Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Control\Print\Monitors\doPDF 7 Monitor] 'Driver' = 'dopdfmn7.dll'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\is-68N97.tmp\i386\dopdfin7.exe' -install -name "doPDF v7" -default -languages en -deflanguage en -hidepages -regpdfkey -nolog
- '%TEMP%\is-GO9F7.tmp\PdfSaz.tmp' /SL5="$2010E,3426303,584704,%TEMP%\RarSFX0\PdfSaz.exe" /SILENT /Default
- '%TEMP%\RarSFX0\PdfSaz.exe' /SILENT /Default
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\spoolsv.exe
Изменения в файловой системе:
Создает следующие файлы:
- %ALLUSERSPROFILE%\Start Menu\Programs\doPDF 7\Uninstall doPDF 7.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\doPDF 7\doPDF Help.lnk
- %TEMP%\is-68N97.tmp\i386\dopdf7.clg
- %PROGRAM_FILES%\Softland\doPDF 7\unins000.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\doPDF 7\doPDF.lnk
- %PROGRAM_FILES%\Softland\doPDF 7\is-CS15U.tmp
- %PROGRAM_FILES%\Softland\doPDF 7\is-D96S2.tmp
- %PROGRAM_FILES%\Softland\doPDF 7\is-JJ0M5.tmp
- %PROGRAM_FILES%\Softland\doPDF 7\is-A3S6J.tmp
- <SYSTEM32>\spool\drivers\w32x86\dopdfcl7.exe
- <SYSTEM32>\dopdfmi7.dll
- <SYSTEM32>\spool\drivers\w32x86\dopdf7.clg
- <SYSTEM32>\dopdf7.ctm
- <SYSTEM32>\dopdfmn7.dll
- <SYSTEM32>\spool\drivers\w32x86\dopdfui7.dll
- <SYSTEM32>\spool\drivers\w32x86\dopdfpr7.dll
- <SYSTEM32>\spool\drivers\w32x86\dopdf7.ctm
- <SYSTEM32>\spool\drivers\w32x86\dopdf7.chm
- %TEMP%\is-68N97.tmp\AMD64\is-4NQHN.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-IODIQ.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-FKV1U.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-21KUV.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-4PBKF.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-BM0H0.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-5PE7E.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-NIJ0A.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-4NI0L.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-2JNBE.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-4C99D.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-KHKK6.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-U3Q6A.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-PMDDM.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-GEHAJ.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-O45LQ.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-T7AUN.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-CV4VU.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-6MJ2E.tmp
- <SYSTEM32>\spool\drivers\w32x86\3\New\dopdfpr7.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- %APPDATA%\Softland\novaPDF\doPDF v7.nvl
- <SYSTEM32>\spool\drivers\w32x86\3\New\dopdf7_en.lng
- %ALLUSERSPROFILE%\Start Menu\Programs\doPDF 7\Visit the forum.lnk
- C:\Documents and Settings\LocalService\Application Data\Softland\novaPDF\doPDF v7.nvl
- <SYSTEM32>\spool\drivers\w32x86\3\New\dopdf7.clg
- <SYSTEM32>\spool\drivers\w32x86\3\New\dopdf7.chm
- <SYSTEM32>\spool\drivers\w32x86\3\New\dopdfui7.dll
- <SYSTEM32>\spool\drivers\w32x86\3\New\dopdf7.ctm
- <SYSTEM32>\spool\drivers\w32x86\3\New\dopdfcl7.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- <SYSTEM32>\spool\drivers\w32x86\dopdf7_en.lng
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- %TEMP%\is-68N97.tmp\AMD64\is-DM6SA.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-GS00R.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-IJE9U.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-94N9M.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-K96OJ.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-5BIM6.tmp
- %PROGRAM_FILES%\Softland\doPDF 7\AMD64\is-2CDLA.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-CJ8JF.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-JGFMT.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-KELMM.tmp
- %TEMP%\is-68N97.tmp\i386\is-DN41R.tmp
- %TEMP%\is-68N97.tmp\i386\is-UJ069.tmp
- %TEMP%\is-68N97.tmp\i386\is-RU65P.tmp
- %TEMP%\is-68N97.tmp\i386\is-QUNTV.tmp
- %TEMP%\is-68N97.tmp\i386\is-2DJJD.tmp
- %TEMP%\is-68N97.tmp\i386\is-4QME4.tmp
- %TEMP%\is-68N97.tmp\i386\is-HFS2C.tmp
- %TEMP%\is-68N97.tmp\i386\is-CSNBM.tmp
- %TEMP%\is-68N97.tmp\i386\is-C8EQ0.tmp
- %PROGRAM_FILES%\Softland\doPDF 7\AMD64\is-20R25.tmp
- %PROGRAM_FILES%\Softland\doPDF 7\is-JDO24.tmp
- %PROGRAM_FILES%\Softland\doPDF 7\is-R9TUH.tmp
- %PROGRAM_FILES%\Softland\doPDF 7\i386\is-A3JAS.tmp
- %PROGRAM_FILES%\Softland\doPDF 7\is-SAO2C.tmp
- %PROGRAM_FILES%\Softland\doPDF 7\is-J7J62.tmp
- %TEMP%\is-GO9F7.tmp\PdfSaz.tmp
- %TEMP%\RarSFX0\PdfSaz.exe
- %TEMP%\is-68N97.tmp\dopdfin7.exe
- %TEMP%\is-68N97.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-68N97.tmp\i386\is-5RE7O.tmp
- %TEMP%\is-68N97.tmp\i386\is-EBHRK.tmp
- %TEMP%\is-68N97.tmp\i386\is-0OPBU.tmp
- %TEMP%\is-68N97.tmp\i386\is-37C3O.tmp
- %TEMP%\is-68N97.tmp\i386\is-RLO0R.tmp
- %PROGRAM_FILES%\Softland\doPDF 7\i386\is-RGUOH.tmp
- %TEMP%\is-68N97.tmp\i386\is-BMBPK.tmp
- %TEMP%\is-68N97.tmp\i386\is-FH48H.tmp
- %TEMP%\is-68N97.tmp\i386\is-K30TA.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-V8DCH.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-QI2JD.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-ST7IG.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-5BP0A.tmp
- %TEMP%\is-68N97.tmp\i386\is-PC3HR.tmp
- %TEMP%\is-68N97.tmp\i386\is-GTC60.tmp
- %TEMP%\is-68N97.tmp\i386\is-8KCVO.tmp
- %TEMP%\is-68N97.tmp\i386\is-A4GR6.tmp
- %TEMP%\is-68N97.tmp\i386\is-ON1AG.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-FUHR4.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-VPMGM.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-S7R3V.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-AERMI.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-LC04L.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-302R0.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-7EUPN.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-BP7AG.tmp
- %TEMP%\is-68N97.tmp\AMD64\is-FLEJN.tmp
- %TEMP%\is-68N97.tmp\i386\is-O7O2I.tmp
- %TEMP%\is-68N97.tmp\i386\is-Q2NEA.tmp
- %TEMP%\is-68N97.tmp\i386\is-IMF3U.tmp
- %TEMP%\is-68N97.tmp\i386\is-B5OPK.tmp
- %TEMP%\is-68N97.tmp\i386\is-4SCLG.tmp
- %TEMP%\is-68N97.tmp\i386\is-TTCAA.tmp
- %TEMP%\is-68N97.tmp\i386\is-0J6AT.tmp
- %TEMP%\is-68N97.tmp\i386\is-KTBL3.tmp
- %TEMP%\is-68N97.tmp\i386\is-UAVM7.tmp
- %TEMP%\is-68N97.tmp\i386\is-1JG68.tmp
- %TEMP%\is-68N97.tmp\i386\is-87Q7G.tmp
- %TEMP%\is-68N97.tmp\i386\is-MA4ON.tmp
- %TEMP%\is-68N97.tmp\i386\is-I6TE6.tmp
- %TEMP%\is-68N97.tmp\i386\is-JSJ9O.tmp
- %TEMP%\is-68N97.tmp\i386\is-0NU4Q.tmp
- %TEMP%\is-68N97.tmp\i386\is-JLJ3S.tmp
- %TEMP%\is-68N97.tmp\i386\is-2A7FK.tmp
- %TEMP%\is-68N97.tmp\i386\is-AL8QS.tmp
- %TEMP%\is-68N97.tmp\i386\is-B608B.tmp
Удаляет следующие файлы:
- %TEMP%\is-68N97.tmp\i386\dopdf7_hu.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_it.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_he.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_fr.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_gr.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_ms.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_nl.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_lt.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_ja.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_kr.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_fi.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_br.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_cs.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_bg.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7.ctm
- %TEMP%\is-68N97.tmp\i386\dopdf7_ar.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_en.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_es.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_de.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_ct.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_da.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_no.lng
- %TEMP%\is-68N97.tmp\i386\dopdfmi7.dll
- %TEMP%\is-68N97.tmp\i386\dopdfmn7.dll
- %TEMP%\is-68N97.tmp\i386\dopdfin7.exe
- %TEMP%\is-68N97.tmp\i386\dopdf7_vi.lng
- %TEMP%\is-68N97.tmp\i386\dopdfcl7.exe
- %TEMP%\is-GO9F7.tmp\PdfSaz.tmp
- %TEMP%\RarSFX0\PdfSaz.exe
- %TEMP%\is-68N97.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-68N97.tmp\i386\dopdfpr7.dll
- %TEMP%\is-68N97.tmp\i386\dopdfui7.dll
- %TEMP%\is-68N97.tmp\i386\dopdf7_uk.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_ru.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_sc.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_ro.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_pl.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_pt.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_th.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_tr.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_sv.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_si.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7_sr.lng
- %TEMP%\is-68N97.tmp\i386\dopdf7.clg
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_he.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_hu.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_gr.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_fi.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_fr.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_lt.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_ms.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_kr.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_it.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_ja.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_es.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_bg.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_br.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_ar.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7.chm
- %TEMP%\is-68N97.tmp\AMD64\dopdf7.ctm
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_de.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_en.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_da.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_cs.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_ct.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_nl.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdfin7.exe
- %TEMP%\is-68N97.tmp\AMD64\dopdfmi7.dll
- %TEMP%\is-68N97.tmp\AMD64\dopdfcl7.exe
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_uk.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_vi.lng
- %TEMP%\is-68N97.tmp\dopdfin7.exe
- %TEMP%\is-68N97.tmp\i386\dopdf7.chm
- %TEMP%\is-68N97.tmp\AMD64\dopdfui7.dll
- %TEMP%\is-68N97.tmp\AMD64\dopdfmn7.dll
- %TEMP%\is-68N97.tmp\AMD64\dopdfpr7.dll
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_tr.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_ro.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_ru.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_pt.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_no.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_pl.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_sv.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_th.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_sr.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_sc.lng
- %TEMP%\is-68N97.tmp\AMD64\dopdf7_si.lng
Перемещает следующие файлы:
- %TEMP%\is-68N97.tmp\AMD64\is-FUHR4.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_cs.lng
- %TEMP%\is-68N97.tmp\AMD64\is-AERMI.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_fr.lng
- %TEMP%\is-68N97.tmp\AMD64\is-S7R3V.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_it.lng
- %TEMP%\is-68N97.tmp\AMD64\is-BP7AG.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_sv.lng
- %TEMP%\is-68N97.tmp\AMD64\is-LC04L.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_sr.lng
- %TEMP%\is-68N97.tmp\AMD64\is-VPMGM.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_uk.lng
- %TEMP%\is-68N97.tmp\AMD64\is-2JNBE.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_si.lng
- %TEMP%\is-68N97.tmp\AMD64\is-4NI0L.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_sc.lng
- %TEMP%\is-68N97.tmp\AMD64\is-BM0H0.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_gr.lng
- %TEMP%\is-68N97.tmp\AMD64\is-DM6SA.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_br.lng
- %TEMP%\is-68N97.tmp\AMD64\is-NIJ0A.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_pt.lng
- %TEMP%\is-68N97.tmp\AMD64\is-5PE7E.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_de.lng
- %TEMP%\is-68N97.tmp\AMD64\is-FLEJN.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_nl.lng
- %TEMP%\is-68N97.tmp\i386\is-ON1AG.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_th.lng
- %TEMP%\is-68N97.tmp\i386\is-A4GR6.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_lt.lng
- %TEMP%\is-68N97.tmp\i386\is-PC3HR.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_he.lng
- %TEMP%\is-68N97.tmp\i386\is-O7O2I.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_no.lng
- %TEMP%\is-68N97.tmp\i386\is-8KCVO.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_da.lng
- %TEMP%\is-68N97.tmp\i386\is-GTC60.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_ms.lng
- %TEMP%\is-68N97.tmp\AMD64\is-ST7IG.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_ru.lng
- %TEMP%\is-68N97.tmp\AMD64\is-7EUPN.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_pl.lng
- %TEMP%\is-68N97.tmp\AMD64\is-302R0.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_ja.lng
- %TEMP%\is-68N97.tmp\AMD64\is-QI2JD.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_en.lng
- %TEMP%\is-68N97.tmp\AMD64\is-V8DCH.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_ro.lng
- %TEMP%\is-68N97.tmp\AMD64\is-5BP0A.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_es.lng
- %PROGRAM_FILES%\Softland\doPDF 7\is-A3S6J.tmp в %PROGRAM_FILES%\Softland\doPDF 7\uninstall.ico
- %PROGRAM_FILES%\Softland\doPDF 7\is-JJ0M5.tmp в %PROGRAM_FILES%\Softland\doPDF 7\dopdf.ico
- <SYSTEM32>\spool\drivers\w32x86\3\New\dopdfpr7.dll в <SYSTEM32>\spool\drivers\w32x86\3\dopdfpr7.dll
- %TEMP%\is-68N97.tmp\AMD64\is-4NQHN.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_he.lng
- %PROGRAM_FILES%\Softland\doPDF 7\is-D96S2.tmp в %PROGRAM_FILES%\Softland\doPDF 7\dopdf.exe
- %PROGRAM_FILES%\Softland\doPDF 7\is-CS15U.tmp в %PROGRAM_FILES%\Softland\doPDF 7\License.rtf
- <SYSTEM32>\spool\drivers\w32x86\3\New\dopdf7.ctm в <SYSTEM32>\spool\drivers\w32x86\3\dopdf7.ctm
- <SYSTEM32>\spool\drivers\w32x86\3\New\dopdf7.clg в <SYSTEM32>\spool\drivers\w32x86\3\dopdf7.clg
- <SYSTEM32>\spool\drivers\w32x86\3\New\dopdf7_en.lng в <SYSTEM32>\spool\drivers\w32x86\3\dopdf7_en.lng
- <SYSTEM32>\spool\drivers\w32x86\3\New\dopdfui7.dll в <SYSTEM32>\spool\drivers\w32x86\3\dopdfui7.dll
- <SYSTEM32>\spool\drivers\w32x86\3\New\dopdf7.chm в <SYSTEM32>\spool\drivers\w32x86\3\dopdf7.chm
- <SYSTEM32>\spool\drivers\w32x86\3\New\dopdfcl7.exe в <SYSTEM32>\spool\drivers\w32x86\3\dopdfcl7.exe
- %TEMP%\is-68N97.tmp\AMD64\is-U3Q6A.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_lt.lng
- %TEMP%\is-68N97.tmp\AMD64\is-21KUV.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_ct.lng
- %TEMP%\is-68N97.tmp\AMD64\is-T7AUN.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_bg.lng
- %TEMP%\is-68N97.tmp\AMD64\is-O45LQ.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_ar.lng
- %TEMP%\is-68N97.tmp\AMD64\is-FKV1U.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_hu.lng
- %TEMP%\is-68N97.tmp\AMD64\is-IODIQ.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_vi.lng
- %TEMP%\is-68N97.tmp\AMD64\is-4PBKF.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_kr.lng
- %TEMP%\is-68N97.tmp\AMD64\is-KHKK6.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_da.lng
- %TEMP%\is-68N97.tmp\AMD64\is-4C99D.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_ms.lng
- %TEMP%\is-68N97.tmp\AMD64\is-PMDDM.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_th.lng
- %TEMP%\is-68N97.tmp\AMD64\is-6MJ2E.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_fi.lng
- %TEMP%\is-68N97.tmp\AMD64\is-CV4VU.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_tr.lng
- %TEMP%\is-68N97.tmp\AMD64\is-GEHAJ.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7_no.lng
- %TEMP%\is-68N97.tmp\i386\is-I6TE6.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_tr.lng
- %PROGRAM_FILES%\Softland\doPDF 7\AMD64\is-2CDLA.tmp в %PROGRAM_FILES%\Softland\doPDF 7\AMD64\dopdfin7.exe
- %TEMP%\is-68N97.tmp\AMD64\is-KELMM.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdfin7.exe
- %TEMP%\is-68N97.tmp\AMD64\is-JGFMT.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdfcl7.exe
- %TEMP%\is-68N97.tmp\i386\is-0OPBU.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7.ctm
- %PROGRAM_FILES%\Softland\doPDF 7\AMD64\is-20R25.tmp в %PROGRAM_FILES%\Softland\doPDF 7\AMD64\dopdf7.ctm
- %TEMP%\is-68N97.tmp\AMD64\is-CJ8JF.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7.chm
- %TEMP%\is-68N97.tmp\AMD64\is-K96OJ.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdfui7.dll
- %TEMP%\is-68N97.tmp\AMD64\is-94N9M.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdf7.ctm
- %TEMP%\is-68N97.tmp\i386\is-HFS2C.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_en.lng
- %TEMP%\is-68N97.tmp\AMD64\is-5BIM6.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdfmn7.dll
- %TEMP%\is-68N97.tmp\AMD64\is-IJE9U.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdfmi7.dll
- %TEMP%\is-68N97.tmp\AMD64\is-GS00R.tmp в %TEMP%\is-68N97.tmp\AMD64\dopdfpr7.dll
- %TEMP%\is-68N97.tmp\i386\is-37C3O.tmp в %TEMP%\is-68N97.tmp\i386\dopdfui7.dll
- %PROGRAM_FILES%\Softland\doPDF 7\is-SAO2C.tmp в %PROGRAM_FILES%\Softland\doPDF 7\dopdf7.ctm
- %PROGRAM_FILES%\Softland\doPDF 7\i386\is-A3JAS.tmp в %PROGRAM_FILES%\Softland\doPDF 7\i386\dopdf7.ctm
- %TEMP%\is-68N97.tmp\i386\is-BMBPK.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7.chm
- %PROGRAM_FILES%\Softland\doPDF 7\is-J7J62.tmp в %PROGRAM_FILES%\Softland\doPDF 7\unins000.exe
- %PROGRAM_FILES%\Softland\doPDF 7\is-R9TUH.tmp в %PROGRAM_FILES%\Softland\doPDF 7\dopdf-support.html
- %PROGRAM_FILES%\Softland\doPDF 7\is-JDO24.tmp в %PROGRAM_FILES%\Softland\doPDF 7\dopdf7.chm
- %TEMP%\is-68N97.tmp\i386\is-RLO0R.tmp в %TEMP%\is-68N97.tmp\i386\dopdfmn7.dll
- %TEMP%\is-68N97.tmp\i386\is-EBHRK.tmp в %TEMP%\is-68N97.tmp\i386\dopdfmi7.dll
- %TEMP%\is-68N97.tmp\i386\is-5RE7O.tmp в %TEMP%\is-68N97.tmp\i386\dopdfpr7.dll
- %PROGRAM_FILES%\Softland\doPDF 7\i386\is-RGUOH.tmp в %PROGRAM_FILES%\Softland\doPDF 7\i386\dopdfin7.exe
- %TEMP%\is-68N97.tmp\i386\is-K30TA.tmp в %TEMP%\is-68N97.tmp\i386\dopdfin7.exe
- %TEMP%\is-68N97.tmp\i386\is-FH48H.tmp в %TEMP%\is-68N97.tmp\i386\dopdfcl7.exe
- %TEMP%\is-68N97.tmp\i386\is-B5OPK.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_sc.lng
- %TEMP%\is-68N97.tmp\i386\is-2A7FK.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_gr.lng
- %TEMP%\is-68N97.tmp\i386\is-JLJ3S.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_hu.lng
- %TEMP%\is-68N97.tmp\i386\is-IMF3U.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_pt.lng
- %TEMP%\is-68N97.tmp\i386\is-Q2NEA.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_de.lng
- %TEMP%\is-68N97.tmp\i386\is-4SCLG.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_si.lng
- %TEMP%\is-68N97.tmp\i386\is-MA4ON.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_bg.lng
- %TEMP%\is-68N97.tmp\i386\is-87Q7G.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_ar.lng
- %TEMP%\is-68N97.tmp\i386\is-JSJ9O.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_fi.lng
- %TEMP%\is-68N97.tmp\i386\is-B608B.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_vi.lng
- %TEMP%\is-68N97.tmp\i386\is-AL8QS.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_kr.lng
- %TEMP%\is-68N97.tmp\i386\is-0NU4Q.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_ct.lng
- %TEMP%\is-68N97.tmp\i386\is-TTCAA.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_br.lng
- %TEMP%\is-68N97.tmp\i386\is-2DJJD.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_pl.lng
- %TEMP%\is-68N97.tmp\i386\is-UJ069.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_ja.lng
- %TEMP%\is-68N97.tmp\i386\is-DN41R.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_nl.lng
- %TEMP%\is-68N97.tmp\i386\is-4QME4.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_ro.lng
- %TEMP%\is-68N97.tmp\i386\is-C8EQ0.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_es.lng
- %TEMP%\is-68N97.tmp\i386\is-CSNBM.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_ru.lng
- %TEMP%\is-68N97.tmp\i386\is-0J6AT.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_cs.lng
- %TEMP%\is-68N97.tmp\i386\is-1JG68.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_fr.lng
- %TEMP%\is-68N97.tmp\i386\is-UAVM7.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_it.lng
- %TEMP%\is-68N97.tmp\i386\is-QUNTV.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_sv.lng
- %TEMP%\is-68N97.tmp\i386\is-RU65P.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_sr.lng
- %TEMP%\is-68N97.tmp\i386\is-KTBL3.tmp в %TEMP%\is-68N97.tmp\i386\dopdf7_uk.lng
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
