Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svcav_module' = '%APPDATA%\rewlwmy.exe'
Изменяет следующие исполняемые системные файлы:
- %WINDIR%\Microsoft.NET\Framework\sbs_microsoft.jscript.dll
Заражает следующие исполняемые файлы:
- %WINDIR%\Microsoft.NET\Framework\sbs_microsoft.jscript.dll
Вредоносные функции:
Создает и запускает на исполнение:
- '%APPDATA%\rewlwmy.exe'
Запускает на исполнение:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\vssadmin.exe' delete shadows /all
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\cmd.exe
следующие пользовательские процессы:
- ecmd.exe
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\log.html
- %APPDATA%\key.dat
- %APPDATA%\rewlwmy.exe
Удаляет следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip[1]
Перемещает следующие системные файлы:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg в %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.ecc
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg в %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg.ecc
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminStyles.css в %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminStyles.css.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3install.txt в %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3install.txt.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3error.txt в %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3error.txt.ecc
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\EULA.rtf в %WINDIR%\Microsoft.NET\Framework\v1.1.4322\EULA.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\WebUIValidation.js в %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\WebUIValidation.js.ecc
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg в %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.ecc
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg в %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg.ecc
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg в %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1032.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1032.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1031.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1031.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1033.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1033.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1036.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1036.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1035.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1035.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1025.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1025.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\VSMsiLog22FD.txt в %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\VSMsiLog22FD.txt.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1028.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1028.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1030.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1030.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1029.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1029.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\SmartNav.js в %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\SmartNav.js.ecc
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Cnt\wmploc.js в %WINDIR%\Help\Tours\WindowsMediaPlayer\Cnt\wmploc.js.ecc
- %WINDIR%\Help\Tours\mmTour\segment5.txt в %WINDIR%\Help\Tours\mmTour\segment5.txt.ecc
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Css\controls.css в %WINDIR%\Help\Tours\WindowsMediaPlayer\Css\controls.css.ecc
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\controls.js в %WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\controls.js.ecc
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Css\wmptour.css в %WINDIR%\Help\Tours\WindowsMediaPlayer\Css\wmptour.css.ecc
- %WINDIR%\Help\Tours\mmTour\segment1.txt в %WINDIR%\Help\Tours\mmTour\segment1.txt.ecc
- %WINDIR%\Help\Tours\mmTour\nav.txt в %WINDIR%\Help\Tours\mmTour\nav.txt.ecc
- %WINDIR%\Help\Tours\mmTour\segment2.txt в %WINDIR%\Help\Tours\mmTour\segment2.txt.ecc
- %WINDIR%\Help\Tours\mmTour\segment4.txt в %WINDIR%\Help\Tours\mmTour\segment4.txt.ecc
- %WINDIR%\Help\Tours\mmTour\segment3.txt в %WINDIR%\Help\Tours\mmTour\segment3.txt.ecc
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\viz.wmv в %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\viz.wmv.ecc
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\rtuner.wmv в %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\rtuner.wmv.ecc
- %WINDIR%\Microsoft.NET\Framework\sbs_microsoft.jscript.dll в %WINDIR%\Microsoft.NET\Framework\sbs_microsoft.jscript.dll.ecc
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU2.txt в %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU2.txt.ecc
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU1.txt в %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU1.txt.ecc
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\tour.js в %WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\tour.js.ecc
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\events.js в %WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\events.js.ecc
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\copycd.wmv в %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\copycd.wmv.ecc
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\nuskin.wmv в %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\nuskin.wmv.ecc
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\mdlib.wmv в %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\mdlib.wmv.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\eula.rtf в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\eula.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\eula.rtf в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\eula.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\eula.rtf в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\eula.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\eula.rtf в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\eula.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\eula.rtf в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\eula.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\WebAdminStyles.css в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\WebAdminStyles.css.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\eula.rtf в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\eula.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\eula.rtf в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\eula.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\eula.rtf в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\eula.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\eula.rtf в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\eula.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\eula.rtf в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\eula.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\eula.rtf в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\eula.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\eula.rtf в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\eula.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\eula.rtf в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\eula.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\eula.rtf в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\eula.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\eula.rtf в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\eula.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\eula.rtf в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\eula.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\eula.rtf в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\eula.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1044.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1044.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1043.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1043.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1045.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1045.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1049.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1049.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1046.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1046.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1038.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1038.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1037.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1037.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1040.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1040.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1042.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1042.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1041.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1041.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\dd_dotnetfx35install.txt в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\dd_dotnetfx35install.txt.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\dd_dotnetfx35error.txt в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\dd_dotnetfx35error.txt.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\defaults\preferences\defaults.js в %WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\defaults\preferences\defaults.js.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.ecc
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1055.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1055.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1053.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1053.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2052.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2052.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.3082.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.3082.rtf.ecc
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2070.rtf в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2070.rtf.ecc
- %WINDIR%\Help\Tours\mmTour\intro.txt в %WINDIR%\Help\Tours\mmTour\intro.txt.ecc
- %WINDIR%\Help\Tours\htmlTour\end_up.jpg в %WINDIR%\Help\Tours\htmlTour\end_up.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\desktop_up.jpg в %WINDIR%\Help\Tours\htmlTour\desktop_up.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\folder_up.jpg в %WINDIR%\Help\Tours\htmlTour\folder_up.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\icon_up.jpg в %WINDIR%\Help\Tours\htmlTour\icon_up.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\gradient.jpg в %WINDIR%\Help\Tours\htmlTour\gradient.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg в %WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg в %WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg в %WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg в %WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\control_up.jpg в %WINDIR%\Help\Tours\htmlTour\control_up.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img046.jpg в %WINDIR%\Help\Tours\htmlTour\img046.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img040.jpg в %WINDIR%\Help\Tours\htmlTour\img040.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img060.jpg в %WINDIR%\Help\Tours\htmlTour\img060.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img072.jpg в %WINDIR%\Help\Tours\htmlTour\img072.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img068.jpg в %WINDIR%\Help\Tours\htmlTour\img068.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img014.jpg в %WINDIR%\Help\Tours\htmlTour\img014.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img004b.jpg в %WINDIR%\Help\Tours\htmlTour\img004b.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img033.jpg в %WINDIR%\Help\Tours\htmlTour\img033.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img034.jpg в %WINDIR%\Help\Tours\htmlTour\img034.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img033a.jpg в %WINDIR%\Help\Tours\htmlTour\img033a.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg в %WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\best_robust.jpg в %WINDIR%\Help\Tours\htmlTour\best_robust.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg в %WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg в %WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\best_secure.jpg в %WINDIR%\Help\Tours\htmlTour\best_secure.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg в %WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg.ecc
- %WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt в %WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt.ecc
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt в %WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt.ecc
- %WINDIR%\clock.avi в %WINDIR%\clock.avi.ecc
- %WINDIR%\Help\Tours\htmlTour\best_road_big.jpg в %WINDIR%\Help\Tours\htmlTour\best_road_big.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\best_road.jpg в %WINDIR%\Help\Tours\htmlTour\best_road.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg в %WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg в %WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg в %WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg в %WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\connected_networks.jpg в %WINDIR%\Help\Tours\htmlTour\connected_networks.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg в %WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg в %WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\connected_data.jpg в %WINDIR%\Help\Tours\htmlTour\connected_data.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg в %WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg в %WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\start_up.jpg в %WINDIR%\Help\Tours\htmlTour\start_up.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\scripts.js в %WINDIR%\Help\Tours\htmlTour\scripts.js.ecc
- %WINDIR%\Help\Tours\htmlTour\style.css в %WINDIR%\Help\Tours\htmlTour\style.css.ecc
- %WINDIR%\Help\Tours\htmlTour\ul_logo.jpg в %WINDIR%\Help\Tours\htmlTour\ul_logo.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg в %WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg в %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg в %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg в %WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg в %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg в %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg в %WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg в %WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg в %WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\window_up.jpg в %WINDIR%\Help\Tours\htmlTour\window_up.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg в %WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg в %WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\unlock_built.jpg в %WINDIR%\Help\Tours\htmlTour\unlock_built.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg в %WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg в %WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg в %WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg в %WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img116.jpg в %WINDIR%\Help\Tours\htmlTour\img116.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img110.jpg в %WINDIR%\Help\Tours\htmlTour\img110.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img121.jpg в %WINDIR%\Help\Tours\htmlTour\img121.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img126.jpg в %WINDIR%\Help\Tours\htmlTour\img126.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img123.jpg в %WINDIR%\Help\Tours\htmlTour\img123.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img089.jpg в %WINDIR%\Help\Tours\htmlTour\img089.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img074a.jpg в %WINDIR%\Help\Tours\htmlTour\img074a.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img100.jpg в %WINDIR%\Help\Tours\htmlTour\img100.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img109.jpg в %WINDIR%\Help\Tours\htmlTour\img109.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img103.jpg в %WINDIR%\Help\Tours\htmlTour\img103.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\read_icon.jpg в %WINDIR%\Help\Tours\htmlTour\read_icon.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\question_icon.jpg в %WINDIR%\Help\Tours\htmlTour\question_icon.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg в %WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg в %WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg в %WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img149.jpg в %WINDIR%\Help\Tours\htmlTour\img149.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\img136.jpg в %WINDIR%\Help\Tours\htmlTour\img136.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\intro_logo.jpg в %WINDIR%\Help\Tours\htmlTour\intro_logo.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\pen_icon.jpg в %WINDIR%\Help\Tours\htmlTour\pen_icon.jpg.ecc
- %WINDIR%\Help\Tours\htmlTour\logo.jpg в %WINDIR%\Help\Tours\htmlTour\logo.jpg.ecc
Самоудаляется.
Сетевая активность:
Подключается к:
- '7t########vlep5o.s2.tor-gateways.de':443
- 'ip##fo.io':80
TCP:
Запросы HTTP GET:
- http://ip##fo.io/ip
UDP:
- DNS ASK 7t######47vlep5o.tor2web.fi
- DNS ASK 7t########vlep5o.s2.tor-gateways.de
- DNS ASK 7t#########lep5o.tor2web.blutmagie.de
- DNS ASK ip##fo.io
- DNS ASK 7t######47vlep5o.2kjb8.net
