Trojan.DownLoader40.5669

Technical Information

Malicious functions

Injects code into

the following user processes:

ffmpeg.exe

Modifies file system

Creates the following files

%APPDATA%\thinstall\formatfactory\registry.rw.tvr.lck.xegbjjrj.ffffffff.bc
%APPDATA%\thinstall\formatfactory\skel\uoirkknvgrllpsnoisstqvoikltnqkkvsnilgpim.tls-2212-872.tls
%APPDATA%\thinstall\formatfactory\skel\sqvtgtmpnrriishvilnuqlktmjtqrppuhmkpijjn.tls-2212-872.tls
%APPDATA%\thinstall\formatfactory\skel\rpkthvgnimqjupkgnigojuqvirhprgkntnimpgpv.tls-2212-872.tls
%APPDATA%\thinstall\formatfactory\skel\rlorqnpnstqokjgjjtpnpgjsgpprtskukrlrttkp.tls-2212-872.tls
%APPDATA%\thinstall\formatfactory\skel\nottrkkmnrsrihqrqppruivghuutsqhhlvipuptk.tls-2212-872.tls
%APPDATA%\thinstall\formatfactory\skel\nsojoukhjttpiumqjmooorknppsjvopvklvkrvqm.tls-2212-872.tls
%APPDATA%\thinstall\formatfactory\skel\gjvmosqttmikkpilohoguhlhqjnouvtuoinurgtj.tls-2212-872.tls
%APPDATA%\thinstall\formatfactory\skel\lntsruvqhvkmkqtsvuovrvivrpqkkovvgonmpttk.tls-2212-872.tls
%APPDATA%\thinstall\formatfactory\registry.tlog
%APPDATA%\thinstall\formatfactory\skel\uqvvqkqjkrlkkvgknuopppimrtvonqjsorimokql.tls-1308-1432.tls
%APPDATA%\thinstall\formatfactory\skel\squprgqliirmltltqktgtqqovilrhgtguqqhtvhi.tls-1308-1432.tls
%APPDATA%\thinstall\formatfactory\skel\tiskhjvvlvhsuhppisphrrhiqrlnmnqirgonsqlg.tls-1308-1432.tls
%APPDATA%\thinstall\formatfactory\skel\ugmvsurlkpppqrrmsvptviikisknmvpkpqqslkmo.tls-1308-1432.tls
%APPDATA%\thinstall\formatfactory\skel\rokqjvjhnktlrgumjuvtlotvnrpikvuvhsvggsll.tls-1308-1432.tls
%APPDATA%\thinstall\formatfactory\skel\hkqvrhiuhpjoqgivqhtmvhgvolilnqjvpggqkrlg.tls-1308-1432.tls
%APPDATA%\thinstall\formatfactory\skel\junihorkkpvhilpjkmgklvhttrvmqgvpvmihusrs.tls-1308-1432.tls
%APPDATA%\thinstall\formatfactory\skel\oqtmgottouogmhspnqsrktvssuotnnjjhsuhqtvm.tls-1308-1432.tls
%APPDATA%\thinstall\formatfactory\skel\ljsvvnkvhjqmotjgmsgnpgootnvuurvposohriko.tls-1308-1432.tls
%APPDATA%\thinstall\formatfactory\skel\vignommsiorimrnqhqkojgroskpgvjimtitvhjnv.tls-1308-1432.tls
%APPDATA%\thinstall\formatfactory\skel\lmrltmjquhporinkrluouisvmtohjjhuptomulmg.tls-896-2984.tls
%APPDATA%\thinstall\formatfactory\skel\njqorsvjunkhunqhqupptttrnvhmusunvgvvqvso.tls-896-2984.tls
%APPDATA%\thinstall\formatfactory\skel\hloiguikipijqqtmsnjlmkjmtnggumgliqgtqlsr.tls-896-2984.tls
%APPDATA%\thinstall\formatfactory\skel\qlgujkgqrolvttshhlhurgoutltuluihjrrjpnpj.tls-896-2984.tls
%APPDATA%\thinstall\formatfactory\skel\pmqvuqoimsilkqhhgupllisjohqqjkiritujunks.tls-2436-1840.tls
%APPDATA%\thinstall\formatfactory\skel\goqomtpriuthouhglvkpumnvotqnmkhmptjqrgog.tls-2436-1840.tls
%APPDATA%\thinstall\formatfactory\skel\lttorropvolghrktiougqjhrjkgvopunnmpgruhp.tls-2436-1840.tls
%APPDATA%\thinstall\formatfactory\skel\kthuivhlsggpotrhvhhiupshtgsinpkqhoqvsqmu.tls-2436-1840.tls
%APPDATA%\thinstall\formatfactory\skel\psqisjlgrotipvjsvhtghvrthmrpinnpgsotrjnj.tls-2436-1840.tls
%APPDATA%\thinstall\formatfactory\skel\ujmsnpjvjrvjlmollrslqiorskvpphpuukhtkiui.tls-2436-1840.tls
%APPDATA%\thinstall\formatfactory\skel\kustqmvpjgiriliiptqvuqkvguhklvsvrikljqti.tls-2436-1840.tls
%APPDATA%\thinstall\formatfactory\skel\mvupthhpinrtshohrvohjvomivsujtnoutisgskj.tls-2964-2204.tls
%APPDATA%\thinstall\formatfactory\skel\inpsvjomgjnrnkugqlvkilhnijjthjougnstjjpg.tls-2964-2204.tls
%APPDATA%\thinstall\formatfactory\skel\lsqmjtqrjourrgsnrnnqgnqgkhvtggrikokllqoo.tls-2848-2364.tls
%APPDATA%\thinstall\formatfactory\skel\sqirsomnlumnnrkphohhnnqmgvntnliknltslqmm.tls-2964-2204.tls
%APPDATA%\thinstall\formatfactory\skel\qgvpimqmsumgqishvlkkvkjgoopvosotlokivipr.tls-2848-2364.tls
%APPDATA%\thinstall\formatfactory\skel\tonuqkhgrsttpvhqokivslqkjgvmpijuklvprhts.tls-2848-2364.tls
%APPDATA%\thinstall\formatfactory\skel\utunivmjvtpmqmsihtghusokkpstsqohpqlitlkq.tls-2816-2944.tls
%APPDATA%\thinstall\formatfactory\skel\jkrvplpnlnnpssoikrhlmnliumpptmgmljkintst.tls-2816-2944.tls
%APPDATA%\thinstall\formatfactory\skel\jjnmpgpjqkrtojsorinnjmjjqgrhpjmlhllomjrg.tls-2816-2944.tls
%APPDATA%\thinstall\formatfactory\skel\pntkolrgmsnlpstvtqpoukpomjtjtmpojglsvqgl.tls-2816-2944.tls
%APPDATA%\thinstall\formatfactory\skel\jhsnqnkgsvthlgrhhmqsgrkirvqjiqpjrguulsmk.tls-2816-2944.tls
%APPDATA%\thinstall\formatfactory\skel\tnnrmsklqomtosvlslvmlvltlokpsiugmklqjttg.tls-2816-2944.tls
%APPDATA%\thinstall\formatfactory\skel\pkonvqvhlsmlnnhjoiqgkginoqggvtuomiqrsinn.tls-896-2984.tls
%TEMP%\bcgccb1.tmp
%APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe.714.588
%APPDATA%\thinstall\formatfactory\skel\nsqmjunrtqumhiighkhivssrmvusnnoslohgqvsh.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\da8356f8301679472ab62d29cfd3df7d17305f09.sharedta.210.588
%APPDATA%\thinstall\formatfactory\skel\rsshhrpsjvguumqjujrimuggmnuotjsqlqolhmio.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\ulvnqtgsltismtormtgqtvputuuptjniutuplgni.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\mtunihmpurpkpnnmttkhrsjjioqmghjlouhvvtkp.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\ormgjvuqgjtmkoqupoiispsjntnrglnqvutmivtk.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\sthurloirslvmhqujsotunulusnupmmmmuqprlqi.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\hlgitpksvrvvgtvgrtmkiikgjqontnumohkhhsjj.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\milriqmhugirltvrimisjstugiltvgspmrgmiigr.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\jgjnjqkoihmpjhgkmggrvthtrimntrsvupmrtttm.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\uklhqilggtjtvlgmjgslvmqrrvothjnsiqhqqvsn.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\ivqinkkkqqlvpupkosgiqsiirojinkgnpmlqrvtj.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\nrohroklrshpvvitkjlurkonnopiilmvlntnmimj.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\tvtslgolpnvrqvrvptnkvuitugrpnqrlnmhlvphu.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\rsnluglnsujhqnrnugrvvrvpuomipltrmtvnusvm.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\ligmlutkqlhkjvnnvvnnmvqgkhsvikihrsllmvsv.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\qonkosgvgpiqsvkqqnmkmiirjrknhkjlrnglopip.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\trlhlhomosmrnnvoppvrsknqhrmniorjqnvtihvh.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\registry.tlog.cache
%APPDATA%\thinstall\formatfactory\registry.rw.tvr.transact
%APPDATA%\thinstall\formatfactory\registry.rw.tvr
%APPDATA%\thinstall\formatfactory\skel\pmqsvqrnvmqrgnolskttrmlnquvhrmgiuvnrvsht.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\nmvvploqhpkprhoqmqhuqprpsursogqrupvtpqqs.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\qoglvpmltkiqgqrvijnnkmgjpmlqrioirpmgssqu.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\kgjuuqshlkjvjgmjmokkmjiqiguovuuiilumkshk.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\bede30dec53a88872f9160e5805b1eff55ffe80e.sharedta.210.588
%APPDATA%\thinstall\formatfactory\skel\ironjgnqkjmqrmskrilqvjppnjlmhtsprglusorj.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\41c59b1a3b2c8149034101bb61fbfb8e266d4da8.sharedta.210.588
%APPDATA%\thinstall\formatfactory\skel\qvipllqjnmotnhohrpruithhtmvrgirhmqkmlijn.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\7ccce17dc76246ba36f2d723405028c4d412b4a2.sharedta.210.588
%APPDATA%\thinstall\formatfactory\skel\ggqlqrlnvjijimsvqvjrhkjvmjiojuoqighipjjr.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\ead12adde5ca76fe9d1168a768abaef22b8a2762.sharedta.210.588
%APPDATA%\thinstall\formatfactory\skel\mothphntujimnvruglunsqjipkkspgijlgppnlsg.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\c079fa7c5c18301f85f9b54e7f1a6e47c010ce2e.sharedta.210.588
%APPDATA%\thinstall\formatfactory\skel\794c2c7495237771b053cb0ab6eb73bd6d68f080.sharedta.210.588
%APPDATA%\thinstall\formatfactory\skel\vlurrgkmtlkrrhnnrqttknjrspiikklpsousoqio.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\rglsjqnrminqrkumrpmithioojmujpinsogmhngh.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\iotoigumtlihrrmqtquqkurqjlumhmrjsqkonpvi.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\ptphqhihortnjjkjsmprjnjhopstgmlnnnkopjiu.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\soiotgilmtpimprppgtvrgpojnmknoojrskquskm.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\tkpnnvuqmsogkjkvvjvlsinsoovjmqqskphjtgut.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\jliqnllvirhnhliumgilvgnvtvqntrvnpmuprvnn.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\vquhqsgptlmqigqqtkltlkrphkqtsnskpigrtugo.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\tpnvhlsguvjronlgssprsoimhjrnmspptirmquts.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\gvsgupvnjqvgnojjkvrsivjiggrukushmtrrjhug.tls-1416-528.tls
%APPDATA%\thinstall\formatfactory\skel\qpkmupvlhirmrntsmhqkmmmslimiktkqkuulsqmq.tls-1416-528.tls
%TEMP%\bcgccc1.tmp

Moves the following files

from %APPDATA%\thinstall\formatfactory\registry.rw.tvr.lck.xegbjjrj.ffffffff.bc to %APPDATA%\thinstall\formatfactory\registry.rw.tvr.lck
from %APPDATA%\thinstall\formatfactory\skel\uoirkknvgrllpsnoisstqvoikltnqkkvsnilgpim.tls-2212-872.tls to %APPDATA%\thinstall\formatfactory\skel\uoirkknvgrllpsnoisstqvoikltnqkkvsnilgpim.tls
from %APPDATA%\thinstall\formatfactory\skel\sqvtgtmpnrriishvilnuqlktmjtqrppuhmkpijjn.tls-2212-872.tls to %APPDATA%\thinstall\formatfactory\skel\sqvtgtmpnrriishvilnuqlktmjtqrppuhmkpijjn.tls
from %APPDATA%\thinstall\formatfactory\skel\rpkthvgnimqjupkgnigojuqvirhprgkntnimpgpv.tls-2212-872.tls to %APPDATA%\thinstall\formatfactory\skel\rpkthvgnimqjupkgnigojuqvirhprgkntnimpgpv.tls
from %APPDATA%\thinstall\formatfactory\skel\rlorqnpnstqokjgjjtpnpgjsgpprtskukrlrttkp.tls-2212-872.tls to %APPDATA%\thinstall\formatfactory\skel\rlorqnpnstqokjgjjtpnpgjsgpprtskukrlrttkp.tls
from %APPDATA%\thinstall\formatfactory\skel\nottrkkmnrsrihqrqppruivghuutsqhhlvipuptk.tls-2212-872.tls to %APPDATA%\thinstall\formatfactory\skel\nottrkkmnrsrihqrqppruivghuutsqhhlvipuptk.tls
from %APPDATA%\thinstall\formatfactory\skel\nsojoukhjttpiumqjmooorknppsjvopvklvkrvqm.tls-2212-872.tls to %APPDATA%\thinstall\formatfactory\skel\nsojoukhjttpiumqjmooorknppsjvopvklvkrvqm.tls
from %APPDATA%\thinstall\formatfactory\skel\gjvmosqttmikkpilohoguhlhqjnouvtuoinurgtj.tls-2212-872.tls to %APPDATA%\thinstall\formatfactory\skel\gjvmosqttmikkpilohoguhlhqjnouvtuoinurgtj.tls
from %APPDATA%\thinstall\formatfactory\skel\lntsruvqhvkmkqtsvuovrvivrpqkkovvgonmpttk.tls-2212-872.tls to %APPDATA%\thinstall\formatfactory\skel\lntsruvqhvkmkqtsvuovrvivrpqkkovvgonmpttk.tls
from %APPDATA%\thinstall\formatfactory\skel\lmrltmjquhporinkrluouisvmtohjjhuptomulmg.tls-896-2984.tls to %APPDATA%\thinstall\formatfactory\skel\lmrltmjquhporinkrluouisvmtohjjhuptomulmg.tls
from %APPDATA%\thinstall\formatfactory\skel\uqvvqkqjkrlkkvgknuopppimrtvonqjsorimokql.tls-1308-1432.tls to %APPDATA%\thinstall\formatfactory\skel\uqvvqkqjkrlkkvgknuopppimrtvonqjsorimokql.tls
from %APPDATA%\thinstall\formatfactory\skel\tiskhjvvlvhsuhppisphrrhiqrlnmnqirgonsqlg.tls-1308-1432.tls to %APPDATA%\thinstall\formatfactory\skel\tiskhjvvlvhsuhppisphrrhiqrlnmnqirgonsqlg.tls
from %APPDATA%\thinstall\formatfactory\skel\ugmvsurlkpppqrrmsvptviikisknmvpkpqqslkmo.tls-1308-1432.tls to %APPDATA%\thinstall\formatfactory\skel\ugmvsurlkpppqrrmsvptviikisknmvpkpqqslkmo.tls
from %APPDATA%\thinstall\formatfactory\skel\rokqjvjhnktlrgumjuvtlotvnrpikvuvhsvggsll.tls-1308-1432.tls to %APPDATA%\thinstall\formatfactory\skel\rokqjvjhnktlrgumjuvtlotvnrpikvuvhsvggsll.tls
from %APPDATA%\thinstall\formatfactory\skel\hkqvrhiuhpjoqgivqhtmvhgvolilnqjvpggqkrlg.tls-1308-1432.tls to %APPDATA%\thinstall\formatfactory\skel\hkqvrhiuhpjoqgivqhtmvhgvolilnqjvpggqkrlg.tls
from %APPDATA%\thinstall\formatfactory\skel\junihorkkpvhilpjkmgklvhttrvmqgvpvmihusrs.tls-1308-1432.tls to %APPDATA%\thinstall\formatfactory\skel\junihorkkpvhilpjkmgklvhttrvmqgvpvmihusrs.tls
from %APPDATA%\thinstall\formatfactory\skel\oqtmgottouogmhspnqsrktvssuotnnjjhsuhqtvm.tls-1308-1432.tls to %APPDATA%\thinstall\formatfactory\skel\oqtmgottouogmhspnqsrktvssuotnnjjhsuhqtvm.tls
from %APPDATA%\thinstall\formatfactory\skel\ljsvvnkvhjqmotjgmsgnpgootnvuurvposohriko.tls-1308-1432.tls to %APPDATA%\thinstall\formatfactory\skel\ljsvvnkvhjqmotjgmsgnpgootnvuurvposohriko.tls
from %APPDATA%\thinstall\formatfactory\skel\vignommsiorimrnqhqkojgroskpgvjimtitvhjnv.tls-1308-1432.tls to %APPDATA%\thinstall\formatfactory\skel\vignommsiorimrnqhqkojgroskpgvjimtitvhjnv.tls
from %APPDATA%\thinstall\formatfactory\skel\squprgqliirmltltqktgtqqovilrhgtguqqhtvhi.tls-1308-1432.tls to %APPDATA%\thinstall\formatfactory\skel\squprgqliirmltltqktgtqqovilrhgtguqqhtvhi.tls
from %APPDATA%\thinstall\formatfactory\skel\qgvpimqmsumgqishvlkkvkjgoopvosotlokivipr.tls-2848-2364.tls to %APPDATA%\thinstall\formatfactory\skel\qgvpimqmsumgqishvlkkvkjgoopvosotlokivipr.tls
from %APPDATA%\thinstall\formatfactory\skel\goqomtpriuthouhglvkpumnvotqnmkhmptjqrgog.tls-2436-1840.tls to %APPDATA%\thinstall\formatfactory\skel\goqomtpriuthouhglvkpumnvotqnmkhmptjqrgog.tls
from %APPDATA%\thinstall\formatfactory\skel\qlgujkgqrolvttshhlhurgoutltuluihjrrjpnpj.tls-896-2984.tls to %APPDATA%\thinstall\formatfactory\skel\qlgujkgqrolvttshhlhurgoutltuluihjrrjpnpj.tls
from %APPDATA%\thinstall\formatfactory\skel\lttorropvolghrktiougqjhrjkgvopunnmpgruhp.tls-2436-1840.tls to %APPDATA%\thinstall\formatfactory\skel\lttorropvolghrktiougqjhrjkgvopunnmpgruhp.tls
from %APPDATA%\thinstall\formatfactory\skel\kthuivhlsggpotrhvhhiupshtgsinpkqhoqvsqmu.tls-2436-1840.tls to %APPDATA%\thinstall\formatfactory\skel\kthuivhlsggpotrhvhhiupshtgsinpkqhoqvsqmu.tls
from %APPDATA%\thinstall\formatfactory\skel\psqisjlgrotipvjsvhtghvrthmrpinnpgsotrjnj.tls-2436-1840.tls to %APPDATA%\thinstall\formatfactory\skel\psqisjlgrotipvjsvhtghvrthmrpinnpgsotrjnj.tls
from %APPDATA%\thinstall\formatfactory\skel\ujmsnpjvjrvjlmollrslqiorskvpphpuukhtkiui.tls-2436-1840.tls to %APPDATA%\thinstall\formatfactory\skel\ujmsnpjvjrvjlmollrslqiorskvpphpuukhtkiui.tls
from %APPDATA%\thinstall\formatfactory\skel\kustqmvpjgiriliiptqvuqkvguhklvsvrikljqti.tls-2436-1840.tls to %APPDATA%\thinstall\formatfactory\skel\kustqmvpjgiriliiptqvuqkvguhklvsvrikljqti.tls
from %APPDATA%\thinstall\formatfactory\skel\mvupthhpinrtshohrvohjvomivsujtnoutisgskj.tls-2964-2204.tls to %APPDATA%\thinstall\formatfactory\skel\mvupthhpinrtshohrvohjvomivsujtnoutisgskj.tls
from %APPDATA%\thinstall\formatfactory\skel\inpsvjomgjnrnkugqlvkilhnijjthjougnstjjpg.tls-2964-2204.tls to %APPDATA%\thinstall\formatfactory\skel\inpsvjomgjnrnkugqlvkilhnijjthjougnstjjpg.tls
from %APPDATA%\thinstall\formatfactory\skel\sqirsomnlumnnrkphohhnnqmgvntnliknltslqmm.tls-2964-2204.tls to %APPDATA%\thinstall\formatfactory\skel\sqirsomnlumnnrkphohhnnqmgvntnliknltslqmm.tls
from %APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe.714.588 to %APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe
from %APPDATA%\thinstall\formatfactory\skel\lsqmjtqrjourrgsnrnnqgnqgkhvtggrikokllqoo.tls-2848-2364.tls to %APPDATA%\thinstall\formatfactory\skel\lsqmjtqrjourrgsnrnnqgnqgkhvtggrikokllqoo.tls
from %APPDATA%\thinstall\formatfactory\skel\tonuqkhgrsttpvhqokivslqkjgvmpijuklvprhts.tls-2848-2364.tls to %APPDATA%\thinstall\formatfactory\skel\tonuqkhgrsttpvhqokivslqkjgvmpijuklvprhts.tls
from %APPDATA%\thinstall\formatfactory\skel\utunivmjvtpmqmsihtghusokkpstsqohpqlitlkq.tls-2816-2944.tls to %APPDATA%\thinstall\formatfactory\skel\utunivmjvtpmqmsihtghusokkpstsqohpqlitlkq.tls
from %APPDATA%\thinstall\formatfactory\skel\jkrvplpnlnnpssoikrhlmnliumpptmgmljkintst.tls-2816-2944.tls to %APPDATA%\thinstall\formatfactory\skel\jkrvplpnlnnpssoikrhlmnliumpptmgmljkintst.tls
from %APPDATA%\thinstall\formatfactory\skel\jjnmpgpjqkrtojsorinnjmjjqgrhpjmlhllomjrg.tls-2816-2944.tls to %APPDATA%\thinstall\formatfactory\skel\jjnmpgpjqkrtojsorinnjmjjqgrhpjmlhllomjrg.tls
from %APPDATA%\thinstall\formatfactory\skel\pntkolrgmsnlpstvtqpoukpomjtjtmpojglsvqgl.tls-2816-2944.tls to %APPDATA%\thinstall\formatfactory\skel\pntkolrgmsnlpstvtqpoukpomjtjtmpojglsvqgl.tls
from %APPDATA%\thinstall\formatfactory\skel\jhsnqnkgsvthlgrhhmqsgrkirvqjiqpjrguulsmk.tls-2816-2944.tls to %APPDATA%\thinstall\formatfactory\skel\jhsnqnkgsvthlgrhhmqsgrkirvqjiqpjrguulsmk.tls
from %APPDATA%\thinstall\formatfactory\skel\tnnrmsklqomtosvlslvmlvltlokpsiugmklqjttg.tls-2816-2944.tls to %APPDATA%\thinstall\formatfactory\skel\tnnrmsklqomtosvlslvmlvltlokpsiugmklqjttg.tls
from %APPDATA%\thinstall\formatfactory\skel\pkonvqvhlsmlnnhjoiqgkginoqggvtuomiqrsinn.tls-896-2984.tls to %APPDATA%\thinstall\formatfactory\skel\pkonvqvhlsmlnnhjoiqgkginoqggvtuomiqrsinn.tls
from %APPDATA%\thinstall\formatfactory\skel\njqorsvjunkhunqhqupptttrnvhmusunvgvvqvso.tls-896-2984.tls to %APPDATA%\thinstall\formatfactory\skel\njqorsvjunkhunqhqupptttrnvhmusunvgvvqvso.tls
from %APPDATA%\thinstall\formatfactory\skel\hloiguikipijqqtmsnjlmkjmtnggumgliqgtqlsr.tls-896-2984.tls to %APPDATA%\thinstall\formatfactory\skel\hloiguikipijqqtmsnjlmkjmtnggumgliqgtqlsr.tls
from %APPDATA%\thinstall\formatfactory\skel\nsqmjunrtqumhiighkhivssrmvusnnoslohgqvsh.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\nsqmjunrtqumhiighkhivssrmvusnnoslohgqvsh.tls
from %APPDATA%\thinstall\formatfactory\skel\gvsgupvnjqvgnojjkvrsivjiggrukushmtrrjhug.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\gvsgupvnjqvgnojjkvrsivjiggrukushmtrrjhug.tls
from %APPDATA%\thinstall\formatfactory\skel\nmvvploqhpkprhoqmqhuqprpsursogqrupvtpqqs.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\nmvvploqhpkprhoqmqhuqprpsursogqrupvtpqqs.tls
from %APPDATA%\thinstall\formatfactory\skel\pmqsvqrnvmqrgnolskttrmlnquvhrmgiuvnrvsht.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\pmqsvqrnvmqrgnolskttrmlnquvhrmgiuvnrvsht.tls
from %APPDATA%\thinstall\formatfactory\skel\rsshhrpsjvguumqjujrimuggmnuotjsqlqolhmio.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\rsshhrpsjvguumqjujrimuggmnuotjsqlqolhmio.tls
from %APPDATA%\thinstall\formatfactory\skel\ulvnqtgsltismtormtgqtvputuuptjniutuplgni.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\ulvnqtgsltismtormtgqtvputuuptjniutuplgni.tls
from %APPDATA%\thinstall\formatfactory\skel\mtunihmpurpkpnnmttkhrsjjioqmghjlouhvvtkp.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\mtunihmpurpkpnnmttkhrsjjioqmghjlouhvvtkp.tls
from %APPDATA%\thinstall\formatfactory\skel\ormgjvuqgjtmkoqupoiispsjntnrglnqvutmivtk.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\ormgjvuqgjtmkoqupoiispsjntnrglnqvutmivtk.tls
from %APPDATA%\thinstall\formatfactory\skel\sthurloirslvmhqujsotunulusnupmmmmuqprlqi.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\sthurloirslvmhqujsotunulusnupmmmmuqprlqi.tls
from %APPDATA%\thinstall\formatfactory\skel\hlgitpksvrvvgtvgrtmkiikgjqontnumohkhhsjj.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\hlgitpksvrvvgtvgrtmkiikgjqontnumohkhhsjj.tls
from %APPDATA%\thinstall\formatfactory\skel\qoglvpmltkiqgqrvijnnkmgjpmlqrioirpmgssqu.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\qoglvpmltkiqgqrvijnnkmgjpmlqrioirpmgssqu.tls
from %APPDATA%\thinstall\formatfactory\skel\milriqmhugirltvrimisjstugiltvgspmrgmiigr.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\milriqmhugirltvrimisjstugiltvgspmrgmiigr.tls
from %APPDATA%\thinstall\formatfactory\skel\uklhqilggtjtvlgmjgslvmqrrvothjnsiqhqqvsn.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\uklhqilggtjtvlgmjgslvmqrrvothjnsiqhqqvsn.tls
from %APPDATA%\thinstall\formatfactory\skel\ivqinkkkqqlvpupkosgiqsiirojinkgnpmlqrvtj.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\ivqinkkkqqlvpupkosgiqsiirojinkgnpmlqrvtj.tls
from %APPDATA%\thinstall\formatfactory\skel\nrohroklrshpvvitkjlurkonnopiilmvlntnmimj.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\nrohroklrshpvvitkjlurkonnopiilmvlntnmimj.tls
from %APPDATA%\thinstall\formatfactory\skel\tvtslgolpnvrqvrvptnkvuitugrpnqrlnmhlvphu.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\tvtslgolpnvrqvrvptnkvuitugrpnqrlnmhlvphu.tls
from %APPDATA%\thinstall\formatfactory\skel\rsnluglnsujhqnrnugrvvrvpuomipltrmtvnusvm.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\rsnluglnsujhqnrnugrvvrvpuomipltrmtvnusvm.tls
from %APPDATA%\thinstall\formatfactory\skel\ligmlutkqlhkjvnnvvnnmvqgkhsvikihrsllmvsv.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\ligmlutkqlhkjvnnvvnnmvqgkhsvikihrsllmvsv.tls
from %APPDATA%\thinstall\formatfactory\skel\qonkosgvgpiqsvkqqnmkmiirjrknhkjlrnglopip.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\qonkosgvgpiqsvkqqnmkmiirjrknhkjlrnglopip.tls
from %APPDATA%\thinstall\formatfactory\skel\trlhlhomosmrnnvoppvrsknqhrmniorjqnvtihvh.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\trlhlhomosmrnnvoppvrsknqhrmniorjqnvtihvh.tls
from %APPDATA%\thinstall\formatfactory\skel\jgjnjqkoihmpjhgkmggrvthtrimntrsvupmrtttm.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\jgjnjqkoihmpjhgkmggrvthtrimntrsvupmrtttm.tls
from %APPDATA%\thinstall\formatfactory\skel\vlurrgkmtlkrrhnnrqttknjrspiikklpsousoqio.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\vlurrgkmtlkrrhnnrqttknjrspiikklpsousoqio.tls
from %APPDATA%\thinstall\formatfactory\skel\qpkmupvlhirmrntsmhqkmmmslimiktkqkuulsqmq.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\qpkmupvlhirmrntsmhqkmmmslimiktkqkuulsqmq.tls
from %APPDATA%\thinstall\formatfactory\skel\tpnvhlsguvjronlgssprsoimhjrnmspptirmquts.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\tpnvhlsguvjronlgssprsoimhjrnmspptirmquts.tls
from %APPDATA%\thinstall\formatfactory\skel\bede30dec53a88872f9160e5805b1eff55ffe80e.sharedta.210.588 to %APPDATA%\thinstall\formatfactory\skel\bede30dec53a88872f9160e5805b1eff55ffe80e.sharedta
from %APPDATA%\thinstall\formatfactory\skel\ironjgnqkjmqrmskrilqvjppnjlmhtsprglusorj.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\ironjgnqkjmqrmskrilqvjppnjlmhtsprglusorj.tls
from %APPDATA%\thinstall\formatfactory\skel\41c59b1a3b2c8149034101bb61fbfb8e266d4da8.sharedta.210.588 to %APPDATA%\thinstall\formatfactory\skel\41c59b1a3b2c8149034101bb61fbfb8e266d4da8.sharedta
from %APPDATA%\thinstall\formatfactory\skel\qvipllqjnmotnhohrpruithhtmvrgirhmqkmlijn.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\qvipllqjnmotnhohrpruithhtmvrgirhmqkmlijn.tls
from %APPDATA%\thinstall\formatfactory\skel\7ccce17dc76246ba36f2d723405028c4d412b4a2.sharedta.210.588 to %APPDATA%\thinstall\formatfactory\skel\7ccce17dc76246ba36f2d723405028c4d412b4a2.sharedta
from %APPDATA%\thinstall\formatfactory\skel\ggqlqrlnvjijimsvqvjrhkjvmjiojuoqighipjjr.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\ggqlqrlnvjijimsvqvjrhkjvmjiojuoqighipjjr.tls
from %APPDATA%\thinstall\formatfactory\skel\ead12adde5ca76fe9d1168a768abaef22b8a2762.sharedta.210.588 to %APPDATA%\thinstall\formatfactory\skel\ead12adde5ca76fe9d1168a768abaef22b8a2762.sharedta
from %APPDATA%\thinstall\formatfactory\skel\mothphntujimnvruglunsqjipkkspgijlgppnlsg.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\mothphntujimnvruglunsqjipkkspgijlgppnlsg.tls
from %APPDATA%\thinstall\formatfactory\skel\da8356f8301679472ab62d29cfd3df7d17305f09.sharedta.210.588 to %APPDATA%\thinstall\formatfactory\skel\da8356f8301679472ab62d29cfd3df7d17305f09.sharedta
from %APPDATA%\thinstall\formatfactory\skel\c079fa7c5c18301f85f9b54e7f1a6e47c010ce2e.sharedta.210.588 to %APPDATA%\thinstall\formatfactory\skel\c079fa7c5c18301f85f9b54e7f1a6e47c010ce2e.sharedta
from %APPDATA%\thinstall\formatfactory\skel\794c2c7495237771b053cb0ab6eb73bd6d68f080.sharedta.210.588 to %APPDATA%\thinstall\formatfactory\skel\794c2c7495237771b053cb0ab6eb73bd6d68f080.sharedta
from %APPDATA%\thinstall\formatfactory\skel\rglsjqnrminqrkumrpmithioojmujpinsogmhngh.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\rglsjqnrminqrkumrpmithioojmujpinsogmhngh.tls
from %APPDATA%\thinstall\formatfactory\skel\iotoigumtlihrrmqtquqkurqjlumhmrjsqkonpvi.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\iotoigumtlihrrmqtquqkurqjlumhmrjsqkonpvi.tls
from %APPDATA%\thinstall\formatfactory\skel\ptphqhihortnjjkjsmprjnjhopstgmlnnnkopjiu.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\ptphqhihortnjjkjsmprjnjhopstgmlnnnkopjiu.tls
from %APPDATA%\thinstall\formatfactory\skel\soiotgilmtpimprppgtvrgpojnmknoojrskquskm.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\soiotgilmtpimprppgtvrgpojnmknoojrskquskm.tls
from %APPDATA%\thinstall\formatfactory\skel\tkpnnvuqmsogkjkvvjvlsinsoovjmqqskphjtgut.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\tkpnnvuqmsogkjkvvjvlsinsoovjmqqskphjtgut.tls
from %APPDATA%\thinstall\formatfactory\skel\jliqnllvirhnhliumgilvgnvtvqntrvnpmuprvnn.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\jliqnllvirhnhliumgilvgnvtvqntrvnpmuprvnn.tls
from %APPDATA%\thinstall\formatfactory\skel\vquhqsgptlmqigqqtkltlkrphkqtsnskpigrtugo.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\vquhqsgptlmqigqqtkltlkrphkqtsnskpigrtugo.tls
from %APPDATA%\thinstall\formatfactory\skel\kgjuuqshlkjvjgmjmokkmjiqiguovuuiilumkshk.tls-1416-528.tls to %APPDATA%\thinstall\formatfactory\skel\kgjuuqshlkjvjgmjmokkmjiqiguovuuiilumkshk.tls
from %APPDATA%\thinstall\formatfactory\skel\pmqvuqoimsilkqhhgupllisjohqqjkiritujunks.tls-2436-1840.tls to %APPDATA%\thinstall\formatfactory\skel\pmqvuqoimsilkqhhgupllisjohqqjkiritujunks.tls

Network activity

Connects to

'se####.pcfreetime.com':80

TCP

HTTP GET requests

http://se####.pcfreetime.com/ff/daily_stat?ve###################################
http://se####.pcfreetime.com/ff/inst_stat?ve###################################
http://www.pc###etime.com/update/FFUpdateLog.txt

UDP

DNS ASK pc###etime.com
DNS ASK se####.pcfreetime.com

Miscellaneous

Creates and executes the following

'%APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe' /init
'%APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe' -y -i "%ProgramFiles(x86)%\FormatFactory\FFModules\Sample\Video\HATest.mp4" -c:v:0 h264_nvenc D:\FFOutput\Temp\_Task_210_\_HATest_210_.mp4
'%APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe' -y -i "%ProgramFiles(x86)%\FormatFactory\FFModules\Sample\Video\HATest.mp4" -c:v:0 hevc_nvenc D:\FFOutput\Temp\_Task_210_\_HATest_210_.mp4
'%APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe' -y -i "%ProgramFiles(x86)%\FormatFactory\FFModules\Sample\Video\HATest.mp4" -c:v:0 h264_amf D:\FFOutput\Temp\_Task_210_\_HATest_210_.mp4
'%APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe' -y -i "%ProgramFiles(x86)%\FormatFactory\FFModules\Sample\Video\HATest.mp4" -c:v:0 hevc_amf D:\FFOutput\Temp\_Task_210_\_HATest_210_.mp4
'%APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe' -y -i "%ProgramFiles(x86)%\FormatFactory\FFModules\Sample\Video\HATest.mp4" -c:v:0 h264_qsv D:\FFOutput\Temp\_Task_210_\_HATest_210_.mp4
'%APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe' -y -i "%ProgramFiles(x86)%\FormatFactory\FFModules\Sample\Video\HATest.mp4" -c:v:0 hevc_qsv D:\FFOutput\Temp\_Task_210_\_HATest_210_.mp4
'%APPDATA%\thinstall\formatfactory\skel\7316d19c4e82695961e9e1422b4342dbea4ab466\ffmpeg.exe' /init' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней