Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Software Refresher' = '%ProgramFiles(x86)%\SoftwareRefresher\SoftwareRefresher.exe'
Создает или изменяет следующие файлы
- %WINDIR%\tasks\davenport-sys.job
- <SYSTEM32>\tasks\davenport-sys
- %WINDIR%\tasks\davenport-s-1-5-21-1960123792-2022915161-3775307078-1001.job
- <SYSTEM32>\tasks\davenport-s-1-5-21-1960123792-2022915161-3775307078-1001
- <SYSTEM32>\tasks\setup-intercepter-x86
- <SYSTEM32>\tasks\setup-intercepter-x64
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nsr624c.tmp
- %ProgramFiles(x86)%\softwarerefresher\ui\popup\img\app-installing.gif
- %ProgramFiles(x86)%\softwarerefresher\ui\popup\img\app-searching.gif
- %ProgramFiles(x86)%\softwarerefresher\ui\popup\img\footer-logo.gif
- %ProgramFiles(x86)%\softwarerefresher\ui\popup\js\handlebars.min.js
- %ProgramFiles(x86)%\softwarerefresher\ui\popup\js\jquery.min.js
- %ProgramFiles(x86)%\softwarerefresher\ui\popup\js\popup.js
- %APPDATA%\microsoft\windows\start menu\programs\software refresher\uninstall.lnk
- %ProgramFiles(x86)%\davenport\intercepter\x64\1.3\intercepter-x64.exe
- %LOCALAPPDATA%\devenportupdater\products.xml
- %ProgramFiles(x86)%\davenport\intercepter\x86\intercepter-x86.exe
- %ProgramFiles(x86)%\davenport\intercepter\x86\1.3\intercepter.dll
- %ProgramFiles(x86)%\davenport\intercepter\x86\1.3\intercepter-x86.exe
- %ProgramFiles(x86)%\davenport\intercepter\x64\intercepter-x64.exe
- %ProgramFiles(x86)%\davenport\intercepter\x64\1.3\intercepter.dll
- %ProgramFiles(x86)%\softwarerefresher\ui\popup\img\app-downloading.gif
- %APPDATA%\microsoft\windows\start menu\programs\software refresher\software refresher.lnk
- %ProgramFiles(x86)%\softwarerefresher\ui\popup\img\app-download.gif
- %LOCALAPPDATA%\software refresher\client_zone_id.js
- %TEMP%\nsg625c.tmp\ping.js
- %TEMP%\nsg625c.tmp\system.dll
- %TEMP%\nsg625c.tmp\md5dll.dll
- %TEMP%\nsg625c.tmp\nsexec.dll
- %LOCALAPPDATA%\software refresher\icon.ico
- %LOCALAPPDATA%\software refresher\common.js
- %ProgramFiles(x86)%\davenport\updater\updater.exe
- %ProgramFiles(x86)%\softwarerefresher\ui\popup\img\app-download-complete.gif
- %ProgramFiles(x86)%\davenport\updater\1.0\updater.exe
- %ProgramFiles(x86)%\davenport\updater\products.xml
- %TEMP%\nsg625c.tmp\nsprocess.dll
- %ProgramFiles(x86)%\softwarerefresher\softwarerefresher.exe
- %ProgramFiles(x86)%\softwarerefresher\ui\popup\index.html
- %ProgramFiles(x86)%\softwarerefresher\ui\popup\css\style.css
- %ProgramFiles(x86)%\softwarerefresher\ui\popup\img\app-download-failed.gif
- %LOCALAPPDATA%\software refresher\uninstall.exe
Удаляет следующие файлы
- %TEMP%\nsg625c.tmp\md5dll.dll
- %TEMP%\nsg625c.tmp\nsexec.dll
- %TEMP%\nsg625c.tmp\nsprocess.dll
- %TEMP%\nsg625c.tmp\ping.js
- %TEMP%\nsg625c.tmp\system.dll
Сетевая активность
TCP
Запросы HTTP GET
- http://cd#####-a.akamaihd.net/tb/gz.php?ke################################################################
- http://cd#####-a.akamaihd.net/tb/gz.php?ke#############################################################
- http://ap#.####warerefresher.com/rules/fresher/1/
- http://ap#.####warerefresher.com/offers/89226918/
UDP
- DNS ASK in####lping5.info
- DNS ASK cd#####-a.akamaihd.net
- DNS ASK ap#.####warerefresher.com
Другое
Ищет следующие окна
- ClassName: 'FresherAppWindow' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: '{18BF6555-9594-48DF-8E54-8976B0101032}' WindowName: ''
- ClassName: '{28784A2C-D207-4AAC-8379-1223BA722A64}' WindowName: ''
Создает и запускает на исполнение
- '%ProgramFiles(x86)%\davenport\updater\1.0\updater.exe' -wait -runmode=addproductex -name="fresher" -updateurl="http://ap#.####warerefresher.com/check/fresher/.eJw1jDEOg0AMBP_iGkXnoBTwGYS4JViyDLKPFInyd-4Kmm1mZn-0OmKDTx94yG40Ej8SdSS26JkxiRX4gqMujcVPd...
- '%ProgramFiles(x86)%\davenport\updater\updater.exe' -wait -runmode=addproductex -name="updater" -updateurl="http://ap#.####warerefresher.com/check/updater/eyJ2ZXJzaW9uIjoiMS4wIn0.yqGf4Ruxun5t8pX4GaRPckT0sNE/" -version="1.0" -needadmin="yes"
- '%ProgramFiles(x86)%\davenport\updater\1.0\updater.exe' -wait -runmode=addproductex -name="intercepter" -updateurl="http://ap#.####warerefresher.com/check/intercepter/.eJxNjTEKgDAMRe-SuYixOOhlRGyUQIjSVgfFu5sOBZdPkkfef4B1kTPQxJopLnRYwpjjSQ5-p-mimHhXG...
- '%ProgramFiles(x86)%\davenport\updater\updater.exe' -wait -runmode=addproductex -name="intercepter" -updateurl="http://ap#.####warerefresher.com/check/intercepter/.eJxNjTEKgDAMRe-SuYixOOhlRGyUQIjSVgfFu5sOBZdPkkfef4B1kTPQxJopLnRYwpjjSQ5-p-mimHhXG...
- '%ProgramFiles(x86)%\davenport\updater\updater.exe' -wait -runmode=addtask
- '%ProgramFiles(x86)%\davenport\updater\1.0\updater.exe' -wait -runmode=addtask
- '%ProgramFiles(x86)%\davenport\intercepter\x64\1.3\intercepter-x64.exe'
- '%ProgramFiles(x86)%\davenport\updater\1.0\updater.exe' -runmode=addsystask
- '%ProgramFiles(x86)%\softwarerefresher\softwarerefresher.exe'
- '%ProgramFiles(x86)%\davenport\updater\updater.exe' -wait -runmode=addproductex -name="fresher" -updateurl="http://ap#.####warerefresher.com/check/fresher/.eJw1jDEOg0AMBP_iGkXnoBTwGYS4JViyDLKPFInyd-4Kmm1mZn-0OmKDTx94yG40Ej8SdSS26JkxiRX4gqMujcVPd...
- '%ProgramFiles(x86)%\davenport\intercepter\x64\intercepter-x64.exe'
- '%ProgramFiles(x86)%\davenport\intercepter\x86\intercepter-x86.exe'
- '%ProgramFiles(x86)%\davenport\intercepter\x86\1.3\intercepter-x86.exe'
- '%ProgramFiles(x86)%\davenport\updater\1.0\updater.exe' -wait -runmode=addproductex -name="updater" -updateurl="http://ap#.####warerefresher.com/check/updater/eyJ2ZXJzaW9uIjoiMS4wIn0.yqGf4Ruxun5t8pX4GaRPckT0sNE/" -version="1.0" -needadmin="yes"
- '%WINDIR%\syswow64\cscript.exe' //Nologo "client_zone_id.js" set_client_zoneid "Software\SoftwareRefresher" "3015109" "1602362402"' (со скрытым окном)
- '%WINDIR%\syswow64\schtasks.exe' /create /tn setup-intercepter-x64 /tr "\"{INTERCEPTER_ROOT_DIR}\x64\intercepter-x64.exe\"" /sc onlogon /RL HIGHEST' (со скрытым окном)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "ping.js" "http://www.in####lping5.info/installer-run/0af8eb8e6f9835a09b24a4fc8298d2f0/69049eaaea3e98c5e6703d3d05cad1a1/xriderexe/3015109/?pi###########################################...' (со скрытым окном)
- '%WINDIR%\syswow64\schtasks.exe' /create /tn setup-intercepter-x86 /tr "\"%ProgramFiles(x86)%\Davenport\Intercepter\x86\intercepter-x86.exe\"" /sc onlogon /RL HIGHEST' (со скрытым окном)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "ping.js" "http://www.in####lping5.info/tbi-ping/0af8eb8e6f9835a09b24a4fc8298d2f0/69049eaaea3e98c5e6703d3d05cad1a1/xriderexe/3015109/?pi###############################################"...' (со скрытым окном)
- '%WINDIR%\syswow64\net.exe' start schedule' (со скрытым окном)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "ping.js" "http://www.in####lping5.info/newuser-ping/0af8eb8e6f9835a09b24a4fc8298d2f0/69049eaaea3e98c5e6703d3d05cad1a1/0/xriderexe/3015109/0/?pi########################################...' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cscript.exe' //Nologo "ping.js" "http://www.in####lping5.info/installer-run/0af8eb8e6f9835a09b24a4fc8298d2f0/69049eaaea3e98c5e6703d3d05cad1a1/xriderexe/3015109/?pi###########################################...
- '%WINDIR%\syswow64\cscript.exe' //Nologo "client_zone_id.js" set_client_zoneid "Software\SoftwareRefresher" "3015109" "1602362402"
- '%WINDIR%\syswow64\net.exe' start schedule
- '%WINDIR%\syswow64\net1.exe' start schedule
- '%WINDIR%\syswow64\schtasks.exe' /create /tn setup-intercepter-x86 /tr "\"%ProgramFiles(x86)%\Davenport\Intercepter\x86\intercepter-x86.exe\"" /sc onlogon /RL HIGHEST
- '%WINDIR%\syswow64\schtasks.exe' /create /tn setup-intercepter-x64 /tr "\"{INTERCEPTER_ROOT_DIR}\x64\intercepter-x64.exe\"" /sc onlogon /RL HIGHEST
- '%WINDIR%\syswow64\cscript.exe' //Nologo "ping.js" "http://www.in####lping5.info/tbi-ping/0af8eb8e6f9835a09b24a4fc8298d2f0/69049eaaea3e98c5e6703d3d05cad1a1/xriderexe/3015109/?pi###############################################"...
- '%WINDIR%\syswow64\cscript.exe' //Nologo "ping.js" "http://www.in####lping5.info/newuser-ping/0af8eb8e6f9835a09b24a4fc8298d2f0/69049eaaea3e98c5e6703d3d05cad1a1/0/xriderexe/3015109/0/?pi########################################...
