Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Del183984' = 'cmd.exe /Q /D /c del "%TEMP%\0.del"'
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\At1.job
Вредоносные функции:
Создает и запускает на исполнение:
- '%APPDATA%\Dealply\UpdateProc\UpdateTask.exe' /ReportI /C=259
- '%TEMP%\DealPlyUpdateVer.exe' /install
- '%TEMP%\GUM6.tmp\DealPlyLive.exe' /silent /install "appguid={ec431650-36f7-4253-acdf-e32c512b02d7}&appname=DealPlyLive&needsadmin=True&lang=en&client=%7b%22h%22%3a%22v24872252285716845488002013091320331214%22%2c%22p%22%3a%22outb%22%2c%22c%22%3a%22outb103%22%2c%22v%22%3a%224872%22%7d"
- '%TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\o-update\DealPlyLive.exe' /silent /install "appguid={ec431650-36f7-4253-acdf-e32c512b02d7}&appname=DealPlyLive&needsadmin=True&lang=en&client=%7b%22h%22%3a%22v24872252285716845488002013091320331214%22%2c%22p%22%3a%22outb%22%2c%22c%22%3a%22outb103%22%2c%22v%22%3a%224872%22%7d"
- 'C:\DealPly.exe' /PID=103
- 'C:\FastestChrome_installer_InstallMonetizer7locale=de.exe' /S /tag
- '%TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\files\uninst.exe' /S /OPTIMIZE /PARTNER=outb /CHANNEL=103 /i
- '%TEMP%\dp.exe' /S /OPTIMIZE /PARTNER=outb /CHANNEL=103
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\DealPly\DealPlyIE64.dll"
- '<SYSTEM32>\at.exe'
- '<SYSTEM32>\at.exe' 13:33 /interactive %APPDATA%\Dealply\UpdateProc\UPDATE~1.EXE /Check
- '<SYSTEM32>\wscript.exe' /B /E:jscript "%TEMP%\nss4.tmp\patch_prefs.js" "<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions/mmffncokckfccddfenhkhnllmlobdahm/5.7.1_0/background.js" "{{ install_source }}" "InstallMonetizer7 locale=de tag="
- '<SYSTEM32>\wscript.exe' /B /E:jscript "%TEMP%\nss4.tmp\install_to_chrome.js" "<LS_APPDATA>\Google\Chrome\User Data\Default\Preferences" "%TEMP%\nss4.tmp\patch.json" "InstallMonetizer7 locale=de tag="
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\DealPly\DealPlyIE.dll"
Завершает или пытается завершить
следующие пользовательские процессы:
- iexplore.exe
- firefox.exe
- chrome.exe
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\GUM6.tmp\goopdateres_th.dll
- %TEMP%\GUM6.tmp\goopdateres_te.dll
- %TEMP%\GUM6.tmp\goopdateres_ta.dll
- %TEMP%\GUM6.tmp\goopdateres_ur.dll
- %TEMP%\GUM6.tmp\goopdateres_uk.dll
- %TEMP%\GUM6.tmp\goopdateres_tr.dll
- %TEMP%\GUM6.tmp\goopdateres_sl.dll
- %TEMP%\GUM6.tmp\goopdateres_sk.dll
- %TEMP%\GUM6.tmp\goopdateres_ru.dll
- %TEMP%\GUM6.tmp\goopdateres_sw.dll
- %TEMP%\GUM6.tmp\goopdateres_sv.dll
- %TEMP%\GUM6.tmp\goopdateres_sr.dll
- %TEMP%\GUM6.tmp\goopdateres_vi.dll
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\B69D763EB21649DA26F20618312DEE70
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\C3E814D1CB223AFCD58214D14C3B7EAB
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\C3E814D1CB223AFCD58214D14C3B7EAB
- %ALLUSERSPROFILE%\Application Data\DealPlyLive\Update\Log\DealPlyLive.log
- %TEMP%\GUM6.tmp\goopdateres_zh-TW.dll
- %TEMP%\GUM6.tmp\goopdateres_zh-CN.dll
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\B69D763EB21649DA26F20618312DEE70
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %TEMP%\GUM6.tmp\goopdateres_ro.dll
- %TEMP%\GUM6.tmp\goopdateres_id.dll
- %TEMP%\GUM6.tmp\goopdateres_hu.dll
- %TEMP%\GUM6.tmp\goopdateres_hr.dll
- %TEMP%\GUM6.tmp\goopdateres_iw.dll
- %TEMP%\GUM6.tmp\goopdateres_it.dll
- %TEMP%\GUM6.tmp\goopdateres_is.dll
- %TEMP%\GUM6.tmp\goopdateres_fil.dll
- %TEMP%\GUM6.tmp\goopdateres_fi.dll
- %TEMP%\GUM6.tmp\goopdateres_fa.dll
- %TEMP%\GUM6.tmp\goopdateres_hi.dll
- %TEMP%\GUM6.tmp\goopdateres_gu.dll
- %TEMP%\GUM6.tmp\goopdateres_fr.dll
- %TEMP%\GUM6.tmp\goopdateres_ja.dll
- %TEMP%\GUM6.tmp\goopdateres_no.dll
- %TEMP%\GUM6.tmp\goopdateres_nl.dll
- %TEMP%\GUM6.tmp\goopdateres_ms.dll
- %TEMP%\GUM6.tmp\goopdateres_pt-PT.dll
- %TEMP%\GUM6.tmp\goopdateres_pt-BR.dll
- %TEMP%\GUM6.tmp\goopdateres_pl.dll
- %TEMP%\GUM6.tmp\goopdateres_lt.dll
- %TEMP%\GUM6.tmp\goopdateres_ko.dll
- %TEMP%\GUM6.tmp\goopdateres_kn.dll
- %TEMP%\GUM6.tmp\goopdateres_mr.dll
- %TEMP%\GUM6.tmp\goopdateres_ml.dll
- %TEMP%\GUM6.tmp\goopdateres_lv.dll
- %TEMP%\Cab38.tmp
- %TEMP%\Cab36.tmp
- %PROGRAM_FILES%\DealPlyLive\Update\1.3.23.0\goopdateres_bn.dll
- %PROGRAM_FILES%\DealPlyLive\Update\1.3.23.0\goopdateres_ca.dll
- %TEMP%\Cab3C.tmp
- %TEMP%\Cab3A.tmp
- %TEMP%\Cab2E.tmp
- %PROGRAM_FILES%\DealPlyLive\Update\1.3.23.0\goopdateres_bg.dll
- %TEMP%\Cab2C.tmp
- %TEMP%\Cab34.tmp
- %TEMP%\Cab32.tmp
- %TEMP%\Cab30.tmp
- %TEMP%\Cab3E.tmp
- %PROGRAM_FILES%\DealPlyLive\Update\1.3.23.0\goopdateres_da.dll
- %TEMP%\Cab4C.tmp
- %TEMP%\Cab4A.tmp
- %TEMP%\Cab52.tmp
- %TEMP%\Cab50.tmp
- %TEMP%\Cab4E.tmp
- %TEMP%\Cab44.tmp
- %TEMP%\Cab42.tmp
- %TEMP%\Cab40.tmp
- %TEMP%\Cab48.tmp
- %TEMP%\Cab46.tmp
- %PROGRAM_FILES%\DealPlyLive\Update\1.3.23.0\goopdateres_cs.dll
- %TEMP%\Cab2A.tmp
- %TEMP%\CabE.tmp
- %PROGRAM_FILES%\DealPlyLive\Update\1.3.23.0\goopdate.dll
- %TEMP%\CabC.tmp
- %TEMP%\Cab14.tmp
- %TEMP%\Cab12.tmp
- %TEMP%\Cab10.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %PROGRAM_FILES%\DealPlyLive\Update\1.3.23.0\DealPlyLive.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA
- %TEMP%\CabA.tmp
- %TEMP%\Cab8.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %PROGRAM_FILES%\DealPlyLive\Update\1.3.23.0\DealPlyLiveHandler.exe
- %TEMP%\Cab24.tmp
- %TEMP%\Cab22.tmp
- %TEMP%\Cab20.tmp
- %TEMP%\Cab28.tmp
- %TEMP%\Cab26.tmp
- %PROGRAM_FILES%\DealPlyLive\Update\1.3.23.0\goopdateres_ar.dll
- %TEMP%\Cab1A.tmp
- %TEMP%\Cab18.tmp
- %TEMP%\Cab16.tmp
- %TEMP%\Cab1E.tmp
- %PROGRAM_FILES%\DealPlyLive\Update\1.3.23.0\goopdateres_am.dll
- %TEMP%\Cab1C.tmp
- C:\DealPly.exe
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\skin\icons\fastestchrome-logo-48x48.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\skin\icons\fastestchrome-logo-32x32.png
- %TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\crx\images\icon16.png
- %TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\crx\images\icon128.png
- %TEMP%\dp.exe
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\skin\smarterfox-logo-48x48.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\skin\smarterfox-logo-32x32.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\skin\related_searches.css
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\skin\icons\fastestchrome-logo-128x128.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\skin\icons\fastestchrome-icon-64x64.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\skin\trending_search_results.css
- %TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\xpi\chrome\content\images\icon32.png
- %TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\crxls\chrome-extension_mphpbdjcljebbcnfopfngmfdackbbdgf_0.localstorage
- %TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\crx\manifest.json
- %TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\files\DealPly.crx
- %TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\o-update\DealPlyLive.exe
- %TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\xpi\chrome\content\dealplyshopping.xul
- %TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\xpi\install.rdf
- %TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\files\DealPly.xpi
- %TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\files\icon.ico
- %TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\crx\images\icon48.png
- %TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\xpi\defaults\preferences\defaults.js
- %TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\crx\background.js
- %TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\xpi\chrome.manifest
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\skin\related_search_results.css
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\manifest.json
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\jquery.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\background.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\options.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\options.html
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\options.css
- %TEMP%\nss4.tmp\install_to_chrome.js
- %TEMP%\nss3.tmp
- C:\FastestChrome_installer_InstallMonetizer7locale=de.exe
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\background.html
- %TEMP%\nss4.tmp\patch_prefs.js
- %TEMP%\nss4.tmp\patch.json
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\scripts\add_scrolling_rule.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\scripts\trending_search_results.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\scripts\related_searches.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\scripts\related_search_results.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\skin\popup_bubble.css
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\skin\infinite_scroll.css
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\skin\endless_pages.css
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\scripts\env_setup.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\scripts\endless_pages_heuristics.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\scripts\endless_pages.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\scripts\related_articles.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\scripts\popup_bubble.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\5.7.1_0\scripts\linkify.js
- %TEMP%\GUM6.tmp\DealPlyLiveOnDemand.exe
- %TEMP%\GUM6.tmp\DealPlyLiveBroker.exe
- %TEMP%\GUM6.tmp\DealPlyLiveHelper.msi
- %TEMP%\GUM6.tmp\goopdateres_am.dll
- %TEMP%\GUM6.tmp\psuser.dll
- %TEMP%\GUM6.tmp\psmachine.dll
- %TEMP%\GUM6.tmp\DealPlyLive.exe
- %TEMP%\GUT7.tmp
- %APPDATA%\Dealply\UpdateProc\config.dat
- %TEMP%\GUM6.tmp\npGoogleUpdate3.dll
- %TEMP%\GUM6.tmp\goopdate.dll
- %TEMP%\GUM6.tmp\DealPlyLiveHandler.exe
- %TEMP%\GUM6.tmp\goopdateres_ar.dll
- %TEMP%\GUM6.tmp\goopdateres_en-GB.dll
- %TEMP%\GUM6.tmp\goopdateres_en.dll
- %TEMP%\GUM6.tmp\goopdateres_el.dll
- %TEMP%\GUM6.tmp\goopdateres_et.dll
- %TEMP%\GUM6.tmp\goopdateres_es-419.dll
- %TEMP%\GUM6.tmp\goopdateres_es.dll
- %TEMP%\GUM6.tmp\goopdateres_ca.dll
- %TEMP%\GUM6.tmp\goopdateres_bn.dll
- %TEMP%\GUM6.tmp\goopdateres_bg.dll
- %TEMP%\GUM6.tmp\goopdateres_de.dll
- %TEMP%\GUM6.tmp\goopdateres_da.dll
- %TEMP%\GUM6.tmp\goopdateres_cs.dll
- %APPDATA%\Dealply\UpdateProc\UpdateTask.exe
- %PROGRAM_FILES%\DealPly\uninst.exe
- %PROGRAM_FILES%\DealPly\icon.ico
- %PROGRAM_FILES%\DealPly\DealPlyUpdateVer.exe
- %HOMEPATH%\Start Menu\Programs\DealPly\Uninstall DealPly.lnk
- %HOMEPATH%\Start Menu\Programs\DealPly\DealPly.url
- %HOMEPATH%\Start Menu\Programs\DealPly\DealPly Help.url
- %TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\files\DealPlyIE.dll
- %TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\files\uninst.exe
- %TEMP%\{578B9A81-73C2-4435-A968-67E8643970A8}\files\DealPlyUpdateVer.exe
- %PROGRAM_FILES%\DealPly\DealPlyIE.dll
- %PROGRAM_FILES%\DealPly\DealPly.xpi
- %PROGRAM_FILES%\DealPly\DealPly.crx
- %TEMP%\logs\uninst.log
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{906000a4-88d9-4d52-b209-7a772970d91f}\defaults\preferences\defaults.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{906000a4-88d9-4d52-b209-7a772970d91f}\chrome.manifest
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{906000a4-88d9-4d52-b209-7a772970d91f}\chrome\content\images\icon32.png
- %TEMP%\DealPlyUpdateVer.exe
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite-journal
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{906000a4-88d9-4d52-b209-7a772970d91f}\install.rdf
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf\3.5.0.0_0\images\icon16.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf\3.5.0.0_0\images\icon128.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf\3.5.0.0_0\background.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{906000a4-88d9-4d52-b209-7a772970d91f}\chrome\content\dealplyshopping.xul
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf\3.5.0.0_0\manifest.json
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf\3.5.0.0_0\images\icon48.png
Удаляет следующие файлы:
- %TEMP%\Cab36.tmp
- %TEMP%\Cab34.tmp
- %TEMP%\Cab38.tmp
- %TEMP%\Cab3C.tmp
- %TEMP%\Cab3A.tmp
- %TEMP%\Cab2C.tmp
- %TEMP%\Cab2A.tmp
- %TEMP%\Cab2E.tmp
- %TEMP%\Cab32.tmp
- %TEMP%\Cab30.tmp
- %TEMP%\Cab3E.tmp
- %TEMP%\Cab4C.tmp
- %TEMP%\Cab4A.tmp
- %TEMP%\Cab4E.tmp
- %TEMP%\Cab52.tmp
- %TEMP%\Cab50.tmp
- %TEMP%\Cab42.tmp
- %TEMP%\Cab40.tmp
- %TEMP%\Cab44.tmp
- %TEMP%\Cab48.tmp
- %TEMP%\Cab46.tmp
- %TEMP%\Cab28.tmp
- %TEMP%\CabA.tmp
- %TEMP%\Cab8.tmp
- %TEMP%\CabC.tmp
- %TEMP%\Cab10.tmp
- %TEMP%\CabE.tmp
- %TEMP%\nss4.tmp\patch.json
- %TEMP%\nss4.tmp\install_to_chrome.js
- %TEMP%\nss4.tmp\patch_prefs.js
- %TEMP%\DealPlyUpdateVer.exe
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite-journal
- %TEMP%\Cab12.tmp
- %TEMP%\Cab20.tmp
- %TEMP%\Cab1E.tmp
- %TEMP%\Cab22.tmp
- %TEMP%\Cab26.tmp
- %TEMP%\Cab24.tmp
- %TEMP%\Cab16.tmp
- %TEMP%\Cab14.tmp
- %TEMP%\Cab18.tmp
- %TEMP%\Cab1C.tmp
- %TEMP%\Cab1A.tmp
Сетевая активность:
Подключается к:
- 'cr#.##modoca.com':80
- 'cr#.#hawte.com':80
- 'ts####.ws.symantec.com':80
- 'cr#.##ertrust.com':80
- 'up#####s.dpupdate.com':80
- 'wp#d':80
- 'www.download.windowsupdate.com':80
TCP:
Запросы HTTP GET:
- cr#.#hawte.com/ThawteTimestampingCA.crl
- ts####.ws.symantec.com/tss-ca-g2.crl
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- cr#.##modoca.com/COMODOCodeSigningCA2.crl
- wp#d/wpad.dat
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- cr#.##ertrust.com/UTN-USERFirst-Object.crl
Запросы HTTP POST:
- up#####s.dpupdate.com/?v=##########################
UDP:
- DNS ASK cr#.##modoca.com
- DNS ASK cr#.#hawte.com
- DNS ASK ts####.ws.symantec.com
- DNS ASK cr#.##ertrust.com
- DNS ASK up#####s.dpupdate.com
- DNS ASK wp#d
- DNS ASK www.download.windowsupdate.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'Chrome_WidgetWin_0' WindowName: '(null)'
