Trojan.MulDrop5.21146

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\EBP Pervasive.SQL] 'Start' = '00000002'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] 'C:\PVSW\Bin\w3dbsmgr.exe' = 'C:\PVSW\Bin\w3dbsmgr.exe:*:Enabled:Database Service Manager'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] 'C:\PVSW\Bin\w3dbsmgr.exe' = 'C:\PVSW\Bin\w3dbsmgr.exe:*:Enabled:Database Service Manager'

Создает и запускает на исполнение:

'C:\PVSW\Bin\w3dbsmgr.exe' -SRDE -SERVICE
'C:\PVSW\Bin\WGE_SRV.exe'
'%TEMP%\mia1.tmp\EBP_Btrieve8.6_SETUP.exe' /m="<Полный путь к вирусу>" /k=""

Запускает на исполнение:

'<SYSTEM32>\msiexec.exe' /Y "C:\PVSW\Bin\poledbsy.dll"
'<SYSTEM32>\msiexec.exe' /Y "C:\PVSW\Bin\upiapirb.dll"
'<SYSTEM32>\msiexec.exe' /Y "C:\PVSW\Bin\poledb.dll"
'<SYSTEM32>\msiexec.exe' /Y "C:\PVSW\Bin\poledber.dll"
'<SYSTEM32>\msiexec.exe' /Y "C:\PVSW\Bin\w3csi100.dll"
'<SYSTEM32>\msiexec.exe' /Y "C:\PVSW\Bin\w3dcm100.dll"
'<SYSTEM32>\netsh.exe' firewall add allowedprogram program = "C:\PVSW\Bin\w3dbsmgr.exe" name = "Database Service Manager" scope = ALL profile = ALL
'<SYSTEM32>\msiexec.exe' /Y "C:\PVSW\Bin\W3csm100.dll"
'<SYSTEM32>\msiexec.exe' /Y "C:\PVSW\Bin\w3csp100.dll"
'<SYSTEM32>\msiexec.exe' /Y "C:\PVSW\Bin\pctlgrb.dll"
'<SYSTEM32>\msiexec.exe' /Y "C:\PVSW\Bin\clientrb.dll"
'<SYSTEM32>\msiexec.exe' /Y "C:\PVSW\Bin\dbcsipxy.dll"
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' -Embedding 3385F1AA38C04DA0D9DF345A2AA915AD
'<SYSTEM32>\msiexec.exe' /Y "C:\PVSW\Bin\dto2.dll"
'<SYSTEM32>\msiexec.exe' /Y "C:\PVSW\Bin\mkc.dll"
'<SYSTEM32>\msiexec.exe' /Y "C:\PVSW\Bin\mkderb.dll"
'<SYSTEM32>\msiexec.exe' /Y "C:\PVSW\Bin\legacylm.dll"
'<SYSTEM32>\msiexec.exe' /Y "C:\PVSW\Bin\licmgrrb.dll"

Изменения в файловой системе:

Создает следующие файлы:

C:\PVSW\Bin\timgrrb.dll
C:\PVSW\Bin\swcomp32.dll
C:\PVSW\Bin\rsiddf.dll
C:\PVSW\Bin\w3btrv7.dll
C:\PVSW\Bin\w3aif10C.dll
C:\PVSW\Bin\w32btxlt.dll
C:\PVSW\Bin\pvkillwg.exe
C:\PVSW\Bin\pvjdbc2x.jar
C:\PVSW\Bin\pvjdbc2.jar
C:\PVSW\Bin\RelTest.dll
C:\PVSW\Bin\pvmsgrb.dll
C:\PVSW\Bin\pvlocate.exe
C:\PVSW\Bin\w3dbnv7.dll
C:\PVSW\Bin\w3dbav80.dll
C:\PVSW\Bin\w3dbav78.dll
C:\PVSW\Bin\w3enc107.dll
C:\PVSW\Bin\w3ddf103.dll
C:\PVSW\Bin\w3dbsmgr.exe
C:\PVSW\Bin\w3clnrsx.dll
C:\PVSW\Bin\w3clnres.dll
C:\PVSW\Bin\w3cache.dll
C:\PVSW\Bin\w3dbav75.dll
C:\PVSW\Bin\w3crs10F.dll
C:\PVSW\Bin\w3comsrv.dll
C:\PVSW\Bin\confmrb.dll
C:\PVSW\Bin\cnstring.dll
C:\PVSW\Bin\clilcadm.exe
C:\PVSW\Bin\jpscs.jar
C:\PVSW\Bin\enginelm.dll
C:\PVSW\Bin\dto.dll
%WINDIR%\Installer\MSI4.tmp
%WINDIR%\Installer\MSI3.tmp
%WINDIR%\Installer\MSI2.tmp
C:\Config.Msi\1d1b5.rbs
%WINDIR%\Installer\MSI6.tmp
%WINDIR%\Installer\MSI5.tmp
C:\PVSW\Bin\pssax.dll
C:\PVSW\Bin\psregsvr.exe
C:\PVSW\Bin\pscore.dll
C:\PVSW\Bin\pvdsncon.exe
C:\PVSW\Bin\pvdrmsrb.dll
C:\PVSW\Bin\psutilrb.dll
C:\PVSW\Bin\lisezmoi.rtf
C:\PVSW\Bin\jsbdosws.exe
C:\PVSW\Bin\jsbdosws.dll
C:\PVSW\Bin\pscl.dll
C:\PVSW\Bin\pceurop.dll
C:\PVSW\Bin\ntpsinst.dll
C:\PVSW\Bin\w3exp010.dll
C:\PVSW\Bin\poledbsy.dll
C:\PVSW\Bin\poledber.dll
C:\PVSW\Bin\poledb.dll
C:\PVSW\Bin\W3csm100.dll
C:\PVSW\Bin\w3csi100.dll
C:\PVSW\Bin\upiapirb.dll
C:\PVSW\Bin\licmgrrb.dll
C:\PVSW\Bin\legacylm.dll
C:\PVSW\Bin\dto2.dll
C:\PVSW\Bin\pctlgrb.dll
C:\PVSW\Bin\mkderb.dll
C:\PVSW\Bin\mkc.dll
%ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\mia.lib
%ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\EBP_Btrieve8.6_SETUP.res
%ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\EBP_Btrieve8.6_SETUP.msi
%ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\instance.dat
%ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\EBP_Btrieve8.6_SETUP.par
%ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\EBP_Btrieve8.6_SETUP.dat
C:\PVSW\Bin\WGE_SRV.exe
C:\PVSW\Bin\w3dcm100.dll
C:\PVSW\Bin\w3csp100.dll
%ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\EBP_Btrieve8.6_SETUP.exe
C:\PVSW\Bin\pvsw_wge.ini
%WINDIR%\pvsw.log
C:\PVSW\Bin\W3NSR122.DLL
C:\PVSW\Bin\w3nsl244.dll
C:\PVSW\Bin\W3MKDE.DLL
C:\PVSW\Bin\w3odbcei.dll
C:\PVSW\Bin\w3odbccs.dll
C:\PVSW\Bin\w3odbcci.dll
C:\PVSW\Bin\w3mgrmsg.dll
C:\PVSW\Bin\w3lgo103.exe
C:\PVSW\Bin\W3ICR104.DLL
C:\PVSW\Bin\w3mif165.dll
C:\PVSW\Bin\w3mgrrsx.dll
C:\PVSW\Bin\w3mgrres.dll
C:\PVSW\Bin\wbtrv32.dll
C:\PVSW\Bin\wbtrcall.dll
C:\PVSW\Bin\WBEXEC32.exe
C:\PVSW\Bin\dbcsipxy.dll
C:\PVSW\Bin\clientrb.dll
C:\PVSW\Bin\wdbuui32.dll
C:\PVSW\Bin\w3sqlmgr.dll
C:\PVSW\Bin\w3scmv7.dll
C:\PVSW\Bin\w3odbces.dll
C:\PVSW\Bin\w3xlt101.dll
C:\PVSW\Bin\W3UPI234.dll
C:\PVSW\Bin\w3sqlv7.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\poledb.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\pctlgrb.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pceurop.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pscl.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\poledbsy.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\poledber.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\licmgrrb.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\legacylm.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\jsbdosws.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\ntpsinst.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\mkderb.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\mkc.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\timgrrb.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\swcomp32.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\rsiddf.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3aif10C.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w32btxlt.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\upiapirb.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\psutilrb.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pssax.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pscore.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\RelTest.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pvmsgrb.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pvdrmsrb.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\psregsvr.exe
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\jsbdosws.exe
%TEMP%\mia1.tmp\EBP_Btrieve8.6_SETUP.exe
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pvlocate.exe
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pvkillwg.exe
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pvdsncon.exe
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pvjdbc2x.jar
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pvjdbc2.jar
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\jpscs.jar
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\clilcadm.exe
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\lisezmoi.rtf
%TEMP%\mia1.tmp\EBP_Btrieve8.6_SETUP.msi
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\dto.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\dbcsipxy.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\confmrb.dll
%TEMP%\mia1.tmp\OFFLINE\FirewallIDEPlugIn.dll\FirewallEXEPlugIn.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\enginelm.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\dto2.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\WBEXEC32.exe
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3lgo103.exe
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3dbsmgr.exe
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\cnstring.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\clientrb.dll
%TEMP%\mia1.tmp\OFFLINE\__servdev_SetupSources\Btrieve\8.6\DATA\service\WGE_SRV.exe
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3btrv7.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3xlt101.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\W3UPI234.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3sqlv7.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\wdbuui32.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\wbtrv32.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\wbtrcall.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3odbcei.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3odbccs.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3odbcci.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3sqlmgr.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3scmv7.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3odbces.dll
%TEMP%\mia1\mMSIExec.dll
%TEMP%\mia1\FirewallEXEPlugIn.dll
%TEMP%\mia1\progress.dfm
%WINDIR%\Installer\1d1b2.msi
%TEMP%\{747D0A04-5BDA-478D-A010-68CCCBE4D15A}
%TEMP%\mia1\EBP_Btrieve8.6_SETUP.msi
%TEMP%\lang.loc
%TEMP%\mia1.tmp\EBP_Btrieve8.6_SETUP.res
%TEMP%\mia1.tmp\mia.lib
%TEMP%\mia1\maintenance.dfm
%TEMP%\mia1\finish.dfm
%TEMP%\mia.tmp
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3dbav75.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\w3csp100.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\W3csm100.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3dbnv7.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3dbav80.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3dbav78.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3clnrsx.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3clnres.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3cache.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\w3csi100.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3crs10F.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3comsrv.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3mif165.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3mgrrsx.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3mgrres.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\W3NSR122.DLL
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3nsl244.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\W3MKDE.DLL
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3enc107.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3ddf103.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\w3dcm100.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3mgrmsg.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\W3ICR104.DLL
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3exp010.dll

Удаляет следующие файлы:

%WINDIR%\Installer\MSI6.tmp
%WINDIR%\Installer\MSI5.tmp
C:\Config.Msi\1d1b5.rbs
%TEMP%\{747D0A04-5BDA-478D-A010-68CCCBE4D15A}
%WINDIR%\Installer\1d1b2.msi
%TEMP%\mia.tmp
%TEMP%\lang.loc
%WINDIR%\Installer\MSI2.tmp
%WINDIR%\Installer\MSI4.tmp
%WINDIR%\Installer\MSI3.tmp

Перемещает следующие файлы:

%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3dbsmgr.exe в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3dbsmgr.exe
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3ddf103.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3ddf103.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3dbnv7.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3dbnv7.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3dbav78.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3dbav78.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3dbav80.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3dbav80.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3lgo103.exe в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3lgo103.exe
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3mgrmsg.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3mgrmsg.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\W3ICR104.DLL в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\W3ICR104.DLL
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3enc107.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3enc107.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3exp010.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3exp010.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3btrv7.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3btrv7.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3cache.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3cache.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3aif10C.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3aif10C.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\timgrrb.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\timgrrb.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w32btxlt.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w32btxlt.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3crs10F.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3crs10F.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3dbav75.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3dbav75.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3comsrv.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3comsrv.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3clnres.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3clnres.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3clnrsx.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3clnrsx.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3mgrres.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3mgrres.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3xlt101.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3xlt101.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\WBEXEC32.exe в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\WBEXEC32.exe
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\W3UPI234.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\W3UPI234.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3sqlmgr.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3sqlmgr.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3sqlv7.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3sqlv7.dll
%TEMP%\mia1.tmp\OFFLINE\FirewallIDEPlugIn.dll\FirewallEXEPlugIn.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\FirewallIDEPlugIn.dll\FirewallEXEPlugIn.dll
%TEMP%\mia1.tmp\OFFLINE\__servdev_SetupSources\Btrieve\8.6\DATA\service\WGE_SRV.exe в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\__servdev_SetupSources\Btrieve\8.6\DATA\service\WGE_SRV.exe
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\wdbuui32.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\wdbuui32.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\wbtrcall.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\wbtrcall.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\wbtrv32.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\wbtrv32.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3nsl244.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3nsl244.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\W3NSR122.DLL в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\W3NSR122.DLL
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\W3MKDE.DLL в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\W3MKDE.DLL
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3mgrrsx.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3mgrrsx.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3mif165.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3mif165.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3odbces.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3odbces.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3scmv7.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3scmv7.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3odbcei.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3odbcei.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3odbcci.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3odbcci.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\w3odbccs.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\w3odbccs.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\swcomp32.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\swcomp32.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\W3csm100.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\BD548851\62BAE64C\W3csm100.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\w3csp100.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\BD548851\62BAE64C\w3csp100.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\w3csi100.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\BD548851\62BAE64C\w3csi100.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\poledbsy.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\BD548851\62BAE64C\poledbsy.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\upiapirb.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\BD548851\62BAE64C\upiapirb.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\confmrb.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\confmrb.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\dto.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\dto.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\cnstring.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\cnstring.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\w3dcm100.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\BD548851\62BAE64C\w3dcm100.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\clilcadm.exe в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\clilcadm.exe
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\legacylm.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\BD548851\62BAE64C\legacylm.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\licmgrrb.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\BD548851\62BAE64C\licmgrrb.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\dto2.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\BD548851\62BAE64C\dto2.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\clientrb.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\BD548851\62BAE64C\clientrb.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\dbcsipxy.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\BD548851\62BAE64C\dbcsipxy.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\poledb.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\BD548851\62BAE64C\poledb.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\poledber.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\BD548851\62BAE64C\poledber.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\pctlgrb.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\BD548851\62BAE64C\pctlgrb.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\mkc.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\BD548851\62BAE64C\mkc.dll
%TEMP%\mia1.tmp\OFFLINE\BD548851\62BAE64C\mkderb.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\BD548851\62BAE64C\mkderb.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\enginelm.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\enginelm.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pvjdbc2.jar в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\pvjdbc2.jar
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pvjdbc2x.jar в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\pvjdbc2x.jar
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pvdsncon.exe в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\pvdsncon.exe
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\psutilrb.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\psutilrb.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pvdrmsrb.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\pvdrmsrb.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\RelTest.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\RelTest.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\rsiddf.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\rsiddf.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pvmsgrb.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\pvmsgrb.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pvkillwg.exe в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\pvkillwg.exe
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pvlocate.exe в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\pvlocate.exe
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\lisezmoi.rtf в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\lisezmoi.rtf
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\ntpsinst.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\ntpsinst.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\jsbdosws.exe в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\jsbdosws.exe
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\jpscs.jar в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\jpscs.jar
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\jsbdosws.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\jsbdosws.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\psregsvr.exe в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\psregsvr.exe
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pssax.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\pssax.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pscore.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\pscore.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pceurop.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\pceurop.dll
%TEMP%\mia1.tmp\OFFLINE\EBBE4C37\1147A1C7\pscl.dll в %ALLUSERSPROFILE%\Application Data\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\offline\EBBE4C37\1147A1C7\pscl.dll

Другое:

Ищет следующие окна:

ClassName: 'TApplication' WindowName: 'EBP_Btrieve8.6_SETUP'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней