Trojan.DownLoader8.21202

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.1\shell\Open\command] '' = '"%PROGRAM_FILES%\Xplus\Xplus.exe" %1'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Xplus' = '"%PROGRAM_FILES%\Xplus\XplusWait.exe" /min'
[<HKLM>\SOFTWARE\Classes\XplusFile\shell\open\command] '' = '"%PROGRAM_FILES%\Xplus\Xplus.exe"%1'

Вредоносные функции:

Создает и запускает на исполнение:

%CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe /REGSERVER
%PROGRAM_FILES%\Xplus\Xplus.exe
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe 32\IKernel.exe -Embedding
%TEMP%\pft3~tmp\Disk1\Setup.exe
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe -RegServer

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Xplus\Skin\main\over89c3.rra
%PROGRAM_FILES%\Xplus\Skin\main\wnd8a30.rra
%PROGRAM_FILES%\Xplus\Skin\main\NewMagz\mask8a5f.rra
%PROGRAM_FILES%\Xplus\Skin\main\over8955.rra
%PROGRAM_FILES%\Xplus\Skin\main\over8974.rra
%PROGRAM_FILES%\Xplus\Skin\main\sel_8994.rra
%PROGRAM_FILES%\Xplus\Skin\main\Broadcast\mask8a7e.rra
%PROGRAM_FILES%\Xplus\Skin\main\NewMagz\NewM8b59.rra
%PROGRAM_FILES%\Xplus\Skin\main\NewMagz\sel_8b88.rra
%PROGRAM_FILES%\Xplus\Skin\main\NewMagz\over8bb7.rra
%PROGRAM_FILES%\Xplus\Skin\main\Broadcast\NewM8a9d.rra
%PROGRAM_FILES%\Xplus\Skin\main\Broadcast\sel_8acc.rra
%PROGRAM_FILES%\Xplus\Skin\main\Broadcast\over8aeb.rra
%PROGRAM_FILES%\Xplus\Skin\main\sel_8926.rra
%PROGRAM_FILES%\Xplus\Resource\images\038742.rra
%PROGRAM_FILES%\Xplus\Resource\images\048761.rra
%PROGRAM_FILES%\Xplus\Resource\images\0587a0.rra
%PROGRAM_FILES%\Xplus\Resource\oldm86d5.rra
%PROGRAM_FILES%\Xplus\Resource\images\018703.rra
%PROGRAM_FILES%\Xplus\Resource\images\028723.rra
%PROGRAM_FILES%\Xplus\Resource\images\icon\a03087cf.rra
%PROGRAM_FILES%\Xplus\Skin\main\Broa88a9.rra
%PROGRAM_FILES%\Xplus\Skin\main\mask88c9.rra
%PROGRAM_FILES%\Xplus\Skin\main\myma88e8.rra
%PROGRAM_FILES%\Xplus\Skin\main882c.rra
%PROGRAM_FILES%\Xplus\Skin\main\body885b.rra
%PROGRAM_FILES%\Xplus\Skin\main\NewM888a.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\BEST8bf5.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\REST8e76.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\SEPA8ea5.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\Titl8ec4.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\MIN_8e18.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\REST8e37.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\REST8e56.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\Titl8ee3.rra
%ALLUSERSPROFILE%\Desktop\Xplus.lnk
%ALLUSERSPROFILE%\Desktop\My Magazine.lnk
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Reg[1].php
<SYSTEM32>\file8f12.rra
%ALLUSERSPROFILE%\Start Menu\Programs\Xplus\Жф¶Ї Xplus.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Xplus\Йѕіэ Xplus.lnk
%PROGRAM_FILES%\Xplus\Skin\Reader\MIN_8df9.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\CLOS8c82.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\CLOS8cb1.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\ERES8cd0.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\BEST8c14.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\BEST8c34.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\CLOS8c62.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\FULL8cff.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\MAX_8d8b.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\MAX_8dab.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\MIN_8dca.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\FULL8d1e.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\FULL8d3d.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\MAX_8d5c.rra
%PROGRAM_FILES%\Xplus\Resource\ТСПВ86b5.rra
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\iuse638d.rra
%CommonProgramFiles%\InstallShield\IScript\IScr6756.rra
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\setu734d.rra
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\core5ff3.rra
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\ctor6061.rra
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\obje6301.rra
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\lice7408.rra
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\_IsR760c.rra
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\layo7e39.rra
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\data7e49.rra
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\valu7495.rra
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\isrt7512.rra
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\defa758f.rra
%TEMP%\pft3~tmp\Disk1\data1.cab
%TEMP%\pft3~tmp\Disk1\data1.hdr
%TEMP%\pft3~tmp\Disk1\data2.cab
%TEMP%\ext2.tmp
%TEMP%\plf1.tmp
%TEMP%\pft3~tmp\pftw1.pkg
%TEMP%\pft3~tmp\Disk1\ikernel.ex_
%TEMP%\pft3~tmp\Disk1\Setup.ini
%TEMP%\pft3~tmp\Disk1\setup.inx
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\temp.000
%TEMP%\pft3~tmp\Disk1\layout.bin
%TEMP%\pft3~tmp\Disk1\setup.bmp
%TEMP%\pft3~tmp\Disk1\Setup.exe
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\data7e68.rra
%PROGRAM_FILES%\Xplus\Resource\Move857d.rra
%PROGRAM_FILES%\Xplus\Resource\noco859c.rra
%PROGRAM_FILES%\Xplus\Resource\images\FsCommand\Redi85cb.rra
%PROGRAM_FILES%\Xplus\Resource\magi850f.rra
%PROGRAM_FILES%\Xplus\Resource\MagN852f.rra
%PROGRAM_FILES%\Xplus\Resource\main854e.rra
%PROGRAM_FILES%\Xplus\Resource\Redi85ea.rra
%PROGRAM_FILES%\Xplus\Resource\ТСПВ8667.rra
%PROGRAM_FILES%\Xplus\Resource\ОґФД8686.rra
%PROGRAM_FILES%\Xplus\Resource\ОґФД86a6.rra
%PROGRAM_FILES%\Xplus\Resource\main8609.rra
%PROGRAM_FILES%\Xplus\Resource\magi8629.rra
%PROGRAM_FILES%\Xplus\Resource\oldm8648.rra
%PROGRAM_FILES%\Xplus\Resource\Chan84f0.rra
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\Setup.ini
%PROGRAM_FILES%\Xplus\GetM802d.rra
%PROGRAM_FILES%\Xplus\Hook805c.rra
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\Setu7ed6.rra
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\Setu7f14.rra
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\setu7f33.rra
%PROGRAM_FILES%\Xplus\kme807c.rra
%PROGRAM_FILES%\Xplus\Xplu8185.rra
%PROGRAM_FILES%\Xplus\Xplu81b4.rra
%PROGRAM_FILES%\Xplus\Resource\images\FsCommand\Chan84d1.rra
%PROGRAM_FILES%\Xplus\Read80ba.rra
%PROGRAM_FILES%\Xplus\Stri8127.rra
%PROGRAM_FILES%\Xplus\Xplu8156.rra

Удаляет следующие файлы:

%TEMP%\pft3~tmp\Disk1\data2.cab
%TEMP%\pft3~tmp\Disk1\ikernel.ex_
%TEMP%\pft3~tmp\Disk1\data1.cab
%TEMP%\pft3~tmp\Disk1\data1.hdr
%TEMP%\pft3~tmp\Disk1\layout.bin
%TEMP%\pft3~tmp\Disk1\Setup.ini
%TEMP%\pft3~tmp\Disk1\setup.inx
%TEMP%\pft3~tmp\Disk1\setup.bmp
%TEMP%\pft3~tmp\Disk1\Setup.exe
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\_IsRes.dll
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\default.pal
%TEMP%\ext2.tmp
%TEMP%\pft3~tmp\pftw1.pkg
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\isrt.dll
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\setup.inx
%TEMP%\plf1.tmp
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\value.shl
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\license.txt

Перемещает следующие файлы:

%PROGRAM_FILES%\Xplus\Skin\main\Broadcast\NewM8a9d.rra в %PROGRAM_FILES%\Xplus\Skin\main\Broadcast\NewMagz.gif
%PROGRAM_FILES%\Xplus\Skin\main\Broadcast\sel_8acc.rra в %PROGRAM_FILES%\Xplus\Skin\main\Broadcast\sel_8abd.rra
%PROGRAM_FILES%\Xplus\Skin\main\Broadcast\mask8a7e.rra в %PROGRAM_FILES%\Xplus\Skin\main\Broadcast\mask.gif
%PROGRAM_FILES%\Xplus\Skin\main\sel_8994.rra в %PROGRAM_FILES%\Xplus\Skin\main\sel_mymag.gif
%PROGRAM_FILES%\Xplus\Skin\main\wnd8a30.rra в %PROGRAM_FILES%\Xplus\Skin\main\wnd.ini
%PROGRAM_FILES%\Xplus\Skin\main\Broadcast\over8aeb.rra в %PROGRAM_FILES%\Xplus\Skin\main\Broadcast\over_NewMagz.gif
%PROGRAM_FILES%\Xplus\Skin\main\NewMagz\over8bb7.rra в %PROGRAM_FILES%\Xplus\Skin\main\NewMagz\over_NewMagz.gif
%PROGRAM_FILES%\Xplus\Skin\main\NewMagz\sel_8b88.rra в %PROGRAM_FILES%\Xplus\Skin\main\NewMagz\sel_NewMagz.gif
%PROGRAM_FILES%\Xplus\Skin\main\NewMagz\NewM8b59.rra в %PROGRAM_FILES%\Xplus\Skin\main\NewMagz\NewMagz.gif
%PROGRAM_FILES%\Xplus\Skin\main\Broadcast\sel_8abd.rra в %PROGRAM_FILES%\Xplus\Skin\main\Broadcast\sel_NewMagz.gif
%PROGRAM_FILES%\Xplus\Skin\main\NewMagz\mask8a5f.rra в %PROGRAM_FILES%\Xplus\Skin\main\NewMagz\mask.gif
%PROGRAM_FILES%\Xplus\Skin\main\sel_8926.rra в %PROGRAM_FILES%\Xplus\Skin\main\sel_body.gif
%PROGRAM_FILES%\Xplus\Skin\main\body885b.rra в %PROGRAM_FILES%\Xplus\Skin\main\body.gif
%PROGRAM_FILES%\Xplus\Skin\main\Broa88a9.rra в %PROGRAM_FILES%\Xplus\Skin\main\Broadcast.ini
%PROGRAM_FILES%\Xplus\Skin\main882c.rra в %PROGRAM_FILES%\Xplus\Skin\main.ini
%PROGRAM_FILES%\Xplus\Resource\images\FsCommand\Chan84d1.rra в %PROGRAM_FILES%\Xplus\Resource\images\FsCommand\ChangeRes.exe
%PROGRAM_FILES%\Xplus\Resource\images\FsCommand\Redi85cb.rra в %PROGRAM_FILES%\Xplus\Resource\images\FsCommand\Redir.exe
%PROGRAM_FILES%\Xplus\Skin\main\mask88c9.rra в %PROGRAM_FILES%\Xplus\Skin\main\mask.gif
%PROGRAM_FILES%\Xplus\Skin\main\over8974.rra в %PROGRAM_FILES%\Xplus\Skin\main\over_mag.gif
%PROGRAM_FILES%\Xplus\Skin\main\over89c3.rra в %PROGRAM_FILES%\Xplus\Skin\main\over_mymag.gif
%PROGRAM_FILES%\Xplus\Skin\main\over8955.rra в %PROGRAM_FILES%\Xplus\Skin\main\over_body.gif
%PROGRAM_FILES%\Xplus\Skin\main\myma88e8.rra в %PROGRAM_FILES%\Xplus\Skin\main\mymag.gif
%PROGRAM_FILES%\Xplus\Skin\main\NewM888a.rra в %PROGRAM_FILES%\Xplus\Skin\main\NewMagz.ini
%PROGRAM_FILES%\Xplus\Skin\Reader\BEST8bf5.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\BEST_IN.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\REST8e37.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\RESTORE_IN.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\REST8e56.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\RESTORE_OUT.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\MIN_8e18.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\MIN_PRESS.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\MIN_8dca.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\MIN_IN.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\MIN_8df9.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\MIN_OUT.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\REST8e76.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\RESTORE_PRESS.bmp
<SYSTEM32>\file8f12.rra в <SYSTEM32>\file.html
%TEMP%\5a75.rra в %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\setup.ilg
%PROGRAM_FILES%\Xplus\Skin\Reader\Titl8ee3.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\TitleLeft.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\SEPA8ea5.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\SEPARATE.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\Titl8ec4.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\TitleBK.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\MAX_8dab.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\MAX_PRESS.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\CLOS8c82.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\CLOSE_OUT.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\CLOS8cb1.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\CLOSE_PRESS.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\CLOS8c62.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\CLOSE_IN.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\BEST8c14.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\BEST_OUT.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\BEST8c34.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\BEST_PRESS.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\ERES8cd0.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\ERESTORE_PRESS.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\MAX_8d5c.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\MAX_IN.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\MAX_8d8b.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\MAX_OUT.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\FULL8d3d.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\FULLSCREEN_PRESS.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\FULL8cff.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\FULLSCREEN_IN.bmp
%PROGRAM_FILES%\Xplus\Skin\Reader\FULL8d1e.rra в %PROGRAM_FILES%\Xplus\Skin\Reader\FULLSCREEN_OUT.bmp
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\Setu7ed6.rra в %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\Setup.exe
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\Setu7f14.rra в %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\Setup.ini
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\data7e68.rra в %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\data1.cab
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\layo7e39.rra в %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\layout.bin
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\data7e49.rra в %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\data1.hdr
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\setu7f33.rra в %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\setup.inx
%PROGRAM_FILES%\Xplus\Read80ba.rra в %PROGRAM_FILES%\Xplus\Reader.exe
%PROGRAM_FILES%\Xplus\Stri8127.rra в %PROGRAM_FILES%\Xplus\String.dll
%PROGRAM_FILES%\Xplus\kme807c.rra в %PROGRAM_FILES%\Xplus\kme.exe
%PROGRAM_FILES%\Xplus\GetM802d.rra в %PROGRAM_FILES%\Xplus\GetMD5.dll
%PROGRAM_FILES%\Xplus\Hook805c.rra в %PROGRAM_FILES%\Xplus\HookDll.dll
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\_IsR760c.rra в %TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\_IsRes.dll
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\obje6301.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\objectps.dll
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\iuse638d.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\iuser.dll
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\ctor6061.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\ctor.dll
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\temp.000 в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\core5ff3.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\corecomp.ini
%CommonProgramFiles%\InstallShield\IScript\IScr6756.rra в %CommonProgramFiles%\InstallShield\IScript\IScript.dll
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\isrt7512.rra в %TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\isrt.dll
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\defa758f.rra в %TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\default.pal
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\valu7495.rra в %TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\value.shl
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\setu734d.rra в %TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\setup.inx
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\lice7408.rra в %TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\license.txt
%PROGRAM_FILES%\Xplus\Xplu8156.rra в %PROGRAM_FILES%\Xplus\Xplus_Firewall.exe
%PROGRAM_FILES%\Xplus\Resource\ТСПВ86b5.rra в %PROGRAM_FILES%\Xplus\Resource\ТСПВФШФУЦѕ.gif
%PROGRAM_FILES%\Xplus\Resource\oldm86d5.rra в %PROGRAM_FILES%\Xplus\Resource\oldmaginfo.html
%PROGRAM_FILES%\Xplus\Resource\ОґФД86a6.rra в %PROGRAM_FILES%\Xplus\Resource\ОґФД¶БФУЦѕ.gif
%PROGRAM_FILES%\Xplus\Resource\ТСПВ8667.rra в %PROGRAM_FILES%\Xplus\Resource\ТСПВФШФУЦѕ.html
%PROGRAM_FILES%\Xplus\Resource\ОґФД8686.rra в %PROGRAM_FILES%\Xplus\Resource\ОґФД¶БФУЦѕ.html
%PROGRAM_FILES%\Xplus\Resource\images\018703.rra в %PROGRAM_FILES%\Xplus\Resource\images\01.gif
%PROGRAM_FILES%\Xplus\Resource\images\0587a0.rra в %PROGRAM_FILES%\Xplus\Resource\images\05.gif
%PROGRAM_FILES%\Xplus\Resource\images\icon\a03087cf.rra в %PROGRAM_FILES%\Xplus\Resource\images\icon\a0300.gif
%PROGRAM_FILES%\Xplus\Resource\images\048761.rra в %PROGRAM_FILES%\Xplus\Resource\images\04.gif
%PROGRAM_FILES%\Xplus\Resource\images\028723.rra в %PROGRAM_FILES%\Xplus\Resource\images\02.gif
%PROGRAM_FILES%\Xplus\Resource\images\038742.rra в %PROGRAM_FILES%\Xplus\Resource\images\03.gif
%PROGRAM_FILES%\Xplus\Resource\oldm8648.rra в %PROGRAM_FILES%\Xplus\Resource\oldmaginfo.gif
%PROGRAM_FILES%\Xplus\Resource\magi850f.rra в %PROGRAM_FILES%\Xplus\Resource\maginfo.gif
%PROGRAM_FILES%\Xplus\Resource\MagN852f.rra в %PROGRAM_FILES%\Xplus\Resource\MagNoConnect.htm
%PROGRAM_FILES%\Xplus\Resource\Chan84f0.rra в %PROGRAM_FILES%\Xplus\Resource\ChangeRes.exe
%PROGRAM_FILES%\Xplus\Xplu8185.rra в %PROGRAM_FILES%\Xplus\XplusWait.exe
%PROGRAM_FILES%\Xplus\Xplu81b4.rra в %PROGRAM_FILES%\Xplus\Xplus.exe
%PROGRAM_FILES%\Xplus\Resource\main854e.rra в %PROGRAM_FILES%\Xplus\Resource\main.gif
%PROGRAM_FILES%\Xplus\Resource\main8609.rra в %PROGRAM_FILES%\Xplus\Resource\main.html
%PROGRAM_FILES%\Xplus\Resource\magi8629.rra в %PROGRAM_FILES%\Xplus\Resource\maginfo.html
%PROGRAM_FILES%\Xplus\Resource\Redi85ea.rra в %PROGRAM_FILES%\Xplus\Resource\Redir.exe
%PROGRAM_FILES%\Xplus\Resource\Move857d.rra в %PROGRAM_FILES%\Xplus\Resource\MoveMagz.exe
%PROGRAM_FILES%\Xplus\Resource\noco859c.rra в %PROGRAM_FILES%\Xplus\Resource\noconnect.gif

Сетевая активность:

Подключается к:

'localhost':1043
'xp######j-01.xplus.com.cn':80
'xp#####bj2.xplus.com.cn':80
'localhost':2002
'xp#######st-bj2.xplus.com.cn':9975

TCP:

Запросы HTTP GET:

xp######j-01.xplus.com.cn/Reg/Reg.php?re#############################################
xp#####bj2.xplus.com.cn/

UDP:

DNS ASK xp#####bj2.xplus.com.cn
DNS ASK xp######j-01.xplus.com.cn
DNS ASK xp#######st-bj2.xplus.com.cn
DNS ASK xp######bj2.xplus.com.cn
'xp######bj2.xplus.com.cn':9976

Другое:

Ищет следующие окна:

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней