Техническая информация
Вредоносные функции
Внедряет код в
следующие пользовательские процессы:
- ffmpeg.exe
Изменения в файловой системе
Создает следующие файлы
- %APPDATA%\thinstall\formatfactory\registry.rw.tvr.lck.xegbjjrj.ffffffff.bc
- %APPDATA%\thinstall\formatfactory\skel\uoirkknvgrllpsnoisstqvoikltnqkkvsnilgpim.tls-2212-872.tls
- %APPDATA%\thinstall\formatfactory\skel\sqvtgtmpnrriishvilnuqlktmjtqrppuhmkpijjn.tls-2212-872.tls
- %APPDATA%\thinstall\formatfactory\skel\rpkthvgnimqjupkgnigojuqvirhprgkntnimpgpv.tls-2212-872.tls
- %APPDATA%\thinstall\formatfactory\skel\rlorqnpnstqokjgjjtpnpgjsgpprtskukrlrttkp.tls-2212-872.tls
- %APPDATA%\thinstall\formatfactory\skel\nottrkkmnrsrihqrqppruivghuutsqhhlvipuptk.tls-2212-872.tls
- %APPDATA%\thinstall\formatfactory\skel\nsojoukhjttpiumqjmooorknppsjvopvklvkrvqm.tls-2212-872.tls
- %APPDATA%\thinstall\formatfactory\skel\gjvmosqttmikkpilohoguhlhqjnouvtuoinurgtj.tls-2212-872.tls
- %APPDATA%\thinstall\formatfactory\skel\lntsruvqhvkmkqtsvuovrvivrpqkkovvgonmpttk.tls-2212-872.tls
- %APPDATA%\thinstall\formatfactory\registry.tlog
- %APPDATA%\thinstall\formatfactory\skel\uqvvqkqjkrlkkvgknuopppimrtvonqjsorimokql.tls-1308-1432.tls
- %APPDATA%\thinstall\formatfactory\skel\squprgqliirmltltqktgtqqovilrhgtguqqhtvhi.tls-1308-1432.tls
- %APPDATA%\thinstall\formatfactory\skel\tiskhjvvlvhsuhppisphrrhiqrlnmnqirgonsqlg.tls-1308-1432.tls
- %APPDATA%\thinstall\formatfactory\skel\ugmvsurlkpppqrrmsvptviikisknmvpkpqqslkmo.tls-1308-1432.tls
- %APPDATA%\thinstall\formatfactory\skel\rokqjvjhnktlrgumjuvtlotvnrpikvuvhsvggsll.tls-1308-1432.tls
- %APPDATA%\thinstall\formatfactory\skel\hkqvrhiuhpjoqgivqhtmvhgvolilnqjvpggqkrlg.tls-1308-1432.tls
- %APPDATA%\thinstall\formatfactory\skel\junihorkkpvhilpjkmgklvhttrvmqgvpvmihusrs.tls-1308-1432.tls
- %APPDATA%\thinstall\formatfactory\skel\oqtmgottouogmhspnqsrktvssuotnnjjhsuhqtvm.tls-1308-1432.tls
- %APPDATA%\thinstall\formatfactory\skel\ljsvvnkvhjqmotjgmsgnpgootnvuurvposohriko.tls-1308-1432.tls
- %APPDATA%\thinstall\formatfactory\skel\vignommsiorimrnqhqkojgroskpgvjimtitvhjnv.tls-1308-1432.tls
- %APPDATA%\thinstall\formatfactory\skel\lmrltmjquhporinkrluouisvmtohjjhuptomulmg.tls-896-2984.tls
- %APPDATA%\thinstall\formatfactory\skel\njqorsvjunkhunqhqupptttrnvhmusunvgvvqvso.tls-896-2984.tls
- %APPDATA%\thinstall\formatfactory\skel\hloiguikipijqqtmsnjlmkjmtnggumgliqgtqlsr.tls-896-2984.tls
- %APPDATA%\thinstall\formatfactory\skel\qlgujkgqrolvttshhlhurgoutltuluihjrrjpnpj.tls-896-2984.tls
- %APPDATA%\thinstall\formatfactory\skel\pmqvuqoimsilkqhhgupllisjohqqjkiritujunks.tls-2436-1840.tls
- %APPDATA%\thinstall\formatfactory\skel\goqomtpriuthouhglvkpumnvotqnmkhmptjqrgog.tls-2436-1840.tls
- %APPDATA%\thinstall\formatfactory\skel\lttorropvolghrktiougqjhrjkgvopunnmpgruhp.tls-2436-1840.tls
- %APPDATA%\thinstall\formatfactory\skel\kthuivhlsggpotrhvhhiupshtgsinpkqhoqvsqmu.tls-2436-1840.tls
- %APPDATA%\thinstall\formatfactory\skel\psqisjlgrotipvjsvhtghvrthmrpinnpgsotrjnj.tls-2436-1840.tls
- %APPDATA%\thinstall\formatfactory\skel\ujmsnpjvjrvjlmollrslqiorskvpphpuukhtkiui.tls-2436-1840.tls
- %APPDATA%\thinstall\formatfactory\skel\kustqmvpjgiriliiptqvuqkvguhklvsvrikljqti.tls-2436-1840.tls
- %APPDATA%\thinstall\formatfactory\skel\mvupthhpinrtshohrvohjvomivsujtnoutisgskj.tls-2964-2204.tls
- %APPDATA%\thinstall\formatfactory\skel\inpsvjomgjnrnkugqlvkilhnijjthjougnstjjpg.tls-2964-2204.tls
- %APPDATA%\thinstall\formatfactory\skel\lsqmjtqrjourrgsnrnnqgnqgkhvtggrikokllqoo.tls-2848-2364.tls
- %APPDATA%\thinstall\formatfactory\skel\sqirsomnlumnnrkphohhnnqmgvntnliknltslqmm.tls-2964-2204.tls
- %APPDATA%\thinstall\formatfactory\skel\qgvpimqmsumgqishvlkkvkjgoopvosotlokivipr.tls-2848-2364.tls
- %APPDATA%\thinstall\formatfactory\skel\tonuqkhgrsttpvhqokivslqkjgvmpijuklvprhts.tls-2848-2364.tls
- %APPDATA%\thinstall\formatfactory\skel\utunivmjvtpmqmsihtghusokkpstsqohpqlitlkq.tls-2816-2944.tls
- %APPDATA%\thinstall\formatfactory\skel\jkrvplpnlnnpssoikrhlmnliumpptmgmljkintst.tls-2816-2944.tls
- %APPDATA%\thinstall\formatfactory\skel\jjnmpgpjqkrtojsorinnjmjjqgrhpjmlhllomjrg.tls-2816-2944.tls
- %APPDATA%\thinstall\formatfactory\skel\pntkolrgmsnlpstvtqpoukpomjtjtmpojglsvqgl.tls-2816-2944.tls
- %APPDATA%\thinstall\formatfactory\skel\jhsnqnkgsvthlgrhhmqsgrkirvqjiqpjrguulsmk.tls-2816-2944.tls
- %APPDATA%\thinstall\formatfactory\skel\tnnrmsklqomtosvlslvmlvltlokpsiugmklqjttg.tls-2816-2944.tls
- %APPDATA%\thinstall\formatfactory\skel\pkonvqvhlsmlnnhjoiqgkginoqggvtuomiqrsinn.tls-896-2984.tls
- %TEMP%\bcgccb1.tmp
- %APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe.714.588
- %APPDATA%\thinstall\formatfactory\skel\nsqmjunrtqumhiighkhivssrmvusnnoslohgqvsh.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\da8356f8301679472ab62d29cfd3df7d17305f09.sharedta.210.588
- %APPDATA%\thinstall\formatfactory\skel\rsshhrpsjvguumqjujrimuggmnuotjsqlqolhmio.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\ulvnqtgsltismtormtgqtvputuuptjniutuplgni.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\mtunihmpurpkpnnmttkhrsjjioqmghjlouhvvtkp.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\ormgjvuqgjtmkoqupoiispsjntnrglnqvutmivtk.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\sthurloirslvmhqujsotunulusnupmmmmuqprlqi.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\hlgitpksvrvvgtvgrtmkiikgjqontnumohkhhsjj.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\milriqmhugirltvrimisjstugiltvgspmrgmiigr.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\jgjnjqkoihmpjhgkmggrvthtrimntrsvupmrtttm.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\uklhqilggtjtvlgmjgslvmqrrvothjnsiqhqqvsn.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\ivqinkkkqqlvpupkosgiqsiirojinkgnpmlqrvtj.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\nrohroklrshpvvitkjlurkonnopiilmvlntnmimj.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\tvtslgolpnvrqvrvptnkvuitugrpnqrlnmhlvphu.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\rsnluglnsujhqnrnugrvvrvpuomipltrmtvnusvm.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\ligmlutkqlhkjvnnvvnnmvqgkhsvikihrsllmvsv.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\qonkosgvgpiqsvkqqnmkmiirjrknhkjlrnglopip.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\trlhlhomosmrnnvoppvrsknqhrmniorjqnvtihvh.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\registry.tlog.cache
- %APPDATA%\thinstall\formatfactory\registry.rw.tvr.transact
- %APPDATA%\thinstall\formatfactory\registry.rw.tvr
- %APPDATA%\thinstall\formatfactory\skel\pmqsvqrnvmqrgnolskttrmlnquvhrmgiuvnrvsht.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\nmvvploqhpkprhoqmqhuqprpsursogqrupvtpqqs.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\qoglvpmltkiqgqrvijnnkmgjpmlqrioirpmgssqu.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\kgjuuqshlkjvjgmjmokkmjiqiguovuuiilumkshk.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\bede30dec53a88872f9160e5805b1eff55ffe80e.sharedta.210.588
- %APPDATA%\thinstall\formatfactory\skel\ironjgnqkjmqrmskrilqvjppnjlmhtsprglusorj.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\41c59b1a3b2c8149034101bb61fbfb8e266d4da8.sharedta.210.588
- %APPDATA%\thinstall\formatfactory\skel\qvipllqjnmotnhohrpruithhtmvrgirhmqkmlijn.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\7ccce17dc76246ba36f2d723405028c4d412b4a2.sharedta.210.588
- %APPDATA%\thinstall\formatfactory\skel\ggqlqrlnvjijimsvqvjrhkjvmjiojuoqighipjjr.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\ead12adde5ca76fe9d1168a768abaef22b8a2762.sharedta.210.588
- %APPDATA%\thinstall\formatfactory\skel\mothphntujimnvruglunsqjipkkspgijlgppnlsg.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\c079fa7c5c18301f85f9b54e7f1a6e47c010ce2e.sharedta.210.588
- %APPDATA%\thinstall\formatfactory\skel\794c2c7495237771b053cb0ab6eb73bd6d68f080.sharedta.210.588
- %APPDATA%\thinstall\formatfactory\skel\vlurrgkmtlkrrhnnrqttknjrspiikklpsousoqio.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\rglsjqnrminqrkumrpmithioojmujpinsogmhngh.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\iotoigumtlihrrmqtquqkurqjlumhmrjsqkonpvi.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\ptphqhihortnjjkjsmprjnjhopstgmlnnnkopjiu.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\soiotgilmtpimprppgtvrgpojnmknoojrskquskm.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\tkpnnvuqmsogkjkvvjvlsinsoovjmqqskphjtgut.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\jliqnllvirhnhliumgilvgnvtvqntrvnpmuprvnn.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\vquhqsgptlmqigqqtkltlkrphkqtsnskpigrtugo.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\tpnvhlsguvjronlgssprsoimhjrnmspptirmquts.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\gvsgupvnjqvgnojjkvrsivjiggrukushmtrrjhug.tls-1416-528.tls
- %APPDATA%\thinstall\formatfactory\skel\qpkmupvlhirmrntsmhqkmmmslimiktkqkuulsqmq.tls-1416-528.tls
- %TEMP%\bcgccc1.tmp
Перемещает следующие файлы
- %APPDATA%\thinstall\formatfactory\registry.rw.tvr.lck.xegbjjrj.ffffffff.bc в %APPDATA%\thinstall\formatfactory\registry.rw.tvr.lck
- %APPDATA%\thinstall\formatfactory\skel\uoirkknvgrllpsnoisstqvoikltnqkkvsnilgpim.tls-2212-872.tls в %APPDATA%\thinstall\formatfactory\skel\uoirkknvgrllpsnoisstqvoikltnqkkvsnilgpim.tls
- %APPDATA%\thinstall\formatfactory\skel\sqvtgtmpnrriishvilnuqlktmjtqrppuhmkpijjn.tls-2212-872.tls в %APPDATA%\thinstall\formatfactory\skel\sqvtgtmpnrriishvilnuqlktmjtqrppuhmkpijjn.tls
- %APPDATA%\thinstall\formatfactory\skel\rpkthvgnimqjupkgnigojuqvirhprgkntnimpgpv.tls-2212-872.tls в %APPDATA%\thinstall\formatfactory\skel\rpkthvgnimqjupkgnigojuqvirhprgkntnimpgpv.tls
- %APPDATA%\thinstall\formatfactory\skel\rlorqnpnstqokjgjjtpnpgjsgpprtskukrlrttkp.tls-2212-872.tls в %APPDATA%\thinstall\formatfactory\skel\rlorqnpnstqokjgjjtpnpgjsgpprtskukrlrttkp.tls
- %APPDATA%\thinstall\formatfactory\skel\nottrkkmnrsrihqrqppruivghuutsqhhlvipuptk.tls-2212-872.tls в %APPDATA%\thinstall\formatfactory\skel\nottrkkmnrsrihqrqppruivghuutsqhhlvipuptk.tls
- %APPDATA%\thinstall\formatfactory\skel\nsojoukhjttpiumqjmooorknppsjvopvklvkrvqm.tls-2212-872.tls в %APPDATA%\thinstall\formatfactory\skel\nsojoukhjttpiumqjmooorknppsjvopvklvkrvqm.tls
- %APPDATA%\thinstall\formatfactory\skel\gjvmosqttmikkpilohoguhlhqjnouvtuoinurgtj.tls-2212-872.tls в %APPDATA%\thinstall\formatfactory\skel\gjvmosqttmikkpilohoguhlhqjnouvtuoinurgtj.tls
- %APPDATA%\thinstall\formatfactory\skel\lntsruvqhvkmkqtsvuovrvivrpqkkovvgonmpttk.tls-2212-872.tls в %APPDATA%\thinstall\formatfactory\skel\lntsruvqhvkmkqtsvuovrvivrpqkkovvgonmpttk.tls
- %APPDATA%\thinstall\formatfactory\skel\lmrltmjquhporinkrluouisvmtohjjhuptomulmg.tls-896-2984.tls в %APPDATA%\thinstall\formatfactory\skel\lmrltmjquhporinkrluouisvmtohjjhuptomulmg.tls
- %APPDATA%\thinstall\formatfactory\skel\uqvvqkqjkrlkkvgknuopppimrtvonqjsorimokql.tls-1308-1432.tls в %APPDATA%\thinstall\formatfactory\skel\uqvvqkqjkrlkkvgknuopppimrtvonqjsorimokql.tls
- %APPDATA%\thinstall\formatfactory\skel\tiskhjvvlvhsuhppisphrrhiqrlnmnqirgonsqlg.tls-1308-1432.tls в %APPDATA%\thinstall\formatfactory\skel\tiskhjvvlvhsuhppisphrrhiqrlnmnqirgonsqlg.tls
- %APPDATA%\thinstall\formatfactory\skel\ugmvsurlkpppqrrmsvptviikisknmvpkpqqslkmo.tls-1308-1432.tls в %APPDATA%\thinstall\formatfactory\skel\ugmvsurlkpppqrrmsvptviikisknmvpkpqqslkmo.tls
- %APPDATA%\thinstall\formatfactory\skel\rokqjvjhnktlrgumjuvtlotvnrpikvuvhsvggsll.tls-1308-1432.tls в %APPDATA%\thinstall\formatfactory\skel\rokqjvjhnktlrgumjuvtlotvnrpikvuvhsvggsll.tls
- %APPDATA%\thinstall\formatfactory\skel\hkqvrhiuhpjoqgivqhtmvhgvolilnqjvpggqkrlg.tls-1308-1432.tls в %APPDATA%\thinstall\formatfactory\skel\hkqvrhiuhpjoqgivqhtmvhgvolilnqjvpggqkrlg.tls
- %APPDATA%\thinstall\formatfactory\skel\junihorkkpvhilpjkmgklvhttrvmqgvpvmihusrs.tls-1308-1432.tls в %APPDATA%\thinstall\formatfactory\skel\junihorkkpvhilpjkmgklvhttrvmqgvpvmihusrs.tls
- %APPDATA%\thinstall\formatfactory\skel\oqtmgottouogmhspnqsrktvssuotnnjjhsuhqtvm.tls-1308-1432.tls в %APPDATA%\thinstall\formatfactory\skel\oqtmgottouogmhspnqsrktvssuotnnjjhsuhqtvm.tls
- %APPDATA%\thinstall\formatfactory\skel\ljsvvnkvhjqmotjgmsgnpgootnvuurvposohriko.tls-1308-1432.tls в %APPDATA%\thinstall\formatfactory\skel\ljsvvnkvhjqmotjgmsgnpgootnvuurvposohriko.tls
- %APPDATA%\thinstall\formatfactory\skel\vignommsiorimrnqhqkojgroskpgvjimtitvhjnv.tls-1308-1432.tls в %APPDATA%\thinstall\formatfactory\skel\vignommsiorimrnqhqkojgroskpgvjimtitvhjnv.tls
- %APPDATA%\thinstall\formatfactory\skel\squprgqliirmltltqktgtqqovilrhgtguqqhtvhi.tls-1308-1432.tls в %APPDATA%\thinstall\formatfactory\skel\squprgqliirmltltqktgtqqovilrhgtguqqhtvhi.tls
- %APPDATA%\thinstall\formatfactory\skel\qgvpimqmsumgqishvlkkvkjgoopvosotlokivipr.tls-2848-2364.tls в %APPDATA%\thinstall\formatfactory\skel\qgvpimqmsumgqishvlkkvkjgoopvosotlokivipr.tls
- %APPDATA%\thinstall\formatfactory\skel\goqomtpriuthouhglvkpumnvotqnmkhmptjqrgog.tls-2436-1840.tls в %APPDATA%\thinstall\formatfactory\skel\goqomtpriuthouhglvkpumnvotqnmkhmptjqrgog.tls
- %APPDATA%\thinstall\formatfactory\skel\qlgujkgqrolvttshhlhurgoutltuluihjrrjpnpj.tls-896-2984.tls в %APPDATA%\thinstall\formatfactory\skel\qlgujkgqrolvttshhlhurgoutltuluihjrrjpnpj.tls
- %APPDATA%\thinstall\formatfactory\skel\lttorropvolghrktiougqjhrjkgvopunnmpgruhp.tls-2436-1840.tls в %APPDATA%\thinstall\formatfactory\skel\lttorropvolghrktiougqjhrjkgvopunnmpgruhp.tls
- %APPDATA%\thinstall\formatfactory\skel\kthuivhlsggpotrhvhhiupshtgsinpkqhoqvsqmu.tls-2436-1840.tls в %APPDATA%\thinstall\formatfactory\skel\kthuivhlsggpotrhvhhiupshtgsinpkqhoqvsqmu.tls
- %APPDATA%\thinstall\formatfactory\skel\psqisjlgrotipvjsvhtghvrthmrpinnpgsotrjnj.tls-2436-1840.tls в %APPDATA%\thinstall\formatfactory\skel\psqisjlgrotipvjsvhtghvrthmrpinnpgsotrjnj.tls
- %APPDATA%\thinstall\formatfactory\skel\ujmsnpjvjrvjlmollrslqiorskvpphpuukhtkiui.tls-2436-1840.tls в %APPDATA%\thinstall\formatfactory\skel\ujmsnpjvjrvjlmollrslqiorskvpphpuukhtkiui.tls
- %APPDATA%\thinstall\formatfactory\skel\kustqmvpjgiriliiptqvuqkvguhklvsvrikljqti.tls-2436-1840.tls в %APPDATA%\thinstall\formatfactory\skel\kustqmvpjgiriliiptqvuqkvguhklvsvrikljqti.tls
- %APPDATA%\thinstall\formatfactory\skel\mvupthhpinrtshohrvohjvomivsujtnoutisgskj.tls-2964-2204.tls в %APPDATA%\thinstall\formatfactory\skel\mvupthhpinrtshohrvohjvomivsujtnoutisgskj.tls
- %APPDATA%\thinstall\formatfactory\skel\inpsvjomgjnrnkugqlvkilhnijjthjougnstjjpg.tls-2964-2204.tls в %APPDATA%\thinstall\formatfactory\skel\inpsvjomgjnrnkugqlvkilhnijjthjougnstjjpg.tls
- %APPDATA%\thinstall\formatfactory\skel\sqirsomnlumnnrkphohhnnqmgvntnliknltslqmm.tls-2964-2204.tls в %APPDATA%\thinstall\formatfactory\skel\sqirsomnlumnnrkphohhnnqmgvntnliknltslqmm.tls
- %APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe.714.588 в %APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe
- %APPDATA%\thinstall\formatfactory\skel\lsqmjtqrjourrgsnrnnqgnqgkhvtggrikokllqoo.tls-2848-2364.tls в %APPDATA%\thinstall\formatfactory\skel\lsqmjtqrjourrgsnrnnqgnqgkhvtggrikokllqoo.tls
- %APPDATA%\thinstall\formatfactory\skel\tonuqkhgrsttpvhqokivslqkjgvmpijuklvprhts.tls-2848-2364.tls в %APPDATA%\thinstall\formatfactory\skel\tonuqkhgrsttpvhqokivslqkjgvmpijuklvprhts.tls
- %APPDATA%\thinstall\formatfactory\skel\utunivmjvtpmqmsihtghusokkpstsqohpqlitlkq.tls-2816-2944.tls в %APPDATA%\thinstall\formatfactory\skel\utunivmjvtpmqmsihtghusokkpstsqohpqlitlkq.tls
- %APPDATA%\thinstall\formatfactory\skel\jkrvplpnlnnpssoikrhlmnliumpptmgmljkintst.tls-2816-2944.tls в %APPDATA%\thinstall\formatfactory\skel\jkrvplpnlnnpssoikrhlmnliumpptmgmljkintst.tls
- %APPDATA%\thinstall\formatfactory\skel\jjnmpgpjqkrtojsorinnjmjjqgrhpjmlhllomjrg.tls-2816-2944.tls в %APPDATA%\thinstall\formatfactory\skel\jjnmpgpjqkrtojsorinnjmjjqgrhpjmlhllomjrg.tls
- %APPDATA%\thinstall\formatfactory\skel\pntkolrgmsnlpstvtqpoukpomjtjtmpojglsvqgl.tls-2816-2944.tls в %APPDATA%\thinstall\formatfactory\skel\pntkolrgmsnlpstvtqpoukpomjtjtmpojglsvqgl.tls
- %APPDATA%\thinstall\formatfactory\skel\jhsnqnkgsvthlgrhhmqsgrkirvqjiqpjrguulsmk.tls-2816-2944.tls в %APPDATA%\thinstall\formatfactory\skel\jhsnqnkgsvthlgrhhmqsgrkirvqjiqpjrguulsmk.tls
- %APPDATA%\thinstall\formatfactory\skel\tnnrmsklqomtosvlslvmlvltlokpsiugmklqjttg.tls-2816-2944.tls в %APPDATA%\thinstall\formatfactory\skel\tnnrmsklqomtosvlslvmlvltlokpsiugmklqjttg.tls
- %APPDATA%\thinstall\formatfactory\skel\pkonvqvhlsmlnnhjoiqgkginoqggvtuomiqrsinn.tls-896-2984.tls в %APPDATA%\thinstall\formatfactory\skel\pkonvqvhlsmlnnhjoiqgkginoqggvtuomiqrsinn.tls
- %APPDATA%\thinstall\formatfactory\skel\njqorsvjunkhunqhqupptttrnvhmusunvgvvqvso.tls-896-2984.tls в %APPDATA%\thinstall\formatfactory\skel\njqorsvjunkhunqhqupptttrnvhmusunvgvvqvso.tls
- %APPDATA%\thinstall\formatfactory\skel\hloiguikipijqqtmsnjlmkjmtnggumgliqgtqlsr.tls-896-2984.tls в %APPDATA%\thinstall\formatfactory\skel\hloiguikipijqqtmsnjlmkjmtnggumgliqgtqlsr.tls
- %APPDATA%\thinstall\formatfactory\skel\nsqmjunrtqumhiighkhivssrmvusnnoslohgqvsh.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\nsqmjunrtqumhiighkhivssrmvusnnoslohgqvsh.tls
- %APPDATA%\thinstall\formatfactory\skel\gvsgupvnjqvgnojjkvrsivjiggrukushmtrrjhug.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\gvsgupvnjqvgnojjkvrsivjiggrukushmtrrjhug.tls
- %APPDATA%\thinstall\formatfactory\skel\nmvvploqhpkprhoqmqhuqprpsursogqrupvtpqqs.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\nmvvploqhpkprhoqmqhuqprpsursogqrupvtpqqs.tls
- %APPDATA%\thinstall\formatfactory\skel\pmqsvqrnvmqrgnolskttrmlnquvhrmgiuvnrvsht.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\pmqsvqrnvmqrgnolskttrmlnquvhrmgiuvnrvsht.tls
- %APPDATA%\thinstall\formatfactory\skel\rsshhrpsjvguumqjujrimuggmnuotjsqlqolhmio.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\rsshhrpsjvguumqjujrimuggmnuotjsqlqolhmio.tls
- %APPDATA%\thinstall\formatfactory\skel\ulvnqtgsltismtormtgqtvputuuptjniutuplgni.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\ulvnqtgsltismtormtgqtvputuuptjniutuplgni.tls
- %APPDATA%\thinstall\formatfactory\skel\mtunihmpurpkpnnmttkhrsjjioqmghjlouhvvtkp.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\mtunihmpurpkpnnmttkhrsjjioqmghjlouhvvtkp.tls
- %APPDATA%\thinstall\formatfactory\skel\ormgjvuqgjtmkoqupoiispsjntnrglnqvutmivtk.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\ormgjvuqgjtmkoqupoiispsjntnrglnqvutmivtk.tls
- %APPDATA%\thinstall\formatfactory\skel\sthurloirslvmhqujsotunulusnupmmmmuqprlqi.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\sthurloirslvmhqujsotunulusnupmmmmuqprlqi.tls
- %APPDATA%\thinstall\formatfactory\skel\hlgitpksvrvvgtvgrtmkiikgjqontnumohkhhsjj.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\hlgitpksvrvvgtvgrtmkiikgjqontnumohkhhsjj.tls
- %APPDATA%\thinstall\formatfactory\skel\qoglvpmltkiqgqrvijnnkmgjpmlqrioirpmgssqu.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\qoglvpmltkiqgqrvijnnkmgjpmlqrioirpmgssqu.tls
- %APPDATA%\thinstall\formatfactory\skel\milriqmhugirltvrimisjstugiltvgspmrgmiigr.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\milriqmhugirltvrimisjstugiltvgspmrgmiigr.tls
- %APPDATA%\thinstall\formatfactory\skel\uklhqilggtjtvlgmjgslvmqrrvothjnsiqhqqvsn.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\uklhqilggtjtvlgmjgslvmqrrvothjnsiqhqqvsn.tls
- %APPDATA%\thinstall\formatfactory\skel\ivqinkkkqqlvpupkosgiqsiirojinkgnpmlqrvtj.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\ivqinkkkqqlvpupkosgiqsiirojinkgnpmlqrvtj.tls
- %APPDATA%\thinstall\formatfactory\skel\nrohroklrshpvvitkjlurkonnopiilmvlntnmimj.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\nrohroklrshpvvitkjlurkonnopiilmvlntnmimj.tls
- %APPDATA%\thinstall\formatfactory\skel\tvtslgolpnvrqvrvptnkvuitugrpnqrlnmhlvphu.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\tvtslgolpnvrqvrvptnkvuitugrpnqrlnmhlvphu.tls
- %APPDATA%\thinstall\formatfactory\skel\rsnluglnsujhqnrnugrvvrvpuomipltrmtvnusvm.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\rsnluglnsujhqnrnugrvvrvpuomipltrmtvnusvm.tls
- %APPDATA%\thinstall\formatfactory\skel\ligmlutkqlhkjvnnvvnnmvqgkhsvikihrsllmvsv.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\ligmlutkqlhkjvnnvvnnmvqgkhsvikihrsllmvsv.tls
- %APPDATA%\thinstall\formatfactory\skel\qonkosgvgpiqsvkqqnmkmiirjrknhkjlrnglopip.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\qonkosgvgpiqsvkqqnmkmiirjrknhkjlrnglopip.tls
- %APPDATA%\thinstall\formatfactory\skel\trlhlhomosmrnnvoppvrsknqhrmniorjqnvtihvh.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\trlhlhomosmrnnvoppvrsknqhrmniorjqnvtihvh.tls
- %APPDATA%\thinstall\formatfactory\skel\jgjnjqkoihmpjhgkmggrvthtrimntrsvupmrtttm.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\jgjnjqkoihmpjhgkmggrvthtrimntrsvupmrtttm.tls
- %APPDATA%\thinstall\formatfactory\skel\vlurrgkmtlkrrhnnrqttknjrspiikklpsousoqio.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\vlurrgkmtlkrrhnnrqttknjrspiikklpsousoqio.tls
- %APPDATA%\thinstall\formatfactory\skel\qpkmupvlhirmrntsmhqkmmmslimiktkqkuulsqmq.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\qpkmupvlhirmrntsmhqkmmmslimiktkqkuulsqmq.tls
- %APPDATA%\thinstall\formatfactory\skel\tpnvhlsguvjronlgssprsoimhjrnmspptirmquts.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\tpnvhlsguvjronlgssprsoimhjrnmspptirmquts.tls
- %APPDATA%\thinstall\formatfactory\skel\bede30dec53a88872f9160e5805b1eff55ffe80e.sharedta.210.588 в %APPDATA%\thinstall\formatfactory\skel\bede30dec53a88872f9160e5805b1eff55ffe80e.sharedta
- %APPDATA%\thinstall\formatfactory\skel\ironjgnqkjmqrmskrilqvjppnjlmhtsprglusorj.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\ironjgnqkjmqrmskrilqvjppnjlmhtsprglusorj.tls
- %APPDATA%\thinstall\formatfactory\skel\41c59b1a3b2c8149034101bb61fbfb8e266d4da8.sharedta.210.588 в %APPDATA%\thinstall\formatfactory\skel\41c59b1a3b2c8149034101bb61fbfb8e266d4da8.sharedta
- %APPDATA%\thinstall\formatfactory\skel\qvipllqjnmotnhohrpruithhtmvrgirhmqkmlijn.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\qvipllqjnmotnhohrpruithhtmvrgirhmqkmlijn.tls
- %APPDATA%\thinstall\formatfactory\skel\7ccce17dc76246ba36f2d723405028c4d412b4a2.sharedta.210.588 в %APPDATA%\thinstall\formatfactory\skel\7ccce17dc76246ba36f2d723405028c4d412b4a2.sharedta
- %APPDATA%\thinstall\formatfactory\skel\ggqlqrlnvjijimsvqvjrhkjvmjiojuoqighipjjr.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\ggqlqrlnvjijimsvqvjrhkjvmjiojuoqighipjjr.tls
- %APPDATA%\thinstall\formatfactory\skel\ead12adde5ca76fe9d1168a768abaef22b8a2762.sharedta.210.588 в %APPDATA%\thinstall\formatfactory\skel\ead12adde5ca76fe9d1168a768abaef22b8a2762.sharedta
- %APPDATA%\thinstall\formatfactory\skel\mothphntujimnvruglunsqjipkkspgijlgppnlsg.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\mothphntujimnvruglunsqjipkkspgijlgppnlsg.tls
- %APPDATA%\thinstall\formatfactory\skel\da8356f8301679472ab62d29cfd3df7d17305f09.sharedta.210.588 в %APPDATA%\thinstall\formatfactory\skel\da8356f8301679472ab62d29cfd3df7d17305f09.sharedta
- %APPDATA%\thinstall\formatfactory\skel\c079fa7c5c18301f85f9b54e7f1a6e47c010ce2e.sharedta.210.588 в %APPDATA%\thinstall\formatfactory\skel\c079fa7c5c18301f85f9b54e7f1a6e47c010ce2e.sharedta
- %APPDATA%\thinstall\formatfactory\skel\794c2c7495237771b053cb0ab6eb73bd6d68f080.sharedta.210.588 в %APPDATA%\thinstall\formatfactory\skel\794c2c7495237771b053cb0ab6eb73bd6d68f080.sharedta
- %APPDATA%\thinstall\formatfactory\skel\rglsjqnrminqrkumrpmithioojmujpinsogmhngh.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\rglsjqnrminqrkumrpmithioojmujpinsogmhngh.tls
- %APPDATA%\thinstall\formatfactory\skel\iotoigumtlihrrmqtquqkurqjlumhmrjsqkonpvi.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\iotoigumtlihrrmqtquqkurqjlumhmrjsqkonpvi.tls
- %APPDATA%\thinstall\formatfactory\skel\ptphqhihortnjjkjsmprjnjhopstgmlnnnkopjiu.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\ptphqhihortnjjkjsmprjnjhopstgmlnnnkopjiu.tls
- %APPDATA%\thinstall\formatfactory\skel\soiotgilmtpimprppgtvrgpojnmknoojrskquskm.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\soiotgilmtpimprppgtvrgpojnmknoojrskquskm.tls
- %APPDATA%\thinstall\formatfactory\skel\tkpnnvuqmsogkjkvvjvlsinsoovjmqqskphjtgut.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\tkpnnvuqmsogkjkvvjvlsinsoovjmqqskphjtgut.tls
- %APPDATA%\thinstall\formatfactory\skel\jliqnllvirhnhliumgilvgnvtvqntrvnpmuprvnn.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\jliqnllvirhnhliumgilvgnvtvqntrvnpmuprvnn.tls
- %APPDATA%\thinstall\formatfactory\skel\vquhqsgptlmqigqqtkltlkrphkqtsnskpigrtugo.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\vquhqsgptlmqigqqtkltlkrphkqtsnskpigrtugo.tls
- %APPDATA%\thinstall\formatfactory\skel\kgjuuqshlkjvjgmjmokkmjiqiguovuuiilumkshk.tls-1416-528.tls в %APPDATA%\thinstall\formatfactory\skel\kgjuuqshlkjvjgmjmokkmjiqiguovuuiilumkshk.tls
- %APPDATA%\thinstall\formatfactory\skel\pmqvuqoimsilkqhhgupllisjohqqjkiritujunks.tls-2436-1840.tls в %APPDATA%\thinstall\formatfactory\skel\pmqvuqoimsilkqhhgupllisjohqqjkiritujunks.tls
Сетевая активность
Подключается к
- 'se####.pcfreetime.com':80
TCP
Запросы HTTP GET
- http://se####.pcfreetime.com/ff/daily_stat?ve###################################
- http://se####.pcfreetime.com/ff/inst_stat?ve###################################
- http://www.pc###etime.com/update/FFUpdateLog.txt
UDP
- DNS ASK pc###etime.com
- DNS ASK se####.pcfreetime.com
Другое
Создает и запускает на исполнение
- '%APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe' /init
- '%APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe' -y -i "%ProgramFiles(x86)%\FormatFactory\FFModules\Sample\Video\HATest.mp4" -c:v:0 h264_nvenc D:\FFOutput\Temp\_Task_210_\_HATest_210_.mp4
- '%APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe' -y -i "%ProgramFiles(x86)%\FormatFactory\FFModules\Sample\Video\HATest.mp4" -c:v:0 hevc_nvenc D:\FFOutput\Temp\_Task_210_\_HATest_210_.mp4
- '%APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe' -y -i "%ProgramFiles(x86)%\FormatFactory\FFModules\Sample\Video\HATest.mp4" -c:v:0 h264_amf D:\FFOutput\Temp\_Task_210_\_HATest_210_.mp4
- '%APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe' -y -i "%ProgramFiles(x86)%\FormatFactory\FFModules\Sample\Video\HATest.mp4" -c:v:0 hevc_amf D:\FFOutput\Temp\_Task_210_\_HATest_210_.mp4
- '%APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe' -y -i "%ProgramFiles(x86)%\FormatFactory\FFModules\Sample\Video\HATest.mp4" -c:v:0 h264_qsv D:\FFOutput\Temp\_Task_210_\_HATest_210_.mp4
- '%APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe' -y -i "%ProgramFiles(x86)%\FormatFactory\FFModules\Sample\Video\HATest.mp4" -c:v:0 hevc_qsv D:\FFOutput\Temp\_Task_210_\_HATest_210_.mp4
- '%APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe' /init' (со скрытым окном)
