Trojan.Siggen18.56081

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\rarsfx0\getintoway.url
%ProgramFiles%\piriform\recuva\lang\is-g86a7.tmp
%ProgramFiles%\piriform\recuva\lang\is-u0o99.tmp
%ProgramFiles%\piriform\recuva\lang\is-9p15q.tmp
%ProgramFiles%\piriform\recuva\lang\is-bf0qm.tmp
%ProgramFiles%\piriform\recuva\lang\is-jq72e.tmp
%ProgramFiles%\piriform\recuva\lang\is-obm5c.tmp
%ProgramFiles%\piriform\speccy\lang\is-7nc7k.tmp
%ProgramFiles%\piriform\recuva\lang\is-8m1n8.tmp
%ProgramFiles%\piriform\recuva\lang\is-tigtn.tmp
%ProgramFiles%\piriform\speccy\lang\is-opqh4.tmp
%ProgramFiles%\piriform\speccy\lang\is-fglr3.tmp
%ProgramFiles%\piriform\speccy\lang\is-umnb4.tmp
%ProgramFiles%\piriform\speccy\lang\is-pu3ik.tmp
%ProgramFiles%\piriform\speccy\lang\is-ug0c9.tmp
%ProgramFiles%\piriform\speccy\lang\is-r6mhp.tmp
%ProgramFiles%\piriform\recuva\lang\is-56p1b.tmp
%ProgramFiles%\piriform\speccy\lang\is-pkn10.tmp
%ProgramFiles%\piriform\recuva\lang\is-2pcoq.tmp
%ProgramFiles%\piriform\speccy\lang\is-cm4fd.tmp
%ProgramFiles%\piriform\recuva\lang\is-548n1.tmp
%ProgramFiles%\piriform\recuva\lang\is-5pp9p.tmp
%ProgramFiles%\piriform\recuva\lang\is-paq83.tmp
%ProgramFiles%\piriform\recuva\lang\is-k6q4s.tmp
%ProgramFiles%\piriform\recuva\lang\is-d29f4.tmp
%ProgramFiles%\piriform\recuva\lang\is-jrd5k.tmp
%ProgramFiles%\piriform\recuva\lang\is-oir68.tmp
%ProgramFiles%\piriform\recuva\lang\is-ptmja.tmp
%ProgramFiles%\piriform\recuva\lang\is-u5j12.tmp
%ProgramFiles%\piriform\recuva\lang\is-sh9vi.tmp
%ProgramFiles%\piriform\recuva\lang\is-8n8h9.tmp
%ProgramFiles%\piriform\recuva\lang\is-3rm0t.tmp
%ProgramFiles%\piriform\recuva\lang\is-b9r15.tmp
%ProgramFiles%\piriform\recuva\lang\is-733to.tmp
%ProgramFiles%\piriform\recuva\lang\is-217kv.tmp
%ProgramFiles%\piriform\recuva\lang\is-s6mia.tmp
%ProgramFiles%\piriform\recuva\lang\is-e1iql.tmp
%ProgramFiles%\piriform\recuva\lang\is-dcsk1.tmp
%ProgramFiles%\piriform\recuva\lang\is-fb97p.tmp
%ProgramFiles%\piriform\speccy\lang\is-s92o2.tmp
%ProgramFiles%\piriform\speccy\lang\is-vcp63.tmp
%ProgramFiles%\piriform\defraggler\is-6lsr6.tmp
%ProgramFiles%\piriform\defraggler\is-tcmc6.tmp
%ProgramFiles%\piriform\recuva\is-e7qqc.tmp
%ProgramFiles%\piriform\recuva\is-gugvg.tmp
%ProgramFiles%\piriform\recuva\is-917ge.tmp
%ProgramFiles%\piriform\speccy\is-946pe.tmp
%ProgramFiles%\piriform\defraggler\is-aj7c0.tmp
%ProgramFiles%\piriform\defraggler\is-avosl.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\piriform utilities\defraggler.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\piriform utilities\uninstall.lnk
%HOMEPATH%\desktop\defraggler.lnk
%HOMEPATH%\desktop\recuva.lnk
%HOMEPATH%\desktop\speccy.lnk
%APPDATA%\microsoft\internet explorer\quick launch\defraggler.lnk
%APPDATA%\microsoft\internet explorer\quick launch\recuva.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\piriform utilities\recuva.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\piriform utilities\speccy.lnk
%ProgramFiles%\piriform\speccy\lang\is-pjho6.tmp
%ProgramFiles%\piriform\speccy\lang\is-i4dqi.tmp
%ProgramFiles%\piriform\speccy\lang\is-h51uq.tmp
%ProgramFiles%\piriform\speccy\lang\is-ini3n.tmp
%ProgramFiles%\piriform\speccy\lang\is-opbl1.tmp
%ProgramFiles%\piriform\speccy\lang\is-033tt.tmp
%ProgramFiles%\piriform\speccy\lang\is-0i05f.tmp
%ProgramFiles%\piriform\speccy\lang\is-0m3jh.tmp
%ProgramFiles%\piriform\speccy\lang\is-nc8f1.tmp
%ProgramFiles%\piriform\speccy\lang\is-joc2k.tmp
%ProgramFiles%\piriform\speccy\lang\is-1h7sa.tmp
%ProgramFiles%\piriform\speccy\lang\is-orc33.tmp
%ProgramFiles%\piriform\speccy\lang\is-64kh4.tmp
%ProgramFiles%\piriform\speccy\lang\is-0sog8.tmp
%ProgramFiles%\piriform\speccy\lang\is-8ufv6.tmp
%ProgramFiles%\piriform\speccy\lang\is-7fva2.tmp
%ProgramFiles%\piriform\speccy\lang\is-drm1q.tmp
%ProgramFiles%\piriform\speccy\lang\is-rqiv6.tmp
%ProgramFiles%\piriform\speccy\lang\is-c5bit.tmp
%ProgramFiles%\piriform\speccy\lang\is-mjtpo.tmp
%ProgramFiles%\piriform\recuva\lang\is-nenf2.tmp
%ProgramFiles%\piriform\recuva\lang\is-479bp.tmp
%ProgramFiles%\piriform\recuva\lang\is-4g835.tmp
%ProgramFiles%\piriform\recuva\lang\is-2s915.tmp
%ProgramFiles%\piriform\recuva\lang\is-inrfm.tmp
%ProgramFiles%\piriform\recuva\lang\is-cll8k.tmp
%ProgramFiles%\piriform\speccy\is-l6hmk.tmp
%ProgramFiles%\piriform\speccy\is-2vhip.tmp
%ProgramFiles%\piriform\speccy\lang\is-3hher.tmp
%ProgramFiles%\piriform\recuva\is-ehuqn.tmp
%ProgramFiles%\piriform\defraggler\lang\is-gcftt.tmp
%ProgramFiles%\piriform\defraggler\lang\is-e81n3.tmp
%ProgramFiles%\piriform\defraggler\lang\is-p65tb.tmp
%ProgramFiles%\piriform\defraggler\lang\is-nak2s.tmp
%ProgramFiles%\piriform\defraggler\lang\is-v817p.tmp
%ProgramFiles%\piriform\defraggler\lang\is-0gaej.tmp
%ProgramFiles%\piriform\defraggler\lang\is-0q5nt.tmp
%ProgramFiles%\piriform\defraggler\lang\is-csoam.tmp
%ProgramFiles%\piriform\speccy\lang\is-957vj.tmp
%ProgramFiles%\piriform\speccy\lang\is-kbr7e.tmp
%ProgramFiles%\piriform\defraggler\lang\is-1mram.tmp
%ProgramFiles%\piriform\defraggler\lang\is-88ub9.tmp
%ProgramFiles%\piriform\is-5pokb.tmp
%TEMP%\is-4aauh.tmp\setup.tmp
%TEMP%\is-8n7vn.tmp\_isetup\_regdll.tmp
%TEMP%\is-8n7vn.tmp\_isetup\_setup64.tmp
%TEMP%\is-8n7vn.tmp\_isetup\_shfoldr.dll
%TEMP%\is-8n7vn.tmp\istask.dll
%TEMP%\is-8n7vn.tmp\vclstylesinno.dll
%ProgramFiles%\piriform\defraggler\lang\is-m1vk1.tmp
%ProgramFiles%\piriform\defraggler\lang\is-96j89.tmp
%TEMP%\rarsfx0\setup.exe
%TEMP%\is-8n7vn.tmp\is-3aaqm.tmp
%ProgramFiles%\piriform\defraggler\is-5o8mj.tmp
%ProgramFiles%\piriform\recuva\is-v9kfd.tmp
%ProgramFiles%\piriform\speccy\is-pg7dm.tmp
%ProgramFiles%\piriform\defraggler\is-va6gb.tmp
%ProgramFiles%\piriform\defraggler\is-9sblv.tmp
%TEMP%\is-8n7vn.tmp\wizardform.bitmapimage1.bmp
%TEMP%\is-8n7vn.tmp\metroblue.vsf
%ProgramFiles%\piriform\recuva\is-vpli3.tmp
%ProgramFiles%\piriform\defraggler\lang\is-5kef9.tmp
%ProgramFiles%\piriform\defraggler\lang\is-gsc5e.tmp
%ProgramFiles%\piriform\defraggler\lang\is-4tmfe.tmp
%ProgramFiles%\piriform\defraggler\lang\is-r1mui.tmp
%ProgramFiles%\piriform\defraggler\lang\is-4c7of.tmp
%ProgramFiles%\piriform\defraggler\lang\is-p7c18.tmp
%ProgramFiles%\piriform\defraggler\lang\is-buqhc.tmp
%ProgramFiles%\piriform\defraggler\lang\is-ftopo.tmp
%ProgramFiles%\piriform\defraggler\lang\is-sc8mu.tmp
%ProgramFiles%\piriform\defraggler\lang\is-sg9r2.tmp
%ProgramFiles%\piriform\recuva\lang\is-vf8na.tmp
%ProgramFiles%\piriform\recuva\lang\is-svl6p.tmp
%ProgramFiles%\piriform\recuva\lang\is-g4c7j.tmp
%ProgramFiles%\piriform\recuva\lang\is-hi4ar.tmp
%ProgramFiles%\piriform\recuva\lang\is-pctne.tmp
%ProgramFiles%\piriform\recuva\lang\is-5593m.tmp
%ProgramFiles%\piriform\recuva\lang\is-t6jv8.tmp
%ProgramFiles%\piriform\recuva\lang\is-h79q8.tmp
%ProgramFiles%\piriform\recuva\lang\is-n1j1f.tmp
%ProgramFiles%\piriform\defraggler\lang\is-h8a7s.tmp
%ProgramFiles%\piriform\defraggler\lang\is-0cjsd.tmp
%ProgramFiles%\piriform\defraggler\lang\is-7djil.tmp
%ProgramFiles%\piriform\defraggler\lang\is-gb85f.tmp
%ProgramFiles%\piriform\defraggler\lang\is-aik89.tmp
%ProgramFiles%\piriform\defraggler\lang\is-qe2ih.tmp
%ProgramFiles%\piriform\defraggler\lang\is-rcbj2.tmp
%ProgramFiles%\piriform\defraggler\lang\is-r27nu.tmp
%ProgramFiles%\piriform\defraggler\lang\is-li7ri.tmp
%ProgramFiles%\piriform\defraggler\lang\is-p2h61.tmp
%ProgramFiles%\piriform\defraggler\lang\is-jn64o.tmp
%ProgramFiles%\piriform\defraggler\lang\is-aljjh.tmp
%ProgramFiles%\piriform\defraggler\lang\is-luslu.tmp
%ProgramFiles%\piriform\defraggler\lang\is-s9oct.tmp
%ProgramFiles%\piriform\defraggler\lang\is-j4j50.tmp
%ProgramFiles%\piriform\defraggler\lang\is-2ehnl.tmp
%ProgramFiles%\piriform\defraggler\lang\is-nleo5.tmp
%ProgramFiles%\piriform\defraggler\lang\is-8csau.tmp
%ProgramFiles%\piriform\defraggler\lang\is-e2mq5.tmp
%ProgramFiles%\piriform\defraggler\lang\is-3uald.tmp
%APPDATA%\microsoft\internet explorer\quick launch\speccy.lnk
%ProgramFiles%\piriform\unins000.dat

Удаляет следующие файлы

%ProgramFiles%\piriform\defraggler\defraggler.dat
%ProgramFiles%\piriform\recuva\recuva.dat
%ProgramFiles%\piriform\speccy\speccy.dat
%ProgramFiles%\piriform\defraggler\defragglershell64.dll
%ProgramFiles%\piriform\recuva\recuvashell64.dll
%TEMP%\is-8n7vn.tmp\syspin.exe
%TEMP%\is-8n7vn.tmp\istask.dll
%TEMP%\is-8n7vn.tmp\metroblue.vsf
%TEMP%\is-8n7vn.tmp\vclstylesinno.dll
%TEMP%\is-8n7vn.tmp\wizardform.bitmapimage1.bmp
%TEMP%\is-8n7vn.tmp\_isetup\_regdll.tmp
%TEMP%\is-8n7vn.tmp\_isetup\_setup64.tmp
%TEMP%\is-8n7vn.tmp\_isetup\_shfoldr.dll
%TEMP%\is-4aauh.tmp\setup.tmp
%TEMP%\rarsfx0\getintoway.url
%TEMP%\rarsfx0\setup.exe

Перемещает следующие файлы

%ProgramFiles%\piriform\is-5pokb.tmp в %ProgramFiles%\piriform\unins000.exe
%ProgramFiles%\piriform\speccy\lang\is-cm4fd.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1026.dll
%ProgramFiles%\piriform\recuva\lang\is-56p1b.tmp в %ProgramFiles%\piriform\recuva\lang\lang-9999.dll
%ProgramFiles%\piriform\recuva\lang\is-obm5c.tmp в %ProgramFiles%\piriform\recuva\lang\lang-5146.dll
%ProgramFiles%\piriform\recuva\lang\is-jq72e.tmp в %ProgramFiles%\piriform\recuva\lang\lang-3098.dll
%ProgramFiles%\piriform\recuva\lang\is-bf0qm.tmp в %ProgramFiles%\piriform\recuva\lang\lang-2074.dll
%ProgramFiles%\piriform\recuva\lang\is-9p15q.tmp в %ProgramFiles%\piriform\recuva\lang\lang-2052.dll
%ProgramFiles%\piriform\recuva\lang\is-u0o99.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1079.dll
%ProgramFiles%\piriform\recuva\lang\is-g86a7.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1071.dll
%ProgramFiles%\piriform\recuva\lang\is-8m1n8.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1068.dll
%ProgramFiles%\piriform\recuva\lang\is-tigtn.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1067.dll
%ProgramFiles%\piriform\recuva\lang\is-u5j12.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1066.dll
%ProgramFiles%\piriform\recuva\lang\is-sh9vi.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1063.dll
%ProgramFiles%\piriform\recuva\lang\is-ptmja.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1062.dll
%ProgramFiles%\piriform\recuva\lang\is-s6mia.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1061.dll
%ProgramFiles%\piriform\recuva\lang\is-733to.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1057.dll
%ProgramFiles%\piriform\speccy\lang\is-opqh4.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1034.dll
%ProgramFiles%\piriform\recuva\lang\is-b9r15.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1055.dll
%ProgramFiles%\piriform\recuva\lang\is-3rm0t.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1054.dll
%ProgramFiles%\piriform\recuva\lang\is-8n8h9.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1053.dll
%ProgramFiles%\piriform\recuva\lang\is-dcsk1.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1052.dll
%ProgramFiles%\piriform\recuva\lang\is-548n1.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1051.dll
%ProgramFiles%\piriform\recuva\lang\is-e1iql.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1050.dll
%ProgramFiles%\piriform\recuva\lang\is-oir68.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1048.dll
%ProgramFiles%\piriform\recuva\lang\is-jrd5k.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1046.dll
%ProgramFiles%\piriform\recuva\lang\is-d29f4.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1045.dll
%ProgramFiles%\piriform\recuva\lang\is-k6q4s.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1044.dll
%ProgramFiles%\piriform\recuva\lang\is-paq83.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1043.dll
%ProgramFiles%\piriform\recuva\lang\is-5pp9p.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1041.dll
%ProgramFiles%\piriform\recuva\lang\is-fb97p.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1040.dll
%ProgramFiles%\piriform\recuva\lang\is-217kv.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1060.dll
%ProgramFiles%\piriform\defraggler\lang\is-gsc5e.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1067.dll
%ProgramFiles%\piriform\speccy\lang\is-fglr3.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1035.dll
%ProgramFiles%\piriform\recuva\is-e7qqc.tmp в %ProgramFiles%\piriform\recuva\recuva.exe
%ProgramFiles%\piriform\defraggler\is-tcmc6.tmp в %ProgramFiles%\piriform\defraggler\df64.exe
%ProgramFiles%\piriform\defraggler\is-avosl.tmp в %ProgramFiles%\piriform\defraggler\defragglershell64.dll
%ProgramFiles%\piriform\defraggler\is-aj7c0.tmp в %ProgramFiles%\piriform\defraggler\defraggler.exe
%ProgramFiles%\piriform\speccy\lang\is-1h7sa.tmp в %ProgramFiles%\piriform\speccy\lang\lang-9999.dll
%ProgramFiles%\piriform\speccy\lang\is-nc8f1.tmp в %ProgramFiles%\piriform\speccy\lang\lang-5146.dll
%ProgramFiles%\piriform\speccy\lang\is-h51uq.tmp в %ProgramFiles%\piriform\speccy\lang\lang-3098.dll
%ProgramFiles%\piriform\speccy\lang\is-drm1q.tmp в %ProgramFiles%\piriform\speccy\lang\lang-2074.dll
%ProgramFiles%\piriform\speccy\lang\is-7fva2.tmp в %ProgramFiles%\piriform\speccy\lang\lang-2070.dll
%ProgramFiles%\piriform\speccy\lang\is-8ufv6.tmp в %ProgramFiles%\piriform\speccy\lang\lang-2052.dll
%ProgramFiles%\piriform\speccy\lang\is-0sog8.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1102.dll
%ProgramFiles%\piriform\speccy\lang\is-64kh4.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1079.dll
%ProgramFiles%\piriform\speccy\lang\is-mjtpo.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1071.dll
%ProgramFiles%\piriform\speccy\lang\is-c5bit.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1068.dll
%ProgramFiles%\piriform\recuva\lang\is-2pcoq.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1038.dll
%ProgramFiles%\piriform\speccy\lang\is-pkn10.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1031.dll
%ProgramFiles%\piriform\speccy\lang\is-0m3jh.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1062.dll
%ProgramFiles%\piriform\speccy\lang\is-0i05f.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1060.dll
%ProgramFiles%\piriform\speccy\lang\is-033tt.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1055.dll
%ProgramFiles%\piriform\speccy\lang\is-opbl1.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1053.dll
%ProgramFiles%\piriform\speccy\lang\is-ini3n.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1052.dll
%ProgramFiles%\piriform\speccy\lang\is-vcp63.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1051.dll
%ProgramFiles%\piriform\speccy\lang\is-joc2k.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1050.dll
%ProgramFiles%\piriform\speccy\lang\is-pjho6.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1046.dll
%ProgramFiles%\piriform\speccy\lang\is-i4dqi.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1045.dll
%ProgramFiles%\piriform\speccy\lang\is-s92o2.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1043.dll
%ProgramFiles%\piriform\speccy\lang\is-7nc7k.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1041.dll
%ProgramFiles%\piriform\speccy\lang\is-r6mhp.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1040.dll
%ProgramFiles%\piriform\speccy\lang\is-ug0c9.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1038.dll
%ProgramFiles%\piriform\speccy\lang\is-pu3ik.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1037.dll
%ProgramFiles%\piriform\speccy\lang\is-orc33.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1066.dll
%ProgramFiles%\piriform\speccy\lang\is-umnb4.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1036.dll
%ProgramFiles%\piriform\recuva\lang\is-nenf2.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1037.dll
%ProgramFiles%\piriform\recuva\lang\is-479bp.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1036.dll
%ProgramFiles%\piriform\recuva\lang\is-4g835.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1035.dll
%ProgramFiles%\piriform\speccy\lang\is-kbr7e.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1058.dll
%ProgramFiles%\piriform\defraggler\lang\is-gb85f.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1038.dll
%ProgramFiles%\piriform\defraggler\lang\is-jn64o.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1037.dll
%ProgramFiles%\piriform\defraggler\lang\is-7djil.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1036.dll
%ProgramFiles%\piriform\defraggler\lang\is-5kef9.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1035.dll
%ProgramFiles%\piriform\defraggler\lang\is-96j89.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1034.dll
%ProgramFiles%\piriform\defraggler\lang\is-gcftt.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1032.dll
%ProgramFiles%\piriform\defraggler\lang\is-csoam.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1031.dll
%ProgramFiles%\piriform\defraggler\lang\is-0q5nt.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1030.dll
%ProgramFiles%\piriform\defraggler\lang\is-0gaej.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1029.dll
%ProgramFiles%\piriform\defraggler\lang\is-v817p.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1028.dll
%ProgramFiles%\piriform\defraggler\lang\is-nak2s.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1027.dll
%ProgramFiles%\piriform\defraggler\lang\is-p65tb.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1026.dll
%ProgramFiles%\piriform\defraggler\lang\is-1mram.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1025.dll
%ProgramFiles%\piriform\recuva\is-gugvg.tmp в %ProgramFiles%\piriform\recuva\recuvashell64.dll
%ProgramFiles%\piriform\defraggler\lang\is-qe2ih.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1041.dll
%ProgramFiles%\piriform\speccy\lang\is-3hher.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1049.dll
%ProgramFiles%\piriform\speccy\is-l6hmk.tmp в %ProgramFiles%\piriform\speccy\branding.dll
%ProgramFiles%\piriform\recuva\lang\is-cll8k.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1059.dll
%ProgramFiles%\piriform\recuva\lang\is-inrfm.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1058.dll
%ProgramFiles%\piriform\recuva\lang\is-2s915.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1049.dll
%ProgramFiles%\piriform\recuva\is-ehuqn.tmp в %ProgramFiles%\piriform\recuva\branding.dll
%ProgramFiles%\piriform\defraggler\lang\is-e81n3.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1059.dll
%ProgramFiles%\piriform\defraggler\lang\is-m1vk1.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1058.dll
%ProgramFiles%\piriform\defraggler\lang\is-88ub9.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1049.dll
%ProgramFiles%\piriform\defraggler\is-va6gb.tmp в %ProgramFiles%\piriform\defraggler\branding.dll
%ProgramFiles%\piriform\speccy\is-pg7dm.tmp в %ProgramFiles%\piriform\speccy\speccy.dat
%ProgramFiles%\piriform\recuva\is-v9kfd.tmp в %ProgramFiles%\piriform\recuva\recuva.dat
%ProgramFiles%\piriform\defraggler\is-5o8mj.tmp в %ProgramFiles%\piriform\defraggler\defraggler.dat
%TEMP%\is-8n7vn.tmp\is-3aaqm.tmp в %TEMP%\is-8n7vn.tmp\syspin.exe
%ProgramFiles%\piriform\speccy\lang\is-957vj.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1059.dll
%ProgramFiles%\piriform\speccy\lang\is-rqiv6.tmp в %ProgramFiles%\piriform\speccy\lang\lang-1067.dll
%ProgramFiles%\piriform\defraggler\lang\is-rcbj2.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1043.dll
%ProgramFiles%\piriform\defraggler\lang\is-p2h61.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1046.dll
%ProgramFiles%\piriform\defraggler\lang\is-r27nu.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1044.dll
%ProgramFiles%\piriform\recuva\lang\is-5593m.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1034.dll
%ProgramFiles%\piriform\recuva\lang\is-pctne.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1032.dll
%ProgramFiles%\piriform\recuva\lang\is-hi4ar.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1031.dll
%ProgramFiles%\piriform\recuva\lang\is-g4c7j.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1030.dll
%ProgramFiles%\piriform\recuva\lang\is-svl6p.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1029.dll
%ProgramFiles%\piriform\recuva\lang\is-n1j1f.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1028.dll
%ProgramFiles%\piriform\recuva\lang\is-h79q8.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1027.dll
%ProgramFiles%\piriform\recuva\lang\is-t6jv8.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1026.dll
%ProgramFiles%\piriform\recuva\lang\is-vf8na.tmp в %ProgramFiles%\piriform\recuva\lang\lang-1025.dll
%ProgramFiles%\piriform\defraggler\lang\is-buqhc.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-9999.dll
%ProgramFiles%\piriform\defraggler\lang\is-p7c18.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-5146.dll
%ProgramFiles%\piriform\defraggler\lang\is-4c7of.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-2070.dll
%ProgramFiles%\piriform\defraggler\lang\is-r1mui.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-2052.dll
%ProgramFiles%\piriform\defraggler\lang\is-li7ri.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1045.dll
%ProgramFiles%\piriform\defraggler\lang\is-4tmfe.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1079.dll
%ProgramFiles%\piriform\defraggler\lang\is-aik89.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1040.dll
%ProgramFiles%\piriform\defraggler\lang\is-ftopo.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1066.dll
%ProgramFiles%\piriform\defraggler\lang\is-h8a7s.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1065.dll
%ProgramFiles%\piriform\defraggler\lang\is-sc8mu.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1063.dll
%ProgramFiles%\piriform\defraggler\lang\is-0cjsd.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1062.dll
%ProgramFiles%\piriform\defraggler\lang\is-e2mq5.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1061.dll
%ProgramFiles%\piriform\defraggler\lang\is-8csau.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1060.dll
%ProgramFiles%\piriform\defraggler\lang\is-nleo5.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1057.dll
%ProgramFiles%\piriform\defraggler\lang\is-2ehnl.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1055.dll
%ProgramFiles%\piriform\defraggler\lang\is-j4j50.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1053.dll
%ProgramFiles%\piriform\defraggler\lang\is-s9oct.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1052.dll
%ProgramFiles%\piriform\defraggler\lang\is-luslu.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1051.dll
%ProgramFiles%\piriform\defraggler\lang\is-3uald.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1050.dll
%ProgramFiles%\piriform\defraggler\lang\is-aljjh.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1048.dll
%ProgramFiles%\piriform\defraggler\lang\is-sg9r2.tmp в %ProgramFiles%\piriform\defraggler\lang\lang-1071.dll
%ProgramFiles%\piriform\speccy\is-946pe.tmp в %ProgramFiles%\piriform\speccy\speccy.exe

Подменяет следующие файлы

%ProgramFiles%\piriform\defraggler\defraggler.dat
%ProgramFiles%\piriform\recuva\recuva.dat
%ProgramFiles%\piriform\speccy\speccy.dat
%ProgramFiles%\piriform\defraggler\defragglershell64.dll
%ProgramFiles%\piriform\recuva\recuvashell64.dll

Сетевая активность

Подключается к

'ge###toway.com':443
'x1.#.lencr.org':80
'x2.#.lencr.org':80
'e1.#.lencr.org':80

TCP

Запросы HTTP GET

http://x1.#.lencr.org/
http://x2.#.lencr.org/
http://e1.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTvkAFw3ViPKmUeIVEf3NC7b1ErqwQUWvPtK%2Fw2wjd5uVIw6lRvz1XLLqwCEgNjTyixZi%2F47JUm7fMDNF7Kaw%3D%3D

Другие

'ge###toway.com':443

UDP

DNS ASK ge###toway.com
DNS ASK microsoft.com
DNS ASK x1.#.lencr.org
DNS ASK x2.#.lencr.org
DNS ASK e1.#.lencr.org

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: 'Static' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\rarsfx0\setup.exe' /VERYSILENT /MERGETASKS=desktopicon
'%TEMP%\is-4aauh.tmp\setup.tmp' /SL5="$10242,11722357,64512,%TEMP%\RarSFX0\Setup.exe" /VERYSILENT /MERGETASKS=desktopicon

Запускает на исполнение

'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Piriform\Defraggler\DefragglerShell64.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Piriform\Recuva\RecuvaShell64.dll"
'%WINDIR%\regedit.exe' /S "%TEMP%\RarSFX0\settings.reg"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней