Trojan.Siggen9.43036

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MarketAdvior' = '"%APPDATA%\MarketAdvior\python\pythonw.exe" "load.pyc" ml2'

Creates or modifies the following files

<SYSTEM32>\tasks\marketadvior
<SYSTEM32>\tasks\marketadvior2

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\ProxyVan2] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\ProxyVan2] 'ImagePath' = '%ProgramFiles(x86)%\ProxyVan\Service\ProxyVan.exe'
[<HKLM>\System\CurrentControlSet\Services\ProxyVanUpdater] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\ProxyVanUpdater] 'ImagePath' = '%ProgramFiles(x86)%\ProxyVan\Updater\ProxyVanUpdater.exe'

Malicious functions

Creates and executes the following

'' (downloaded from the Internet)

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im "gamesdepartupdate.exe"

Modifies file system

Creates the following files

%TEMP%\marketadvior.exe
%ProgramFiles(x86)%\proxyvan\updater\is-vppk6.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-04mo5.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-3v0sd.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-ficd9.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-ti7at.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-a9jsg.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-o3312.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-rudce.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-n4gjb.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-jeidv.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-uv3bi.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-06ima.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-j1nqn.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-9sh8r.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-8jcr4.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-51mh8.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-j672a.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-r4adc.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-lh331.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-b1pvb.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-gsb7d.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-mnrmm.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-ijgia.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-lkdsp.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-coeei.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-1j7kc.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-82g2p.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-vnaen.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-7fggb.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-p10tb.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-v1c16.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-foof0.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-c6u1o.tmp
%ProgramFiles(x86)%\proxyvan\service\is-q0hiu.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-b4vrf.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-ohh4r.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-6nddv.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-vjhar.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-jd0ps.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-77abh.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-5nraa.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-ia2lu.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-pfl8m.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-b6kvp.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-9esah.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-r3d74.tmp
%ProgramFiles(x86)%\proxyvan\service\is-jguii.tmp
%ProgramFiles(x86)%\proxyvan\service\is-63us2.tmp
%ProgramFiles(x86)%\proxyvan\service\is-gpf4e.tmp
%ProgramFiles(x86)%\proxyvan\service\is-7tl9u.tmp
%ProgramFiles(x86)%\proxyvan\service\is-4jgd3.tmp
%ProgramFiles(x86)%\proxyvan\service\is-stf56.tmp
%ProgramFiles(x86)%\proxyvan\service\is-ffeh8.tmp
%ProgramFiles(x86)%\proxyvan\service\is-rqo8a.tmp
%ProgramFiles(x86)%\proxyvan\service\is-5scfp.tmp
%ProgramFiles(x86)%\proxyvan\service\is-93ij4.tmp
%ProgramFiles(x86)%\proxyvan\service\is-n1srr.tmp
%ProgramFiles(x86)%\proxyvan\service\is-84ksk.tmp
%ProgramFiles(x86)%\proxyvan\service\is-sir6r.tmp
%ProgramFiles(x86)%\proxyvan\service\is-9pfl4.tmp
%ProgramFiles(x86)%\proxyvan\service\is-8hpqe.tmp
%ProgramFiles(x86)%\proxyvan\service\is-esso5.tmp
%ProgramFiles(x86)%\proxyvan\service\is-ioo2h.tmp
%ProgramFiles(x86)%\proxyvan\service\is-nmtef.tmp
%ProgramFiles(x86)%\proxyvan\service\is-pvt34.tmp
%ProgramFiles(x86)%\proxyvan\service\is-7shsi.tmp
%ProgramFiles(x86)%\proxyvan\service\is-pkq49.tmp
%ProgramFiles(x86)%\proxyvan\service\is-3cvnu.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-ed7r3.tmp
%ProgramFiles(x86)%\proxyvan\service\is-19ae3.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-n578b.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-6ircr.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-dvl2j.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-2sdip.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-bcoj9.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-019p7.tmp
%ProgramFiles(x86)%\proxyvan\service\ru\is-ji9g2.tmp
%ProgramFiles(x86)%\proxyvan\service\ru\is-6tnnm.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-3h4bd.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-jt5s1.tmp
%ProgramFiles(x86)%\proxyvan\service\is-i2h9q.tmp
%ProgramFiles(x86)%\proxyvan\service\is-8mcf1.tmp
%ProgramFiles(x86)%\proxyvan\service\is-7c7la.tmp
%ProgramFiles(x86)%\proxyvan\service\is-m1nh7.tmp
%ProgramFiles(x86)%\proxyvan\service\is-4c5e2.tmp
%ProgramFiles(x86)%\proxyvan\service\is-fbli2.tmp
%ProgramFiles(x86)%\proxyvan\service\is-kdbou.tmp
%ProgramFiles(x86)%\proxyvan\service\is-hukvb.tmp
%ProgramFiles(x86)%\proxyvan\service\is-2v2v3.tmp
%ProgramFiles(x86)%\proxyvan\service\is-u83gr.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-pkuvn.tmp
%TEMP%\is-qama2.tmp\idp.dll
%ProgramFiles(x86)%\proxyvan\updater\is-d2c5t.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-t48ck.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-ct281.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-t07ei.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-uiidh.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-7oh55.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-um335.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-tr7e6.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-9qq22.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-fquem.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-0t5hl.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-brtkt.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-e6m1j.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-v4bac.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-ss0jp.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-856lt.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-tvtmd.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-4tkdh.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-vuodq.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-mg1oh.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-ct21d.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-p72en.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-b8ftp.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-a19mp.tmp
%TEMP%\is-qama2.tmp\_isetup\_setup64.tmp
%TEMP%\is-19rgd.tmp\gamesdepart.000.5241.0.tmp
%TEMP%\is-obsqs.tmp\idp.dll
%TEMP%\is-obsqs.tmp\_isetup\_setup64.tmp
%TEMP%\is-uu5cd.tmp\gamesdepart.000.5241.0.tmp
%ProgramFiles(x86)%\proxyvan\unins000.dat
%ProgramFiles(x86)%\proxyvan\unins000.msg
%PROGRAMDATA%\microsoft\windows\start menu\programs\proxyvan\uninstall proxyvan.lnk
%ProgramFiles(x86)%\proxyvan\updater\ru\is-jmlhs.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-cp186.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-rpbhk.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-omu4i.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-0lk5m.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-7lq7i.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-fe4dc.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-hiuv0.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-cm8ri.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-h9pgh.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-h50np.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-7qn42.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-pd080.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-atanv.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-cn1sq.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-thd05.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-pipk6.tmp
%TEMP%\gamesdepart.000.5241.0.exe
%ProgramFiles(x86)%\proxyvan\updater\is-31b5r.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-3i0nk.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-ikl4e.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-0kbf8.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-3ebj2.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-88062.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-4qd74.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-o9g0c.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-akce9.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-s1edn.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-jbdof.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-ohnar.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-j62hp.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-6c7jq.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-ehkcm.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-jvmgd.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-92avv.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-4rdh5.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-gcvdv.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-t0i37.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-stjlb.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-vrsei.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-ick3f.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-g9nmt.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-cl248.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-f94ho.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-d80ua.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-8dfn9.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-fqp9n.tmp
%ProgramFiles(x86)%\proxyvan\service\is-vml7a.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-gpkrp.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-nrns5.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-omict.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-s2233.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-kq0iv.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-m0i7q.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-q05r1.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-e5o5n.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-19mna.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-6370f.tmp
%ProgramFiles(x86)%\proxyvan\updater\is-nf55r.tmp
%ProgramFiles(x86)%\proxyvan\updater\ru\is-auf8j.tmp
%ProgramFiles(x86)%\proxyvan\service\is-hib04.tmp
%ProgramFiles(x86)%\proxyvan\service\is-94e38.tmp
%ProgramFiles(x86)%\proxyvan\service\is-q6su9.tmp
%ProgramFiles(x86)%\proxyvan\service\is-eloas.tmp
%ProgramFiles(x86)%\proxyvan\service\is-b0u61.tmp
%ProgramFiles(x86)%\proxyvan\service\is-gbef4.tmp
%ProgramFiles(x86)%\proxyvan\service\is-jmlmp.tmp
%ProgramFiles(x86)%\proxyvan\service\is-cd4dv.tmp
%ProgramFiles(x86)%\proxyvan\service\is-0i5s2.tmp
%ProgramFiles(x86)%\proxyvan\service\is-ge83a.tmp
%ProgramFiles(x86)%\proxyvan\service\is-6tcek.tmp
%ProgramFiles(x86)%\proxyvan\service\is-b1b7b.tmp
%ProgramFiles(x86)%\proxyvan\service\is-m0j6h.tmp
%ProgramFiles(x86)%\proxyvan\service\is-is6od.tmp
%ProgramFiles(x86)%\proxyvan\service\is-3fmt1.tmp
%ProgramFiles(x86)%\proxyvan\service\is-s22l7.tmp
%ProgramFiles(x86)%\proxyvan\service\is-i28un.tmp
%ProgramFiles(x86)%\proxyvan\service\is-tpm6l.tmp
%ProgramFiles(x86)%\proxyvan\is-onfd9.tmp
%TEMP%\is-5lkps.tmp\_isetup\_iscrypt.dll
%TEMP%\is-5lkps.tmp\_isetup\_setup64.tmp
%TEMP%\tmp8346.tmp
%TEMP%\is-j8tsj.tmp\tmp8346.tmp
%ProgramFiles(x86)%\proxyvan\service\is-3d57i.tmp
%ProgramFiles(x86)%\proxyvan\service\is-sfcv7.tmp
%ProgramFiles(x86)%\proxyvan\service\is-i571e.tmp
%ProgramFiles(x86)%\proxyvan\service\is-3nhij.tmp
%ProgramFiles(x86)%\proxyvan\service\is-dc23s.tmp
%ProgramFiles(x86)%\proxyvan\service\is-1nguj.tmp
%ProgramFiles(x86)%\proxyvan\service\is-oooev.tmp
%ProgramFiles(x86)%\proxyvan\service\is-ud0un.tmp
%ProgramFiles(x86)%\proxyvan\service\is-cq50g.tmp
%ProgramFiles(x86)%\proxyvan\service\is-dbcc4.tmp
%ProgramFiles(x86)%\proxyvan\service\is-o2stg.tmp
%ProgramFiles(x86)%\proxyvan\service\is-3ogk7.tmp
%APPDATA%\marketadvior\python\winsound.pyd
%ProgramFiles(x86)%\proxyvan\service\is-0rckl.tmp
%ProgramFiles(x86)%\proxyvan\service\is-6lne6.tmp
%ProgramFiles(x86)%\proxyvan\service\is-uip1b.tmp
%ProgramFiles(x86)%\proxyvan\service\is-7l9i7.tmp
%ProgramFiles(x86)%\proxyvan\service\is-ajh2f.tmp
%ProgramFiles(x86)%\proxyvan\service\is-u7cmb.tmp
%ProgramFiles(x86)%\proxyvan\service\is-fdcsc.tmp
%ProgramFiles(x86)%\proxyvan\service\is-f8n1r.tmp
%ProgramFiles(x86)%\proxyvan\service\is-cqj3p.tmp
%TEMP%\installer_2.21.3.exe
%TEMP%\tmpyt879lrz
%APPDATA%\marketadvior\uninstall.exe
%APPDATA%\marketadvior\python\_sqlite3.pyd
%APPDATA%\marketadvior\python\_socket.pyd
%APPDATA%\marketadvior\python\_queue.pyd
%APPDATA%\marketadvior\python\_overlapped.pyd
%APPDATA%\marketadvior\python\_multiprocessing.pyd
%APPDATA%\marketadvior\python\_msi.pyd
%APPDATA%\marketadvior\python\_lzma.pyd
%APPDATA%\marketadvior\python\_hashlib.pyd
%APPDATA%\marketadvior\python\_elementtree.pyd
%APPDATA%\marketadvior\python\_decimal.pyd
%APPDATA%\marketadvior\python\_ctypes.pyd
%APPDATA%\marketadvior\python\_bz2.pyd
%APPDATA%\marketadvior\python\_asyncio.pyd
%APPDATA%\marketadvior\python\license.txt
%APPDATA%\marketadvior\mcfckchjhehcdgoeihjjjbkcdpdfmloa.crx
%APPDATA%\marketadvior\load.pyc
%APPDATA%\marketadvior\load.bin
%TEMP%\nswd42b.tmp
%APPDATA%\marketadvior\python\libcrypto-1_1.dll
%APPDATA%\marketadvior\python\libssl-1_1.dll
%APPDATA%\marketadvior\python\_ssl.pyd
%APPDATA%\marketadvior\python\pyexpat.pyd
%APPDATA%\marketadvior\pbsent.txt
%APPDATA%\marketadvior\python\python.exe
%TEMP%\tmp2hdej9ri
%TEMP%\xbn4rjqv
%APPDATA%\marketadvior\uuid.txt
%APPDATA%\marketadvior\pb2url.txt
%APPDATA%\marketadvior\pburl.txt
%APPDATA%\marketadvior\pbid.txt
%APPDATA%\marketadvior\subid.txt
%APPDATA%\marketadvior\pi.txt
%ProgramFiles(x86)%\proxyvan\service\is-vlee7.tmp
%ProgramFiles(x86)%\proxyvan\service\is-ks35r.tmp
%APPDATA%\marketadvior\python\vcruntime140.dll
%APPDATA%\marketadvior\python\unicodedata.pyd
%APPDATA%\marketadvior\python\sqlite3.dll
%APPDATA%\marketadvior\python\select.pyd
%APPDATA%\marketadvior\python\pythonw.exe
%APPDATA%\marketadvior\python\python37.zip
%APPDATA%\marketadvior\python\python37.dll
%APPDATA%\marketadvior\python\python37._pth
%APPDATA%\marketadvior\python\python3.dll
%TEMP%\nskdd92.tmp\nsexec.dll
%ProgramFiles(x86)%\proxyvan\service\is-38i27.tmp
%ProgramFiles(x86)%\proxyvan\service\is-sotmc.tmp
%ProgramFiles(x86)%\proxyvan\service\is-c9t7j.tmp
%ProgramFiles(x86)%\proxyvan\service\is-3j13d.tmp
%ProgramFiles(x86)%\proxyvan\service\is-3im61.tmp
%ProgramFiles(x86)%\proxyvan\service\is-5kglq.tmp
%ProgramFiles(x86)%\proxyvan\service\is-3mslk.tmp
%ProgramFiles(x86)%\proxyvan\service\is-v9od8.tmp
%ProgramFiles(x86)%\proxyvan\service\is-ciof0.tmp
%ProgramFiles(x86)%\proxyvan\service\is-dus5q.tmp
%ProgramFiles(x86)%\proxyvan\service\is-ofmu7.tmp
%ProgramFiles(x86)%\proxyvan\service\is-els1v.tmp
%ProgramFiles(x86)%\proxyvan\service\is-sj9gi.tmp
%ProgramFiles(x86)%\proxyvan\service\is-jr44a.tmp
%ProgramFiles(x86)%\proxyvan\service\is-1cf6h.tmp
%ProgramFiles(x86)%\proxyvan\service\is-vvkpq.tmp
%ProgramFiles(x86)%\proxyvan\service\is-5uslu.tmp
%ProgramFiles(x86)%\proxyvan\service\is-3fnjj.tmp
%ProgramFiles(x86)%\proxyvan\service\is-0a6rp.tmp
%ProgramFiles(x86)%\proxyvan\service\is-35kh2.tmp
%ProgramFiles(x86)%\proxyvan\service\is-e0juc.tmp
%ProgramFiles(x86)%\proxyvan\service\is-18rps.tmp
%ProgramFiles(x86)%\proxyvan\service\is-33o7v.tmp
%ProgramFiles(x86)%\proxyvan\service\is-csmv8.tmp
%ProgramFiles(x86)%\proxyvan\service\is-mocjf.tmp
%ProgramFiles(x86)%\proxyvan\service\is-samm3.tmp
%ProgramFiles(x86)%\proxyvan\service\is-dl10m.tmp
%ProgramFiles(x86)%\proxyvan\service\is-7iedq.tmp
%ProgramFiles(x86)%\proxyvan\service\is-t0lss.tmp
%ProgramFiles(x86)%\proxyvan\service\is-i7mo4.tmp
%ProgramFiles(x86)%\proxyvan\service\is-8638r.tmp
%ProgramFiles(x86)%\proxyvan\service\is-5njee.tmp
%ProgramFiles(x86)%\proxyvan\service\is-osvg0.tmp
%ProgramFiles(x86)%\proxyvan\service\is-k1div.tmp
%ProgramFiles(x86)%\proxyvan\service\is-a0860.tmp
%ProgramFiles(x86)%\proxyvan\service\is-jicgo.tmp
%ProgramFiles(x86)%\proxyvan\service\is-mdbv3.tmp
%ProgramFiles(x86)%\proxyvan\service\is-vpvq4.tmp
%ProgramFiles(x86)%\proxyvan\service\is-8gk2e.tmp
%ProgramFiles(x86)%\proxyvan\service\is-vs41i.tmp
%ProgramFiles(x86)%\proxyvan\service\is-2om3e.tmp
%ProgramFiles(x86)%\proxyvan\service\is-tvtkr.tmp
%ProgramFiles(x86)%\proxyvan\service\is-bllcc.tmp
%ProgramFiles(x86)%\proxyvan\service\is-i7mih.tmp
%ProgramFiles(x86)%\proxyvan\service\is-k1kg7.tmp
%ProgramFiles(x86)%\proxyvan\service\is-rm3ud.tmp
%ProgramFiles(x86)%\proxyvan\service\is-jbpt5.tmp
%ProgramFiles(x86)%\proxyvan\service\is-dpu1e.tmp
%ProgramFiles(x86)%\proxyvan\service\is-6eq65.tmp
%ProgramFiles(x86)%\proxyvan\service\is-18oup.tmp
%ProgramFiles(x86)%\proxyvan\service\is-kfrup.tmp
%ProgramFiles(x86)%\proxyvan\service\is-ul8o7.tmp
%ProgramFiles(x86)%\proxyvan\service\is-6g5o5.tmp
%ProgramFiles(x86)%\proxyvan\service\is-42156.tmp
%ProgramFiles(x86)%\proxyvan\service\is-6th1e.tmp
%ProgramFiles(x86)%\proxyvan\service\is-5nbno.tmp
%ProgramFiles(x86)%\proxyvan\service\is-hggb2.tmp
%ProgramFiles(x86)%\proxyvan\service\is-pqtj6.tmp
%ProgramFiles(x86)%\proxyvan\service\is-l93ll.tmp
%ProgramFiles(x86)%\proxyvan\service\is-rucu0.tmp
%ProgramFiles(x86)%\proxyvan\service\is-v2ss4.tmp
%ProgramFiles(x86)%\proxyvan\service\is-h3540.tmp
%ProgramFiles(x86)%\proxyvan\service\is-bggdk.tmp
%ProgramFiles(x86)%\proxyvan\service\is-38t86.tmp
%ProgramFiles(x86)%\proxyvan\service\is-jm6ni.tmp
%ProgramFiles(x86)%\proxyvan\service\is-ail6s.tmp
%ProgramFiles(x86)%\proxyvan\service\is-2c1vj.tmp
%ProgramFiles(x86)%\proxyvan\service\is-neom4.tmp
%ProgramFiles(x86)%\proxyvan\service\is-903vb.tmp
%ProgramFiles(x86)%\proxyvan\service\is-fg2r4.tmp
%ProgramFiles(x86)%\proxyvan\service\is-loqon.tmp
%ProgramFiles(x86)%\proxyvan\service\is-lja2o.tmp
%ProgramFiles(x86)%\proxyvan\service\is-shcfo.tmp
%ProgramFiles(x86)%\proxyvan\service\is-i8rpg.tmp
%ProgramFiles(x86)%\proxyvan\service\is-g05og.tmp
%ProgramFiles(x86)%\proxyvan\service\is-qfmpo.tmp
%ProgramFiles(x86)%\proxyvan\service\is-2k39l.tmp
%ProgramFiles(x86)%\proxyvan\service\is-dn3em.tmp
%ProgramFiles(x86)%\proxyvan\service\is-pm6hb.tmp
%ProgramFiles(x86)%\proxyvan\service\is-9t8nb.tmp
%ProgramFiles(x86)%\proxyvan\service\is-bee8v.tmp
%ProgramFiles(x86)%\proxyvan\service\is-6ujn4.tmp
%ProgramFiles(x86)%\proxyvan\service\is-l9cdk.tmp
%ProgramFiles(x86)%\proxyvan\service\is-vrbg3.tmp
%ProgramFiles(x86)%\proxyvan\service\is-1u8gu.tmp
%ProgramFiles(x86)%\proxyvan\service\is-qkmki.tmp
%ProgramFiles(x86)%\proxyvan\service\is-2ra5a.tmp
%ProgramFiles(x86)%\proxyvan\service\is-k849a.tmp
%ProgramFiles(x86)%\proxyvan\service\is-8n4lp.tmp
%ProgramFiles(x86)%\proxyvan\service\is-0bevn.tmp
%ProgramFiles(x86)%\proxyvan\service\is-bgiov.tmp
%ProgramFiles(x86)%\proxyvan\service\is-stbs8.tmp
%ProgramFiles(x86)%\proxyvan\service\is-bjhbv.tmp
%TEMP%\is-qama2.tmp\gamesdepart.zip

Deletes the following files

%TEMP%\xbn4rjqv
%TEMP%\nskdd92.tmp\nsexec.dll
%TEMP%\tmp2hdej9ri
%TEMP%\tmpyt879lrz
%TEMP%\is-5lkps.tmp\_isetup\_iscrypt.dll
%TEMP%\is-5lkps.tmp\_isetup\_setup64.tmp
%TEMP%\is-j8tsj.tmp\tmp8346.tmp
%TEMP%\is-obsqs.tmp\idp.dll
%TEMP%\is-obsqs.tmp\_isetup\_setup64.tmp
%TEMP%\is-uu5cd.tmp\gamesdepart.000.5241.0.tmp

Moves the following files

from %TEMP%\tmp8346.tmp to %TEMP%\tmp8346.exe
from %ProgramFiles(x86)%\proxyvan\updater\is-vjhar.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.componentmodel.annotations.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-jd0ps.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.collections.specialized.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-77abh.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.collections.nongeneric.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-5nraa.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.collections.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-ia2lu.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.collections.concurrent.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-pfl8m.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.buffers.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-ijgia.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.appcontext.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-mnrmm.tmp to %ProgramFiles(x86)%\proxyvan\updater\serilog.sinks.rollingfile.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-vppk6.tmp to %ProgramFiles(x86)%\proxyvan\updater\serilog.sinks.file.pdb
from %ProgramFiles(x86)%\proxyvan\updater\is-04mo5.tmp to %ProgramFiles(x86)%\proxyvan\updater\serilog.sinks.file.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-3v0sd.tmp to %ProgramFiles(x86)%\proxyvan\updater\serilog.sinks.console.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-ficd9.tmp to %ProgramFiles(x86)%\proxyvan\updater\serilog.extensions.logging.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-ti7at.tmp to %ProgramFiles(x86)%\proxyvan\updater\serilog.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-a9jsg.tmp to %ProgramFiles(x86)%\proxyvan\updater\proxyvanupdater.pdb
from %ProgramFiles(x86)%\proxyvan\updater\is-o3312.tmp to %ProgramFiles(x86)%\proxyvan\updater\proxyvanupdater.exe.config
from %ProgramFiles(x86)%\proxyvan\updater\is-n4gjb.tmp to %ProgramFiles(x86)%\proxyvan\updater\proxyvan.common.pdb
from %ProgramFiles(x86)%\proxyvan\updater\is-rudce.tmp to %ProgramFiles(x86)%\proxyvan\updater\proxyvanupdater.exe
from %ProgramFiles(x86)%\proxyvan\updater\is-6nddv.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.componentmodel.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-ohh4r.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.componentmodel.eventbasedasync.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-d2c5t.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.globalization.calendars.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-gpkrp.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.dynamic.runtime.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-rpbhk.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.drawing.primitives.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-jt5s1.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.diagnostics.tracing.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-lkdsp.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.diagnostics.tracesource.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-coeei.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.diagnostics.tools.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-1j7kc.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.diagnostics.textwritertracelistener.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-vnaen.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.diagnostics.process.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-uv3bi.tmp to %ProgramFiles(x86)%\proxyvan\updater\proxyvan.common.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-7fggb.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.diagnostics.fileversioninfo.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-p10tb.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.diagnostics.debug.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-v1c16.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.diagnostics.contracts.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-foof0.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.data.common.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-3h4bd.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.console.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-c6u1o.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.componentmodel.typeconverter.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-b4vrf.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.componentmodel.primitives.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-jeidv.tmp to %ProgramFiles(x86)%\proxyvan\updater\proxyvan.common.dll.config
from %ProgramFiles(x86)%\proxyvan\updater\is-06ima.tmp to %ProgramFiles(x86)%\proxyvan\updater\protobuf-net.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-6c7jq.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.globalization.extensions.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-019p7.tmp to %ProgramFiles(x86)%\proxyvan\updater\commandline.dll
from %ProgramFiles(x86)%\proxyvan\service\is-u83gr.tmp to %ProgramFiles(x86)%\proxyvan\service\system.xml.xpath.xdocument.dll
from %ProgramFiles(x86)%\proxyvan\service\is-q0hiu.tmp to %ProgramFiles(x86)%\proxyvan\service\system.xml.xpath.dll
from %ProgramFiles(x86)%\proxyvan\service\is-i2h9q.tmp to %ProgramFiles(x86)%\proxyvan\service\system.xml.xmlserializer.dll
from %ProgramFiles(x86)%\proxyvan\service\is-8mcf1.tmp to %ProgramFiles(x86)%\proxyvan\service\system.xml.xmldocument.dll
from %ProgramFiles(x86)%\proxyvan\service\is-7c7la.tmp to %ProgramFiles(x86)%\proxyvan\service\system.xml.xdocument.dll
from %ProgramFiles(x86)%\proxyvan\service\is-m1nh7.tmp to %ProgramFiles(x86)%\proxyvan\service\system.xml.readerwriter.dll
from %ProgramFiles(x86)%\proxyvan\service\is-4c5e2.tmp to %ProgramFiles(x86)%\proxyvan\service\system.valuetuple.xml
from %ProgramFiles(x86)%\proxyvan\service\is-fbli2.tmp to %ProgramFiles(x86)%\proxyvan\service\system.valuetuple.dll
from %ProgramFiles(x86)%\proxyvan\service\is-kdbou.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.timer.dll
from %ProgramFiles(x86)%\proxyvan\service\is-hukvb.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.threadpool.dll
from %ProgramFiles(x86)%\proxyvan\service\is-2v2v3.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.thread.dll
from %ProgramFiles(x86)%\proxyvan\service\is-19ae3.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.tasks.parallel.dll
from %ProgramFiles(x86)%\proxyvan\service\is-3cvnu.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.tasks.extensions.xml
from %ProgramFiles(x86)%\proxyvan\service\is-7shsi.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.tasks.extensions.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-bcoj9.tmp to %ProgramFiles(x86)%\proxyvan\updater\danilovsoft.vrpc.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-2sdip.tmp to %ProgramFiles(x86)%\proxyvan\updater\danilovsoft.websocket.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-j1nqn.tmp to %ProgramFiles(x86)%\proxyvan\updater\netstandard.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-b1pvb.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.logging.configuration.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-gsb7d.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.logging.console.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-9sh8r.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.win32.primitives.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-8jcr4.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.io.recyclablememorystream.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-51mh8.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.primitives.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-j672a.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.options.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-r4adc.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.options.configurationextensions.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-lh331.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.logging.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-82g2p.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.diagnostics.stacktrace.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-ehkcm.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.globalization.dll
from %ProgramFiles(x86)%\proxyvan\service\ru\is-6tnnm.tmp to %ProgramFiles(x86)%\proxyvan\service\ru\danilovsoft.vrpc.resources.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-9esah.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.dependencyinjection.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-r3d74.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.dependencyinjection.abstractions.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-ed7r3.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.configuration.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-n578b.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.configuration.binder.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-6ircr.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.configuration.abstractions.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-dvl2j.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.bcl.asyncinterfaces.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-b6kvp.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.logging.abstractions.dll
from %ProgramFiles(x86)%\proxyvan\service\is-ciof0.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.nameresolution.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-j62hp.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.compression.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-fquem.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.text.encoding.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-0t5hl.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.security.securestring.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-brtkt.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.security.principal.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-e6m1j.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.security.cryptography.x509certificates.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-v4bac.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.security.cryptography.primitives.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-ss0jp.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.security.cryptography.encoding.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-856lt.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.security.cryptography.csp.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-tvtmd.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.security.cryptography.algorithms.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-4tkdh.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.security.claims.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-vuodq.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.serialization.xml.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-mg1oh.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.serialization.primitives.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-p72en.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.serialization.json.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-ct21d.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.serialization.formatters.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-pd080.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.numerics.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-atanv.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.interopservices.runtimeinformation.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-9qq22.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.text.encoding.extensions.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-tr7e6.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.text.encodings.web.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-um335.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.text.json.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-7oh55.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.text.regularexpressions.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-cp186.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.xml.xpath.xdocument.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-omu4i.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.xml.xpath.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-0lk5m.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.xml.xmlserializer.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-7lq7i.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.xml.xmldocument.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-fe4dc.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.xml.xdocument.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-hiuv0.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.xml.readerwriter.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-cm8ri.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.valuetuple.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-cn1sq.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.interopservices.dll
from %ProgramFiles(x86)%\proxyvan\service\is-pvt34.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.tasks.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-7qn42.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.threading.thread.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-a19mp.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.threading.tasks.parallel.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-b8ftp.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.threading.tasks.extensions.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-t48ck.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.threading.tasks.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-ct281.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.threading.overlapped.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-t07ei.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.threading.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-uiidh.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.threading.channels.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-h50np.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.threading.threadpool.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-t0i37.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.handles.dll
from %ProgramFiles(x86)%\proxyvan\service\ru\is-ji9g2.tmp to %ProgramFiles(x86)%\proxyvan\service\ru\danilovsoft.websocket.resources.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-ick3f.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-pkuvn.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.reflection.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-4rdh5.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.memory.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-thd05.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.linq.queryable.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-pipk6.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.linq.parallel.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-31b5r.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.linq.expressions.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-3i0nk.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.linq.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-ikl4e.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.unmanagedmemorystream.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-0kbf8.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.pipes.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-3ebj2.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.memorymappedfiles.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-88062.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.isolatedstorage.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-4qd74.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.filesystem.watcher.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-o9g0c.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.filesystem.primitives.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-akce9.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.filesystem.driveinfo.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-s1edn.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.filesystem.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-jbdof.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-92avv.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.nameresolution.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-gcvdv.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.networkinformation.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-stjlb.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.ping.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-6370f.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.primitives.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-g9nmt.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.compilerservices.visualc.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-cl248.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.compilerservices.unsafe.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-f94ho.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.resources.writer.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-d80ua.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.resources.resourcemanager.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-8dfn9.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.resources.reader.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-fqp9n.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.reflection.primitives.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-nf55r.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.reflection.extensions.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-vrsei.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.extensions.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-ohnar.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.compression.zipfile.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-omict.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.numerics.vectors.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-s2233.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.websockets.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-kq0iv.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.websockets.client.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-m0i7q.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.webheadercollection.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-q05r1.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.sockets.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-e5o5n.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.security.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-19mna.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.requests.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-nrns5.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.objectmodel.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-jvmgd.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.http.dll
from %ProgramFiles(x86)%\proxyvan\service\is-pkq49.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.overlapped.dll
from %ProgramFiles(x86)%\proxyvan\service\is-jguii.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.dll
from %ProgramFiles(x86)%\proxyvan\service\is-63us2.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.channels.xml
from %ProgramFiles(x86)%\proxyvan\service\is-6th1e.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.sinks.rollingfile.dll
from %ProgramFiles(x86)%\proxyvan\service\is-pqtj6.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.sinks.file.dll
from %ProgramFiles(x86)%\proxyvan\service\is-l93ll.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.sinks.console.xml
from %ProgramFiles(x86)%\proxyvan\service\is-rucu0.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.sinks.console.dll
from %ProgramFiles(x86)%\proxyvan\service\is-v2ss4.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.extensions.logging.xml
from %ProgramFiles(x86)%\proxyvan\service\is-h3540.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.extensions.logging.dll
from %ProgramFiles(x86)%\proxyvan\service\is-bggdk.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.dll
from %ProgramFiles(x86)%\proxyvan\service\is-38t86.tmp to %ProgramFiles(x86)%\proxyvan\service\proxyvan.pdb
from %ProgramFiles(x86)%\proxyvan\service\is-jm6ni.tmp to %ProgramFiles(x86)%\proxyvan\service\proxyvan.exe.config
from %ProgramFiles(x86)%\proxyvan\service\is-ail6s.tmp to %ProgramFiles(x86)%\proxyvan\service\proxyvan.exe
from %ProgramFiles(x86)%\proxyvan\service\is-2c1vj.tmp to %ProgramFiles(x86)%\proxyvan\service\proxyvan.common.pdb
from %ProgramFiles(x86)%\proxyvan\service\is-c9t7j.tmp to %ProgramFiles(x86)%\proxyvan\service\proxyvan.common.dll.config
from %ProgramFiles(x86)%\proxyvan\service\is-l9cdk.tmp to %ProgramFiles(x86)%\proxyvan\service\proxyvan.common.dll
from %ProgramFiles(x86)%\proxyvan\service\is-mdbv3.tmp to %ProgramFiles(x86)%\proxyvan\service\proxy.common.pdb
from %ProgramFiles(x86)%\proxyvan\service\is-ks35r.tmp to %ProgramFiles(x86)%\proxyvan\service\proxy.common.dll
from %ProgramFiles(x86)%\proxyvan\service\is-42156.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.sinks.rollingfile.xml
from %ProgramFiles(x86)%\proxyvan\service\is-6g5o5.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.xml
from %ProgramFiles(x86)%\proxyvan\service\is-1u8gu.tmp to %ProgramFiles(x86)%\proxyvan\service\system.diagnostics.debug.dll
from %ProgramFiles(x86)%\proxyvan\service\is-shcfo.tmp to %ProgramFiles(x86)%\proxyvan\service\system.componentmodel.annotations.dll
from %ProgramFiles(x86)%\proxyvan\service\is-stbs8.tmp to %ProgramFiles(x86)%\proxyvan\service\system.componentmodel.dll
from %ProgramFiles(x86)%\proxyvan\service\is-qkmki.tmp to %ProgramFiles(x86)%\proxyvan\service\system.diagnostics.contracts.dll
from %ProgramFiles(x86)%\proxyvan\service\is-2ra5a.tmp to %ProgramFiles(x86)%\proxyvan\service\system.data.common.dll
from %ProgramFiles(x86)%\proxyvan\service\is-k849a.tmp to %ProgramFiles(x86)%\proxyvan\service\system.console.dll
from %ProgramFiles(x86)%\proxyvan\service\is-8n4lp.tmp to %ProgramFiles(x86)%\proxyvan\service\system.componentmodel.typeconverter.dll
from %ProgramFiles(x86)%\proxyvan\service\is-0bevn.tmp to %ProgramFiles(x86)%\proxyvan\service\system.componentmodel.primitives.dll
from %ProgramFiles(x86)%\proxyvan\service\is-bgiov.tmp to %ProgramFiles(x86)%\proxyvan\service\system.componentmodel.eventbasedasync.dll
from %ProgramFiles(x86)%\proxyvan\service\is-5nbno.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.sinks.file.xml
from %ProgramFiles(x86)%\proxyvan\service\is-i571e.tmp to %ProgramFiles(x86)%\proxyvan\service\protobuf-net.xml
from %ProgramFiles(x86)%\proxyvan\service\is-6lne6.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.logging.xml
from %ProgramFiles(x86)%\proxyvan\service\is-903vb.tmp to %ProgramFiles(x86)%\proxyvan\service\system.collections.nongeneric.dll
from %ProgramFiles(x86)%\proxyvan\service\is-neom4.tmp to %ProgramFiles(x86)%\proxyvan\service\system.collections.dll
from %ProgramFiles(x86)%\proxyvan\service\is-fg2r4.tmp to %ProgramFiles(x86)%\proxyvan\service\system.collections.concurrent.dll
from %ProgramFiles(x86)%\proxyvan\service\is-18oup.tmp to %ProgramFiles(x86)%\proxyvan\service\system.buffers.xml
from %ProgramFiles(x86)%\proxyvan\service\is-kfrup.tmp to %ProgramFiles(x86)%\proxyvan\service\system.buffers.dll
from %ProgramFiles(x86)%\proxyvan\service\is-ul8o7.tmp to %ProgramFiles(x86)%\proxyvan\service\system.appcontext.dll
from %ProgramFiles(x86)%\proxyvan\service\is-loqon.tmp to %ProgramFiles(x86)%\proxyvan\service\system.collections.specialized.dll
from %ProgramFiles(x86)%\proxyvan\updater\ru\is-auf8j.tmp to %ProgramFiles(x86)%\proxyvan\updater\ru\danilovsoft.vrpc.resources.dll
from %ProgramFiles(x86)%\proxyvan\service\is-vrbg3.tmp to %ProgramFiles(x86)%\proxyvan\service\system.diagnostics.fileversioninfo.dll
from %ProgramFiles(x86)%\proxyvan\service\is-1nguj.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.win32.primitives.dll
from %ProgramFiles(x86)%\proxyvan\service\is-gbef4.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.configuration.dll
from %ProgramFiles(x86)%\proxyvan\service\is-jmlmp.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.configuration.binder.xml
from %ProgramFiles(x86)%\proxyvan\service\is-cd4dv.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.configuration.binder.dll
from %ProgramFiles(x86)%\proxyvan\service\is-0i5s2.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.configuration.abstractions.xml
from %ProgramFiles(x86)%\proxyvan\service\is-ge83a.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.configuration.abstractions.dll
from %ProgramFiles(x86)%\proxyvan\service\is-6tcek.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.bcl.asyncinterfaces.xml
from %ProgramFiles(x86)%\proxyvan\service\is-b1b7b.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.bcl.asyncinterfaces.dll
from %ProgramFiles(x86)%\proxyvan\service\is-m0j6h.tmp to %ProgramFiles(x86)%\proxyvan\service\danilovsoft.websocket.xml
from %ProgramFiles(x86)%\proxyvan\service\is-is6od.tmp to %ProgramFiles(x86)%\proxyvan\service\danilovsoft.websocket.dll
from %ProgramFiles(x86)%\proxyvan\service\is-3fmt1.tmp to %ProgramFiles(x86)%\proxyvan\service\danilovsoft.vrpc.xml
from %ProgramFiles(x86)%\proxyvan\service\is-s22l7.tmp to %ProgramFiles(x86)%\proxyvan\service\danilovsoft.vrpc.dll
from %ProgramFiles(x86)%\proxyvan\service\is-i28un.tmp to %ProgramFiles(x86)%\proxyvan\service\commandline.xml
from %ProgramFiles(x86)%\proxyvan\service\is-tpm6l.tmp to %ProgramFiles(x86)%\proxyvan\service\commandline.dll
from %ProgramFiles(x86)%\proxyvan\is-onfd9.tmp to %ProgramFiles(x86)%\proxyvan\unins000.exe
from %ProgramFiles(x86)%\proxyvan\service\is-eloas.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.dependencyinjection.abstractions.dll
from %ProgramFiles(x86)%\proxyvan\service\is-q6su9.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.dependencyinjection.abstractions.xml
from %ProgramFiles(x86)%\proxyvan\service\is-b0u61.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.configuration.xml
from %ProgramFiles(x86)%\proxyvan\service\is-3d57i.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.dependencyinjection.dll
from %ProgramFiles(x86)%\proxyvan\service\is-oooev.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.io.recyclablememorystream.xml
from %ProgramFiles(x86)%\proxyvan\service\is-sfcv7.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.dependencyinjection.xml
from %ProgramFiles(x86)%\proxyvan\service\is-ud0un.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.io.recyclablememorystream.dll
from %ProgramFiles(x86)%\proxyvan\service\is-cq50g.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.primitives.xml
from %ProgramFiles(x86)%\proxyvan\service\is-dbcc4.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.primitives.dll
from %ProgramFiles(x86)%\proxyvan\service\is-o2stg.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.options.xml
from %ProgramFiles(x86)%\proxyvan\service\is-vlee7.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.options.dll
from %ProgramFiles(x86)%\proxyvan\service\is-3ogk7.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.options.configurationextensions.xml
from %ProgramFiles(x86)%\proxyvan\service\is-3nhij.tmp to %ProgramFiles(x86)%\proxyvan\service\protobuf-net.dll
from %ProgramFiles(x86)%\proxyvan\service\is-dc23s.tmp to %ProgramFiles(x86)%\proxyvan\service\netstandard.dll
from %ProgramFiles(x86)%\proxyvan\service\is-uip1b.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.logging.dll
from %ProgramFiles(x86)%\proxyvan\service\is-7l9i7.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.logging.console.xml
from %ProgramFiles(x86)%\proxyvan\service\is-ajh2f.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.logging.console.dll
from %ProgramFiles(x86)%\proxyvan\service\is-u7cmb.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.logging.configuration.xml
from %ProgramFiles(x86)%\proxyvan\service\is-fdcsc.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.logging.configuration.dll
from %ProgramFiles(x86)%\proxyvan\service\is-f8n1r.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.logging.abstractions.xml
from %ProgramFiles(x86)%\proxyvan\service\is-cqj3p.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.logging.abstractions.dll
from %ProgramFiles(x86)%\proxyvan\service\is-0rckl.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.options.configurationextensions.dll
from %ProgramFiles(x86)%\proxyvan\updater\is-h9pgh.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.threading.timer.dll
from %ProgramFiles(x86)%\proxyvan\service\is-38i27.tmp to %ProgramFiles(x86)%\proxyvan\service\system.diagnostics.process.dll
from %ProgramFiles(x86)%\proxyvan\service\is-9t8nb.tmp to %ProgramFiles(x86)%\proxyvan\service\system.diagnostics.tools.dll
from %ProgramFiles(x86)%\proxyvan\service\is-sotmc.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.serialization.formatters.dll
from %ProgramFiles(x86)%\proxyvan\service\is-dl10m.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.numerics.dll
from %ProgramFiles(x86)%\proxyvan\service\is-7iedq.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.interopservices.runtimeinformation.dll
from %ProgramFiles(x86)%\proxyvan\service\is-t0lss.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.interopservices.dll
from %ProgramFiles(x86)%\proxyvan\service\is-i7mo4.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.handles.dll
from %ProgramFiles(x86)%\proxyvan\service\is-8638r.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.extensions.dll
from %ProgramFiles(x86)%\proxyvan\service\is-5njee.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.dll
from %ProgramFiles(x86)%\proxyvan\service\is-osvg0.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.compilerservices.visualc.dll
from %ProgramFiles(x86)%\proxyvan\service\is-k1div.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.compilerservices.unsafe.xml
from %ProgramFiles(x86)%\proxyvan\service\is-a0860.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.compilerservices.unsafe.dll
from %ProgramFiles(x86)%\proxyvan\service\is-94e38.tmp to %ProgramFiles(x86)%\proxyvan\service\system.resources.writer.dll
from %ProgramFiles(x86)%\proxyvan\service\is-jicgo.tmp to %ProgramFiles(x86)%\proxyvan\service\system.resources.resourcemanager.dll
from %ProgramFiles(x86)%\proxyvan\service\is-vpvq4.tmp to %ProgramFiles(x86)%\proxyvan\service\system.resources.reader.dll
from %ProgramFiles(x86)%\proxyvan\service\is-8gk2e.tmp to %ProgramFiles(x86)%\proxyvan\service\system.reflection.primitives.dll
from %ProgramFiles(x86)%\proxyvan\service\is-vs41i.tmp to %ProgramFiles(x86)%\proxyvan\service\system.reflection.extensions.dll
from %ProgramFiles(x86)%\proxyvan\service\is-6ujn4.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.serialization.json.dll
from %ProgramFiles(x86)%\proxyvan\service\is-hib04.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.serialization.primitives.dll
from %ProgramFiles(x86)%\proxyvan\service\is-vml7a.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.serialization.xml.dll
from %ProgramFiles(x86)%\proxyvan\service\is-nmtef.tmp to %ProgramFiles(x86)%\proxyvan\service\system.security.claims.dll
from %ProgramFiles(x86)%\proxyvan\service\is-tvtkr.tmp to %ProgramFiles(x86)%\proxyvan\service\system.objectmodel.dll
from %ProgramFiles(x86)%\proxyvan\service\is-gpf4e.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.channels.dll
from %ProgramFiles(x86)%\proxyvan\service\is-7tl9u.tmp to %ProgramFiles(x86)%\proxyvan\service\system.text.regularexpressions.dll
from %ProgramFiles(x86)%\proxyvan\service\is-4jgd3.tmp to %ProgramFiles(x86)%\proxyvan\service\system.text.json.xml
from %ProgramFiles(x86)%\proxyvan\service\is-stf56.tmp to %ProgramFiles(x86)%\proxyvan\service\system.text.json.dll
from %ProgramFiles(x86)%\proxyvan\service\is-ffeh8.tmp to %ProgramFiles(x86)%\proxyvan\service\system.text.encodings.web.xml
from %ProgramFiles(x86)%\proxyvan\service\is-rqo8a.tmp to %ProgramFiles(x86)%\proxyvan\service\system.text.encodings.web.dll
from %ProgramFiles(x86)%\proxyvan\service\is-2om3e.tmp to %ProgramFiles(x86)%\proxyvan\service\system.reflection.dll
from %ProgramFiles(x86)%\proxyvan\service\is-5scfp.tmp to %ProgramFiles(x86)%\proxyvan\service\system.text.encoding.extensions.dll
from %ProgramFiles(x86)%\proxyvan\service\is-bjhbv.tmp to %ProgramFiles(x86)%\proxyvan\service\system.diagnostics.stacktrace.dll
from %ProgramFiles(x86)%\proxyvan\service\is-84ksk.tmp to %ProgramFiles(x86)%\proxyvan\service\system.security.principal.dll
from %ProgramFiles(x86)%\proxyvan\service\is-sir6r.tmp to %ProgramFiles(x86)%\proxyvan\service\system.security.cryptography.x509certificates.dll
from %ProgramFiles(x86)%\proxyvan\service\is-9pfl4.tmp to %ProgramFiles(x86)%\proxyvan\service\system.security.cryptography.primitives.dll
from %ProgramFiles(x86)%\proxyvan\service\is-8hpqe.tmp to %ProgramFiles(x86)%\proxyvan\service\system.security.cryptography.encoding.dll
from %ProgramFiles(x86)%\proxyvan\service\is-esso5.tmp to %ProgramFiles(x86)%\proxyvan\service\system.security.cryptography.csp.dll
from %ProgramFiles(x86)%\proxyvan\service\is-ioo2h.tmp to %ProgramFiles(x86)%\proxyvan\service\system.security.cryptography.algorithms.dll
from %ProgramFiles(x86)%\proxyvan\service\is-93ij4.tmp to %ProgramFiles(x86)%\proxyvan\service\system.text.encoding.dll
from %ProgramFiles(x86)%\proxyvan\service\is-bee8v.tmp to %ProgramFiles(x86)%\proxyvan\service\system.diagnostics.textwritertracelistener.dll
from %ProgramFiles(x86)%\proxyvan\service\is-n1srr.tmp to %ProgramFiles(x86)%\proxyvan\service\system.security.securestring.dll
from %ProgramFiles(x86)%\proxyvan\service\is-hggb2.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.sinks.file.pdb
from %ProgramFiles(x86)%\proxyvan\service\is-35kh2.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.isolatedstorage.dll
from %ProgramFiles(x86)%\proxyvan\service\is-e0juc.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.filesystem.watcher.dll
from %ProgramFiles(x86)%\proxyvan\service\is-18rps.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.filesystem.primitives.dll
from %ProgramFiles(x86)%\proxyvan\service\is-csmv8.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.filesystem.driveinfo.dll
from %ProgramFiles(x86)%\proxyvan\service\is-33o7v.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.filesystem.dll
from %ProgramFiles(x86)%\proxyvan\service\is-jbpt5.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.dll
from %ProgramFiles(x86)%\proxyvan\service\is-dpu1e.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.compression.zipfile.dll
from %ProgramFiles(x86)%\proxyvan\service\is-6eq65.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.compression.dll
from %ProgramFiles(x86)%\proxyvan\service\is-lja2o.tmp to %ProgramFiles(x86)%\proxyvan\service\system.globalization.extensions.dll
from %ProgramFiles(x86)%\proxyvan\service\is-i8rpg.tmp to %ProgramFiles(x86)%\proxyvan\service\system.globalization.dll
from %ProgramFiles(x86)%\proxyvan\service\is-g05og.tmp to %ProgramFiles(x86)%\proxyvan\service\system.globalization.calendars.dll
from %ProgramFiles(x86)%\proxyvan\service\is-qfmpo.tmp to %ProgramFiles(x86)%\proxyvan\service\system.dynamic.runtime.dll
from %ProgramFiles(x86)%\proxyvan\service\is-2k39l.tmp to %ProgramFiles(x86)%\proxyvan\service\system.drawing.primitives.dll
from %ProgramFiles(x86)%\proxyvan\service\is-dn3em.tmp to %ProgramFiles(x86)%\proxyvan\service\system.diagnostics.tracing.dll
from %ProgramFiles(x86)%\proxyvan\service\is-pm6hb.tmp to %ProgramFiles(x86)%\proxyvan\service\system.diagnostics.tracesource.dll
from %ProgramFiles(x86)%\proxyvan\service\is-0a6rp.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.memorymappedfiles.dll
from %ProgramFiles(x86)%\proxyvan\service\is-3fnjj.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.pipes.dll
from %ProgramFiles(x86)%\proxyvan\service\is-5uslu.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.unmanagedmemorystream.dll
from %ProgramFiles(x86)%\proxyvan\service\is-vvkpq.tmp to %ProgramFiles(x86)%\proxyvan\service\system.linq.dll
from %ProgramFiles(x86)%\proxyvan\service\is-i7mih.tmp to %ProgramFiles(x86)%\proxyvan\service\system.numerics.vectors.dll
from %ProgramFiles(x86)%\proxyvan\service\is-rm3ud.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.websockets.client.dll
from %ProgramFiles(x86)%\proxyvan\service\is-samm3.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.webheadercollection.dll
from %ProgramFiles(x86)%\proxyvan\service\is-mocjf.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.sockets.dll
from %ProgramFiles(x86)%\proxyvan\service\is-3j13d.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.security.dll
from %ProgramFiles(x86)%\proxyvan\service\is-3im61.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.requests.dll
from %ProgramFiles(x86)%\proxyvan\service\is-5kglq.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.primitives.dll
from %ProgramFiles(x86)%\proxyvan\service\is-bllcc.tmp to %ProgramFiles(x86)%\proxyvan\service\system.numerics.vectors.xml
from %ProgramFiles(x86)%\proxyvan\service\is-3mslk.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.ping.dll
from %ProgramFiles(x86)%\proxyvan\service\is-k1kg7.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.websockets.dll
from %ProgramFiles(x86)%\proxyvan\service\is-dus5q.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.http.dll
from %ProgramFiles(x86)%\proxyvan\service\is-ofmu7.tmp to %ProgramFiles(x86)%\proxyvan\service\system.memory.xml
from %ProgramFiles(x86)%\proxyvan\service\is-els1v.tmp to %ProgramFiles(x86)%\proxyvan\service\system.memory.dll
from %ProgramFiles(x86)%\proxyvan\service\is-sj9gi.tmp to %ProgramFiles(x86)%\proxyvan\service\system.linq.queryable.dll
from %ProgramFiles(x86)%\proxyvan\service\is-jr44a.tmp to %ProgramFiles(x86)%\proxyvan\service\system.linq.parallel.dll
from %ProgramFiles(x86)%\proxyvan\service\is-1cf6h.tmp to %ProgramFiles(x86)%\proxyvan\service\system.linq.expressions.dll
from %ProgramFiles(x86)%\proxyvan\service\is-v9od8.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.networkinformation.dll
from %ProgramFiles(x86)%\proxyvan\updater\ru\is-jmlhs.tmp to %ProgramFiles(x86)%\proxyvan\updater\ru\danilovsoft.websocket.resources.dll

Network activity

TCP

HTTP GET requests

http://do###nht6.ml/click.php?cn#######################
http://ya###etn1k.ru/files/MarketAdvior.exe
http://www.go#####analytics.com/collect?v=#######################################################################################################################################################...
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://on#####game-group.ru/download.php?ad######
http://ga###depart.com/client/get_build.php

'jj###.adsbtrk.com':443

'pr##yvan.io':443

UDP

DNS ASK do###nht6.ml
DNS ASK ya###etn1k.ru
DNS ASK jj###.adsbtrk.com
DNS ASK go#####analytics.com
DNS ASK pr##yvan.io
DNS ASK microsoft.com
DNS ASK on#####game-group.ru
DNS ASK ga###depart.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%TEMP%\marketadvior.exe' /S /pb=https://jjmyn.adsbtrk.com/c/f9706f7de562eb2b?SUBID={SUBID}&PUBID={PUBID}&HID={HID}&GEO={GEO}&TS={TS} /pb2=https://jjmyn.adsbtrk.com/c/63ac61070427831d?SUBID={SUBID}&PUBID={PUBID}&HID={HI...
'%TEMP%\installer_2.21.3.exe'
'%ProgramFiles(x86)%\proxyvan\updater\proxyvanupdater.exe'
'%TEMP%\is-uu5cd.tmp\gamesdepart.000.5241.0.tmp' /SL5="$10260,1011219,721408,%TEMP%\Gamesdepart.000.5241.0.exe" /S /adv 5241 /subadv 435
'%ProgramFiles(x86)%\proxyvan\service\proxyvan.exe'
'%TEMP%\gamesdepart.000.5241.0.exe' /VERYSILENT /adv=5241 /subadv=435
'%TEMP%\tmp8346.exe' /PASSWORD=cYIrud1plNek /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /UTM=
'%APPDATA%\marketadvior\python\python.exe' load.pyc --act=inst ml2
'%TEMP%\gamesdepart.000.5241.0.exe' /S /adv 5241 /subadv 435
'%APPDATA%\marketadvior\python\python.exe' load.pyc manage2
'%APPDATA%\marketadvior\python\python.exe' load.pyc launchall2
'%APPDATA%\marketadvior\python\python.exe' load.pyc --subid="{SES}" --pbid="Pao" --pb="https://jjmyn.adsbtrk.com/c/f9706f7de562eb2b?SUBID={SUBID}&PUBID={PUBID}&HID={HID}&GEO={GEO}&TS={TS}" --pb2="https://jjmyn.adsbtrk.com/c/63ac61070427...
'%APPDATA%\marketadvior\python\python.exe' load.pyc "akgdkknilkblpjcgpjmbjgpamneokmag;djgdgdcfmdkficbifbnaacknblbkhhoc;fdjdjkkjoiomafnihnobkinnfjnnlhdg;mocgkongaoagjoicmbimkiopebgfkich" checkinstalled
'%APPDATA%\marketadvior\python\python.exe' load.py app
'%TEMP%\is-19rgd.tmp\gamesdepart.000.5241.0.tmp' /SL5="$20266,1011219,721408,%TEMP%\Gamesdepart.000.5241.0.exe" /VERYSILENT /adv=5241 /subadv=435
'%TEMP%\is-j8tsj.tmp\tmp8346.tmp' /SL5="$D0154,1996124,721408,%TEMP%\tmp8346.exe" /PASSWORD=cYIrud1plNek /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /UTM=
'%APPDATA%\marketadvior\python\python.exe' load.pyc "akgdkknilkblpjcgpjmbjgpamneokmag;djgdgdcfmdkficbifbnaacknblbkhhoc;fdjdjkkjoiomafnihnobkinnfjnnlhdg;mocgkongaoagjoicmbimkiopebgfkich" checkinstalled' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /f /im "gamesdepartupdate.exe"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create ProxyVan2 obj= "LocalSystem" start= auto binPath= "%ProgramFiles(x86)%\ProxyVan\Service\ProxyVan.exe"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create ProxyVanUpdater obj= "LocalSystem" start= auto binPath= "%ProgramFiles(x86)%\ProxyVan\Updater\ProxyVanUpdater.exe"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start ProxyVan2' (with hidden window)
'%APPDATA%\marketadvior\python\python.exe' load.pyc --subid="{SES}" --pbid="Pao" --pb="https://jjmyn.adsbtrk.com/c/f9706f7de562eb2b?SUBID={SUBID}&PUBID={PUBID}&HID={HID}&GEO={GEO}&TS={TS}" --pb2="https://jjmyn.adsbtrk.com/c/63ac61070427...' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start ProxyVanUpdater' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /tn "MarketAdvior" /xml "%TEMP%\tmp2hdej9ri"
'%WINDIR%\syswow64\schtasks.exe' /create /f /tn "MarketAdvior" /xml "%TEMP%\tmp2hdej9ri"
'%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /tn "MarketAdvior2" /xml "%TEMP%\tmpyt879lrz"
'%WINDIR%\syswow64\schtasks.exe' /create /f /tn "MarketAdvior2" /xml "%TEMP%\tmpyt879lrz"
'%WINDIR%\syswow64\sc.exe' create ProxyVan2 obj= "LocalSystem" start= auto binPath= "%ProgramFiles(x86)%\ProxyVan\Service\ProxyVan.exe"
'%WINDIR%\syswow64\sc.exe' create ProxyVanUpdater obj= "LocalSystem" start= auto binPath= "%ProgramFiles(x86)%\ProxyVan\Updater\ProxyVanUpdater.exe"
'%WINDIR%\syswow64\sc.exe' start ProxyVan2
'%WINDIR%\syswow64\sc.exe' start ProxyVanUpdater

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial