Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.Siggen9.43036

Added to the Dr.Web virus database: 2020-04-28

Virus description added:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MarketAdvior' = '"%APPDATA%\MarketAdvior\python\pythonw.exe" "load.pyc" ml2'
Creates or modifies the following files
  • <SYSTEM32>\tasks\marketadvior
  • <SYSTEM32>\tasks\marketadvior2
Creates the following services
  • [<HKLM>\System\CurrentControlSet\Services\ProxyVan2] 'Start' = '00000002'
  • [<HKLM>\System\CurrentControlSet\Services\ProxyVan2] 'ImagePath' = '%ProgramFiles(x86)%\ProxyVan\Service\ProxyVan.exe'
  • [<HKLM>\System\CurrentControlSet\Services\ProxyVanUpdater] 'Start' = '00000002'
  • [<HKLM>\System\CurrentControlSet\Services\ProxyVanUpdater] 'ImagePath' = '%ProgramFiles(x86)%\ProxyVan\Updater\ProxyVanUpdater.exe'
Malicious functions
Creates and executes the following
  • '' (downloaded from the Internet)
Executes the following
  • '%WINDIR%\syswow64\taskkill.exe' /f /im "gamesdepartupdate.exe"
Modifies file system
Creates the following files
  • %TEMP%\marketadvior.exe
  • %ProgramFiles(x86)%\proxyvan\updater\is-vppk6.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-04mo5.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-3v0sd.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-ficd9.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-ti7at.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-a9jsg.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-o3312.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-rudce.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-n4gjb.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-jeidv.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-uv3bi.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-06ima.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-j1nqn.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-9sh8r.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-8jcr4.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-51mh8.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-j672a.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-r4adc.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-lh331.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-b1pvb.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-gsb7d.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-mnrmm.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-ijgia.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-lkdsp.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-coeei.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-1j7kc.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-82g2p.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-vnaen.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-7fggb.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-p10tb.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-v1c16.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-foof0.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-c6u1o.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-q0hiu.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-b4vrf.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-ohh4r.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-6nddv.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-vjhar.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-jd0ps.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-77abh.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-5nraa.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-ia2lu.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-pfl8m.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-b6kvp.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-9esah.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-r3d74.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-jguii.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-63us2.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-gpf4e.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-7tl9u.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-4jgd3.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-stf56.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-ffeh8.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-rqo8a.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-5scfp.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-93ij4.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-n1srr.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-84ksk.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-sir6r.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-9pfl4.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-8hpqe.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-esso5.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-ioo2h.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-nmtef.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-pvt34.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-7shsi.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-pkq49.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-3cvnu.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-ed7r3.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-19ae3.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-n578b.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-6ircr.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-dvl2j.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-2sdip.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-bcoj9.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-019p7.tmp
  • %ProgramFiles(x86)%\proxyvan\service\ru\is-ji9g2.tmp
  • %ProgramFiles(x86)%\proxyvan\service\ru\is-6tnnm.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-3h4bd.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-jt5s1.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-i2h9q.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-8mcf1.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-7c7la.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-m1nh7.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-4c5e2.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-fbli2.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-kdbou.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-hukvb.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-2v2v3.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-u83gr.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-pkuvn.tmp
  • %TEMP%\is-qama2.tmp\idp.dll
  • %ProgramFiles(x86)%\proxyvan\updater\is-d2c5t.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-t48ck.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-ct281.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-t07ei.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-uiidh.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-7oh55.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-um335.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-tr7e6.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-9qq22.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-fquem.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-0t5hl.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-brtkt.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-e6m1j.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-v4bac.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-ss0jp.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-856lt.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-tvtmd.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-4tkdh.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-vuodq.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-mg1oh.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-ct21d.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-p72en.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-b8ftp.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-a19mp.tmp
  • %TEMP%\is-qama2.tmp\_isetup\_setup64.tmp
  • %TEMP%\is-19rgd.tmp\gamesdepart.000.5241.0.tmp
  • %TEMP%\is-obsqs.tmp\idp.dll
  • %TEMP%\is-obsqs.tmp\_isetup\_setup64.tmp
  • %TEMP%\is-uu5cd.tmp\gamesdepart.000.5241.0.tmp
  • %ProgramFiles(x86)%\proxyvan\unins000.dat
  • %ProgramFiles(x86)%\proxyvan\unins000.msg
  • %PROGRAMDATA%\microsoft\windows\start menu\programs\proxyvan\uninstall proxyvan.lnk
  • %ProgramFiles(x86)%\proxyvan\updater\ru\is-jmlhs.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-cp186.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-rpbhk.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-omu4i.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-0lk5m.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-7lq7i.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-fe4dc.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-hiuv0.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-cm8ri.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-h9pgh.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-h50np.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-7qn42.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-pd080.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-atanv.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-cn1sq.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-thd05.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-pipk6.tmp
  • %TEMP%\gamesdepart.000.5241.0.exe
  • %ProgramFiles(x86)%\proxyvan\updater\is-31b5r.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-3i0nk.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-ikl4e.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-0kbf8.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-3ebj2.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-88062.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-4qd74.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-o9g0c.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-akce9.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-s1edn.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-jbdof.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-ohnar.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-j62hp.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-6c7jq.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-ehkcm.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-jvmgd.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-92avv.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-4rdh5.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-gcvdv.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-t0i37.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-stjlb.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-vrsei.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-ick3f.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-g9nmt.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-cl248.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-f94ho.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-d80ua.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-8dfn9.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-fqp9n.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-vml7a.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-gpkrp.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-nrns5.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-omict.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-s2233.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-kq0iv.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-m0i7q.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-q05r1.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-e5o5n.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-19mna.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-6370f.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\is-nf55r.tmp
  • %ProgramFiles(x86)%\proxyvan\updater\ru\is-auf8j.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-hib04.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-94e38.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-q6su9.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-eloas.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-b0u61.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-gbef4.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-jmlmp.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-cd4dv.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-0i5s2.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-ge83a.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-6tcek.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-b1b7b.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-m0j6h.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-is6od.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-3fmt1.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-s22l7.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-i28un.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-tpm6l.tmp
  • %ProgramFiles(x86)%\proxyvan\is-onfd9.tmp
  • %TEMP%\is-5lkps.tmp\_isetup\_iscrypt.dll
  • %TEMP%\is-5lkps.tmp\_isetup\_setup64.tmp
  • %TEMP%\tmp8346.tmp
  • %TEMP%\is-j8tsj.tmp\tmp8346.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-3d57i.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-sfcv7.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-i571e.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-3nhij.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-dc23s.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-1nguj.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-oooev.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-ud0un.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-cq50g.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-dbcc4.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-o2stg.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-3ogk7.tmp
  • %APPDATA%\marketadvior\python\winsound.pyd
  • %ProgramFiles(x86)%\proxyvan\service\is-0rckl.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-6lne6.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-uip1b.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-7l9i7.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-ajh2f.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-u7cmb.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-fdcsc.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-f8n1r.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-cqj3p.tmp
  • %TEMP%\installer_2.21.3.exe
  • %TEMP%\tmpyt879lrz
  • %APPDATA%\marketadvior\uninstall.exe
  • %APPDATA%\marketadvior\python\_sqlite3.pyd
  • %APPDATA%\marketadvior\python\_socket.pyd
  • %APPDATA%\marketadvior\python\_queue.pyd
  • %APPDATA%\marketadvior\python\_overlapped.pyd
  • %APPDATA%\marketadvior\python\_multiprocessing.pyd
  • %APPDATA%\marketadvior\python\_msi.pyd
  • %APPDATA%\marketadvior\python\_lzma.pyd
  • %APPDATA%\marketadvior\python\_hashlib.pyd
  • %APPDATA%\marketadvior\python\_elementtree.pyd
  • %APPDATA%\marketadvior\python\_decimal.pyd
  • %APPDATA%\marketadvior\python\_ctypes.pyd
  • %APPDATA%\marketadvior\python\_bz2.pyd
  • %APPDATA%\marketadvior\python\_asyncio.pyd
  • %APPDATA%\marketadvior\python\license.txt
  • %APPDATA%\marketadvior\mcfckchjhehcdgoeihjjjbkcdpdfmloa.crx
  • %APPDATA%\marketadvior\load.pyc
  • %APPDATA%\marketadvior\load.bin
  • %TEMP%\nswd42b.tmp
  • %APPDATA%\marketadvior\python\libcrypto-1_1.dll
  • %APPDATA%\marketadvior\python\libssl-1_1.dll
  • %APPDATA%\marketadvior\python\_ssl.pyd
  • %APPDATA%\marketadvior\python\pyexpat.pyd
  • %APPDATA%\marketadvior\pbsent.txt
  • %APPDATA%\marketadvior\python\python.exe
  • %TEMP%\tmp2hdej9ri
  • %TEMP%\xbn4rjqv
  • %APPDATA%\marketadvior\uuid.txt
  • %APPDATA%\marketadvior\pb2url.txt
  • %APPDATA%\marketadvior\pburl.txt
  • %APPDATA%\marketadvior\pbid.txt
  • %APPDATA%\marketadvior\subid.txt
  • %APPDATA%\marketadvior\pi.txt
  • %ProgramFiles(x86)%\proxyvan\service\is-vlee7.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-ks35r.tmp
  • %APPDATA%\marketadvior\python\vcruntime140.dll
  • %APPDATA%\marketadvior\python\unicodedata.pyd
  • %APPDATA%\marketadvior\python\sqlite3.dll
  • %APPDATA%\marketadvior\python\select.pyd
  • %APPDATA%\marketadvior\python\pythonw.exe
  • %APPDATA%\marketadvior\python\python37.zip
  • %APPDATA%\marketadvior\python\python37.dll
  • %APPDATA%\marketadvior\python\python37._pth
  • %APPDATA%\marketadvior\python\python3.dll
  • %TEMP%\nskdd92.tmp\nsexec.dll
  • %ProgramFiles(x86)%\proxyvan\service\is-38i27.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-sotmc.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-c9t7j.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-3j13d.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-3im61.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-5kglq.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-3mslk.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-v9od8.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-ciof0.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-dus5q.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-ofmu7.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-els1v.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-sj9gi.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-jr44a.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-1cf6h.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-vvkpq.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-5uslu.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-3fnjj.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-0a6rp.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-35kh2.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-e0juc.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-18rps.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-33o7v.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-csmv8.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-mocjf.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-samm3.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-dl10m.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-7iedq.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-t0lss.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-i7mo4.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-8638r.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-5njee.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-osvg0.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-k1div.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-a0860.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-jicgo.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-mdbv3.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-vpvq4.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-8gk2e.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-vs41i.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-2om3e.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-tvtkr.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-bllcc.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-i7mih.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-k1kg7.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-rm3ud.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-jbpt5.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-dpu1e.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-6eq65.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-18oup.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-kfrup.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-ul8o7.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-6g5o5.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-42156.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-6th1e.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-5nbno.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-hggb2.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-pqtj6.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-l93ll.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-rucu0.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-v2ss4.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-h3540.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-bggdk.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-38t86.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-jm6ni.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-ail6s.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-2c1vj.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-neom4.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-903vb.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-fg2r4.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-loqon.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-lja2o.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-shcfo.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-i8rpg.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-g05og.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-qfmpo.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-2k39l.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-dn3em.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-pm6hb.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-9t8nb.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-bee8v.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-6ujn4.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-l9cdk.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-vrbg3.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-1u8gu.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-qkmki.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-2ra5a.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-k849a.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-8n4lp.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-0bevn.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-bgiov.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-stbs8.tmp
  • %ProgramFiles(x86)%\proxyvan\service\is-bjhbv.tmp
  • %TEMP%\is-qama2.tmp\gamesdepart.zip
Deletes the following files
  • %TEMP%\xbn4rjqv
  • %TEMP%\nskdd92.tmp\nsexec.dll
  • %TEMP%\tmp2hdej9ri
  • %TEMP%\tmpyt879lrz
  • %TEMP%\is-5lkps.tmp\_isetup\_iscrypt.dll
  • %TEMP%\is-5lkps.tmp\_isetup\_setup64.tmp
  • %TEMP%\is-j8tsj.tmp\tmp8346.tmp
  • %TEMP%\is-obsqs.tmp\idp.dll
  • %TEMP%\is-obsqs.tmp\_isetup\_setup64.tmp
  • %TEMP%\is-uu5cd.tmp\gamesdepart.000.5241.0.tmp
Moves the following files
  • from %TEMP%\tmp8346.tmp to %TEMP%\tmp8346.exe
  • from %ProgramFiles(x86)%\proxyvan\updater\is-vjhar.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.componentmodel.annotations.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-jd0ps.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.collections.specialized.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-77abh.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.collections.nongeneric.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-5nraa.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.collections.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-ia2lu.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.collections.concurrent.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-pfl8m.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.buffers.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-ijgia.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.appcontext.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-mnrmm.tmp to %ProgramFiles(x86)%\proxyvan\updater\serilog.sinks.rollingfile.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-vppk6.tmp to %ProgramFiles(x86)%\proxyvan\updater\serilog.sinks.file.pdb
  • from %ProgramFiles(x86)%\proxyvan\updater\is-04mo5.tmp to %ProgramFiles(x86)%\proxyvan\updater\serilog.sinks.file.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-3v0sd.tmp to %ProgramFiles(x86)%\proxyvan\updater\serilog.sinks.console.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-ficd9.tmp to %ProgramFiles(x86)%\proxyvan\updater\serilog.extensions.logging.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-ti7at.tmp to %ProgramFiles(x86)%\proxyvan\updater\serilog.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-a9jsg.tmp to %ProgramFiles(x86)%\proxyvan\updater\proxyvanupdater.pdb
  • from %ProgramFiles(x86)%\proxyvan\updater\is-o3312.tmp to %ProgramFiles(x86)%\proxyvan\updater\proxyvanupdater.exe.config
  • from %ProgramFiles(x86)%\proxyvan\updater\is-n4gjb.tmp to %ProgramFiles(x86)%\proxyvan\updater\proxyvan.common.pdb
  • from %ProgramFiles(x86)%\proxyvan\updater\is-rudce.tmp to %ProgramFiles(x86)%\proxyvan\updater\proxyvanupdater.exe
  • from %ProgramFiles(x86)%\proxyvan\updater\is-6nddv.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.componentmodel.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-ohh4r.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.componentmodel.eventbasedasync.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-d2c5t.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.globalization.calendars.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-gpkrp.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.dynamic.runtime.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-rpbhk.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.drawing.primitives.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-jt5s1.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.diagnostics.tracing.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-lkdsp.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.diagnostics.tracesource.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-coeei.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.diagnostics.tools.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-1j7kc.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.diagnostics.textwritertracelistener.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-vnaen.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.diagnostics.process.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-uv3bi.tmp to %ProgramFiles(x86)%\proxyvan\updater\proxyvan.common.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-7fggb.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.diagnostics.fileversioninfo.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-p10tb.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.diagnostics.debug.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-v1c16.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.diagnostics.contracts.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-foof0.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.data.common.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-3h4bd.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.console.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-c6u1o.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.componentmodel.typeconverter.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-b4vrf.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.componentmodel.primitives.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-jeidv.tmp to %ProgramFiles(x86)%\proxyvan\updater\proxyvan.common.dll.config
  • from %ProgramFiles(x86)%\proxyvan\updater\is-06ima.tmp to %ProgramFiles(x86)%\proxyvan\updater\protobuf-net.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-6c7jq.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.globalization.extensions.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-019p7.tmp to %ProgramFiles(x86)%\proxyvan\updater\commandline.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-u83gr.tmp to %ProgramFiles(x86)%\proxyvan\service\system.xml.xpath.xdocument.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-q0hiu.tmp to %ProgramFiles(x86)%\proxyvan\service\system.xml.xpath.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-i2h9q.tmp to %ProgramFiles(x86)%\proxyvan\service\system.xml.xmlserializer.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-8mcf1.tmp to %ProgramFiles(x86)%\proxyvan\service\system.xml.xmldocument.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-7c7la.tmp to %ProgramFiles(x86)%\proxyvan\service\system.xml.xdocument.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-m1nh7.tmp to %ProgramFiles(x86)%\proxyvan\service\system.xml.readerwriter.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-4c5e2.tmp to %ProgramFiles(x86)%\proxyvan\service\system.valuetuple.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-fbli2.tmp to %ProgramFiles(x86)%\proxyvan\service\system.valuetuple.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-kdbou.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.timer.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-hukvb.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.threadpool.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-2v2v3.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.thread.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-19ae3.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.tasks.parallel.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-3cvnu.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.tasks.extensions.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-7shsi.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.tasks.extensions.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-bcoj9.tmp to %ProgramFiles(x86)%\proxyvan\updater\danilovsoft.vrpc.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-2sdip.tmp to %ProgramFiles(x86)%\proxyvan\updater\danilovsoft.websocket.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-j1nqn.tmp to %ProgramFiles(x86)%\proxyvan\updater\netstandard.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-b1pvb.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.logging.configuration.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-gsb7d.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.logging.console.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-9sh8r.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.win32.primitives.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-8jcr4.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.io.recyclablememorystream.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-51mh8.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.primitives.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-j672a.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.options.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-r4adc.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.options.configurationextensions.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-lh331.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.logging.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-82g2p.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.diagnostics.stacktrace.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-ehkcm.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.globalization.dll
  • from %ProgramFiles(x86)%\proxyvan\service\ru\is-6tnnm.tmp to %ProgramFiles(x86)%\proxyvan\service\ru\danilovsoft.vrpc.resources.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-9esah.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.dependencyinjection.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-r3d74.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.dependencyinjection.abstractions.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-ed7r3.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.configuration.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-n578b.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.configuration.binder.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-6ircr.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.configuration.abstractions.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-dvl2j.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.bcl.asyncinterfaces.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-b6kvp.tmp to %ProgramFiles(x86)%\proxyvan\updater\microsoft.extensions.logging.abstractions.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-ciof0.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.nameresolution.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-j62hp.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.compression.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-fquem.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.text.encoding.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-0t5hl.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.security.securestring.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-brtkt.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.security.principal.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-e6m1j.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.security.cryptography.x509certificates.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-v4bac.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.security.cryptography.primitives.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-ss0jp.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.security.cryptography.encoding.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-856lt.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.security.cryptography.csp.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-tvtmd.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.security.cryptography.algorithms.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-4tkdh.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.security.claims.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-vuodq.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.serialization.xml.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-mg1oh.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.serialization.primitives.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-p72en.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.serialization.json.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-ct21d.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.serialization.formatters.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-pd080.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.numerics.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-atanv.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.interopservices.runtimeinformation.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-9qq22.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.text.encoding.extensions.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-tr7e6.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.text.encodings.web.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-um335.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.text.json.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-7oh55.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.text.regularexpressions.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-cp186.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.xml.xpath.xdocument.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-omu4i.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.xml.xpath.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-0lk5m.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.xml.xmlserializer.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-7lq7i.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.xml.xmldocument.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-fe4dc.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.xml.xdocument.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-hiuv0.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.xml.readerwriter.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-cm8ri.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.valuetuple.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-cn1sq.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.interopservices.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-pvt34.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.tasks.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-7qn42.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.threading.thread.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-a19mp.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.threading.tasks.parallel.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-b8ftp.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.threading.tasks.extensions.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-t48ck.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.threading.tasks.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-ct281.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.threading.overlapped.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-t07ei.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.threading.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-uiidh.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.threading.channels.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-h50np.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.threading.threadpool.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-t0i37.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.handles.dll
  • from %ProgramFiles(x86)%\proxyvan\service\ru\is-ji9g2.tmp to %ProgramFiles(x86)%\proxyvan\service\ru\danilovsoft.websocket.resources.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-ick3f.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-pkuvn.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.reflection.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-4rdh5.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.memory.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-thd05.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.linq.queryable.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-pipk6.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.linq.parallel.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-31b5r.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.linq.expressions.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-3i0nk.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.linq.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-ikl4e.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.unmanagedmemorystream.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-0kbf8.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.pipes.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-3ebj2.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.memorymappedfiles.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-88062.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.isolatedstorage.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-4qd74.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.filesystem.watcher.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-o9g0c.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.filesystem.primitives.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-akce9.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.filesystem.driveinfo.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-s1edn.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.filesystem.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-jbdof.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-92avv.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.nameresolution.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-gcvdv.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.networkinformation.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-stjlb.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.ping.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-6370f.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.primitives.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-g9nmt.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.compilerservices.visualc.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-cl248.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.compilerservices.unsafe.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-f94ho.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.resources.writer.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-d80ua.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.resources.resourcemanager.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-8dfn9.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.resources.reader.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-fqp9n.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.reflection.primitives.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-nf55r.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.reflection.extensions.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-vrsei.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.runtime.extensions.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-ohnar.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.io.compression.zipfile.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-omict.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.numerics.vectors.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-s2233.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.websockets.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-kq0iv.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.websockets.client.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-m0i7q.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.webheadercollection.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-q05r1.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.sockets.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-e5o5n.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.security.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-19mna.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.requests.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-nrns5.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.objectmodel.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-jvmgd.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.net.http.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-pkq49.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.overlapped.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-jguii.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-63us2.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.channels.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-6th1e.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.sinks.rollingfile.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-pqtj6.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.sinks.file.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-l93ll.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.sinks.console.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-rucu0.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.sinks.console.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-v2ss4.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.extensions.logging.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-h3540.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.extensions.logging.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-bggdk.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-38t86.tmp to %ProgramFiles(x86)%\proxyvan\service\proxyvan.pdb
  • from %ProgramFiles(x86)%\proxyvan\service\is-jm6ni.tmp to %ProgramFiles(x86)%\proxyvan\service\proxyvan.exe.config
  • from %ProgramFiles(x86)%\proxyvan\service\is-ail6s.tmp to %ProgramFiles(x86)%\proxyvan\service\proxyvan.exe
  • from %ProgramFiles(x86)%\proxyvan\service\is-2c1vj.tmp to %ProgramFiles(x86)%\proxyvan\service\proxyvan.common.pdb
  • from %ProgramFiles(x86)%\proxyvan\service\is-c9t7j.tmp to %ProgramFiles(x86)%\proxyvan\service\proxyvan.common.dll.config
  • from %ProgramFiles(x86)%\proxyvan\service\is-l9cdk.tmp to %ProgramFiles(x86)%\proxyvan\service\proxyvan.common.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-mdbv3.tmp to %ProgramFiles(x86)%\proxyvan\service\proxy.common.pdb
  • from %ProgramFiles(x86)%\proxyvan\service\is-ks35r.tmp to %ProgramFiles(x86)%\proxyvan\service\proxy.common.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-42156.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.sinks.rollingfile.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-6g5o5.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-1u8gu.tmp to %ProgramFiles(x86)%\proxyvan\service\system.diagnostics.debug.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-shcfo.tmp to %ProgramFiles(x86)%\proxyvan\service\system.componentmodel.annotations.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-stbs8.tmp to %ProgramFiles(x86)%\proxyvan\service\system.componentmodel.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-qkmki.tmp to %ProgramFiles(x86)%\proxyvan\service\system.diagnostics.contracts.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-2ra5a.tmp to %ProgramFiles(x86)%\proxyvan\service\system.data.common.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-k849a.tmp to %ProgramFiles(x86)%\proxyvan\service\system.console.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-8n4lp.tmp to %ProgramFiles(x86)%\proxyvan\service\system.componentmodel.typeconverter.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-0bevn.tmp to %ProgramFiles(x86)%\proxyvan\service\system.componentmodel.primitives.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-bgiov.tmp to %ProgramFiles(x86)%\proxyvan\service\system.componentmodel.eventbasedasync.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-5nbno.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.sinks.file.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-i571e.tmp to %ProgramFiles(x86)%\proxyvan\service\protobuf-net.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-6lne6.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.logging.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-903vb.tmp to %ProgramFiles(x86)%\proxyvan\service\system.collections.nongeneric.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-neom4.tmp to %ProgramFiles(x86)%\proxyvan\service\system.collections.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-fg2r4.tmp to %ProgramFiles(x86)%\proxyvan\service\system.collections.concurrent.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-18oup.tmp to %ProgramFiles(x86)%\proxyvan\service\system.buffers.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-kfrup.tmp to %ProgramFiles(x86)%\proxyvan\service\system.buffers.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-ul8o7.tmp to %ProgramFiles(x86)%\proxyvan\service\system.appcontext.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-loqon.tmp to %ProgramFiles(x86)%\proxyvan\service\system.collections.specialized.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\ru\is-auf8j.tmp to %ProgramFiles(x86)%\proxyvan\updater\ru\danilovsoft.vrpc.resources.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-vrbg3.tmp to %ProgramFiles(x86)%\proxyvan\service\system.diagnostics.fileversioninfo.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-1nguj.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.win32.primitives.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-gbef4.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.configuration.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-jmlmp.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.configuration.binder.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-cd4dv.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.configuration.binder.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-0i5s2.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.configuration.abstractions.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-ge83a.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.configuration.abstractions.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-6tcek.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.bcl.asyncinterfaces.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-b1b7b.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.bcl.asyncinterfaces.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-m0j6h.tmp to %ProgramFiles(x86)%\proxyvan\service\danilovsoft.websocket.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-is6od.tmp to %ProgramFiles(x86)%\proxyvan\service\danilovsoft.websocket.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-3fmt1.tmp to %ProgramFiles(x86)%\proxyvan\service\danilovsoft.vrpc.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-s22l7.tmp to %ProgramFiles(x86)%\proxyvan\service\danilovsoft.vrpc.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-i28un.tmp to %ProgramFiles(x86)%\proxyvan\service\commandline.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-tpm6l.tmp to %ProgramFiles(x86)%\proxyvan\service\commandline.dll
  • from %ProgramFiles(x86)%\proxyvan\is-onfd9.tmp to %ProgramFiles(x86)%\proxyvan\unins000.exe
  • from %ProgramFiles(x86)%\proxyvan\service\is-eloas.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.dependencyinjection.abstractions.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-q6su9.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.dependencyinjection.abstractions.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-b0u61.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.configuration.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-3d57i.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.dependencyinjection.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-oooev.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.io.recyclablememorystream.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-sfcv7.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.dependencyinjection.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-ud0un.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.io.recyclablememorystream.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-cq50g.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.primitives.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-dbcc4.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.primitives.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-o2stg.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.options.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-vlee7.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.options.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-3ogk7.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.options.configurationextensions.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-3nhij.tmp to %ProgramFiles(x86)%\proxyvan\service\protobuf-net.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-dc23s.tmp to %ProgramFiles(x86)%\proxyvan\service\netstandard.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-uip1b.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.logging.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-7l9i7.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.logging.console.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-ajh2f.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.logging.console.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-u7cmb.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.logging.configuration.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-fdcsc.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.logging.configuration.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-f8n1r.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.logging.abstractions.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-cqj3p.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.logging.abstractions.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-0rckl.tmp to %ProgramFiles(x86)%\proxyvan\service\microsoft.extensions.options.configurationextensions.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\is-h9pgh.tmp to %ProgramFiles(x86)%\proxyvan\updater\system.threading.timer.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-38i27.tmp to %ProgramFiles(x86)%\proxyvan\service\system.diagnostics.process.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-9t8nb.tmp to %ProgramFiles(x86)%\proxyvan\service\system.diagnostics.tools.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-sotmc.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.serialization.formatters.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-dl10m.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.numerics.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-7iedq.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.interopservices.runtimeinformation.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-t0lss.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.interopservices.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-i7mo4.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.handles.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-8638r.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.extensions.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-5njee.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-osvg0.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.compilerservices.visualc.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-k1div.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.compilerservices.unsafe.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-a0860.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.compilerservices.unsafe.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-94e38.tmp to %ProgramFiles(x86)%\proxyvan\service\system.resources.writer.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-jicgo.tmp to %ProgramFiles(x86)%\proxyvan\service\system.resources.resourcemanager.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-vpvq4.tmp to %ProgramFiles(x86)%\proxyvan\service\system.resources.reader.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-8gk2e.tmp to %ProgramFiles(x86)%\proxyvan\service\system.reflection.primitives.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-vs41i.tmp to %ProgramFiles(x86)%\proxyvan\service\system.reflection.extensions.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-6ujn4.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.serialization.json.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-hib04.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.serialization.primitives.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-vml7a.tmp to %ProgramFiles(x86)%\proxyvan\service\system.runtime.serialization.xml.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-nmtef.tmp to %ProgramFiles(x86)%\proxyvan\service\system.security.claims.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-tvtkr.tmp to %ProgramFiles(x86)%\proxyvan\service\system.objectmodel.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-gpf4e.tmp to %ProgramFiles(x86)%\proxyvan\service\system.threading.channels.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-7tl9u.tmp to %ProgramFiles(x86)%\proxyvan\service\system.text.regularexpressions.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-4jgd3.tmp to %ProgramFiles(x86)%\proxyvan\service\system.text.json.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-stf56.tmp to %ProgramFiles(x86)%\proxyvan\service\system.text.json.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-ffeh8.tmp to %ProgramFiles(x86)%\proxyvan\service\system.text.encodings.web.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-rqo8a.tmp to %ProgramFiles(x86)%\proxyvan\service\system.text.encodings.web.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-2om3e.tmp to %ProgramFiles(x86)%\proxyvan\service\system.reflection.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-5scfp.tmp to %ProgramFiles(x86)%\proxyvan\service\system.text.encoding.extensions.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-bjhbv.tmp to %ProgramFiles(x86)%\proxyvan\service\system.diagnostics.stacktrace.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-84ksk.tmp to %ProgramFiles(x86)%\proxyvan\service\system.security.principal.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-sir6r.tmp to %ProgramFiles(x86)%\proxyvan\service\system.security.cryptography.x509certificates.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-9pfl4.tmp to %ProgramFiles(x86)%\proxyvan\service\system.security.cryptography.primitives.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-8hpqe.tmp to %ProgramFiles(x86)%\proxyvan\service\system.security.cryptography.encoding.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-esso5.tmp to %ProgramFiles(x86)%\proxyvan\service\system.security.cryptography.csp.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-ioo2h.tmp to %ProgramFiles(x86)%\proxyvan\service\system.security.cryptography.algorithms.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-93ij4.tmp to %ProgramFiles(x86)%\proxyvan\service\system.text.encoding.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-bee8v.tmp to %ProgramFiles(x86)%\proxyvan\service\system.diagnostics.textwritertracelistener.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-n1srr.tmp to %ProgramFiles(x86)%\proxyvan\service\system.security.securestring.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-hggb2.tmp to %ProgramFiles(x86)%\proxyvan\service\serilog.sinks.file.pdb
  • from %ProgramFiles(x86)%\proxyvan\service\is-35kh2.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.isolatedstorage.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-e0juc.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.filesystem.watcher.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-18rps.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.filesystem.primitives.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-csmv8.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.filesystem.driveinfo.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-33o7v.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.filesystem.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-jbpt5.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-dpu1e.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.compression.zipfile.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-6eq65.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.compression.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-lja2o.tmp to %ProgramFiles(x86)%\proxyvan\service\system.globalization.extensions.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-i8rpg.tmp to %ProgramFiles(x86)%\proxyvan\service\system.globalization.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-g05og.tmp to %ProgramFiles(x86)%\proxyvan\service\system.globalization.calendars.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-qfmpo.tmp to %ProgramFiles(x86)%\proxyvan\service\system.dynamic.runtime.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-2k39l.tmp to %ProgramFiles(x86)%\proxyvan\service\system.drawing.primitives.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-dn3em.tmp to %ProgramFiles(x86)%\proxyvan\service\system.diagnostics.tracing.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-pm6hb.tmp to %ProgramFiles(x86)%\proxyvan\service\system.diagnostics.tracesource.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-0a6rp.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.memorymappedfiles.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-3fnjj.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.pipes.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-5uslu.tmp to %ProgramFiles(x86)%\proxyvan\service\system.io.unmanagedmemorystream.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-vvkpq.tmp to %ProgramFiles(x86)%\proxyvan\service\system.linq.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-i7mih.tmp to %ProgramFiles(x86)%\proxyvan\service\system.numerics.vectors.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-rm3ud.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.websockets.client.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-samm3.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.webheadercollection.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-mocjf.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.sockets.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-3j13d.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.security.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-3im61.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.requests.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-5kglq.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.primitives.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-bllcc.tmp to %ProgramFiles(x86)%\proxyvan\service\system.numerics.vectors.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-3mslk.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.ping.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-k1kg7.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.websockets.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-dus5q.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.http.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-ofmu7.tmp to %ProgramFiles(x86)%\proxyvan\service\system.memory.xml
  • from %ProgramFiles(x86)%\proxyvan\service\is-els1v.tmp to %ProgramFiles(x86)%\proxyvan\service\system.memory.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-sj9gi.tmp to %ProgramFiles(x86)%\proxyvan\service\system.linq.queryable.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-jr44a.tmp to %ProgramFiles(x86)%\proxyvan\service\system.linq.parallel.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-1cf6h.tmp to %ProgramFiles(x86)%\proxyvan\service\system.linq.expressions.dll
  • from %ProgramFiles(x86)%\proxyvan\service\is-v9od8.tmp to %ProgramFiles(x86)%\proxyvan\service\system.net.networkinformation.dll
  • from %ProgramFiles(x86)%\proxyvan\updater\ru\is-jmlhs.tmp to %ProgramFiles(x86)%\proxyvan\updater\ru\danilovsoft.websocket.resources.dll
Network activity
TCP
HTTP GET requests
  • http://do###nht6.ml/click.php?cn#######################
  • http://ya###etn1k.ru/files/MarketAdvior.exe
  • http://www.go#####analytics.com/collect?v=#######################################################################################################################################################...
  • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
  • http://on#####game-group.ru/download.php?ad######
  • http://ga###depart.com/client/get_build.php
  • 'jj###.adsbtrk.com':443
  • 'pr##yvan.io':443
  • UDP
    • DNS ASK do###nht6.ml
    • DNS ASK ya###etn1k.ru
    • DNS ASK jj###.adsbtrk.com
    • DNS ASK go#####analytics.com
    • DNS ASK pr##yvan.io
    • DNS ASK microsoft.com
    • DNS ASK on#####game-group.ru
    • DNS ASK ga###depart.com
    Miscellaneous
    Searches for the following windows
    • ClassName: '' WindowName: ''
    Creates and executes the following
    • '%TEMP%\marketadvior.exe' /S /pb=https://jjmyn.adsbtrk.com/c/f9706f7de562eb2b?SUBID={SUBID}&PUBID={PUBID}&HID={HID}&GEO={GEO}&TS={TS} /pb2=https://jjmyn.adsbtrk.com/c/63ac61070427831d?SUBID={SUBID}&PUBID={PUBID}&HID={HI...
    • '%TEMP%\installer_2.21.3.exe'
    • '%ProgramFiles(x86)%\proxyvan\updater\proxyvanupdater.exe'
    • '%TEMP%\is-uu5cd.tmp\gamesdepart.000.5241.0.tmp' /SL5="$10260,1011219,721408,%TEMP%\Gamesdepart.000.5241.0.exe" /S /adv 5241 /subadv 435
    • '%ProgramFiles(x86)%\proxyvan\service\proxyvan.exe'
    • '%TEMP%\gamesdepart.000.5241.0.exe' /VERYSILENT /adv=5241 /subadv=435
    • '%TEMP%\tmp8346.exe' /PASSWORD=cYIrud1plNek /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /UTM=
    • '%APPDATA%\marketadvior\python\python.exe' load.pyc --act=inst ml2
    • '%TEMP%\gamesdepart.000.5241.0.exe' /S /adv 5241 /subadv 435
    • '%APPDATA%\marketadvior\python\python.exe' load.pyc manage2
    • '%APPDATA%\marketadvior\python\python.exe' load.pyc launchall2
    • '%APPDATA%\marketadvior\python\python.exe' load.pyc --subid="{SES}" --pbid="Pao" --pb="https://jjmyn.adsbtrk.com/c/f9706f7de562eb2b?SUBID={SUBID}&PUBID={PUBID}&HID={HID}&GEO={GEO}&TS={TS}" --pb2="https://jjmyn.adsbtrk.com/c/63ac61070427...
    • '%APPDATA%\marketadvior\python\python.exe' load.pyc "akgdkknilkblpjcgpjmbjgpamneokmag;djgdgdcfmdkficbifbnaacknblbkhhoc;fdjdjkkjoiomafnihnobkinnfjnnlhdg;mocgkongaoagjoicmbimkiopebgfkich" checkinstalled
    • '%APPDATA%\marketadvior\python\python.exe' load.py app
    • '%TEMP%\is-19rgd.tmp\gamesdepart.000.5241.0.tmp' /SL5="$20266,1011219,721408,%TEMP%\Gamesdepart.000.5241.0.exe" /VERYSILENT /adv=5241 /subadv=435
    • '%TEMP%\is-j8tsj.tmp\tmp8346.tmp' /SL5="$D0154,1996124,721408,%TEMP%\tmp8346.exe" /PASSWORD=cYIrud1plNek /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /UTM=
    • '%APPDATA%\marketadvior\python\python.exe' load.pyc "akgdkknilkblpjcgpjmbjgpamneokmag;djgdgdcfmdkficbifbnaacknblbkhhoc;fdjdjkkjoiomafnihnobkinnfjnnlhdg;mocgkongaoagjoicmbimkiopebgfkich" checkinstalled' (with hidden window)
    • '%WINDIR%\syswow64\taskkill.exe' /f /im "gamesdepartupdate.exe"' (with hidden window)
    • '%WINDIR%\syswow64\sc.exe' create ProxyVan2 obj= "LocalSystem" start= auto binPath= "%ProgramFiles(x86)%\ProxyVan\Service\ProxyVan.exe"' (with hidden window)
    • '%WINDIR%\syswow64\sc.exe' create ProxyVanUpdater obj= "LocalSystem" start= auto binPath= "%ProgramFiles(x86)%\ProxyVan\Updater\ProxyVanUpdater.exe"' (with hidden window)
    • '%WINDIR%\syswow64\sc.exe' start ProxyVan2' (with hidden window)
    • '%APPDATA%\marketadvior\python\python.exe' load.pyc --subid="{SES}" --pbid="Pao" --pb="https://jjmyn.adsbtrk.com/c/f9706f7de562eb2b?SUBID={SUBID}&PUBID={PUBID}&HID={HID}&GEO={GEO}&TS={TS}" --pb2="https://jjmyn.adsbtrk.com/c/63ac61070427...' (with hidden window)
    • '%WINDIR%\syswow64\sc.exe' start ProxyVanUpdater' (with hidden window)
    Executes the following
    • '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /tn "MarketAdvior" /xml "%TEMP%\tmp2hdej9ri"
    • '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "MarketAdvior" /xml "%TEMP%\tmp2hdej9ri"
    • '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /tn "MarketAdvior2" /xml "%TEMP%\tmpyt879lrz"
    • '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "MarketAdvior2" /xml "%TEMP%\tmpyt879lrz"
    • '%WINDIR%\syswow64\sc.exe' create ProxyVan2 obj= "LocalSystem" start= auto binPath= "%ProgramFiles(x86)%\ProxyVan\Service\ProxyVan.exe"
    • '%WINDIR%\syswow64\sc.exe' create ProxyVanUpdater obj= "LocalSystem" start= auto binPath= "%ProgramFiles(x86)%\ProxyVan\Updater\ProxyVanUpdater.exe"
    • '%WINDIR%\syswow64\sc.exe' start ProxyVan2
    • '%WINDIR%\syswow64\sc.exe' start ProxyVanUpdater

    Curing recommendations

    1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
    2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
    Free trial

    One month (no registration) or three months (registration and renewal discount)

    Download Dr.Web

    Download by serial number

    Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

    Free trial

    One month (no registration) or three months (registration and renewal discount)

    Download Dr.Web

    Download by serial number

    After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

    Free trial

    One month (no registration) or three months (registration and renewal discount)

    Download Dr.Web

    Download by serial number

    1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
    2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
      • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
      • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
      • Switch off your device and turn it on as normal.

    Find out more about Dr.Web for Android

    The Russian developer of Dr.Web anti-viruses
    Doctor Web has been developing anti-virus software since 1992
    Dr.Web is trusted by users around the world in 200+ countries
    The company has delivered an anti-virus as a service since 2007
    24/7 tech support

    Dr.Web © Doctor Web
    2003 — 2020

    Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

    2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125124