Trojan.MulDrop13.2551

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ApowerREC' = '%ProgramFiles(x86)%\Apowersoft\ApowerREC\ApowerREC.exe /autoStart'

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="ApowerREC" dir=in action=allow program="%ProgramFiles(x86)%\Apowersoft\ApowerREC\ApowerREC.exe" enable=yes
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="ApowerREC" dir=out action=allow program="%ProgramFiles(x86)%\Apowersoft\ApowerREC\ApowerREC.exe" enable=yes

Изменения в файловой системе

Создает следующие файлы

%TEMP%\aut1951.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-btt4g.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-pn22t.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-i1dj8.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-fpiuv.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-s2uib.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-61ctf.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-dt7kb.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-cvrlc.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-60ch1.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-chohq.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-j5bne.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-h7js6.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-5ljfq.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-arim6.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-hv1dm.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-g6l3l.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-khght.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-d7p4p.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-nfpsd.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-4oe00.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-qjbei.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-krbru.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-pupsr.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-u0jcm.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-uolmr.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-af8fr.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-u5ic7.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\setuplog.log
%ProgramFiles(x86)%\apowersoft\apowerrec\unins000.dat
%APPDATA%\apowersoft\apowerrec\config.ini
C:\users\public\desktop\apowerrec.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\apowersoft\apowerrec\uninstall apowerrec.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\apowersoft\apowerrec\apowerrec on the web.url
%PROGRAMDATA%\microsoft\windows\start menu\programs\apowersoft\apowerrec\apowerrec.lnk
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-aptqk.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-5psts.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-ge5dp.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-chg77.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-mvh0b.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-ilu3v.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-cqh99.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-q9k5a.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-tq0g6.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-baujd.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-8elb9.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-ioer4.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-0k9nh.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-0r529.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-p1sm2.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-gudls.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-tn7m9.tmp
%TEMP%\autb2a4.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-pb49f.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-u0gh2.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-aeutq.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-17bke.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-7io4r.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-uud6j.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-nosfj.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-82jbe.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-6u5q2.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-h3h2k.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-k6qtp.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-nf1u2.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\is-k2fhi.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\is-uh8ru.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\is-38gre.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\is-r4vgj.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\is-ee8im.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\is-opa0o.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\is-3aqhq.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\is-5a3b9.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\is-d20ok.tmp
%TEMP%\is-p9m3b.tmp\isxdl.dll
%TEMP%\is-p9m3b.tmp\_isetup\_setup64.tmp
%TEMP%\setup log 2020-06-27 #001.txt
%TEMP%\is-i1som.tmp\~zxtgyqq.tmp
%CommonProgramFiles(x86)%\~zxtgyqq.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-2p4ri.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-m91ti.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-jhlun.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-upfoq.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-i5msb.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-vvaok.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-q7cgo.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-kv1rq.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-9mvos.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-t6toh.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-sv6ut.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-78fgr.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-ntm39.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-gjvo1.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-rhamk.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-4pg3r.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-eu44j.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-uijib.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-0kga3.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-b9sk9.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-el56p.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-nd2mn.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-lnufi.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-7g5h6.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-kpfsb.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-7fn8e.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-fgs1a.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-1c50h.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-dj3s7.tmp
%ProgramFiles(x86)%\apowersoft\apowerrec\apowersoft.commutilities.dll

Присваивает атрибут 'скрытый' для следующих файлов

%CommonProgramFiles(x86)%\~zxtgyqq.tmp

Удаляет следующие файлы

%TEMP%\aut1951.tmp
%TEMP%\is-p9m3b.tmp\isxdl.dll
%TEMP%\is-p9m3b.tmp\_isetup\_setup64.tmp
%TEMP%\is-i1som.tmp\~zxtgyqq.tmp
%TEMP%\autb2a4.tmp
%CommonProgramFiles(x86)%\~zxtgyqq.tmp

Перемещает следующие файлы

%ProgramFiles(x86)%\apowersoft\apowerrec\is-d20ok.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\unins000.exe
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-61ctf.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\swedish.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-dt7kb.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\swedish.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-cvrlc.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\spanish@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-60ch1.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\spanish.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-chohq.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\spanish.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-j5bne.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\slovenian@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-h7js6.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\slovenian.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-5ljfq.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\slovenian.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-arim6.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\portuguesebrazil@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-g6l3l.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\portuguesebrazil.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-fpiuv.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\turkish.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-khght.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\portuguese@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-d7p4p.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\portuguese.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-nfpsd.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\portuguese.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-4oe00.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\polish@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-qjbei.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\polish.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-krbru.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\polish.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-pupsr.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\norwegian@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-pb49f.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\norwegian.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-hv1dm.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\portuguesebrazil.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-eu44j.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\german.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-i1dj8.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\turkish.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-ge5dp.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\spanish.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-chg77.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\slovenian.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-ilu3v.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\portuguesebrazil.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-mvh0b.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\portuguese.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-cqh99.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\polish.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-q9k5a.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\norwegian.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-tq0g6.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\japanese.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-baujd.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\italian.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-8elb9.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\hungarian.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-u0gh2.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\norwegian.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-s2uib.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\swedish@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-0r529.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\french.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-p1sm2.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\finnish.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-gudls.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\english.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-tn7m9.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\dutch.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-u5ic7.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\danish.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-af8fr.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\czech.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-uolmr.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\chinesetraditional.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-u0jcm.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\chinesesimplified.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-btt4g.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包.zip
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-0k9nh.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\german.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-pn22t.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\turkish@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-aeutq.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\japanese@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-dj3s7.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\japanese.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-i5msb.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\japanese.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-k6qtp.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\chinesesimplified.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-m91ti.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\danish.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-2p4ri.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\danish.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-17bke.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\czech@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-7io4r.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\czech.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-uud6j.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\czech.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-nosfj.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\chinesetraditional@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-82jbe.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\chinesetraditional.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-6u5q2.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\chinesetraditional.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-5psts.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\swedish.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-upfoq.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\dutch.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-nf1u2.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\chinesesimplified.png
%ProgramFiles(x86)%\apowersoft\apowerrec\is-k2fhi.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\wxmedia.dll
%ProgramFiles(x86)%\apowersoft\apowerrec\is-uh8ru.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\log4net.dll
%ProgramFiles(x86)%\apowersoft\apowerrec\is-38gre.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\log.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\is-r4vgj.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\libffmpeg.dll
%ProgramFiles(x86)%\apowersoft\apowerrec\is-ee8im.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\apowerrec.exe.config
%ProgramFiles(x86)%\apowersoft\apowerrec\is-opa0o.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\apowerrec.exe
%ProgramFiles(x86)%\apowersoft\apowerrec\is-3aqhq.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\aliyun.oss.dll
%ProgramFiles(x86)%\apowersoft\apowerrec\is-5a3b9.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\aliyun.log.dll
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-h3h2k.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\chinesesimplified@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-ioer4.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\greek.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-1c50h.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\dutch.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-kpfsb.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\english.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-fgs1a.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\dutch@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-vvaok.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\italian@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-q7cgo.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\italian.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-kv1rq.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\italian.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-9mvos.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\hungarian@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-t6toh.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\hungarian.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-sv6ut.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\hungarian.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-78fgr.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\greek@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-ntm39.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\greek.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-7fn8e.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\english.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-gjvo1.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\greek.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-jhlun.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\danish@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-4pg3r.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\german.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-uijib.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\french@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-0kga3.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\french.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-b9sk9.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\french.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-el56p.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\finnish@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-nd2mn.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\finnish.xml
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-lnufi.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\finnish.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-7g5h6.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\english@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\is-rhamk.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\german@2x.png
%ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\is-aptqk.tmp в %ProgramFiles(x86)%\apowersoft\apowerrec\lang\windowsapowerrec语言包\turkish.xml

Другое

Создает и запускает на исполнение

'%CommonProgramFiles(x86)%\~zxtgyqq.tmp' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-i1som.tmp\~zxtgyqq.tmp' /SL5="$C0226,22560721,313344,%CommonProgramFiles(x86)%\~zxtgyqq.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%WINDIR%\syswow64\netsh.exe' http add urlacl url=http://12#.#.0.1:18500/ user=everyone' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' http add urlacl url=http://12#.#.0.1:18501/ user=everyone' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' http add urlacl url=http://12#.#.0.1:18502/ user=everyone' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' http add urlacl url=http://12#.#.0.1:18503/ user=everyone' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' http add urlacl url=http://12#.#.0.1:18504/ user=everyone' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' http add urlacl url=http://12#.#.0.1:54321/ user=everyone' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="ApowerREC" program="%ProgramFiles(x86)%\Apowersoft\ApowerREC\ApowerREC.exe"' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="ApowerREC" dir=in action=allow program="%ProgramFiles(x86)%\Apowersoft\ApowerREC\ApowerREC.exe" enable=yes' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="ApowerREC" dir=out action=allow program="%ProgramFiles(x86)%\Apowersoft\ApowerREC\ApowerREC.exe" enable=yes' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\netsh.exe' http add urlacl url=http://12#.#.0.1:18500/ user=everyone
'%WINDIR%\syswow64\netsh.exe' http add urlacl url=http://12#.#.0.1:18501/ user=everyone
'%WINDIR%\syswow64\netsh.exe' http add urlacl url=http://12#.#.0.1:18502/ user=everyone
'%WINDIR%\syswow64\netsh.exe' http add urlacl url=http://12#.#.0.1:18503/ user=everyone
'%WINDIR%\syswow64\netsh.exe' http add urlacl url=http://12#.#.0.1:18504/ user=everyone
'%WINDIR%\syswow64\netsh.exe' http add urlacl url=http://12#.#.0.1:54321/ user=everyone
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="ApowerREC" program="%ProgramFiles(x86)%\Apowersoft\ApowerREC\ApowerREC.exe"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней