA1

          f2f4c6b8013502ec09afc06c3240a69363195f18

          SHA256

          5e644fef6b9f289ee9a9ba3eddf4fdf07e6c7fa0c76230deccd396037a3e6740

          SHA512

          5ecac62704b64783bbdf0427b7effb9ab71fbd97098695c629c5a3ce503a1489e012e331a5574318b8e6e5d8c18c7ad59619ae6490c6a33da2e74c77d0957add

        • C:\Program Files (x86)\Perfect Automation\images\default\groups\fldopen.ico

          Filesize

          3KB

          MD5

          74d67fbe31f7528a119084cf8086bb76

          SHA1

          8cbcd0d014ca1bbfebd73ae8d42134a15fdf65fb

          SHA256

          5030a358cd602ce66e7b5c2545e5f972783d08047b601486b6ab4479f7db1c9c

          SHA512

          6c0286a0bba87377044182a4fcd2a5ef6f9f09792b1339877e40e52916dc62aea4a1b1fd8c7de0bdcf555adea15725005c7d71840cafc27ead776936c1a30c27

        • C:\Program Files (x86)\Perfect Automation\images\default\groups\history.ico

          Filesize

          1KB

          MD5

          34185ee136d14ebfd3ebe35bc1492f22

          SHA1

          424c663a4206be52b19db4255e3341493f33f62b

          SHA256

          2715e9bb0b296962a5825be2b695239ea436f77b254e203a3a6ae03c80fbfc97

          SHA512

          e30216e81e10505260e7f82f3a7d59d7018efc61b727b6077e5c87cd38a32b9840fcf0685672aa86084ac45bad2ddc4a8c9a88b97804d4081d6b791ae81897e2

        • C:\Program Files (x86)\Perfect Automation\images\default\groups\search.ico

          Filesize

          1KB

          MD5

          8dc649a32883ed027c084ca5049eef37

          SHA1

          f893dc685356313f4588678ec452c449cb9096ae

          SHA256

          38d7906bb3ed4e1f006e85a5cb576929f13bc15c26f04afd6ca6ffe8e8becf6b

          SHA512

          34d70c4af2e6940d366df9002f7736de99d4edfc3b0c89f3ddb4997027a6eda830de5a5a22c6d13836a8f57a0246a2019aa5a2cecd3826022c22abbc6e3bb0c7

        • C:\Program Files (x86)\Perfect Automation\images\default\main\bcancel.ico

          Filesize

          894B

          MD5

          2c8844c4521fac1d4b99562ed9e2c010

          SHA1

          7fd06d0da5e5f509ede3f78c53ea8b8eb21743d9

          SHA256

          ecafb99546882b04b0ef197fb74b7cb2c24b92d971e157e651fc4c2e74c66fcb

          SHA512

          237196ca3d49f4cdc012724715cc19d016254e5fa6c6ac637ab933b3f477d30090447ae60f91e7fcfab4254a13b1995426fbc5e24a3551fb8cff22740e5a6cd1

        • C:\Program Files (x86)\Perfect Automation\images\default\main\bhelp.ico

          Filesize

          894B

          MD5

          90f5cdf589db9e9486dd3df8453e6f5e

          SHA1

          c44b188c863e0c897f73de2b1aeb6560b0159ce2

          SHA256

          fe92ee57d0b34213890a1a198f2ce1bbb547c457eb8e528603cb1c6131e43f4f

          SHA512

          b68cfcf47f1fdeef2682fc30980571fd10326ebabb4e5e0f158a10f9a1c8b9b1627f1b20085c6d4c4d42ba36fbcd0da6de1e16796688392bb286a3871b50be6d

        • C:\Program Files (x86)\Perfect Automation\images\default\main\binfo.ico

          Filesize

          894B

          MD5

          0d2a47eb0978ad42e05009a0cd890221

          SHA1

          643e2f4399f370aba94a5f3aa5c01bbb58b834ed

          SHA256

          6a1a1c2d72b02f56fc23acbbfb19e82b07ea1d3387411258d2facf419424b9fb

          SHA512

          4398326632ba3820c7f50ad73779b01e3770eec01a7e97a3ed5702d0a18dbb8d88bc4d18b5280b1e9f57d29fbf869c023e43db9d870e83d81b39d02be3efe35d

        • C:\Program Files (x86)\Perfect Automation\images\default\main\bok.ico

          Filesize

          894B

          MD5

          9c84c36ff66481f0f7af8810beb736f7

          SHA1

          affaaf0be6bf4e792e2ffa612fc2840b95057ca1

          SHA256

          560f95e87ae3c5d60fe599ba66fa3d80d9da3fc6b9dda2660645c1dd40a5dcdc

          SHA512

          4bd87741dbadb4f40afc350fc8d79ddf48b20b1d22ef887394cd4e5878afa4e0559da33d954cac581cbeba97b3b4c200b3451b983fa1453b934711397cacd0f7

        • C:\Program Files (x86)\Perfect Automation\images\default\main\brefresh.ico

          Filesize

          1KB

          MD5

          69015528652e03eefa377917b69f9bf0

          SHA1

          fe55d0e3ab6882798382e073ec80500317b1e564

          SHA256

          7b2ec2df6191cc5757c4c247e35f5c526874d088ed0d510ecb0ac448809f565c

          SHA512

          7a0ca5bfdb7018ec8096c27ba2e8e14716564f4a0f86b29059f3ce5e19d946943c4bfefc98236078e0d26122b3e3260f02a26b9c4f58a793c867d8fe9f8f01c4

        • C:\Program Files (x86)\Perfect Automation\images\default\main\brestart.ico

          Filesize

          1KB

          MD5

          f0231d67acccf5b5d8d48d913e5881e4

          SHA1

          5ee8f6433698c575185f50d5b4a6c23e2158e5e1

          SHA256

          48797a37166af50baeb461d9cc819f926d642cd272ed1abcf610407d0ef04bbd

          SHA512

          2810f44c9b45060eb1df45b0b86f64154916b4cf5596f609328d5e9e5a2ebe2c86bbe33ebd80d9ba83811a6526e960e3d6c1bca3e6440590779ef3ec042169ce

        • C:\Program Files (x86)\Perfect Automation\images\default\main\closeafter.ico

          Filesize

          1KB

          MD5

          c95b6428df25cebe954b326ef97d7ecd

          SHA1

          8f9255fdb60f22576de6ee17f076ac994f464da6

          SHA256

          67d1a2865cb504c221af2f5f9170274992bb4c30b7cdb91a3643d6fa1d7fd03e

          SHA512

          82960a54fbeb42983cf21bce3e0c9b99bb0c68d39dfde2d9451c211aecf2529e980576f73575b32c872f1100f3d5e7253024963366bb8bf359d8c9c44b8931a5

        • C:\Program Files (x86)\Perfect Automation\images\default\main\filter.ico

          Filesize

          1KB

          MD5

          8c5d62e1d3dfc69466164c53c7e7c51a

          SHA1

          169ea3d265c66fb1884ce4f6a61c807e6033fb5d

          SHA256

          03b8a70ab25d9fe744b7b65b822a9ffdf0bc9869bbc7863bdfd74b24d348a319

          SHA512

          36a2f4d7d19d89c7690bd3f82bd3f37c9706706f68072d3423bddb64076b923b35642c8f2ab1a2a2ad3ad915313cf70a4861ab800d717b9a074071aac1b4c372

        • C:\Program Files (x86)\Perfect Automation\images\default\main\logo.ico

          Filesize

          12KB

          MD5

          5961f23bb98a5298a13f1328bc83265d

          SHA1

          c15e79581ab80ea9a93ddc6bb9d672a73a4ae3a7

          SHA256

          2b3cb98e7fd150b6d072a828ecd995003e1837db38302a592ff351fdb3d9e0e5

          SHA512

          f3d2735c4096d70406b4e6bcccc805473ef227cbd6ac7d2532879535e7661235d3c124459159455a21724c1c2b2413ff749eec5e9cb1b393352b0eb1cc3cf76a

        • C:\Program Files (x86)\Perfect Automation\images\default\main\openfile.ico

          Filesize

          1KB

          MD5

          9ddf9ba8b7ee9dc0de97f3d415db7df2

          SHA1

          ca3e3141088e0d5420887109495cbd87578ce53f

          SHA256

          bb280e871ec2c7ffd8b835483191421bf4314d027ca269a03d84835648b06fbf

          SHA512

          127853c144cb6ea7c02951609ef03e158980c0d14908b0d195b2a0741b87a302e7eaa2c4a0c2b08aae1f2642faf946b5c1a3736109aca048d4313a81e29c968c

        • C:\Program Files (x86)\Perfect Automation\images\default\main\openfolder.ico

          Filesize

          1KB

          MD5

          f3372adfdc1a39b86b4054357836e3c4

          SHA1

          e8f6588d10a64467e9f91e991a1b377a5d09c433

          SHA256

          515a9fd1d05886e1a12bf360406597ffbedae8dcb80ebf8cb6162b641cacaf6f

          SHA512

          e80be521416faf1848cdf6e59473307821e2010db630f53cf04e76708edbad87b354219e3d89b441b6e5284679101ef771522b71ff3a2746573144a947daa024

        • C:\Program Files (x86)\Perfect Automation\images\default\main\pautomation.ico

          Filesize

          5KB

          MD5

          0a491e8a85ddc4923a4834760dd1a35a

          SHA1

          94e46a0a342d019250e6e22ff3dffdd2ab6b9b91

          SHA256

          4f3bd91d0a599abf91ba4dd47e9cbf617beb849ab99448fdd047b32d32ddedfd

          SHA512

          e4baeaf9297ba482636ecdcd861287840adeb3dd9a8476261eb0c987f45b997d191b19a9efbf7ec787faad0416d7c457f2e31af4464cfc5f51aac452418d0e0f

        • C:\Program Files (x86)\Perfect Automation\images\default\main\quickmenu.ico

          Filesize

          1KB

          MD5

          dc2d05a0f8dd18abf8ebb28c059dca60

          SHA1

          39bcc69e16b5273a62d881c7179c29b79641f390

          SHA256

          f6522b590d33ed10bdaa52088da5e1778f3bc89b6e980a4ca3eab90a16717d4e

          SHA512

          c3d4a36875eab251d57e4b1146de3df41c387733ac58c69a79a6cbdcad62979bc765956f61e8a7c5cd16faa1811633848530ee5510fdbc89024b016995a991fb

        • C:\Program Files (x86)\Perfect Automation\images\default\main\refresh-x.ico

          Filesize

          894B

          MD5

          787e1aae4289ab421a63d8eda6218fc5

          SHA1

          963999ac264cbb5f80063752a221d76801c19fe6

          SHA256

          ca9095384fb356f2c40206b34a1d7c172bb45bae9b45945efe411fcc0471312c

          SHA512

          c822b14a8ddf3e296cdeda731241b7d9508f9224f2f6de209c899e4cdcfd32be132f66505c86a1cf64d3e4c4b353a44acd28ad71b6a12600d57772763ebb74ad

        • C:\Program Files (x86)\Perfect Automation\images\default\main\stoprec.ico

          Filesize

          1KB

          MD5

          9d1a115e40ee3ff831829c5429622691

          SHA1

          0cd3c94997fc8a3fc5c68d13d24021f9c89d47cb

          SHA256

          4115e4334d211e28285494e177546a793b7fea60fa9b70219e0c7426a1deae38

          SHA512

          44ec67f45bff6fb63f3dcad0f737a374e19ebed27ad370e30eb650b12cdec12c520245d639edc4f56d05048a8023a148354cd806917325224bcd4e46eae5f59f

        • C:\Program Files (x86)\Perfect Automation\images\default\main\tray.ico

          Filesize

          894B

          MD5

          71000930862401e536792c0e7df5ced5

          SHA1

          539fe1c90aa93f38ad9d37e9f65d42079ecbe19a

          SHA256

          500c80b09e1454c3208087952cdfc91499ba945e09bde199482b527a7f69022a

          SHA512

          8e85c3534eb9d53e6135a38e26c530e88f12861d656a34410f5bc4d225291edf6596227f381d77749635308c485a8d9b5fd01f6ac3f8aee45562f40ca2831e72

        • C:\Program Files (x86)\Perfect Automation\images\default\main\vars.ico

          Filesize

          1KB

          MD5

          8c297a2dab9d6100cd8bb390db38e42d

          SHA1

          ff3808e9293e8fa849369d5ef95551066eef35d2

          SHA256

          9885cc629618bdbcbc8519a34d81bf91983db96d0d31d782c15b2c53bae4c5e0

          SHA512

          7dbf3db896709b0bfde9bd5c1dab1055bdd5c16ba05f0f4fc63dc69242a46ab6a00d2d9b79f182fae6520156f2b918a659e65d5734ae55f70e5914ce60d328e7

        • C:\Program Files (x86)\Perfect Automation\images\default\modules\launcher.ico

          Filesize

          4KB

          MD5

          9dba1593716579aa6b716ed3c60f3b73

          SHA1

          75b66666c29ea6b0b8ce0b9c85982e2d38baa35f

          SHA256

          2227b1295038479c03aa97463b0c094b45a080fcd075611aef560b325961c9b9

          SHA512

          22e56c03f14e1b863f5848d03b942678c93d71bb72ceea1aefaaf3f61f2132d58d73cbcdd14e2193c2dcf0b58d91266dcbc71253968e9574acfbc47c91548846

        • C:\Program Files (x86)\Perfect Automation\images\default\modules\programming.ico

          Filesize

          5KB

          MD5

          7fa93b41f2db036da41f394d7efd32d6

          SHA1

          e205924ff0efcc04a9f26e259e6da750e025bcff

          SHA256

          5685b0c33f4307e899961bf1b380519288e590adcac860d726870a632cf9a95c

          SHA512

          554c64e3c85416b65cb003370a4c4c217e10ac640b777fdbc88a9e3e576123fc05d393931939208fca75133b29b42e3b2b72a50b4fe0fe14082f2fbff1120144

        • C:\Program Files (x86)\Perfect Automation\images\default\modules\recorder-x.ico

          Filesize

          4KB

          MD5

          8813f29219946e477a29bf1192e72fc1

          SHA1

          5632563239f46b41ffa95ac8d658a32d506b2d39

          SHA256

          2b9da45f58d86098f366455d28a50182a7ea3666423882bc2694cf120ebfa737

          SHA512

          dce07962ac73842cfd025a385e59b0c5693ba253f164587adaf3a44c592f00f317831f4b7ba5954c3a01fd19f62d151eae0c5deed99e0645563cf68c96ec7c9d

        • C:\Program Files (x86)\Perfect Automation\images\default\modules\recorder.ico

          Filesize

          4KB

          MD5

          a2dc0b01cf6c3d028edd2b3f3b1f6dfa

          SHA1

          de633caf95000bc70d0be31655f4ea5dfc6cb5e7

          SHA256

          5c536421679555ecd2efeb79f382dd77ad381ce902f51f509b406d83b235eb03

          SHA512

          24063f3f22efdb95e82760266a0744a6f44b8839077dfa0742fc8e5354c95ce615e4f2b9bef2e710f6a5bb3615f790eb854531da60ee2a6116fd0f5e281ce10c

        • C:\Program Files (x86)\Perfect Automation\images\default\modules\reminder.ico

          Filesize

          3KB

          MD5

          9d7528c0afa7519b31f9d906dcc359e3

          SHA1

          39578915e5775ac052c082101918b3a6f33b86eb

          SHA256

          56cde44e0bc676a6e7f53c48ffa9f77bd75d84c5684acf20c6c2ab7b32c98393

          SHA512

          2b1550d3d3b152bfad7310dfc36cf736fc1d304be1cc32c1d89793bad912be40108e2ac7ddcc16d96551619fdb4b23ec0da2150a7594c8da85b5360d831130db

        • C:\Program Files (x86)\Perfect Automation\images\default\modules\scheduler-x.ico

          Filesize

          4KB

          MD5

          63d23697514684de2134e19f05f7a79c

          SHA1

          19ca549439547aa11f0e8eb318036780c1c99b18

          SHA256

          50e02e361ff529faabbaee76993a9fc7d270507ac80ac80714bab9a5cc9b75c0

          SHA512

          af63277cae95e65e3cf929246175c59107c8e4e64621adbc16e5ee23b144dd218d741e84877e2919bcf7a509e40f68963dccb2ce582cf94feb247162b2382da6

        • C:\Program Files (x86)\Perfect Automation\images\default\modules\scheduler-y.ico

          Filesize

          4KB

          MD5

          015ec7137b1e48b7e1db184d8fe6f59b

          SHA1

          a995565f0c6fd2e0a872e5b3ca320c231ee48b4e

          SHA256

          9b4277425dbfe9b392c1adea6751bd49ee51f82bd6f2dff50277a36622f8a828

          SHA512

          040f90ec82a750ac5d0a72dfa22a0f46f86fbdd52f70045114304c465785d97d2db6b35c267d814b0d5b0851517dae35550a120e7deace1bb80d646d82c2491b

        • C:\Program Files (x86)\Perfect Automation\images\default\modules\scheduler.ico

          Filesize

          4KB

          MD5

          63d23697514684de2134e19f05f7a79c

          SHA1

          19ca549439547aa11f0e8eb318036780c1c99b18

          SHA256

          50e02e361ff529faabbaee76993a9fc7d270507ac80ac80714bab9a5cc9b75c0

          SHA512

          af63277cae95e65e3cf929246175c59107c8e4e64621adbc16e5ee23b144dd218d741e84877e2919bcf7a509e40f68963dccb2ce582cf94feb247162b2382da6

        • C:\Program Files (x86)\Perfect Automation\images\default\modules\scripts.ico

          Filesize

          4KB

          MD5

          f07bea0c32138645230860e649ec2c68

          SHA1

          d9910c62f55d5dd5685cb9acf8941a890cd024bf

          SHA256

          8b1e59a890b7712815e91df3e65c0f1ca04716b26690daf137eb966dfd4f8e3a

          SHA512

          005857a752db22d2f77def2a102187cb258692974224f11e4736cc34846d34278611006153b2e4042453187e13a6adfcd02728faa613001d5c74198ceaebf39d

        • C:\Program Files (x86)\Perfect Automation\images\default\modules\toolwin.ico

          Filesize

          4KB

          MD5

          a180f8cfdf559aacb03b01676ce7ed65

          SHA1

          9b88e73f150033b0684706674b8c2ca79a9d0eba

          SHA256

          efb6dc4f563b7d4e6b576f873ebf53a4ef07d2a6e748376e1ce44b96b29e8e92

          SHA512

          b0d6834216d78615e48f20a2c833a49332270998fbb51a25427c7c46ede540859e5eb44364541b48cb83e6c0a4684a470e8aff4f980e3d6b470d70e64c7bab07

        • C:\Program Files (x86)\Perfect Automation\language\english.lng

          Filesize

          19KB

          MD5

          0b533f3fc9f2b3e78e69debde635d7f3

          SHA1

          1bfb98e160979a9718d27b7fadcb5e3be20c9015

          SHA256

          72443d6b4d0f43a5459064c3cbe263ad8c7477f682f065a46e03abf7b5f31c94

          SHA512

          dda3cd1fcf9a447f8032766735c80ee079e013f21a5ff6c7301654cbde0d15058a11d9ab3d27c071b20440c6d234d8744264cd31bd3f6740fe8447b9fd3e40ee

        • C:\Program Files (x86)\Perfect Automation\language\french.lng

          Filesize

          21KB

          MD5

          b53ec25f382bfcab74638021dc23f990

          SHA1

          0169bdaee8327292ec0e43785197e9669db35779

          SHA256

          815d49cc8b79f911908c0064bc32ccce4b38bab1445213c637e3f49b2f613d56

          SHA512

          479786b5e3da9ab036d328f802d44c5ecf05b9c6163a8f1d24a23dfacb770557fe1bca641bf0b1c7a898808828420bb18a47473bbe21fb50834f684bb55af137

        • C:\Program Files (x86)\Perfect Automation\language\german.lng

          Filesize

          20KB

          MD5

          1ee198a5642d9be2804a94211d60b6e0

          SHA1

          26322e2bba7f81ca1998c3681d2d3b2b4ba1aafe

          SHA256

          dc15a7f9f95b3898406a0701fbf15e689e711b02d3d5d665b52dbae56b3f931b

          SHA512

          4895180f089ed307652529a4d44da5e78799b0ca6c197f1f4901de5fdf4e4d6680c73f62eef0f78063fbb8ed93ad621e34929cb6f9ff97e6a56c9cba5ea461be

        • C:\Program Files (x86)\Perfect Automation\language\polish.lng

          Filesize

          20KB

          MD5

          a67769b83e06e941427b0a0ebaef89a8

          SHA1

          9b9a5d18844dd9fb0c54d6ad41ee5407900db73a

          SHA256

          1c1ee2c7771a15cc6e6e993841a670108fd3e39f229203c566e51604222f50e0

          SHA512

          f2ace128b02dfe48455ee24756bcccc501f35ac378db9d65dd0193507a25ef8444d4534a95a9185ee39262b5e0d69f5dbebce5513085c269959c8fff3485534b

        • C:\Program Files (x86)\Perfect Automation\language\russian.lng

          Filesize

          28KB

          MD5

          caa07ed98970ea2c70c24d9fe1aad7b3

          SHA1

          15f78cfae305737b85d4cde9cba6766209ce5f9f

          SHA256

          32f94c6c215aaab06c8f4992069934dbbed2d481c4413ccb766299e5f41e1da4

          SHA512

          b8c2183594366ee8b2b6c0c14f467e7c51eeab84a68abf8345761c5d62f2af6053115d29a7f3aeb7c59cc3fe7df2881c81c149b2869cc2525e1c1abd8468eb42

        • C:\Program Files (x86)\Perfect Automation\language\spanish.lng

          Filesize

          21KB

          MD5

          d7a9c3fe2bd921ef13d5f8b1808a0136

          SHA1

          d06633c630eeb5b05fdcda5fd80ed22944ef42cb

          SHA256

          ecae4301aab4f2ad2eba4beaa1661c44f9eb3c17d4486b2afd0515c2c8666ee3

          SHA512

          c55b66404bdf6b5b23bdb795fb4139e79aa7a64d3796035b8d2d33e03cfe08f09888114cc11f94ac088a01f2554b34efe9d8f758dc1f05555d066bdc9d0ddec5

        • C:\Program Files (x86)\Perfect Automation\language\ukrainian.lng

          Filesize

          26KB

          MD5

          547a657aa5bcac6c4f76005e31c29cf4

          SHA1

          92aafc6a222db6be6f0c042ebdf87d7fe547af7d

          SHA256

          a4bac9d7d0c25a95f14f248fcc9486df2254a0854f0f902fa17721f139ff6b1e

          SHA512

          de35a5cad8784fb4eb81232d8dd00847a589dfcc9395b076394877fe6efd89d47f5585470f0e7bd1ee2216f95f4f7b4f8464e4f35d4c3af68a00b88dbbc4b005

        • C:\Program Files (x86)\Perfect Automation\pautomation.dll

          Filesize

          35KB

          MD5

          433980530ddef772c670f2d3fc1ea1ed

          SHA1

          486f8a80552e15ff88da1c52247470743b218ffa

          SHA256

          7f8f535b864c3e3fb1db0457ff0f7d19f6c09088a873e3417f2174218215de64

          SHA512

          876d9d159f706e56164b1cf30ed2c01140007fb84e096296aa10f6b969e1c7bd408b54f68297d4751e9665722f638d928d9341fd8ad236056b42695d2a54a781

        • C:\Program Files (x86)\Perfect Automation\pautomation.exe

          Filesize

          451KB

          MD5

          9a8613297651c83bdd318a5db5e1d932

          SHA1

          10c701bede24bfabb6894f15d7cadc7c5ebdcd20

          SHA256

          c33d82b9164960d3a7cf91abd473dc47cb179713d958c2cf057c06ae205f372f

          SHA512

          74ae2a3f2de6f47f450a4666bd396ef2ae5803f26e2603c2bd2f1bc9214fb2f690f8040d24755602b9af71c42459379831f9d914deb8336439491ea7d3fa8410

        • C:\Program Files (x86)\Perfect Automation\pautomation.exe

          Filesize

          451KB

          MD5

          9a8613297651c83bdd318a5db5e1d932

          SHA1

          10c701bede24bfabb6894f15d7cadc7c5ebdcd20

          SHA256

          c33d82b9164960d3a7cf91abd473dc47cb179713d958c2cf057c06ae205f372f

          SHA512

          74ae2a3f2de6f47f450a4666bd396ef2ae5803f26e2603c2bd2f1bc9214fb2f690f8040d24755602b9af71c42459379831f9d914deb8336439491ea7d3fa8410

        • C:\Program Files (x86)\Perfect Automation\uninstall.ini

          Filesize

          4KB

          MD5

          d97d01223d950b6ef4b5b3ceb5c63182

          SHA1

          462ada8e3f5f2ffd9e7976abe8ccee676c2e2cb8

          SHA256

          b91b227146578c35e1a1546396e6d5a01ad798a6c172ff934fd2e94b4d5bd9ef

          SHA512

          0440d9f7094aca14dcfa62deeeff5986bdb25d98047acabf31a291d03a1f8090a5063dae84d177562cc465c7026b70be4f89e6adec037b1e4e26e87ed80d7f43

        • C:\Users\Admin\AppData\Local\Temp\gentee01\pauto.dll

          Filesize

          31KB

          MD5

          5395e2e30e9347d2292dc3b610163274

          SHA1

          f87597f156a460608b577da0bc4ab708d142104b

          SHA256

          492e67102db73433364b6a0163ce3a0f7e9d5d905033cc2fedca45a210c817cf

          SHA512

          73e50adf7d5967f617c0fcffa0fedbff2837f9582cf762fa62f59340e0b917354405dc5b0f15140b8bd1c719b6c23f66f338f523ac78be8ccfad5033c412783e

        • C:\Users\Admin\AppData\Local\Temp\gentee51\4default - 1.bmp

          Filesize

          7KB

          MD5

          14a455e9eef9fe7fea4de14d579a3e84

          SHA1

          c0265607ab41c6724ab53065ddfc22e76110b011

          SHA256

          b666e6bd71eff3547fb2f5580ac61c64527f6f9be6a2178fa00f80e32431460a

          SHA512

          8f7368818ef80c0e835de4e081315854979b427a8716f6f888985b53b59d8d6ad108ad534275404e667e7020e7b89d7014d55fe47d79a91ac1a92aefb193ca30

        • C:\Users\Admin\AppData\Roaming\Perfect Automation\options.gt

          Filesize

          2KB

          MD5

          d62513cd5d1bdf44c9337e12a05b79cf

          SHA1

          f45368b4c82ff8617c7da846ab1c5c9674c55ea5

          SHA256

          fb16ca0ad9dea85ee2e6a7413f0ca7d0693267be8f5aee6330d62d1bedf4db75

          SHA512

          56c4ba3124f8f700f332b6c49ecbf7989ec9314a3368643e8851332cd60bca5288085a775b19cf95adcb74f20ededffd7519ec8d4fe0e936d720feeb78204a6c

        • C:\Users\Admin\AppData\Roaming\Perfect Automation\options.gt

          Filesize

          2KB

          MD5

          d62513cd5d1bdf44c9337e12a05b79cf

          SHA1

          f45368b4c82ff8617c7da846ab1c5c9674c55ea5

          SHA256

          fb16ca0ad9dea85ee2e6a7413f0ca7d0693267be8f5aee6330d62d1bedf4db75

          SHA512

          56c4ba3124f8f700f332b6c49ecbf7989ec9314a3368643e8851332cd60bca5288085a775b19cf95adcb74f20ededffd7519ec8d4fe0e936d720feeb78204a6c

        • C:\Users\Admin\AppData\Roaming\Perfect Automation\solutions\programs\Customize Open & Save dialogs.pa

          Filesize

          8KB

          MD5

          7a806752a86301415533f921befc9dd0

          SHA1

          ade6cb0a0138ddad09d005ecdc9420f6b32f36b9

          SHA256

          52b14d95926f37c39039d8c3b012eba11482a800c7971ac5f514ebd43a014195

          SHA512

          7bfb77f5db2cdfa55ead8d2e52460eeb756f5ad07867846f65b93023bbd16704ef5d437a7e3207519063be0adb69cabae64cc9ccb01177620161ddcce7cb203c

        • \Program Files (x86)\Perfect Automation\gentee.dll

          Filesize

          115KB

          MD5

          8559da5b839b7fb7865bbbecd5403343

          SHA1

          7a1f74afa80ad2b2c45bb668fd99190874464eaf

          SHA256

          18df26817de00dbaab3394bd709e0dadbb75a6a7bccc31708e1410b5f394587b

          SHA512

          5c2825becbf7cf08e5050e29d577c18c9d1af49314012ae82e8fa82bbd22419dcb34451cc5ba065e3ee2e1b2e4fedd634e1d2b6dc130631fd0aca116ae4857e7

        • \Program Files (x86)\Perfect Automation\pautomation.dll

          Filesize

          35KB

          MD5

          433980530ddef772c670f2d3fc1ea1ed

          SHA1

          486f8a80552e15ff88da1c52247470743b218ffa

          SHA256

          7f8f535b864c3e3fb1db0457ff0f7d19f6c09088a873e3417f2174218215de64

          SHA512

          876d9d159f706e56164b1cf30ed2c01140007fb84e096296aa10f6b969e1c7bd408b54f68297d4751e9665722f638d928d9341fd8ad236056b42695d2a54a781

        • \Program Files (x86)\Perfect Automation\uninstall.exe

          Filesize

          124KB

          MD5

          7301ae9d76f9675f5bfa32c50cbc9f97

          SHA1

          08052bf3269ed96980c786697242c1f1bb86814b

          SHA256

          00a0b2afc8ee89beb0a05b554af18a9e085910898d5c8e9e598965f48d3aa9a2

          SHA512

          e5b7067514529c2dae90cb967ae5f54e014061d0666211458c7afd50eaf60525a6a398981374b10aee1fef53574eceb1a9f89c205408d9566d90894c33e73760

        • \Users\Admin\AppData\Local\Temp\gentee51\guig.dll

          Filesize

          20KB

          MD5

          8757cd8c68b85d668f15befc13251d5e

          SHA1

          4ac9df9e507727072644e03815ab2f872e72fd89

          SHA256

          96d1906ef8f1ac224830da79bc9492aa21ffbacd4caa4fb44cc64dedf09047a2

          SHA512

          9a3286826d1ce780ce699dfd8d1244a94ce8700a89c75f2dbcfbae19e8609d243754067385364bdecb91e9108c11c062564e2d045652977faaf2e92d129b1a4a

        • \Users\Admin\AppData\Local\Temp\genteert.dll

          Filesize

          60KB

          MD5

          f1d0c343e43b8d4f026bd4c59099812f

          SHA1

          86f563a42bb8a7976caf396042d852dd4ba075f7

          SHA256

          aedb5e44c3865767f8cd803342c21658575c7349f4ee26882d2052f16c5adcf9

          SHA512

          68ce60c1ae3e93313d822ab4b55d6804ee24184a65f255c46c703c0321e183afa6d87c8333f5a9019ef878001892e38bd03fdf586b2a9c162409269ec01526fe

        • memory/1324-70-0x0000000002C80000-0x0000000002C81000-memory.dmp

          Filesize

          4KB

        • memory/1324-1530-0x0000000000420000-0x000000000042A000-memory.dmp

          Filesize

          40KB

        • memory/1336-1525-0x00000000020F0000-0x00000000020F1000-memory.dmp

          Filesize

          4KB

        • memory/1336-1527-0x0000000002170000-0x0000000002171000-memory.dmp

          Filesize

          4KB

        • memory/1336-1560-0x00000000020D0000-0x00000000020DA000-memory.dmp

          Filesize

          40KB

        • memory/1336-1511-0x00000000020D0000-0x00000000020DA000-memory.dmp

          Filesize

          40KB

        • memory/1336-1524-0x00000000030A0000-0x00000000030A1000-memory.dmp

          Filesize

          4KB

        • memory/1336-1529-0x0000000003000000-0x0000000003001000-memory.dmp

          Filesize

          4KB

        • memory/1336-1528-0x00000000005C0000-0x00000000005C1000-memory.dmp

          Filesize

          4KB

        • memory/1336-1526-0x0000000002110000-0x0000000002111000-memory.dmp

          Filesize

          4KB

        • memory/1788-1507-0x0000000002190000-0x0000000002191000-memory.dmp

          Filesize

          4KB

        • memory/1788-1505-0x0000000005710000-0x0000000005711000-memory.dmp

          Filesize

          4KB

        • memory/1788-1504-0x0000000004E90000-0x0000000004E91000-memory.dmp

          Filesize

          4KB

        • memory/1788-1502-0x0000000002200000-0x0000000002201000-memory.dmp

          Filesize

          4KB

        • memory/1788-1503-0x0000000000340000-0x0000000000341000-memory.dmp

          Filesize

          4KB

        • memory/1788-1510-0x0000000002220000-0x0000000002221000-memory.dmp

          Filesize

          4KB