Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AC97 Audio' = '%TEMP%\WINDOWS\loader.exe'
Malicious functions:
Creates and executes the following:
- '%TEMP%\WINDOWS\loader.exe'
Searches for windows to
detect programs and games:
- ClassName: 'TibiaClient' WindowName: '(null)'
Modifies file system :
Creates the following files:
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\necro ramoa.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mutatedratscript.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mutatedrat.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\necro.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Nightyyyyy.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\nighty looting.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\nights pally.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mutant Rats 3 tower bez batow.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mutant Rats 2 towers.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mutant Rats 2 towers mag.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mutant Rats 3 wierze.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\MutatedHumanAntboyRSDEPOT.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mutant Rats Mag.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mutant Rats 4 wierze.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Port Hope Tortoise.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Port Hope North Jungle for Paladin.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Port Hope - Swamp Troll Cave - by Mastha.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\PortHope trolls.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\PortHopeMage.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\PortHope.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\PortHope.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Paladin - Mutated Rats.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\paladin - mutated rat.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Orc Fort.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Pirates by Stahu.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Port Hope - Swamp Troll Cave - by Mastha.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Pirates.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Pirates M.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mistrock cyc [North Up].elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Lizards_depositer.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Lizards_depositer.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Lizards.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mage Yal Drags NE.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mammoth_svar.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mammoth_Svar.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mage Yal Drags SW.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\laguna.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Laguna Island.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Knights - Mutated Rats.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\LagunaDepositer.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Lizard Camp.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Lby Pirates ~ M45.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Larvs.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mistrock Cyc Knight.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mistrock cyc (Upper South Spawn, 1st floor with one up).elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mintwallin.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mistrock Cyc Mage.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mistrock cyc [Medium].elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mistrock Cyc [Hardcore].wpt
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mistrock Cyc [Easy].wpt
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Meduzyyy.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\meduzy.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\meduski full.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Minotaurs Yalahar (FULL) + Depositer + MPrebuyer.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Mintwallin.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Minotaury Yalahar DEPO.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Minotaurs.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Rook v1.9.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar Green Djinn no efreet.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar Green Djinn ALL.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar Green Djinn 3efreet.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar Green Djinn.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar GS.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar GS EK 200.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar GS dp.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar Drags SW drop.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar Drags SE-SW drop.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar Drags SE-NW.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar Drags SW Mage.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar Drags SW.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar Drags SW-NE.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar Drags SW-NE ltdrop.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar WorkerGolems.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar WorkerGolems.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar WorkerGolems ltrdp.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar Zombie 0.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\[PRO]YALAHAR WITCHE HERO NECRO.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\[PRO]YALAHAR HERO NECRO.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar Zombie 1.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar Minos.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar IceWitch.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar IceWitch.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar Minos.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar SW quarter.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar SW quarter.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar Minotaurs.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar Drags NE.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Soldier Hell.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Soldier Hell.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\small cults.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Tarantule rkl.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\tarpit.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Tarpit.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Tarantule.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\scarabs.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\scarabs palm.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Rook.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\skille.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Small Cults.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Slime Train.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\skille.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yal Dragon Mage.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\wyrmLB2floorDeposit.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\workergolem(3 spawns).elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yal Knight - Cementery.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar Drags NE-SE.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar DLs.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Yalahar Cults Surface.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Venore Dragon Lair Knight.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\trole abbb.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\trole ab.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Venore Dragon Lair.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Worker golems.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Worker Golems Hatchling Cave.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Waypoints Rookgard Premmy side new 8.5.wpt
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\darashia dragons.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\darashia dlair.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Cyclops Mistrock.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\DarkCathedral+items+dpGold (v1.1).elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Djinns Knight.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\depo laguna.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\DarkCathedral1st.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Cults.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Cults Mines NW.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\crystal spiders.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\cyc2ndfloor.wpt
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\cyclopolis.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\cyclopolis targ.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Cyclopolis - Waypoints.wpt
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\DLs.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\DLs Knight.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\dleeeee.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\dlsnoholes POI.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Dragi Darashia.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\DRagi darashia depo.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Dragi Darashia depo!.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Dl's.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\DL pally.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Djinns.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\dl-e fenrock.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\dle vistera.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\dle vistera.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\dl-e fenrock.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Crystal spiders.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Ape all.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Ape all(2).elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Ape -2.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Apes 0 Reverse.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Apes_Ground_Tower.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Apes.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Apes Ground floor_depositer.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\1 Island -2 .elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\1 a test.elfc
- %TEMP%\WINDOWS\loader.exe
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\1 Island -2.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Ape -2 With Depositer.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\11 laguna island+depositer by St@hu.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\1.2.3. Polis.wpt
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Bogs Raiders.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Bogs Raiders Knight.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Bog Raiders Paladin.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Cemetery skels.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Chakoyas depositer 2.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Chakoyas depositer 1.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Chakoya.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\avalanche ank.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Arena Mutated.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Apes_Ground_Tower.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Barbs.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Bog Raiders Knight.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\blue djinn yalahar.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\barbs.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\dragi targeting.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\ghaz .elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Frosts with just spears no san EAST UP.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Frosts Paladin 2.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\ghaz.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\GS knight.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\gs island forbidden.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\gs forbidden.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\frost mage.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Frost hardcore 220.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Frost HARD 180.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\frost WEST.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Frosts Knight.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Frosts Hard WEST 0.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Frosts Hard WEST 0(2).elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Ice witches.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Ice witch tower.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\hydry forbidden.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Icons Knight.txt
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\knight - mutated rat.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\JungleMage.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Jungle.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\GS_ph_knight.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\GS paladin.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\GS mage.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\GS_ph_paladin.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\hydra.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Hidden Larvas.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\gs_porthope.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Frost Giants.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Dworc Depositer - EK.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\dwarfyyy small.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\dwarfy smallll.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Dworc Depositer - Knight.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Dworc knight.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Dworc Depositer - Pally.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Dworc Depositer - Mage.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\dragikuba.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\dragi.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Dragi Witka).elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Dragon Mage.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\dragons.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Dragon Yalahar.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Dragon VDL Knight.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Final.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\femourhills_perfect_allgoblins.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\femourhills_perfect.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Frost Dragon +1.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Frost Giants + Depositer.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Frost East Up.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Frost Dragons Quest W.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Edron goblins with gold and stones.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Edron Dragon Lair.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Dworc mage.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Edron goblins.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Edron trolls.elft
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Edron trolls with gold.elfc
- %TEMP%\WINDOWS\Scripts_by_admin_LordOfWar\Edron goblins.elft
Network activity:
Connects to:
- 'ti##xxa.pl':80
TCP:
HTTP POST requests:
- ti##xxa.pl/key/index.php
UDP:
- DNS ASK ti##xxa.pl
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Tibia'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
