Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\$inst\2.tmp
- %ProgramFiles%\remote manipulator system - host\printer\x64\unires_vpd.dll
- %ProgramFiles%\remote manipulator system - host\printer\x64\rppd.lng
- %ProgramFiles%\remote manipulator system - host\printer\x64\msvcr120.dll
- %ProgramFiles%\remote manipulator system - host\printer\x64\printer.ico
- %ProgramFiles%\remote manipulator system - host\printer\x64\rppd.gpd
- %ProgramFiles%\remote manipulator system - host\printer\x64\vccorlib120.dll
- %ProgramFiles%\remote manipulator system - host\printer\x64\stdnames_vpd.gpd
- %ProgramFiles%\remote manipulator system - host\printer\x64\unidrvui_rppd.dll
- %ProgramFiles%\remote manipulator system - host\printer\x64\unidrv_rppd.hlp
- %ProgramFiles%\remote manipulator system - host\printer\x64\unidrv_rppd.dll
- %ProgramFiles%\remote manipulator system - host\printer\x64\rppd.ini
- %ProgramFiles%\remote manipulator system - host\printer\x64\ntprint.inf
- %ProgramFiles%\remote manipulator system - host\printer\x64\rppdpm.dll
- %ProgramFiles%\remote manipulator system - host\rfusclient.exe
- %ProgramFiles%\remote manipulator system - host\printer\x64\rppdui.dll
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\63001fe2-ece7-4837-b936-716ca5dfb92e\1909b0b1-4364-41b1-9875-b080fc939256.aamdownload
- %ProgramFiles%\remote manipulator system - host\printer\x86\msvcp120.dll
- %ProgramFiles%\remote manipulator system - host\printer\x86\msvcr120.dll
- %ProgramFiles%\remote manipulator system - host\printer\x86\vccorlib120.dll
- %ProgramFiles%\remote manipulator system - host\printer\x86\rppdui.dll
- %ProgramFiles%\remote manipulator system - host\printer\x86\rppdpm.dll
- %ProgramFiles%\remote manipulator system - host\printer\x86\rppd.ini
- %ProgramFiles%\remote manipulator system - host\printer\x86\printer.ico
- %ProgramFiles%\remote manipulator system - host\printer\x86\ntprint.inf
- %ProgramFiles%\remote manipulator system - host\printer\x86\unidrv_rppd.dll
- %ProgramFiles%\remote manipulator system - host\printer\x86\stdnames_vpd.gpd
- %ProgramFiles%\remote manipulator system - host\printer\x86\setupdrv.exe
- %ProgramFiles%\remote manipulator system - host\printer\x86\unires_vpd.dll
- %ProgramFiles%\remote manipulator system - host\printer\x86\unidrvui_rppd.dll
- %ProgramFiles%\remote manipulator system - host\printer\x86\unidrv_rppd.hlp
- %ProgramFiles%\remote manipulator system - host\rutserv.exe
- %ProgramFiles%\remote manipulator system - host\monitor\x64\drvinstaller64.exe
- %WINDIR%\installer\{e5803a4b-5a4b-44f6-a759-882fb6ad7982}\server_start_c00864331b9d4391a8a26292a601ebe2.exe
- %ProgramFiles%\remote manipulator system - host\printer\common\printer.ico
- %WINDIR%\installer\{e5803a4b-5a4b-44f6-a759-882fb6ad7982}\server_config_c8e9a92497a149d695f92e4e3ae550f0.exe
- %WINDIR%\installer\{e5803a4b-5a4b-44f6-a759-882fb6ad7982}\server_stop_27d7873393984316bea10fb36bb4d2f9.exe
- %WINDIR%\installer\{e5803a4b-5a4b-44f6-a759-882fb6ad7982}\uninst_uninstall_r_3b1e3c8b7d0945898da82ceeed02f0c7.exe
- %WINDIR%\installer\{e5803a4b-5a4b-44f6-a759-882fb6ad7982}\arpproducticon.exe
- %WINDIR%\installer\140c66.msi
- %ProgramFiles%\remote manipulator system - host\monitor\x86\windows10\lockscr.cat
- %ProgramFiles%\remote manipulator system - host\monitor\x86\windows10\lockscr.inf
- %ProgramFiles%\remote manipulator system - host\monitor\x86\windows10\lockscr.sys
- %ProgramFiles%\remote manipulator system - host\monitor\x64\windows10\lockscr.cat
- %ProgramFiles%\remote manipulator system - host\monitor\x64\windows10\lockscr.inf
- %ProgramFiles%\remote manipulator system - host\monitor\x64\windows10\lockscr.sys
- %ProgramFiles%\remote manipulator system - host\monitor\x86\drvinstaller32.exe
- %ProgramFiles%\remote manipulator system - host\monitor\x86\windows8\lockscr.cat
- %ProgramFiles%\remote manipulator system - host\monitor\x86\windows8\lockscr.inf
- %ProgramFiles%\remote manipulator system - host\printer\x86\rppd.gpd
- %ProgramFiles%\remote manipulator system - host\monitor\x86\windows8\lockscr.sys
- %ProgramFiles%\remote manipulator system - host\monitor\x64\windows8\lockscr.cat
- %ProgramFiles%\remote manipulator system - host\monitor\x64\windows8\lockscr.inf
- %ProgramFiles%\remote manipulator system - host\monitor\x64\windows8\lockscr.sys
- %ProgramFiles%\remote manipulator system - host\printer\common\rppd.lng
- %ProgramFiles%\remote manipulator system - host\printer\common\vpd_sdk.dll
- %ProgramFiles%\remote manipulator system - host\printer\common\pdfout.dll
- %ProgramFiles%\remote manipulator system - host\printer\common\emf2pdf.dll
- %ProgramFiles%\remote manipulator system - host\printer\common\vpdisp.exe
- %ProgramFiles%\remote manipulator system - host\printer\common\vpdagent.exe
- %ProgramFiles%\remote manipulator system - host\printer\common\srvinst.exe
- %ProgramFiles%\remote manipulator system - host\printer\common\properties.exe
- %ProgramFiles%\remote manipulator system - host\printer\common\progressbar.exe
- %ProgramFiles%\remote manipulator system - host\printer\common\messagebox.exe
- %ProgramFiles%\remote manipulator system - host\printer\common\fwproc.exe
- %ProgramFiles%\remote manipulator system - host\printer\x64\setupdrv.exe
- %ProgramFiles%\remote manipulator system - host\printer\x64\msvcp120.dll
- %ProgramFiles%\remote manipulator system - host\printer\x86\rppd.lng
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\progressbar_pole_null_150.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\progressbar_pole_null_200.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\close_200.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\gray_button_200.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\transparent.gif
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\progressbar_blue_active_150.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\progressbar_blue_active_125.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\progressbar_blue_active_100.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\progressbar_blue_active_200.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\progressbar_darkgray_base_100.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\progressbar_darkgray_base_200.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\status_icon_check_150.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\status_icon_check_125.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\status_icon_check_100.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\status_icon_check_200.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\progressbar_pole_null_100.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\status_icon_x_150.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\status_icon_x_100.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\status_icon_x_200.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\status_icon_caution_150.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\status_icon_caution_125.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\status_icon_caution_100.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\status_icon_caution_200.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\warning_icon_200.png
- %WINDIR%\installer\140c61.msi
- %TEMP%\$inst\0002.tmp
- %ProgramFiles%\system\readerdc_ro_id_cra_install.exe
- %ProgramFiles%\system\test3.bat
- %TEMP%\$inst\0001.tmp
- %ProgramFiles%\system\original.msi
- %TEMP%\$inst\temp_0.tmp
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\status_icon_x_125.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\f76eeaec-d681-43e4-8034-c38d292d2b1e
- %ProgramFiles%\remote manipulator system - host\libeay32.dll
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\yellow_button_200.png
- %ProgramFiles%\remote manipulator system - host\russian.lg
- %ProgramFiles%\remote manipulator system - host\webmmux.dll
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\63001fe2-ece7-4837-b936-716ca5dfb92e\1909b0b1-4364-41b1-9875-b080fc939256.aamdownload.aamd
- %ProgramFiles%\remote manipulator system - host\webmvorbisdecoder.dll
- %ProgramFiles%\remote manipulator system - host\eula.rtf
- %ProgramFiles%\remote manipulator system - host\vp8decoder.dll
- %ProgramFiles%\remote manipulator system - host\vp8encoder.dll
- %ProgramFiles%\remote manipulator system - host\webmvorbisencoder.dll
- %ProgramFiles%\remote manipulator system - host\english.lg
- C:\config.msi\140c65.rbs
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\63001fe2-ece7-4837-b936-716ca5dfb92e\349fd226-a05e-46c9-ab22-10935f802ed0.aamdownload
- %WINDIR%\installer\msi2.tmp
- %WINDIR%\installer\140c64.ipi
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\gtcheck.exe
- %ProgramFiles%\remote manipulator system - host\ssleay32.dll
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\gccheck_small.exe
- %HOMEPATH%\cookies\user@adobe[2].txt
- %WINDIR%\installer\msi1.tmp
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\info_icon_100.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\yellow_button_short_150.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\yellow_button_short_125.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\yellow_button_short_100.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\yellow_button_short_200.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\yellow_button_mini_150.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\yellow_button_mini_125.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\yellow_button_mini_100.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\yellow_button_mini_200.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\yellow_button_150.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\yellow_button_125.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\yellow_button_100.png
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\progressbar_pole_null_125.png
- %ALLUSERSPROFILE%\application data\remote manipulator system\msi\69110_{e5803a4b-5a4b-44f6-a759-882fb6ad7982}\original.msi
Удаляет следующие файлы
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\0001.tmp
- %TEMP%\$inst\0002.tmp
- %TEMP%\$inst\2.tmp
- %WINDIR%\installer\msi1.tmp
Перемещает следующие файлы
- <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\63001fe2-ece7-4837-b936-716ca5dfb92e\349fd226-a05e-46c9-ab22-10935f802ed0.aamdownload в <LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\63001fe2-ece7-4837-b936-716ca5dfb92e\349fd226-a05e-46c9-ab22-10935f802ed0
Подменяет следующие файлы
- %TEMP%\Adobe_ADMLogs\Adobe_ADM.log
- %TEMP%\Adobe_ADMLogs\Adobe_GDE.log
Сетевая активность
Подключается к
- 'ardownload2.adobe.com':443
TCP
Запросы HTTP GET
- http://stats.adobe.com/b/ss/adbacdcprod/1/H.25.4/s44971013614345?AQ##############################################################################################################################...
UDP
- DNS ASK get.adobe.com
- DNS ASK dlmping2.adobe.com
- DNS ASK platformdl.adobe.com
- DNS ASK stats.adobe.com
- DNS ASK ardownload2.adobe.com
Другое
Ищет следующие окна
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Создает и запускает на исполнение
- '%ProgramFiles%\system\readerdc_ro_id_cra_install.exe'
- '<LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\gccheck_small.exe' -chromeEligibilityTest -shellMode:standard
- '<LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\gccheck_small.exe' -canOfferReactivation -shellMode:standard -brandCode:ARRC
- '<LS_APPDATA>\adobe\64cb6fdc-d690-433c-ad1c-72650ae73fd3\gtcheck.exe'
- '%ProgramFiles%\remote manipulator system - host\rfusclient.exe' -msi_copy "%ProgramFiles%\System\Original.msi"
- '<SYSTEM32>\cmd.exe' /c ""%ProgramFiles%\System\test3.bat" "' (со скрытым окном)
- '%ProgramFiles%\system\readerdc_ro_id_cra_install.exe' ' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c ""%ProgramFiles%\System\test3.bat" "
- '<SYSTEM32>\msiexec.exe' /i Original.msi /qn
- '<SYSTEM32>\msiexec.exe' -Embedding A80EF4A456290E339621BAD0DC86714D
