Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Isamtray' = '"%PROGRAM_FILES%\C4ebreg\isamtray.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'C4EBReg' = '"%PROGRAM_FILES%\C4ebreg\c4ebreg.exe" /q'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\PMEM] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\ISAMSvc] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- %PROGRAM_FILES%\C4ebreg\c4ebreg.exe
- %PROGRAM_FILES%\C4ebreg\instdrvw.exe PMEM remove
- %PROGRAM_FILES%\C4ebreg\instdrvw.exe PMEM <DRIVERS>\PMEMNT.SYS
- %PROGRAM_FILES%\C4ebreg\c4ebreg.exe /u
- %PROGRAM_FILES%\C4ebreg\isam_full.exe -o
- %PROGRAM_FILES%\C4ebreg\unzip.exe -o %PROGRAM_FILES%\C4ebreg\inventory.zip -d %PROGRAM_FILES%\C4ebreg
- %PROGRAM_FILES%\C4ebreg\isamtray.exe
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\C4ebreg\Scripts\script8324.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8325.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8326.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8320.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8321.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8323.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8330.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8331.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8332.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8327.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8328.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8329.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8311.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8312.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8313.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8308.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8309.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8310.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8317.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8318.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8319.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8314.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8315.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8316.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8333.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8349.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8350.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8351.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8346.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8347.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8348.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8355.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8356.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8357.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8352.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8353.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8354.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8337.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8338.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8339.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8334.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8335.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8336.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8343.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8344.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8345.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8340.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8341.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8342.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8307.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script5007.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script513.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8051.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script5004.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script5005.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script5006.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8055.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8056.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8057.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8052.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8053.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8054.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script468.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script476.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script488.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3631.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3632.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3633.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script5001.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script5002.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script5003.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script494.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script500.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script5000.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8058.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8211.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8212.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8300.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8208.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8209.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8210.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8304.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8305.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8306.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8301.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8302.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8303.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8062.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8200.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8201.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8059.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8060.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8061.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8205.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8206.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8207.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8202.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8203.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8204.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8423.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8424.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8425.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8420.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8421.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8422.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8429.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8430.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8431.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8426.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8427.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8428.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8411.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8412.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8413.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8408.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8409.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8410.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8417.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8418.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8419.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8414.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8415.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8416.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8432.py
- %ALLUSERSPROFILE%\Application Data\IGS\C4ebreg\isamtray.log
- C:\setupisam.log
- %PROGRAM_FILES%\C4ebreg\c4ebreg.log
- %PROGRAM_FILES%\C4ebreg\Scripts\script8445.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8446.py
- %WINDIR%\isamunin.exe
- <DRIVERS>\PMEMNT.SYS
- <SYSTEM32>\Microsoft\Protect\S-1-5-18\28ae7174-dd20-45f8-83f8-f74c9f0a1f5b
- <SYSTEM32>\Microsoft\Protect\S-1-5-18\Preferred
- <DRIVERS>\isamfilter.sys
- %PROGRAM_FILES%\C4ebreg\health.ini
- %PROGRAM_FILES%\C4ebreg\Scripts\script8436.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8437.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8438.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8433.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8434.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8435.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8442.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8443.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8444.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8439.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8440.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8441.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8407.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8373.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8374.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8375.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8370.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8371.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8372.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8379.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8380.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8381.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8376.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8377.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8378.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8361.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8362.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8363.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8358.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8359.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8360.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8367.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8368.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8369.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8364.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8365.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8366.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8382.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8398.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8399.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8400.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8395.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8396.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8397.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8404.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8405.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8406.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8401.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8402.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8403.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8386.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8387.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8388.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8383.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8384.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8385.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8392.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8393.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8394.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8389.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8390.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script8391.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script116.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script198.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script243.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1116.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1117.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1119.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3501.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3502.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3504.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script332.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3435.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3500.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1099.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1100.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script11000.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1096.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1097.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1098.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1104.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1106.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1115.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1101.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1102.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1103.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3505.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3521.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3522.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3523.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3518.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3519.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3520.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3527.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3528.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3529.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3524.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3525.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3526.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3509.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3510.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3511.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3506.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3507.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3508.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3515.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3516.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3517.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3512.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3513.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3514.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1093.py
- %PROGRAM_FILES%\C4ebreg\isamsmt.ini
- %PROGRAM_FILES%\C4ebreg\myhscan.mif
- %PROGRAM_FILES%\C4ebreg\pmdata.mif
- %PROGRAM_FILES%\C4ebreg\python23.dll
- %PROGRAM_FILES%\C4ebreg\c4ebreg.ini
- %PROGRAM_FILES%\C4ebreg\inventory.zip
- %PROGRAM_FILES%\C4ebreg\smtscan.mif
- %PROGRAM_FILES%\C4ebreg\wstscan.mif
- %PROGRAM_FILES%\C4ebreg\miscdata.mif
- %PROGRAM_FILES%\C4ebreg\wamdata.mif
- %PROGRAM_FILES%\C4ebreg\eproj.mif
- %PROGRAM_FILES%\C4ebreg\wamsscan.mif
- %PROGRAM_FILES%\C4ebreg\isamunin.exe
- %PROGRAM_FILES%\C4ebreg\c4ebrfrc.dll
- %PROGRAM_FILES%\C4ebreg\c4ebrkor.dll
- %PROGRAM_FILES%\C4ebreg\isam_full.exe
- %PROGRAM_FILES%\C4ebreg\c4ebreg.exe
- %PROGRAM_FILES%\C4ebreg\isamtray.exe
- %PROGRAM_FILES%\C4ebreg\pmemw.dll
- %PROGRAM_FILES%\C4ebreg\instdrvw.exe
- %PROGRAM_FILES%\C4ebreg\osprules.dll
- %PROGRAM_FILES%\C4ebreg\c4ebrjpn.dll
- %PROGRAM_FILES%\C4ebreg\isamfilter.sys
- %PROGRAM_FILES%\C4ebreg\pmemnt.sys
- %PROGRAM_FILES%\C4ebreg\support.html
- %PROGRAM_FILES%\C4ebreg\Scripts\script1071.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1080.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1084.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1065.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1069.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1070.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1090.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1091.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1092.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1085.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1087.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1088.py
- %PROGRAM_FILES%\C4ebreg\servers.ini
- %PROGRAM_FILES%\C4ebreg\inventory.ini
- %PROGRAM_FILES%\C4ebreg\Scripts\script1000.py
- %PROGRAM_FILES%\C4ebreg\isamfilter.inf
- %PROGRAM_FILES%\C4ebreg\unzip.exe
- %PROGRAM_FILES%\C4ebreg\zip.exe
- %PROGRAM_FILES%\C4ebreg\Scripts\script1059.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1061.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1062.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1009.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1042.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script1046.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3597.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3598.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3599.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3594.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3595.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3596.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3603.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3604.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3605.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3600.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3601.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3602.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3585.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3586.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3587.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3582.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3583.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3584.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3591.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3592.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3593.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3588.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3589.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3590.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3606.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3622.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3623.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3624.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3619.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3620.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3621.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3628.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3629.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3630.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3625.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3626.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3627.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3610.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3611.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3612.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3607.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3608.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3609.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3616.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3617.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3618.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3613.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3614.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3615.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3581.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3545.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3546.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3547.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3542.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3543.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3544.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3551.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3552.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3553.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3548.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3549.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3550.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3533.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3534.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3535.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3530.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3531.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3532.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3539.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3540.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3541.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3536.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3537.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3538.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3554.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3572.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3573.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3574.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3569.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3570.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3571.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3578.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3579.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3580.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3575.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3576.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3577.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3560.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3561.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3562.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3555.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3556.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3559.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3566.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3567.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3568.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3563.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3564.py
- %PROGRAM_FILES%\C4ebreg\Scripts\script3565.py
Удаляет следующие файлы:
- %PROGRAM_FILES%\C4ebreg\inventory.zip
- %PROGRAM_FILES%\C4ebreg\isamunin.exe
- %PROGRAM_FILES%\C4ebreg\isam_full.exe
- %PROGRAM_FILES%\C4ebreg\c4ebrfrc.dll
- %PROGRAM_FILES%\C4ebreg\c4ebrkor.dll
- %PROGRAM_FILES%\C4ebreg\c4ebrjpn.dll
Сетевая активность:
Подключается к:
- 'pl#####de.de.ibm.com':21
- 'pl#####uk.uk.ibm.com':21
UDP:
- DNS ASK pl#####de.de.ibm.com
- DNS ASK rt####.raleigh.ibm.com
- DNS ASK po#####am.pok.ibm.com
- DNS ASK wa#####tde.emea.ibm.com
- DNS ASK po####.pok.ibm.com
- DNS ASK pl#####uk.uk.ibm.com
- DNS ASK wa#####tuk.emea.ibm.com
- DNS ASK sb######epb01.sby.ibm.com
- DNS ASK bl######m.boulder.ibm.com
Другое:
Ищет следующие окна:
- ClassName: 'IBM Standard Asset Manager GUI' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
