Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svcav_module' = '%APPDATA%\rewlwmy.exe'
- %WINDIR%\Microsoft.NET\Framework\sbs_microsoft.jscript.dll
- %WINDIR%\Microsoft.NET\Framework\sbs_microsoft.jscript.dll
- '%APPDATA%\rewlwmy.exe'
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\vssadmin.exe' delete shadows /all
- <SYSTEM32>\cmd.exe
- ecmd.exe
- %APPDATA%\log.html
- %APPDATA%\key.dat
- %APPDATA%\rewlwmy.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip[1]
- from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.ecc
- from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg.ecc
- from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminStyles.css to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminStyles.css.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3install.txt to %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3install.txt.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3error.txt to %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3error.txt.ecc
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\EULA.rtf to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\EULA.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\WebUIValidation.js to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\WebUIValidation.js.ecc
- from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.ecc
- from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg.ecc
- from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1032.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1032.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1031.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1031.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1033.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1033.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1036.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1036.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1035.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1035.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1025.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1025.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\VSMsiLog22FD.txt to %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\VSMsiLog22FD.txt.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1028.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1028.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1030.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1030.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1029.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1029.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\SmartNav.js to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\SmartNav.js.ecc
- from %WINDIR%\Help\Tours\WindowsMediaPlayer\Cnt\wmploc.js to %WINDIR%\Help\Tours\WindowsMediaPlayer\Cnt\wmploc.js.ecc
- from %WINDIR%\Help\Tours\mmTour\segment5.txt to %WINDIR%\Help\Tours\mmTour\segment5.txt.ecc
- from %WINDIR%\Help\Tours\WindowsMediaPlayer\Css\controls.css to %WINDIR%\Help\Tours\WindowsMediaPlayer\Css\controls.css.ecc
- from %WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\controls.js to %WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\controls.js.ecc
- from %WINDIR%\Help\Tours\WindowsMediaPlayer\Css\wmptour.css to %WINDIR%\Help\Tours\WindowsMediaPlayer\Css\wmptour.css.ecc
- from %WINDIR%\Help\Tours\mmTour\segment1.txt to %WINDIR%\Help\Tours\mmTour\segment1.txt.ecc
- from %WINDIR%\Help\Tours\mmTour\nav.txt to %WINDIR%\Help\Tours\mmTour\nav.txt.ecc
- from %WINDIR%\Help\Tours\mmTour\segment2.txt to %WINDIR%\Help\Tours\mmTour\segment2.txt.ecc
- from %WINDIR%\Help\Tours\mmTour\segment4.txt to %WINDIR%\Help\Tours\mmTour\segment4.txt.ecc
- from %WINDIR%\Help\Tours\mmTour\segment3.txt to %WINDIR%\Help\Tours\mmTour\segment3.txt.ecc
- from %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\viz.wmv to %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\viz.wmv.ecc
- from %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\rtuner.wmv to %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\rtuner.wmv.ecc
- from %WINDIR%\Microsoft.NET\Framework\sbs_microsoft.jscript.dll to %WINDIR%\Microsoft.NET\Framework\sbs_microsoft.jscript.dll.ecc
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU2.txt to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU2.txt.ecc
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU1.txt to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU1.txt.ecc
- from %WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\tour.js to %WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\tour.js.ecc
- from %WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\events.js to %WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\events.js.ecc
- from %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\copycd.wmv to %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\copycd.wmv.ecc
- from %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\nuskin.wmv to %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\nuskin.wmv.ecc
- from %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\mdlib.wmv to %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\mdlib.wmv.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\eula.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\eula.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\eula.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\eula.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\eula.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\WebAdminStyles.css to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\WebAdminStyles.css.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\eula.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\eula.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\eula.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\eula.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\eula.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\eula.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\eula.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\eula.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\eula.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\eula.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\eula.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\eula.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1044.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1044.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1043.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1043.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1045.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1045.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1049.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1049.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1046.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1046.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1038.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1038.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1037.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1037.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1040.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1040.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1042.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1042.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1041.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1041.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\dd_dotnetfx35install.txt to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\dd_dotnetfx35install.txt.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\dd_dotnetfx35error.txt to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\dd_dotnetfx35error.txt.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\defaults\preferences\defaults.js to %WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\defaults\preferences\defaults.js.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.ecc
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1055.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1055.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1053.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1053.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2052.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2052.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.3082.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.3082.rtf.ecc
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2070.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2070.rtf.ecc
- from %WINDIR%\Help\Tours\mmTour\intro.txt to %WINDIR%\Help\Tours\mmTour\intro.txt.ecc
- from %WINDIR%\Help\Tours\htmlTour\end_up.jpg to %WINDIR%\Help\Tours\htmlTour\end_up.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\desktop_up.jpg to %WINDIR%\Help\Tours\htmlTour\desktop_up.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\folder_up.jpg to %WINDIR%\Help\Tours\htmlTour\folder_up.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\icon_up.jpg to %WINDIR%\Help\Tours\htmlTour\icon_up.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\gradient.jpg to %WINDIR%\Help\Tours\htmlTour\gradient.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg to %WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg to %WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\control_up.jpg to %WINDIR%\Help\Tours\htmlTour\control_up.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img046.jpg to %WINDIR%\Help\Tours\htmlTour\img046.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img040.jpg to %WINDIR%\Help\Tours\htmlTour\img040.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img060.jpg to %WINDIR%\Help\Tours\htmlTour\img060.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img072.jpg to %WINDIR%\Help\Tours\htmlTour\img072.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img068.jpg to %WINDIR%\Help\Tours\htmlTour\img068.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img014.jpg to %WINDIR%\Help\Tours\htmlTour\img014.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img004b.jpg to %WINDIR%\Help\Tours\htmlTour\img004b.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img033.jpg to %WINDIR%\Help\Tours\htmlTour\img033.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img034.jpg to %WINDIR%\Help\Tours\htmlTour\img034.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img033a.jpg to %WINDIR%\Help\Tours\htmlTour\img033a.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\best_robust.jpg to %WINDIR%\Help\Tours\htmlTour\best_robust.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg to %WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\best_secure.jpg to %WINDIR%\Help\Tours\htmlTour\best_secure.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg.ecc
- from %WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt to %WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt.ecc
- from %WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt to %WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt.ecc
- from %WINDIR%\clock.avi to %WINDIR%\clock.avi.ecc
- from %WINDIR%\Help\Tours\htmlTour\best_road_big.jpg to %WINDIR%\Help\Tours\htmlTour\best_road_big.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\best_road.jpg to %WINDIR%\Help\Tours\htmlTour\best_road.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg to %WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\connected_networks.jpg to %WINDIR%\Help\Tours\htmlTour\connected_networks.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg to %WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\connected_data.jpg to %WINDIR%\Help\Tours\htmlTour\connected_data.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\start_up.jpg to %WINDIR%\Help\Tours\htmlTour\start_up.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\scripts.js to %WINDIR%\Help\Tours\htmlTour\scripts.js.ecc
- from %WINDIR%\Help\Tours\htmlTour\style.css to %WINDIR%\Help\Tours\htmlTour\style.css.ecc
- from %WINDIR%\Help\Tours\htmlTour\ul_logo.jpg to %WINDIR%\Help\Tours\htmlTour\ul_logo.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg to %WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\window_up.jpg to %WINDIR%\Help\Tours\htmlTour\window_up.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\unlock_built.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_built.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img116.jpg to %WINDIR%\Help\Tours\htmlTour\img116.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img110.jpg to %WINDIR%\Help\Tours\htmlTour\img110.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img121.jpg to %WINDIR%\Help\Tours\htmlTour\img121.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img126.jpg to %WINDIR%\Help\Tours\htmlTour\img126.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img123.jpg to %WINDIR%\Help\Tours\htmlTour\img123.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img089.jpg to %WINDIR%\Help\Tours\htmlTour\img089.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img074a.jpg to %WINDIR%\Help\Tours\htmlTour\img074a.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img100.jpg to %WINDIR%\Help\Tours\htmlTour\img100.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img109.jpg to %WINDIR%\Help\Tours\htmlTour\img109.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img103.jpg to %WINDIR%\Help\Tours\htmlTour\img103.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\read_icon.jpg to %WINDIR%\Help\Tours\htmlTour\read_icon.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\question_icon.jpg to %WINDIR%\Help\Tours\htmlTour\question_icon.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img149.jpg to %WINDIR%\Help\Tours\htmlTour\img149.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\img136.jpg to %WINDIR%\Help\Tours\htmlTour\img136.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\intro_logo.jpg to %WINDIR%\Help\Tours\htmlTour\intro_logo.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\pen_icon.jpg to %WINDIR%\Help\Tours\htmlTour\pen_icon.jpg.ecc
- from %WINDIR%\Help\Tours\htmlTour\logo.jpg to %WINDIR%\Help\Tours\htmlTour\logo.jpg.ecc
- '7t########vlep5o.s2.tor-gateways.de':443
- 'ip##fo.io':80
- http://ip##fo.io/ip
- DNS ASK 7t######47vlep5o.tor2web.fi
- DNS ASK 7t########vlep5o.s2.tor-gateways.de
- DNS ASK 7t#########lep5o.tor2web.blutmagie.de
- DNS ASK ip##fo.io
- DNS ASK 7t######47vlep5o.2kjb8.net