Technical Information
Modifies file system :
Creates the following files:
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD
- %TEMP%\tmp1.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD
- <SYSTEM32>\d3d9caps.dat
- <SYSTEM32>\d3d9caps.tmp
Deletes the following files:
- %TEMP%\tmp1.tmp
- <SYSTEM32>\d3d9caps.dat
Moves the following files:
- from <SYSTEM32>\d3d9caps.tmp to <SYSTEM32>\d3d9caps.dat
Network activity:
Connects to:
- '20#.#6.232.182':80
- 'wp#d':80
TCP:
HTTP GET requests:
- 20#.#6.232.182/pki/crl/products/microsoftrootcert.crl
- wp#d/wpad.dat
UDP:
- DNS ASK crl.microsoft.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'SysListView32' WindowName: '(null)'
