Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\CleanupHardDrive.job
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\DTT Surveillance\CleanupHardDrive\cleanupdate.exe'
- '%TEMP%\2.tmp\b2e.exe' %TEMP%\2.tmp\b2e.exe "%PROGRAM_FILES%\DTT Surveillance\CleanupHardDrive" "%PROGRAM_FILES%\DTT Surveillance\CleanupHardDrive\cc.exe"
- '%PROGRAM_FILES%\DTT Surveillance\CleanupHardDrive\cc.exe'
Запускает на исполнение:
- '<SYSTEM32>\attrib.exe' -r -h -s %WINDIR%\$nt* /s /d
- '<SYSTEM32>\powercfg.exe' /H OFF
- '<SYSTEM32>\ping.exe' -n 2 127.0.0.1
- '<SYSTEM32>\attrib.exe' -r -h -s %WINDIR%\$hf_* /s /d
- '<SYSTEM32>\eventcreate.exe' /ID 1 /L APPLICATION /T INFORMATION /SO CLEANDISK /D "DTT Clean.bat Has Been Ran"
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v ScheduledInstallTime /t REG_DWORD /d 4 /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v ScheduledInstallDay /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ratings" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v IncludeRecommendedUpdates /t REG_DWORD /d 1 /f
- '<SYSTEM32>\taskkill.exe' /F /IM firefox.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM chrome.exe /T
- '<SYSTEM32>\rundll32.exe' InetCpl.cpl,ClearMyTracksByProcess 8
- '<SYSTEM32>\ping.exe' -n 3 127.0.0.1
- '<SYSTEM32>\taskkill.exe' /F /IM iexplore.exe /T
- '<SYSTEM32>\msiexec.exe' /qn /x{FBD4C5F8-9F32-4926-9827-0ED9CB13DBB3}
- '<SYSTEM32>\reg.exe' delete "HKEY_CURRENT_USER\Software\Ashkon Technology\WebAllow" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\CLSID\{FBD4C5F8-9F32-4926-9827-0ED9CB13DBB3}" /f
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\attrib.exe' -s -h "%PROGRAM_FILES% (x86)\DTT Surveillance\CleanupHardDrive\cleanupdate.exe"
- '<SYSTEM32>\attrib.exe' -s -h "%PROGRAM_FILES%\DTT Surveillance\CleanupHardDrive\cleanupdate.exe"
- '<SYSTEM32>\attrib.exe' +s +h "%PROGRAM_FILES%\DTT Surveillance\CleanupHardDrive\cleanupdate.exe"
- '<SYSTEM32>\schtasks.exe' /create /tn "CleanupHardDrive" /sc weekly /d SUN /st 06:00:00 /tr "\"%PROGRAM_FILES%\DTT Surveillance\CleanupHardDrive\clean.bat"\" /ru dttserver /rp Tpw15h@rd
- '<SYSTEM32>\schtasks.exe' /delete /tn "CleanupHardDrive" /f
- '<SYSTEM32>\mode.com' con: cols=50 lines=10
- '<SYSTEM32>\cmd.exe' /c "%PROGRAM_FILES%\DTT Surveillance\CleanupHardDrive\task.bat"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\3.tmp\batchfile.bat" "
- '<SYSTEM32>\find.exe' "XP"
- '<SYSTEM32>\attrib.exe' +s +h "%PROGRAM_FILES%\DTT Surveillance\DTTClean"
- '<SYSTEM32>\mode.com' con: cols=50 lines=25
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v AUOptions /t REG_DWORD /d 4 /f
- '<SYSTEM32>\attrib.exe' +s +h "%PROGRAM_FILES% (x86)\DTT Surveillance\DTTClean"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\selfdel0.bat" "
- '<SYSTEM32>\attrib.exe' +s +h "%PROGRAM_FILES%\DTT Surveillance\CleanupHardDrive\cc.exe"
- '<SYSTEM32>\attrib.exe' +s +h "%PROGRAM_FILES% (x86)\DTT Surveillance\CleanupHardDrive\cleanupdate.exe"
- '<SYSTEM32>\cmd.exe' /c "%PROGRAM_FILES%\DTT Surveillance\DTTClean\cleanM.bat"
- '<SYSTEM32>\attrib.exe' +s +h "%PROGRAM_FILES% (x86)\DTT Surveillance\CleanupHardDrive\cc.exe"
Завершает или пытается завершить
следующие пользовательские процессы:
- firefox.exe
- chrome.exe
- iexplore.exe
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nst5.tmp\NSISdl.dll
- %TEMP%\3.tmp\batchfile.bat
- %PROGRAM_FILES%\DTT Surveillance\DTTClean\uninstall.exe
- %TEMP%\selfdel0.bat
- %PROGRAM_FILES%\DTT Surveillance\CleanupHardDrive\clean.bat
- %TEMP%\2.tmp\b2e.exe
- %PROGRAM_FILES%\DTT Surveillance\CleanupHardDrive\cleanupdate.exe
- %PROGRAM_FILES%\DTT Surveillance\DTTClean\cleanM.bat
- %PROGRAM_FILES%\DTT Surveillance\CleanupHardDrive\cc.exe
- %PROGRAM_FILES%\DTT Surveillance\CleanupHardDrive\uninstall.exe
- %PROGRAM_FILES%\DTT Surveillance\CleanupHardDrive\task.bat
Присваивает атрибут 'скрытый' для следующих файлов:
- %PROGRAM_FILES%\DTT Surveillance\CleanupHardDrive\cc.exe
- %PROGRAM_FILES%\DTT Surveillance\CleanupHardDrive\cleanupdate.exe
Удаляет следующие файлы:
- %WINDIR%\$NtUninstallKB942288-v3$\reg00057
- %WINDIR%\$NtUninstallKB942288-v3$\reg00056
- %WINDIR%\$NtUninstallKB942288-v3$\reg00055
- %WINDIR%\$NtUninstallKB942288-v3$\reg00060
- %WINDIR%\$NtUninstallKB942288-v3$\reg00059
- %WINDIR%\$NtUninstallKB942288-v3$\reg00058
- %WINDIR%\$NtUninstallKB942288-v3$\reg00049
- %WINDIR%\$NtUninstallKB942288-v3$\reg00048
- %WINDIR%\$NtUninstallKB942288-v3$\reg00047
- %WINDIR%\$NtUninstallKB942288-v3$\reg00054
- %WINDIR%\$NtUninstallKB942288-v3$\reg00053
- %WINDIR%\$NtUninstallKB942288-v3$\reg00052
- %WINDIR%\$NtUninstallKB942288-v3$\reg00061
- %WINDIR%\$NtUninstallKB942288-v3$\reg00070
- %WINDIR%\$NtUninstallKB942288-v3$\reg00069
- %WINDIR%\$NtUninstallKB942288-v3$\reg00068
- %WINDIR%\$NtUninstallKB942288-v3$\reg00073
- %WINDIR%\$NtUninstallKB942288-v3$\reg00072
- %WINDIR%\$NtUninstallKB942288-v3$\reg00071
- %WINDIR%\$NtUninstallKB942288-v3$\reg00064
- %WINDIR%\$NtUninstallKB942288-v3$\reg00063
- %WINDIR%\$NtUninstallKB942288-v3$\reg00062
- %WINDIR%\$NtUninstallKB942288-v3$\reg00067
- %WINDIR%\$NtUninstallKB942288-v3$\reg00066
- %WINDIR%\$NtUninstallKB942288-v3$\reg00065
- %WINDIR%\$NtUninstallKB942288-v3$\reg00046
- %WINDIR%\$NtUninstallKB942288-v3$\reg00028
- %WINDIR%\$NtUninstallKB942288-v3$\reg00027
- %WINDIR%\$NtUninstallKB942288-v3$\reg00026
- %WINDIR%\$NtUninstallKB942288-v3$\reg00031
- %WINDIR%\$NtUninstallKB942288-v3$\reg00030
- %WINDIR%\$NtUninstallKB942288-v3$\reg00029
- %WINDIR%\$NtUninstallKB942288-v3$\reg00022
- %WINDIR%\$NtUninstallKB942288-v3$\reg00021
- %WINDIR%\$NtUninstallKB942288-v3$\reg00020
- %WINDIR%\$NtUninstallKB942288-v3$\reg00025
- %WINDIR%\$NtUninstallKB942288-v3$\reg00024
- %WINDIR%\$NtUninstallKB942288-v3$\reg00023
- %WINDIR%\$NtUninstallKB942288-v3$\reg00032
- %WINDIR%\$NtUninstallKB942288-v3$\reg00042
- %WINDIR%\$NtUninstallKB942288-v3$\reg00041
- %WINDIR%\$NtUninstallKB942288-v3$\reg00040
- %WINDIR%\$NtUninstallKB942288-v3$\reg00045
- %WINDIR%\$NtUninstallKB942288-v3$\reg00044
- %WINDIR%\$NtUninstallKB942288-v3$\reg00043
- %WINDIR%\$NtUninstallKB942288-v3$\reg00035
- %WINDIR%\$NtUninstallKB942288-v3$\reg00034
- %WINDIR%\$NtUninstallKB942288-v3$\reg00033
- %WINDIR%\$NtUninstallKB942288-v3$\reg00039
- %WINDIR%\$NtUninstallKB942288-v3$\reg00037
- %WINDIR%\$NtUninstallKB942288-v3$\reg00036
- %WINDIR%\$NtUninstallKB942288-v3$\reg00074
- %WINDIR%\$NtUninstallKB942288-v3$\reg00109
- %WINDIR%\$NtUninstallKB942288-v3$\reg00108
- %WINDIR%\$NtUninstallKB942288-v3$\reg00107
- %WINDIR%\$NtUninstallKB942288-v3$\reg00112
- %WINDIR%\$NtUninstallKB942288-v3$\reg00111
- %WINDIR%\$NtUninstallKB942288-v3$\reg00110
- %WINDIR%\$NtUninstallKB942288-v3$\reg00103
- %WINDIR%\$NtUninstallKB942288-v3$\reg00102
- %WINDIR%\$NtUninstallKB942288-v3$\reg00101
- %WINDIR%\$NtUninstallKB942288-v3$\reg00106
- %WINDIR%\$NtUninstallKB942288-v3$\reg00105
- %WINDIR%\$NtUninstallKB942288-v3$\reg00104
- %WINDIR%\$NtUninstallKB942288-v3$\reg00113
- %WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\updspapi.dll
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt
- %WINDIR%\$NtUninstallWIC$\spuninst\updspapi.dll
- %WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt
- %WINDIR%\$NtUninstallWIC$\spuninst\spuninst.inf
- %WINDIR%\$NtUninstallKB942288-v3$\reg00116
- %WINDIR%\$NtUninstallKB942288-v3$\reg00115
- %WINDIR%\$NtUninstallKB942288-v3$\reg00114
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.inf
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.exe
- %WINDIR%\$NtUninstallKB942288-v3$\reg00117
- %WINDIR%\$NtUninstallKB942288-v3$\reg00100
- %WINDIR%\$NtUninstallKB942288-v3$\reg00083
- %WINDIR%\$NtUninstallKB942288-v3$\reg00082
- %WINDIR%\$NtUninstallKB942288-v3$\reg00081
- %WINDIR%\$NtUninstallKB942288-v3$\reg00086
- %WINDIR%\$NtUninstallKB942288-v3$\reg00085
- %WINDIR%\$NtUninstallKB942288-v3$\reg00084
- %WINDIR%\$NtUninstallKB942288-v3$\reg00077
- %WINDIR%\$NtUninstallKB942288-v3$\reg00076
- %WINDIR%\$NtUninstallKB942288-v3$\reg00075
- %WINDIR%\$NtUninstallKB942288-v3$\reg00080
- %WINDIR%\$NtUninstallKB942288-v3$\reg00079
- %WINDIR%\$NtUninstallKB942288-v3$\reg00078
- %WINDIR%\$NtUninstallKB942288-v3$\reg00087
- %WINDIR%\$NtUninstallKB942288-v3$\reg00096
- %WINDIR%\$NtUninstallKB942288-v3$\reg00095
- %WINDIR%\$NtUninstallKB942288-v3$\reg00094
- %WINDIR%\$NtUninstallKB942288-v3$\reg00099
- %WINDIR%\$NtUninstallKB942288-v3$\reg00098
- %WINDIR%\$NtUninstallKB942288-v3$\reg00097
- %WINDIR%\$NtUninstallKB942288-v3$\reg00090
- %WINDIR%\$NtUninstallKB942288-v3$\reg00089
- %WINDIR%\$NtUninstallKB942288-v3$\reg00088
- %WINDIR%\$NtUninstallKB942288-v3$\reg00093
- %WINDIR%\$NtUninstallKB942288-v3$\reg00092
- %WINDIR%\$NtUninstallKB942288-v3$\reg00091
- %WINDIR%\$NtUninstallKB942288-v3$\reg00019
- %WINDIR%\Installer\10c847.msp
- %WINDIR%\Installer\10c846.msp
- %WINDIR%\Installer\10c845.msp
- %WINDIR%\Installer\11a0d.msi
- %WINDIR%\Installer\11a08.msi
- %WINDIR%\Installer\11014b.msi
- %WINDIR%\Installer\10c841.msp
- %WINDIR%\Installer\10c840.msp
- %WINDIR%\Installer\10c83f.msp
- %WINDIR%\Installer\10c844.msp
- %WINDIR%\Installer\10c843.msp
- %WINDIR%\Installer\10c842.msp
- %WINDIR%\Installer\12534c.msi
- %WINDIR%\Installer\d2525.msp
- %WINDIR%\Installer\d2524.msp
- %WINDIR%\Installer\d2523.msp
- %WINDIR%\Installer\d2528.msp
- %WINDIR%\Installer\d2527.msp
- %WINDIR%\Installer\d2526.msp
- %WINDIR%\Installer\68b62.msi
- %WINDIR%\Installer\271fe.msi
- %WINDIR%\Installer\1f148.msi
- %WINDIR%\Installer\d2522.msp
- %WINDIR%\Installer\d2521.msi
- %WINDIR%\Installer\68b6c.msi
- %WINDIR%\Installer\10c83e.msp
- %WINDIR%\Driver Cache\i386\mxdwdui.dll
- %WINDIR%\Driver Cache\i386\mxdwdrv.dll
- %WINDIR%\Driver Cache\i386\msxpsinc.ppd
- %WINDIR%\Driver Cache\i386\sp2.cab
- %WINDIR%\Driver Cache\i386\mxdwdui.ini
- %WINDIR%\Driver Cache\i386\mxdwdui.gpd
- %WINDIR%\Driver Cache\i386\driver.cab
- %TEMP%\2.tmp\b2e.exe
- %TEMP%\3.tmp\batchfile.bat
- %WINDIR%\Driver Cache\i386\msxpsinc.gpd
- %WINDIR%\Driver Cache\i386\msxpsdrv.inf
- %WINDIR%\Driver Cache\i386\filterpipelineprintproc.dll
- %WINDIR%\Driver Cache\i386\stddtype.gdl
- %WINDIR%\Installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}\places.exe
- %WINDIR%\Temp\Perflib_Perfdata_7e8.dat
- %WINDIR%\Driver Cache\i386\unires.dll
- %WINDIR%\Installer\10c83d.msi
- %WINDIR%\Installer\{FE9126DB-5F84-495A-BB46-3C724F1C2D08}\ARPIco
- %WINDIR%\Installer\{BAF78226-3200-4DB4-BE33-4D922A799840}\ArpIcon
- %WINDIR%\Driver Cache\i386\stdschmx.gdl
- %WINDIR%\Driver Cache\i386\stdschem.gdl
- %WINDIR%\Driver Cache\i386\stdnames.gpd
- %WINDIR%\Driver Cache\i386\unidrvui.dll
- %WINDIR%\Driver Cache\i386\unidrv.hlp
- %WINDIR%\Driver Cache\i386\unidrv.dll
- %WINDIR%\Installer\d2529.msp
- %WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\1.1.4322\FL_sbs_mscorsec_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\1.1.4322\FL_sbs_mscorrc_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\1.1.4322\FL_sbs_mscordbi_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\1.1.4322\FL_sbs_system_enterpriseservices_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\1.1.4322\FL_sbs_system_data_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\1.1.4322\FL_sbs_system_configuration_install_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\1.1.4322\FL_NETFXSBS10_exe_____X86.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\1.1.4322\FL_netfxperf_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\1.1.4322\FL_mscormmc_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\1.1.4322\FL_sbs_microsoft_jscript_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\1.1.4322\FL_sbs_diasymreader_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\1.1.4322\FL_sbscmp10_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\1.1.4322\FL_sbs_wminet_utils_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\$NtUninstallKB942288-v3$\reg00015
- %WINDIR%\$NtUninstallKB942288-v3$\reg00014
- %WINDIR%\$NtUninstallKB942288-v3$\reg00013
- %WINDIR%\$NtUninstallKB942288-v3$\reg00018
- %WINDIR%\$NtUninstallKB942288-v3$\reg00017
- %WINDIR%\$NtUninstallKB942288-v3$\reg00016
- %WINDIR%\$NtUninstallKB942288-v3$\msiexec.exe
- %WINDIR%\$NtUninstallKB942288-v3$\msi.dll
- %TEMP%\nst5.tmp\NSISdl.dll
- %WINDIR%\$NtUninstallKB942288-v3$\msisip.dll
- %WINDIR%\$NtUninstallKB942288-v3$\msimsg.dll
- %WINDIR%\$NtUninstallKB942288-v3$\msihnd.dll
- %WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\1.1.4322\FL_mscories_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\3.5.30729\DP_System_Data_Services_Client_x86
- %WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\3.5.30729\DP_System_Data_Services_Client_gac_x86
- %WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\CacheSize.txt
- %WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\3.5.30729\FL_System_Web_Entity_dll_Gac_x86_ln.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\3.5.30729\DP_System_Data_Services_x86
- %WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\3.5.30729\DP_System_Data_Services_gac_x86
- %WINDIR%\Installer\ece7.msi
- %WINDIR%\Installer\ecca.msp
- %WINDIR%\Installer\d252a.msp
- %WINDIR%\Installer\wix{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}.SchedServiceConfig.rmi
- %WINDIR%\Installer\wix{3C3901C5-3455-3E0A-A214-0B093A5070A6}.SchedServiceConfig.rmi
- %WINDIR%\Installer\eced.msi
- %WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\3.5.30729\FL_System_Web_Entity_dll_x86_ln.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\XPSViewer_X86.exe
- %WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\PresentationHost_X86.exe
- %WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\PresentationHostProxy_X86.dll
- %WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\1.1.4322\FL_mscorier_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\1.1.4322\FL_mscorier_dll_1_ENU_X86.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\1.1.4322\FL_mscoree_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\3.5.30729\System.Web.Extensions_dll_x86_gc.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\3.5.30729\System.Web.DynamicData_dll_x86_ln.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\3.5.30729\System.Web.DynamicData_dll_x86_gc.3643236F_FC70_11D3_A536_0090278A1BB8
- %WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\PresentationHostDLL_X86.dll
- %WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\PenIMC_X86.dll
- %WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\3.5.30729\System.Web.Extensions_dll_x86_ln.3643236F_FC70_11D3_A536_0090278A1BB8
Сетевая активность:
Подключается к:
- 'su####t.dttinc.com':80
TCP:
Запросы HTTP GET:
- su####t.dttinc.com/support/clean.bat
UDP:
- DNS ASK su####t.dttinc.com
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
