Trojan.Siggen21.2661

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\Software\Classes\cclaunch\shell\open\command] '' = '"%ProgramFiles%\CCleaner\ccleaner64.exe" /%1'
[HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'

Modifies file system

Creates the following files

%TEMP%\rarsfx0\cybermania.url
%ProgramFiles%\ccleaner\lang\setb6bd.tmp
%ProgramFiles%\ccleaner\lang\setb6cd.tmp
%ProgramFiles%\ccleaner\lang\setb6ce.tmp
%ProgramFiles%\ccleaner\lang\setb6ef.tmp
%ProgramFiles%\ccleaner\lang\setb71e.tmp
%ProgramFiles%\ccleaner\lang\setb6ab.tmp
%ProgramFiles%\ccleaner\lang\setb6ac.tmp
%ProgramFiles%\ccleaner\lang\setb72f.tmp
%ProgramFiles%\ccleaner\lang\setb780.tmp
%ProgramFiles%\ccleaner\lang\setb791.tmp
%ProgramFiles%\ccleaner\lang\setb792.tmp
%ProgramFiles%\ccleaner\lang\setb793.tmp
%ProgramFiles%\ccleaner\lang\setb7b3.tmp
%ProgramFiles%\ccleaner\lang\setb75f.tmp
%ProgramFiles%\ccleaner\lang\setb760.tmp
%ProgramFiles%\ccleaner\lang\setb7c4.tmp
%ProgramFiles%\ccleaner\lang\setb7b4.tmp
%ProgramFiles%\ccleaner\lang\setb679.tmp
%ProgramFiles%\ccleaner\lang\setb5f1.tmp
%ProgramFiles%\ccleaner\lang\setb5f2.tmp
%ProgramFiles%\ccleaner\lang\setb602.tmp
%ProgramFiles%\ccleaner\lang\setb613.tmp
%ProgramFiles%\ccleaner\lang\setb68a.tmp
%ProgramFiles%\ccleaner\lang\setb5cf.tmp
%ProgramFiles%\ccleaner\lang\setb69b.tmp
%ProgramFiles%\ccleaner\lang\setb623.tmp
%ProgramFiles%\ccleaner\lang\setb656.tmp
%ProgramFiles%\ccleaner\lang\setb667.tmp
%ProgramFiles%\ccleaner\lang\setb668.tmp
%ProgramFiles%\ccleaner\lang\setb678.tmp
%ProgramFiles%\ccleaner\lang\setb634.tmp
%ProgramFiles%\ccleaner\lang\setb635.tmp
%ProgramFiles%\ccleaner\lang\setb646.tmp
%ProgramFiles%\ccleaner\lang\setb386.tmp
%ProgramFiles%\ccleaner\lang\setb7c5.tmp
%ProgramFiles%\ccleaner\ccleaner.ini
%TEMP%\etilqs_qh7ozacw9f6ahin
%TEMP%\etilqs_a0kzfbvboqzp8tc
%TEMP%\etilqs_lctbtlm2hidp7z8
%TEMP%\etilqs_xbjtef82h8hh2ua
%ProgramFiles%\ccleaner\setb911.tmp
%TEMP%\etilqs_hyymxuvm9fidshd
nul
%TEMP%\etilqs_jawvxzzxg4bgwiz
%TEMP%\etilqs_vtejyt4fwrrhn5f
%TEMP%\etilqs_pzx5p2roilbvzg6
%TEMP%\etilqs_nitwrb3lan2pubx
%TEMP%\etilqs_imxyh6idky4sucb
%TEMP%\etilqs_mcl0viyuy2bx0it
%ProgramFiles%\ccleaner\setb8c2.tmp
%TEMP%\etilqs_zbrbdqvesvudqcm
%ProgramFiles%\ccleaner\lang\setb8c1.tmp
%ProgramFiles%\ccleaner\lang\setb8b1.tmp
%ProgramFiles%\ccleaner\lang\setb7d7.tmp
%ProgramFiles%\ccleaner\lang\setb7e9.tmp
%ProgramFiles%\ccleaner\lang\setb809.tmp
%ProgramFiles%\ccleaner\lang\setb819.tmp
%ProgramFiles%\ccleaner\lang\setb82a.tmp
%ProgramFiles%\ccleaner\lang\setb82b.tmp
%ProgramFiles%\ccleaner\lang\setb83c.tmp
%ProgramFiles%\ccleaner\lang\setb7e8.tmp
%ProgramFiles%\ccleaner\lang\setb84c.tmp
%ProgramFiles%\ccleaner\lang\setb86d.tmp
%ProgramFiles%\ccleaner\lang\setb87e.tmp
%ProgramFiles%\ccleaner\lang\setb87f.tmp
%ProgramFiles%\ccleaner\lang\setb890.tmp
%ProgramFiles%\ccleaner\lang\setb8a0.tmp
%ProgramFiles%\ccleaner\lang\setb5bf.tmp
%ProgramFiles%\ccleaner\lang\setb85d.tmp
%ProgramFiles%\ccleaner\lang\setb5e0.tmp
%ProgramFiles%\ccleaner\lang\setb5be.tmp
%ProgramFiles%\ccleaner\lang\setb5ad.tmp
%ProgramFiles%\ccleaner\lang\setb59d.tmp
%ProgramFiles%\ccleaner\lang\setb2cd.tmp
%ProgramFiles%\ccleaner\lang\setb2dd.tmp
%ProgramFiles%\ccleaner\lang\setb2ee.tmp
%ProgramFiles%\ccleaner\lang\setb2ef.tmp
%ProgramFiles%\ccleaner\lang\setb2ab.tmp
%ProgramFiles%\ccleaner\lang\setb299.tmp
%ProgramFiles%\ccleaner\lang\setb2bc.tmp
%ProgramFiles%\ccleaner\lang\setb300.tmp
%ProgramFiles%\ccleaner\lang\setb332.tmp
%ProgramFiles%\ccleaner\lang\setb343.tmp
%ProgramFiles%\ccleaner\lang\setb354.tmp
%ProgramFiles%\ccleaner\lang\setb355.tmp
%ProgramFiles%\ccleaner\lang\setb310.tmp
%ProgramFiles%\ccleaner\lang\setb321.tmp
%ProgramFiles%\ccleaner\lang\setb331.tmp
%ProgramFiles%\ccleaner\lang\setb29a.tmp
%ProgramFiles%\ccleaner\lang\setb288.tmp
%ProgramFiles%\ccleaner\lang\setb365.tmp
%TEMP%\rarsfx0\ccleaner64.inf
%TEMP%\rarsfx0\blockhost.cmd
%ProgramFiles%\ccleaner\setac55.tmp
%ProgramFiles%\ccleaner\setac56.tmp
%ProgramFiles%\ccleaner\setac95.tmp
%ProgramFiles%\ccleaner\setac96.tmp
%TEMP%\rarsfx0\ccleaner64.cab
%ProgramFiles%\ccleaner\setaca7.tmp
%ProgramFiles%\ccleaner\lang\setb234.tmp
%ProgramFiles%\ccleaner\lang\setb235.tmp
%ProgramFiles%\ccleaner\lang\setb256.tmp
%ProgramFiles%\ccleaner\lang\setb276.tmp
%ProgramFiles%\ccleaner\lang\setb277.tmp
%ProgramFiles%\ccleaner\lang\setb278.tmp
%ProgramFiles%\ccleaner\setb09e.tmp
%TEMP%\9530.tmp
%ProgramFiles%\ccleaner\lang\setb7d6.tmp
%ProgramFiles%\ccleaner\lang\setb376.tmp
%ProgramFiles%\ccleaner\lang\setb3a9.tmp
%ProgramFiles%\ccleaner\lang\setb4e5.tmp
%ProgramFiles%\ccleaner\lang\setb4f6.tmp
%ProgramFiles%\ccleaner\lang\setb4f7.tmp
%ProgramFiles%\ccleaner\lang\setb517.tmp
%ProgramFiles%\ccleaner\lang\setb4b3.tmp
%ProgramFiles%\ccleaner\lang\setb518.tmp
%ProgramFiles%\ccleaner\lang\setb4d4.tmp
%ProgramFiles%\ccleaner\lang\setb558.tmp
%ProgramFiles%\ccleaner\lang\setb56a.tmp
%ProgramFiles%\ccleaner\lang\setb57a.tmp
%ProgramFiles%\ccleaner\lang\setb57b.tmp
%ProgramFiles%\ccleaner\lang\setb58c.tmp
%ProgramFiles%\ccleaner\lang\setb548.tmp
%ProgramFiles%\ccleaner\lang\setb2bb.tmp
%ProgramFiles%\ccleaner\lang\setb569.tmp
%ProgramFiles%\ccleaner\lang\setb4c4.tmp
%ProgramFiles%\ccleaner\lang\setb4a3.tmp
%ProgramFiles%\ccleaner\lang\setb4a2.tmp
%ProgramFiles%\ccleaner\lang\setb3aa.tmp
%ProgramFiles%\ccleaner\lang\setb3ba.tmp
%ProgramFiles%\ccleaner\lang\setb3cb.tmp
%ProgramFiles%\ccleaner\lang\setb3db.tmp
%ProgramFiles%\ccleaner\lang\setb3ec.tmp
%ProgramFiles%\ccleaner\lang\setb398.tmp
%ProgramFiles%\ccleaner\lang\setb3fd.tmp
%ProgramFiles%\ccleaner\lang\setb43d.tmp
%ProgramFiles%\ccleaner\lang\setb44e.tmp
%ProgramFiles%\ccleaner\lang\setb44f.tmp
%ProgramFiles%\ccleaner\lang\setb45f.tmp
%ProgramFiles%\ccleaner\lang\setb470.tmp
%ProgramFiles%\ccleaner\lang\setb480.tmp
%ProgramFiles%\ccleaner\lang\setb42c.tmp
%ProgramFiles%\ccleaner\lang\setb481.tmp
%ProgramFiles%\ccleaner\lang\setb387.tmp
%TEMP%\9531.tmp

Deletes the following files

%ProgramFiles%\ccleaner\setac55.tmp
%ProgramFiles%\ccleaner\lang\setb5e0.tmp
%ProgramFiles%\ccleaner\lang\setb5f2.tmp
%ProgramFiles%\ccleaner\lang\setb613.tmp
%ProgramFiles%\ccleaner\lang\setb634.tmp
%ProgramFiles%\ccleaner\lang\setb646.tmp
%ProgramFiles%\ccleaner\lang\setb667.tmp
%ProgramFiles%\ccleaner\lang\setb678.tmp
%ProgramFiles%\ccleaner\lang\setb68a.tmp
%ProgramFiles%\ccleaner\lang\setb6ab.tmp
%ProgramFiles%\ccleaner\lang\setb6bd.tmp
%ProgramFiles%\ccleaner\lang\setb6ce.tmp
%ProgramFiles%\ccleaner\lang\setb71e.tmp
%ProgramFiles%\ccleaner\lang\setb75f.tmp
%ProgramFiles%\ccleaner\lang\setb386.tmp
%ProgramFiles%\ccleaner\lang\setb780.tmp
%ProgramFiles%\ccleaner\lang\setb7b3.tmp
%ProgramFiles%\ccleaner\lang\setb7c4.tmp
%ProgramFiles%\ccleaner\lang\setb7d6.tmp
%ProgramFiles%\ccleaner\lang\setb7e8.tmp
%ProgramFiles%\ccleaner\lang\setb809.tmp
%ProgramFiles%\ccleaner\lang\setb82a.tmp
%ProgramFiles%\ccleaner\lang\setb83c.tmp
%ProgramFiles%\ccleaner\lang\setb85d.tmp
%ProgramFiles%\ccleaner\lang\setb87e.tmp
%ProgramFiles%\ccleaner\lang\setb890.tmp
%ProgramFiles%\ccleaner\lang\setb8b1.tmp
%ProgramFiles%\ccleaner\setb8c2.tmp
%TEMP%\rarsfx0\blockhost.cmd
%ProgramFiles%\ccleaner\lang\setb5ad.tmp
%ProgramFiles%\ccleaner\lang\setb5bf.tmp
%ProgramFiles%\ccleaner\lang\setb58c.tmp
%ProgramFiles%\ccleaner\lang\setb57a.tmp
%ProgramFiles%\ccleaner\lang\setb569.tmp
%ProgramFiles%\ccleaner\setaca7.tmp
%ProgramFiles%\ccleaner\lang\setb234.tmp
%ProgramFiles%\ccleaner\lang\setb256.tmp
%ProgramFiles%\ccleaner\lang\setb277.tmp
%ProgramFiles%\ccleaner\lang\setb288.tmp
%ProgramFiles%\ccleaner\lang\setb29a.tmp
%ProgramFiles%\ccleaner\lang\setb2bb.tmp
%ProgramFiles%\ccleaner\lang\setb2cd.tmp
%ProgramFiles%\ccleaner\lang\setb2ee.tmp
%ProgramFiles%\ccleaner\lang\setb300.tmp
%ProgramFiles%\ccleaner\lang\setb321.tmp
%ProgramFiles%\ccleaner\lang\setb332.tmp
%ProgramFiles%\ccleaner\lang\setb354.tmp
%TEMP%\9530.tmp
%ProgramFiles%\ccleaner\lang\setb792.tmp
%ProgramFiles%\ccleaner\lang\setb365.tmp
%ProgramFiles%\ccleaner\lang\setb3aa.tmp
%ProgramFiles%\ccleaner\lang\setb3cb.tmp
%ProgramFiles%\ccleaner\lang\setb3ec.tmp
%ProgramFiles%\ccleaner\lang\setb42c.tmp
%ProgramFiles%\ccleaner\lang\setb44e.tmp
%ProgramFiles%\ccleaner\lang\setb45f.tmp
%ProgramFiles%\ccleaner\lang\setb480.tmp
%ProgramFiles%\ccleaner\lang\setb4a2.tmp
%ProgramFiles%\ccleaner\lang\setb4b3.tmp
%ProgramFiles%\ccleaner\lang\setb4d4.tmp
%ProgramFiles%\ccleaner\lang\setb4f6.tmp
%ProgramFiles%\ccleaner\lang\setb517.tmp
%ProgramFiles%\ccleaner\lang\setb548.tmp
%ProgramFiles%\ccleaner\setac95.tmp
%ProgramFiles%\ccleaner\lang\setb398.tmp
%TEMP%\9531.tmp

Moves the following files

from %ProgramFiles%\ccleaner\setac56.tmp to %ProgramFiles%\ccleaner\branding.dll
from %ProgramFiles%\ccleaner\lang\setb59d.tmp to %ProgramFiles%\ccleaner\lang\lang-1058.dll
from %ProgramFiles%\ccleaner\lang\setb5be.tmp to %ProgramFiles%\ccleaner\lang\lang-1059.dll
from %ProgramFiles%\ccleaner\lang\setb5cf.tmp to %ProgramFiles%\ccleaner\lang\lang-1060.dll
from %ProgramFiles%\ccleaner\lang\setb5f1.tmp to %ProgramFiles%\ccleaner\lang\lang-1061.dll
from %ProgramFiles%\ccleaner\lang\setb602.tmp to %ProgramFiles%\ccleaner\lang\lang-1062.dll
from %ProgramFiles%\ccleaner\lang\setb623.tmp to %ProgramFiles%\ccleaner\lang\lang-1063.dll
from %ProgramFiles%\ccleaner\lang\setb635.tmp to %ProgramFiles%\ccleaner\lang\lang-1065.dll
from %ProgramFiles%\ccleaner\lang\setb656.tmp to %ProgramFiles%\ccleaner\lang\lang-1066.dll
from %ProgramFiles%\ccleaner\lang\setb668.tmp to %ProgramFiles%\ccleaner\lang\lang-1067.dll
from %ProgramFiles%\ccleaner\lang\setb679.tmp to %ProgramFiles%\ccleaner\lang\lang-1068.dll
from %ProgramFiles%\ccleaner\lang\setb69b.tmp to %ProgramFiles%\ccleaner\lang\lang-1071.dll
from %ProgramFiles%\ccleaner\lang\setb6ac.tmp to %ProgramFiles%\ccleaner\lang\lang-1079.dll
from %ProgramFiles%\ccleaner\lang\setb6cd.tmp to %ProgramFiles%\ccleaner\lang\lang-1081.dll
from %ProgramFiles%\ccleaner\lang\setb72f.tmp to %ProgramFiles%\ccleaner\lang\lang-1087.dll
from %ProgramFiles%\ccleaner\lang\setb8c1.tmp to %ProgramFiles%\ccleaner\lang\lang-9999.dll
from %ProgramFiles%\ccleaner\lang\setb760.tmp to %ProgramFiles%\ccleaner\lang\lang-1090.dll
from %ProgramFiles%\ccleaner\lang\setb791.tmp to %ProgramFiles%\ccleaner\lang\lang-1092.dll
from %ProgramFiles%\ccleaner\lang\setb793.tmp to %ProgramFiles%\ccleaner\lang\lang-1093.dll
from %ProgramFiles%\ccleaner\lang\setb7b4.tmp to %ProgramFiles%\ccleaner\lang\lang-1102.dll
from %ProgramFiles%\ccleaner\lang\setb7c5.tmp to %ProgramFiles%\ccleaner\lang\lang-1104.dll
from %ProgramFiles%\ccleaner\lang\setb7d7.tmp to %ProgramFiles%\ccleaner\lang\lang-1109.dll
from %ProgramFiles%\ccleaner\lang\setb7e9.tmp to %ProgramFiles%\ccleaner\lang\lang-1110.dll
from %ProgramFiles%\ccleaner\lang\setb819.tmp to %ProgramFiles%\ccleaner\lang\lang-1155.dll
from %ProgramFiles%\ccleaner\lang\setb82b.tmp to %ProgramFiles%\ccleaner\lang\lang-2052.dll
from %ProgramFiles%\ccleaner\lang\setb84c.tmp to %ProgramFiles%\ccleaner\lang\lang-2070.dll
from %ProgramFiles%\ccleaner\lang\setb86d.tmp to %ProgramFiles%\ccleaner\lang\lang-2074.dll
from %ProgramFiles%\ccleaner\lang\setb87f.tmp to %ProgramFiles%\ccleaner\lang\lang-3098.dll
from %ProgramFiles%\ccleaner\lang\setb8a0.tmp to %ProgramFiles%\ccleaner\lang\lang-5146.dll
from %ProgramFiles%\ccleaner\lang\setb57b.tmp to %ProgramFiles%\ccleaner\lang\lang-1057.dll
from %ProgramFiles%\ccleaner\lang\setb6ef.tmp to %ProgramFiles%\ccleaner\lang\lang-1086.dll
from %ProgramFiles%\ccleaner\lang\setb56a.tmp to %ProgramFiles%\ccleaner\lang\lang-1056.dll
from %ProgramFiles%\ccleaner\lang\setb355.tmp to %ProgramFiles%\ccleaner\lang\lang-1037.dll
from %ProgramFiles%\ccleaner\setac96.tmp to %ProgramFiles%\ccleaner\ccleaner.dat
from %ProgramFiles%\ccleaner\setb09e.tmp to %ProgramFiles%\ccleaner\ccleaner64.exe
from %ProgramFiles%\ccleaner\lang\setb235.tmp to %ProgramFiles%\ccleaner\lang\lang-1025.dll
from %ProgramFiles%\ccleaner\lang\setb276.tmp to %ProgramFiles%\ccleaner\lang\lang-1026.dll
from %ProgramFiles%\ccleaner\lang\setb278.tmp to %ProgramFiles%\ccleaner\lang\lang-1027.dll
from %ProgramFiles%\ccleaner\lang\setb299.tmp to %ProgramFiles%\ccleaner\lang\lang-1028.dll
from %ProgramFiles%\ccleaner\lang\setb2ab.tmp to %ProgramFiles%\ccleaner\lang\lang-1029.dll
from %ProgramFiles%\ccleaner\lang\setb2bc.tmp to %ProgramFiles%\ccleaner\lang\lang-1030.dll
from %ProgramFiles%\ccleaner\lang\setb2dd.tmp to %ProgramFiles%\ccleaner\lang\lang-1031.dll
from %ProgramFiles%\ccleaner\lang\setb2ef.tmp to %ProgramFiles%\ccleaner\lang\lang-1032.dll
from %ProgramFiles%\ccleaner\lang\setb310.tmp to %ProgramFiles%\ccleaner\lang\lang-1034.dll
from %ProgramFiles%\ccleaner\lang\setb331.tmp to %ProgramFiles%\ccleaner\lang\lang-1035.dll
from %ProgramFiles%\ccleaner\lang\setb343.tmp to %ProgramFiles%\ccleaner\lang\lang-1036.dll
from %ProgramFiles%\ccleaner\lang\setb376.tmp to %ProgramFiles%\ccleaner\lang\lang-1038.dll
from %ProgramFiles%\ccleaner\lang\setb518.tmp to %ProgramFiles%\ccleaner\lang\lang-1054.dll
from %ProgramFiles%\ccleaner\lang\setb387.tmp to %ProgramFiles%\ccleaner\lang\lang-1040.dll
from %ProgramFiles%\ccleaner\lang\setb3a9.tmp to %ProgramFiles%\ccleaner\lang\lang-1041.dll
from %ProgramFiles%\ccleaner\lang\setb3ba.tmp to %ProgramFiles%\ccleaner\lang\lang-1042.dll
from %ProgramFiles%\ccleaner\lang\setb3db.tmp to %ProgramFiles%\ccleaner\lang\lang-1043.dll
from %ProgramFiles%\ccleaner\lang\setb3fd.tmp to %ProgramFiles%\ccleaner\lang\lang-1044.dll
from %ProgramFiles%\ccleaner\lang\setb43d.tmp to %ProgramFiles%\ccleaner\lang\lang-1045.dll
from %ProgramFiles%\ccleaner\lang\setb44f.tmp to %ProgramFiles%\ccleaner\lang\lang-1046.dll
from %ProgramFiles%\ccleaner\lang\setb470.tmp to %ProgramFiles%\ccleaner\lang\lang-1048.dll
from %ProgramFiles%\ccleaner\lang\setb481.tmp to %ProgramFiles%\ccleaner\lang\lang-1049.dll
from %ProgramFiles%\ccleaner\lang\setb4a3.tmp to %ProgramFiles%\ccleaner\lang\lang-1050.dll
from %ProgramFiles%\ccleaner\lang\setb4c4.tmp to %ProgramFiles%\ccleaner\lang\lang-1051.dll
from %ProgramFiles%\ccleaner\lang\setb4e5.tmp to %ProgramFiles%\ccleaner\lang\lang-1052.dll
from %ProgramFiles%\ccleaner\lang\setb4f7.tmp to %ProgramFiles%\ccleaner\lang\lang-1053.dll
from %ProgramFiles%\ccleaner\lang\setb558.tmp to %ProgramFiles%\ccleaner\lang\lang-1055.dll
from %ProgramFiles%\ccleaner\setb911.tmp to %ProgramFiles%\ccleaner\uninst.exe

Modifies the following files

%LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl

Modifies the HOSTS file.

Network activity

Connects to

'au######te.geo.opera.com':80
'pa#####.#ooglesyndication.com':443
'sd#####es.operacdn.com':443
'fo###.gstatic.com':443
'ro###.ebay.com':80
'go######s.g.doubleclick.net':443
'ro###.ebay.com':443
'go#####a###ytics.com':443
'am##on.com':443
'pa#####.#oogleadservices.com':443
'adservice.google.com':443
'tw##ter.com':80
'oc##.#ectigo.com':80
'tp#.####lesyndication.com':443
'bo##ing.com':80
'pk#.goog':80
'fo###.#oogleapis.com':443
'go#####agmanager.com':443
'ge###toway.com':443
'fa###ook.com':80
're###.opera.com':80
'si#####ck2.opera.com':443
'en.###ipedia.org':443
'en.###ipedia.org':80
's.##mg.com':443
'se####.yahoo.com':443
'am##on.com':80
'bing.com':80
'du###uckgo.com':443
'se####.yahoo.com':80
'google.com':80
'au######te.geo.opera.com':443
'bo##ing.com':443
'do#####d3.operacdn.com':443

TCP

HTTP GET requests

http://au######te.geo.opera.com/geolocation/
http://oc##.#ectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEQDOWNb6vI%2B8e8R17dh0fsVl
http://ro###.ebay.com/rover/1/711-53200-19255-0/1?ic###########################################################################################################################
http://www.ya##o.com/?il#####
http://re###.opera.com/speeddials/partner/wikipedia_org_us
http://re###.opera.com/speeddials/partner/youtube
http://re###.opera.com/speeddials/partner/product
http://re###.opera.com/speeddials/partner/booking_com_us
http://re###.opera.com/speeddials/partner/twitter_us
http://re###.opera.com/speeddials/partner/yahoo
http://re###.opera.com/speeddials/partner/ebay_us
http://re###.opera.com/speeddials/partner/amazon_us
http://pk#.goog/gsr1/gsr1.crt
http://re###.opera.com/www.opera.com/firstrun/
http://re###.opera.com/favicon.ico
http://www.fa###ook.com/campaign/landing.php?ca#########################
http://re###.opera.com/speeddials/partner/facebook
http://en.###ipedia.org/favicon.ico
http://www.am##on.com/favicon.ico
http://www.bing.com/s/a/bing_p.ico
http://se####.yahoo.com/favicon.ico
http://www.google.com/favicon.ico
http://www.bo##ing.com/index.html?ai##########################################################################################
http://www.op##a.com/follow?ut###############################################################################################

Other

'au######te.geo.opera.com':443
'bo##ing.com':443
'pa###.ebay.com':443
'google.com':443
'tp#.####lesyndication.com':443
'eb##.com':443
'adservice.google.com':443
'pa#####.#oogleadservices.com':443
'go#####a###ytics.com':443
's.##mg.com':443
'ro###.ebay.com':443
'do#####d3.operacdn.com':443
'ya##o.com':443
'sd#####es.operacdn.com':443
'pa#####.#ooglesyndication.com':443
'fo###.#oogleapis.com':443
'go#####agmanager.com':443
'ge###toway.com':443
'si#####ck2.opera.com':443
'en.###ipedia.org':443
'am##on.com':443
'se####.yahoo.com':443
'du###uckgo.com':443
'fo###.gstatic.com':443
'op##a.com':443

UDP

DNS ASK google.com
DNS ASK bo##ing.com
DNS ASK pa###.ebay.com
DNS ASK tp#.####lesyndication.com
DNS ASK eb##.com
DNS ASK oc##.#ectigo.com
DNS ASK tw##ter.com
DNS ASK adservice.google.com
DNS ASK pa#####.#oogleadservices.com
DNS ASK go#####a###ytics.com
DNS ASK s.##mg.com
DNS ASK go######s.g.doubleclick.net
DNS ASK ya##o.com
DNS ASK ro###.ebay.com
DNS ASK fo###.gstatic.com
DNS ASK do#####d3.operacdn.com
DNS ASK sd#####es.operacdn.com
DNS ASK pk#.goog
DNS ASK fo###.#oogleapis.com
DNS ASK go#####agmanager.com
DNS ASK ge###toway.com
DNS ASK fa###ook.com
DNS ASK re###.opera.com
DNS ASK si#####ck2.opera.com
DNS ASK en.###ipedia.org
DNS ASK am##on.com
DNS ASK du###uckgo.com
DNS ASK se####.yahoo.com
DNS ASK bi##.#ikimedia.org
DNS ASK bing.com
DNS ASK au######te.geo.opera.com
DNS ASK pa#####.#ooglesyndication.com
DNS ASK op##a.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'

Executes the following

'<SYSTEM32>\infdefaultinstall.exe' "%TEMP%\RarSFX0\CCleaner64.inf"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2152.19.1146076844\625421138" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2152.18.1032014492\1477808783" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2152.15.906708985\807961812" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2152.14.812171472\428129766" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2152.13.641527123\1146072341" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2152.12.271867067\334822347" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2152.11.904495552\499167002" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2152.10.1934603754\213424385" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2152.8.1539650110\107385813" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2152.9.563111684\2133768168" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="2152.4.1119360642\1323218615" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=2080
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2152.7.688106102\586964971" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2152.20.1985336171\611452564" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2152.6.1152416186\432433830" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2152.4.1119360642\1323218615" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="2152.0.1590560007\682054462" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://getintoway.com/ /crash-reporter-parent-id=2152
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://getintoway.com/
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://getintoway.com/"
'<SYSTEM32>\fltmc.exe'
'<SYSTEM32>\find.exe' /i "license-api.ccleaner.com" <DRIVERS>\etc\hosts
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\BlockHost.cmd" "
'<SYSTEM32>\grpconv.exe' -o
'<SYSTEM32>\runonce.exe' -r
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2152.5.2131220857\1256546104" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2152.21.741186647\1407332321" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней