Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = '%WINDIR%\xdwd.dll'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%WINDIR%\xdwdsvchost.exe'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '%WINDIR%\xdwdSystem32.exe'
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\svchost.exe
- <SYSTEM32>\tasks\update
Изменения в файловой системе
Создает следующие файлы
- %ProgramFiles%\mozilla firefox\updated\xul.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-string-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-time-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-utility-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\application.ini
- %ProgramFiles%\mozilla firefox\updated\browser\visualelements\privatebrowsing_150.png
- %ProgramFiles%\mozilla firefox\updated\browser\visualelements\privatebrowsing_70.png
- %ProgramFiles%\mozilla firefox\updated\browser\visualelements\visualelements_150.png
- %ProgramFiles%\mozilla firefox\updated\browser\visualelements\visualelements_70.png
- %ProgramFiles%\mozilla firefox\updated\defaultagent.ini
- %ProgramFiles%\mozilla firefox\updated\browser\crashreporter-override.ini
- %ProgramFiles%\mozilla firefox\updated\browser\features\pictureinpicture@mozilla.org.xpi
- %ProgramFiles%\mozilla firefox\updated\browser\features\screenshots@mozilla.org.xpi
- %ProgramFiles%\mozilla firefox\updated\browser\features\webcompat-reporter@mozilla.org.xpi
- %ProgramFiles%\mozilla firefox\updated\browser\features\webcompat@mozilla.org.xpi
- %ProgramFiles%\mozilla firefox\updated\browser\omni.ja
- %ProgramFiles%\mozilla firefox\updated\crashreporter.exe
- %ProgramFiles%\mozilla firefox\updated\crashreporter.ini
- %ProgramFiles%\mozilla firefox\updated\d3dcompiler_47.dll
- %ProgramFiles%\mozilla firefox\updated\browser\features\formautofill@mozilla.org.xpi
- %ProgramFiles%\mozilla firefox\updated\default-browser-agent.exe
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-stdio-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-conio-l1-1-0.dll
- %WINDIR%\xdwdsvchost.exe
- %ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\active-update.xml.tmp
- %ProgramFiles%\mozilla firefox\updated\accessiblemarshal.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-core-file-l1-2-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-core-file-l2-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-core-localization-l1-2-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-core-processthreads-l1-1-1.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-core-synch-l1-2-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-process-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-runtime-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-convert-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-environment-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-filesystem-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-heap-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-locale-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-math-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-multibyte-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-private-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-core-timezone-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\defaultagent_localized.ini
- %ProgramFiles%\mozilla firefox\updated\dependentlibs.list
- %ProgramFiles%\mozilla firefox\updated\firefox.visualelementsmanifest.xml
- %ProgramFiles%\mozilla firefox\updated\osclientcerts.dll
- %ProgramFiles%\mozilla firefox\updated\pingsender.exe
- %ProgramFiles%\mozilla firefox\updated\platform.ini
- %ProgramFiles%\mozilla firefox\updated\plugin-container.exe
- %ProgramFiles%\mozilla firefox\updated\plugin-container.exe.sig
- %ProgramFiles%\mozilla firefox\updated\precomplete
- %ProgramFiles%\mozilla firefox\updated\private_browsing.visualelementsmanifest.xml
- %ProgramFiles%\mozilla firefox\updated\nssckbi.dll
- %ProgramFiles%\mozilla firefox\updated\private_browsing.exe
- %ProgramFiles%\mozilla firefox\updated\removed-files
- %ProgramFiles%\mozilla firefox\updated\softokn3.dll
- %ProgramFiles%\mozilla firefox\updated\ucrtbase.dll
- %ProgramFiles%\mozilla firefox\updated\uninstall\helper.exe
- %ProgramFiles%\mozilla firefox\updated\updater.exe
- %ProgramFiles%\mozilla firefox\updated\updater.ini
- %ProgramFiles%\mozilla firefox\updated\vcruntime140.dll
- %ProgramFiles%\mozilla firefox\updated\vcruntime140_1.dll
- %ProgramFiles%\mozilla firefox\updated\qipcap64.dll
- %ProgramFiles%\mozilla firefox\updated\nss3.dll
- %ProgramFiles%\mozilla firefox\updated\omni.ja
- %ProgramFiles%\mozilla firefox\updated\notificationserver.dll
- %ProgramFiles%\mozilla firefox\updated\firefox.exe
- %ProgramFiles%\mozilla firefox\updated\libegl.dll
- %ProgramFiles%\mozilla firefox\updated\firefox.exe.sig
- %ProgramFiles%\mozilla firefox\updated\fonts\twemojimozilla.ttf
- %ProgramFiles%\mozilla firefox\updated\freebl3.dll
- %ProgramFiles%\mozilla firefox\updated\gmp-clearkey\0.1\clearkey.dll
- %ProgramFiles%\mozilla firefox\updated\gmp-clearkey\0.1\clearkey.dll.sig
- %ProgramFiles%\mozilla firefox\updated\gmp-clearkey\0.1\manifest.json
- %ProgramFiles%\mozilla firefox\updated\ipcclientcerts.dll
- %ProgramFiles%\mozilla firefox\updated\lgpllibs.dll
- %ProgramFiles%\mozilla firefox\updated\libglesv2.dll
- %ProgramFiles%\mozilla firefox\updated\msvcp140.dll
- %ProgramFiles%\mozilla firefox\updated\locale.ini
- %ProgramFiles%\mozilla firefox\updated\maintenanceservice.exe
- %ProgramFiles%\mozilla firefox\updated\maintenanceservice_installer.exe
- %ProgramFiles%\mozilla firefox\updated\minidump-analyzer.exe
- %ProgramFiles%\mozilla firefox\updated\mozavcodec.dll
- %ProgramFiles%\mozilla firefox\updated\mozavutil.dll
- %ProgramFiles%\mozilla firefox\updated\mozglue.dll
- %ProgramFiles%\mozilla firefox\updated\mozwer.dll
- %WINDIR%\xdwdsystem32.exe
- %WINDIR%\xdwd.dll
Присваивает атрибут 'скрытый' для следующих файлов
- %WINDIR%\xdwdsvchost.exe
- %WINDIR%\xdwdsystem32.exe
Удаляет следующие файлы
- %ProgramFiles%\mozilla firefox\updated\updating\update.manifest
Изменяет следующие файлы
- %ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\updates\0\update.log
- %ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\updates\0\update.status
Подменяет следующие файлы
- %ALLUSERSPROFILE%\Mozilla\updates\308046B0AF4A39CB\active-update.xml
Сетевая активность
Подключается к
- 'lt#####n.gl.at.ply.gg':55320
TCP
Другие
- '34.##7.35.28':443
UDP
- DNS ASK lt#####n.gl.at.ply.gg
Другое
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost.exe" /tr "%WINDIR%\xdwdsvchost.exe" & exit
- '<SYSTEM32>\schtasks.exe' /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost.exe" /tr "%WINDIR%\xdwdsvchost.exe"
- '<SYSTEM32>\cmd.exe' /c SchTaSKs /create /f /sc minute /mo -1 /tn "windows" /tr "%WINDIR%\xdwdsvchost.exe" /RL HIGHEST & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo -1 /tn "windows" /tr "%WINDIR%\xdwdsvchost.exe" /RL HIGHEST
- '<SYSTEM32>\cmd.exe' /c SchTaSKs /create /f /sc minute /mo 5 /tn "Update" /tr "%WINDIR%\xdwdSystem32.exe" /RL HIGHEST & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo 5 /tn "Update" /tr "%WINDIR%\xdwdSystem32.exe" /RL HIGHEST
