Trojan.Siggen32.12354

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\Software\Classes\CLSID\{FB562550-BBE6-4298-861A-5C0A6562C272}\Shell\Open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe'
[HKLM\Software\Classes\RevoUninstallerPro.ruel\shell\open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe /implog "%1"'
[HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'

Устанавливает следующие настройки сервисов

[HKLM\SYSTEM\CurrentControlSet\Services\Revoflt] 'ImagePath' = 'system32\DRIVERS\revoflt.sys'

Создает следующие сервисы

'Revoflt' system32\DRIVERS\revoflt.sys

Вредоносные функции

Завершает или пытается завершить

следующие пользовательские процессы:

firefox.exe
iexplore.exe

Регистрирует фильтр файловой системы

[HKLM\SYSTEM\CurrentControlSet\Services\Revoflt] 'Group' = 'FSFilter Activity Monitor'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\aut2968.tmp
C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\test.gif
%TEMP%\aut31d5.tmp
C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\setup.exe
%TEMP%\aut3699.tmp
C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\crack.exe
%TEMP%\aut36c9.tmp
C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\revo86.exe
%TEMP%\aut3709.tmp
C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\revo64.exe
%TEMP%\is-nh65q.tmp\setup.tmp
%TEMP%\is-7bvr0.tmp\_isetup\_setup64.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-fimuv.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-k7dr2.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4uogp.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-djfbl.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-lhgp9.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-n7c1l.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tv10m.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-d6h63.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ikeke.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-vv8sc.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-8nn59.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-j6to1.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-aa2l5.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2kn2v.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-gkgla.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-gtpj8.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-59rk7.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-udoh7.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-b7eri.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-a83df.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7iaub.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-h7s6s.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-orkmo.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ek20f.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qsak9.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ins7l.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9kspl.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7vi9v.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7j3aq.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-m2rra.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4cfb0.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-j7lbo.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-t1iam.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-q05dk.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-kqo5i.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-toubh.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-j4fgk.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-mk8eb.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-etso3.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-bh0j3.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-mhjdd.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-0knh5.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-sdi59.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-h0tg5.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-p3t5o.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-156dt.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-ibj3v.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-l0ikg.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-7soid.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-9t809.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-k1lur.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-l37lr.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-ga405.tmp
%ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\is-l7c81.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-gs2kl.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-gssdv.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-61mfo.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro on the web.url
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\uninstall revo uninstaller pro.lnk
C:\users\public\desktop\revo uninstaller pro.lnk
%APPDATA%\microsoft\internet explorer\quick launch\revo uninstaller pro.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro help.lnk
%ProgramFiles%\vs revo group\revo uninstaller pro\unins000.dat
<DRIVERS>\seta232.tmp
%LOCALAPPDATA%\vs revo group\revo uninstaller pro\data\cachedata.dat
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69370d57-81c.pma
%ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\revouninstallerpro4.lic
%TEMP%\aute381.tmp
%WINDIR%\performance\winsat\datastore\installfiles\install\denspike.gif
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69370d5c-2cc.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b3fb0ca3fad7c868_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2c34d010db26042b_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9d6e8435496d66cf_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ca62262cb8bf97c9_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a33811e4578cab1c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e94633b143e38b57_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b312220c688dca5a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a3092ddd8a475e39_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8efbddd8b4e33e2d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5d00eab6d695654e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000c
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\242bfd7fa1b30002_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\afd424038ea7b801_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\2cc80dabc69f58b6_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index-dir\temp-index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000d
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3e919434e09aeaa6_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\2cc80dabc69f58b6_1
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000e
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6c3f02ec7a13e358_0
%LOCALAPPDATA%\microsoft\edge\user data\default\quotamanager-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000f
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000010
%LOCALAPPDATA%\microsoft\edge\user data\default\quotamanager
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\303018fa33318fbb_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a629eef85682a981_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8c3a26a450f326a3_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000011
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000012
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\828b7ec5d7fa435c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000013
%TEMP%\3a346594-5bb0-482f-bec2-e4e5c583d80c.tmp
%TEMP%\c8152151-8663-435e-b91c-e205a787ba81.tmp
%TEMP%\861e7e92-161c-461f-8e14-848ea3ab1df0.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000004
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000004.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
%LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log

Удаляет файлы, которые сам же создал

%TEMP%\aut2968.tmp
%TEMP%\aut31d5.tmp
%TEMP%\aut3699.tmp
%TEMP%\aut36c9.tmp
%TEMP%\aut3709.tmp
%TEMP%\is-7bvr0.tmp\_isetup\_setup64.tmp
%TEMP%\is-nh65q.tmp\setup.tmp
%TEMP%\aute381.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69370d57-81c.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69370d5c-2cc.pma

Перемещает следующие файлы

%ProgramFiles%\vs revo group\revo uninstaller pro\is-fimuv.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\unins000.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-k7dr2.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\albanian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4uogp.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\arabic.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-djfbl.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\armenian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-lhgp9.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\azerbaijani.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-n7c1l.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\bengali.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tv10m.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\bulgarian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-d6h63.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\czech.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ikeke.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\danish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-vv8sc.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\dutch.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-8nn59.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\english.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-j6to1.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\estonian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-aa2l5.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\finnish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2kn2v.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\french.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-gkgla.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\german.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-gtpj8.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hebrew.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-59rk7.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hellenic.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-udoh7.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hindi.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-b7eri.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hrvatski.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-a83df.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hungarian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7iaub.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\italiano.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-h7s6s.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\indonesian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-orkmo.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\japanese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ek20f.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\korean.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qsak9.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\kurdish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ins7l.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\macedonian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9kspl.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\norwegian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7vi9v.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\persian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7j3aq.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\polish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-m2rra.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguesebrazil.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4cfb0.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-j7lbo.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguese_standard.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-t1iam.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\romanian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-q05dk.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\russian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-kqo5i.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\serbian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-toubh.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\serbianlatin.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-j4fgk.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\simplifiedchinese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-mk8eb.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\slovak.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-etso3.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\slovenian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-bh0j3.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\swedish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-mhjdd.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\spanish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-0knh5.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\traditionalchinese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-sdi59.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\turkish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-h0tg5.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\ukrainian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-p3t5o.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\vietnamese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\is-156dt.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.inf
%ProgramFiles%\vs revo group\revo uninstaller pro\is-ibj3v.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\is-l0ikg.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revocmd.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\is-7soid.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoappbar.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\is-9t809.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\ruext.dll
%ProgramFiles%\vs revo group\revo uninstaller pro\is-k1lur.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.sys
%ProgramFiles%\vs revo group\revo uninstaller pro\is-l37lr.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revo uninstaller pro help.pdf
%ProgramFiles%\vs revo group\revo uninstaller pro\is-ga405.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\license.txt
%ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\is-l7c81.tmp в %ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\revouninstallerpro4.lic
%ProgramFiles%\vs revo group\revo uninstaller pro\is-gs2kl.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\ruplp.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\is-gssdv.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\rupilogs.rupldb
%ProgramFiles%\vs revo group\revo uninstaller pro\is-61mfo.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\reg_lp.bat
<DRIVERS>\seta232.tmp в <DRIVERS>\revoflt.sys
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\current
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index-dir\temp-index в %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index-dir\the-real-index
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\current
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current

Изменяет следующие файлы

%LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl
%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\edge\user data\default\visited links
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\history
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
%LOCALAPPDATA%\microsoft\edge\user data\last browser
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons

Подменяет следующие файлы

%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index-dir\temp-index
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG

Сетевая активность

Подключается к

'co####.edge.skype.com':443
're####installer.com':80
're####installer.com':443
'23.##5.2.144':80
'fo###.gstatic.com':443
'st######h.bootstrapcdn.com':443
'pk#.goog':80
'st####.zdassets.com':443
'aj##.#oogleapis.com':443
'cd#.##delivr.net':443
'wi####.trustpilot.com':443
'f0##################-b74530d2d26278124f446233f95622ef.ssl.cf1.rackcdn.com':443
'st####.elfsight.com':443
'fo###.#oogleapis.com':443
'ap#.#ailjet.com':443
'go#####agmanager.com':443
'cr#.####g2.amazontrust.com':80
'x.##2.us':80
'xw###.mjt.lu':443
'st#####.elfsight.com':443
'x1.#.lencr.org':80
'co#####.facebook.net':443
'google.com':443
'un#######static.elfsightcdn.com':443
'fa###ook.com':443
'st###.#.doubleclick.net':443
'go##le.ru':443
'vs#####roup.zendesk.com':443
'wi######ediator.zopim.com':443

TCP

Запросы HTTP GET

http://www.re####installer.com/proinstall_thankyou.html
http://pk#.goog/gsr1/gsr1.crt
http://cr#.####g2.amazontrust.com/rootg2.cer
http://x.##2.us/x.cer

Другие

'co####.edge.skype.com':443
're####installer.com':443
'fo###.gstatic.com':443
'st######h.bootstrapcdn.com':443
'ek#.##assets.com':443
'aj##.#oogleapis.com':443
'cd#.##delivr.net':443
'wi####.trustpilot.com':443
'co##.###vice.elfsight.com':443
'fo###.#oogleapis.com':443
'ap#.#ailjet.com':443
'go#####agmanager.com':443
'f0##################-b74530d2d26278124f446233f95622ef.ssl.cf1.rackcdn.com':443
'xw###.mjt.lu':443
'co#####.facebook.net':443
'google.com':443
'a###ytics.google.com':443
'un#######static.elfsightcdn.com':443
'fa###ook.com':443
'st###.#.doubleclick.net':443
'vs#####roup.zendesk.com':443
'wi######ediator.zopim.com':443

UDP

DNS ASK co####.edge.skype.com
DNS ASK re####installer.com
DNS ASK fo###.gstatic.com
DNS ASK aj##.#oogleapis.com
DNS ASK cd#.##delivr.net
DNS ASK st######h.bootstrapcdn.com
DNS ASK pk#.goog
DNS ASK st####.zdassets.com
DNS ASK wi####.trustpilot.com
DNS ASK f0##################-b74530d2d26278124f446233f95622ef.ssl.cf1.rackcdn.com
DNS ASK st####.elfsight.com
DNS ASK ap#.#ailjet.com
DNS ASK go#####agmanager.com
DNS ASK fo###.#oogleapis.com
DNS ASK cr#.####g2.amazontrust.com
DNS ASK x.##2.us
DNS ASK xw###.mjt.lu
DNS ASK co##.###vice.elfsight.com
DNS ASK se#########iews-ultimate.elfsight.com
DNS ASK st#####.elfsight.com
DNS ASK ek#.##assets.com
DNS ASK x1.#.lencr.org
DNS ASK google.com
DNS ASK co#####.facebook.net
DNS ASK a###ytics.google.com
DNS ASK st###.#.doubleclick.net
DNS ASK go##le.ru
DNS ASK un#######static.elfsightcdn.com
DNS ASK fa###ook.com
DNS ASK vs#####roup.zendesk.com
DNS ASK wi######ediator.zopim.com

Другое

Ищет следующие окна

ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
ClassName: 'EDIT' WindowName: ''
ClassName: 'BUTTON' WindowName: ''

Создает и запускает на исполнение

'C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-nh65q.tmp\setup.tmp' /SL5="$1D002E,16038129,188928,C:\Users\Default\AppData\Local\Microsoft\Windows\History\installfiles\install\setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%ProgramFiles%\vs revo group\revo uninstaller pro\ruplp.exe' /regserver /NOREDIRECT
'%ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe' /bc
'C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\crack.exe'
'C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\revo64.exe'

Запускает на исполнение

'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
'<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
'<SYSTEM32>\runonce.exe' -r
'<SYSTEM32>\grpconv.exe' -o
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.revouninstaller.com/proinstall_thankyou.html
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate http://www.revouninstaller.com/proinstall_thankyou.html (со скрытым окном)
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,5214096453742055375,9926291472077295943,131072 --lang=en-US --service-sandbox-type=none --mojo-p...
'C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- (со скрытым окном)
'C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\crack.exe' (со скрытым окном)
'C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\revo64.exe' (со скрытым окном)

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней