Trojan.Spambot.15863

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = 'EQPortMonitorSpy.dll'
[<HKLM>\System\CurrentControlSet\Control\Print\Monitors\I-Queue Printer Port] 'Driver' = 'EQUniversalPortMonitor.dll'

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\EQSharedEngine] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\EQSharedEngine] 'ImagePath' = '"%ProgramFiles%\Equitrac\Office\Client\EQSharedEngine.exe"'
[<HKLM>\System\CurrentControlSet\Services\EQSLPSrv] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\EQSLPSrv] 'ImagePath' = '"%ProgramFiles%\Equitrac\Office\SLP\eqslpd.exe"'

Создает следующие сервисы

'EQSharedEngine' "%ProgramFiles%\Equitrac\Office\Client\EQSharedEngine.exe"
'EQSharedEngine' %ProgramFiles%\Equitrac\Office\Client\EQSharedEngine.exe
'EQSLPSrv' "%ProgramFiles%\Equitrac\Office\SLP\eqslpd.exe"
'EQSLPSrv' %ProgramFiles%\Equitrac\Office\SLP\eqslpd.exe

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\net.exe' stop PcaSvc
'%WINDIR%\syswow64\net.exe' stop EQSharedEngine

Изменения в файловой системе

Создает следующие файлы

%TEMP%\ckz_fn28\commonconfiguration.xml
%ProgramFiles%\equitrac\office\i-queue print driver\xdcmykprinter.icc
%ProgramFiles%\equitrac\office\i-queue print driver\xdwscrgb.icc
<SYSTEM32>\eqportmonitorhook.dll
<SYSTEM32>\eqportmonitorspy.dll
<SYSTEM32>\equniversalportmonitor.dll
<SYSTEM32>\equniversalportmonitorui.dll
%ProgramFiles%\equitrac\office\client\eqpopuplauncher.exe
%ProgramFiles%\equitrac\office\i-queue print driver\x64\nuanxpsdrvui.dll
%ProgramFiles%\equitrac\office\client\eqpopupmgr.dll
%ProgramFiles%\equitrac\office\client\eqpopupmgrres.dll
%ProgramFiles%\equitrac\office\client\eqsharedengine.exe
<SYSTEM32>\detoured_eq.dll
%WINDIR%\syswow64\detoured_eq.dll
<SYSTEM32>\eqdtphook.dll
%ProgramFiles%\equitrac\office\i-queue print driver\x86\nuanxpsdrvui.dll
%ProgramFiles%\equitrac\office\i-queue print driver\nuanxpsdrv-pipelineconfig.xml
<SYSTEM32>\eqdtpspy.dll
%ProgramFiles%\equitrac\office\i-queue print driver\nuannames.gpd
%ProgramFiles%\equitrac\office\i-queue print driver\x64\nuannup.dll
%ProgramFiles%\equitrac\office\i-queue print driver\x86\nuannup.dll
%ProgramFiles%\equitrac\office\i-queue print driver\nuannup.gpd
%WINDIR%\syswow64\eqdtphook.dll
%ProgramFiles%\equitrac\office\document routing engine\eqxpsjobsubmitter.exe
%ProgramFiles%\equitrac\office\client\eqclienttracing.exe
%ProgramFiles%\equitrac\office\i-queue print driver\nuanstapling.gpd
%ProgramFiles%\equitrac\office\i-queue print driver\nuanxpsdrv.cat
%ProgramFiles%\equitrac\office\i-queue print driver\nuanxpsdrv.gpd
%ProgramFiles%\equitrac\office\i-queue print driver\nuanxpsdrv.inf
%ProgramFiles%\equitrac\office\i-queue print driver\nuanxpsdrv.ini
%ProgramFiles%\equitrac\office\i-queue print driver\x64\nuanwmark.dll
%ProgramFiles%\equitrac\office\i-queue print driver\x86\nuanwmark.dll
%ProgramFiles%\equitrac\office\i-queue print driver\nuanwmark.gpd
%BOOT_VOL%\boot\bcd.log
%WINDIR%\syswow64\eqdtpspy.x86.dll
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set345a.tmp
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set3516.tmp
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set35f2.tmp
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set36cd.tmp
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set3799.tmp
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set3855.tmp
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set336f.tmp
%ProgramFiles%\equitrac\office\slp\eqslptool.exe
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set3284.tmp
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\x64\set3c9d.tmp
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\x64\set3d69.tmp
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\x64\set3e35.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
%ProgramFiles%\difx\1b43c2f6bd720492\difxappa.dll
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set3a2b.tmp
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set3931.tmp
%ProgramFiles%\equitrac\office\document routing engine\eqxpsjobsubmitter.exe.config
%ProgramFiles%\equitrac\office\common\eqbrands.dll
%ProgramFiles%\equitrac\office\common\eqsnmp_kyocera.dll
%ProgramFiles%\equitrac\office\common\eqcasmsg.dll
%ProgramFiles%\equitrac\office\common\eqmailwindows.dll
%ProgramFiles%\equitrac\office\common\eqpce.cfg
%ProgramFiles%\equitrac\office\common\eqpce.dll
%ProgramFiles%\equitrac\office\common32\eqpce.dll
%ProgramFiles%\equitrac\office\common32\eqbrands.dll
%ProgramFiles%\equitrac\office\common\bsdtar.exe
%ProgramFiles%\equitrac\office\common\coreinit.ps
%ProgramFiles%\equitrac\office\common\eqsnmp_panasonic.dll
%ProgramFiles%\equitrac\office\common\eqsnmp_ricoh.dll
%ProgramFiles%\equitrac\office\common\eqsnmp_sharp.dll
%ProgramFiles%\equitrac\office\common\eqsnmp_xerox.dll
%ProgramFiles%\equitrac\office\common\userinit.ps
%ProgramFiles%\equitrac\office\common\eqsnmp_hp.dll
%ProgramFiles%\equitrac\office\common\eqsnmp_canon.dll
%ProgramFiles%\equitrac\office\slp\eqslpd.exe
%ProgramFiles%\equitrac\office\slp\eqslp.conf
%ProgramFiles%\equitrac\office\document routing engine\eqdreservice.exe
%WINDIR%\sccmlogs\sccm_sprint_equitrac_office_client_5.5.26.9137_msi_x64_2021_9_13.log
%WINDIR%\installer\msid79b.tmp-\customactions.net.dll
%WINDIR%\installer\msid79b.tmp-\collectiongen.dll
%WINDIR%\installer\msid79b.tmp-\icsharpcode.sharpziplib.dll
%WINDIR%\sccmlogs\sccm_uninstall_sprint_equitrac_office_client_5.4.24.5978_x64_2021_9_13.log
%TEMP%\ckz_fn28\reinstallequitrac.vbs
%WINDIR%\sccmlogs\sccm_uninstall_sprint_equitrac_office_client_5.5.26.9137_x64_2021_9_13.log
%WINDIR%\installer\msid79b.tmp-\log4net.dll
%WINDIR%\installer\msid79b.tmp-\nant.core.dll
%WINDIR%\installer\msid79b.tmp-\nant.dotnettasks.dll
%WINDIR%\installer\msid79b.tmp-\nant.extensions.tasks.dll
%WINDIR%\installer\msid79b.tmp-\nant.msnettasks.dll
%WINDIR%\installer\msid79b.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msid79b.tmp-\nant.compressiontasks.dll
%WINDIR%\installer\msid79b.tmp-\nant.contrib.tasks.dll
%WINDIR%\installer\{b43e9d3b-1572-482c-b9ce-f8c864c16707}\icon.eqmsgclient
%WINDIR%\installer\msid79b.tmp-\nant.sourcecontroltasks.dll
%TEMP%\ckz_fn28\uninstallequitrac.vbs
%TEMP%\ckz_fn28\uninstallequitrac.cmd
%TEMP%\ckz_fn28\sprintrunasadministrator.reg
%TEMP%\ckz_fn28\sprint.exe
%TEMP%\ckz_fn28\reinstallequitrac_start.vbs
%TEMP%\ckz_fn28\reinstallequitracpromptlogin_start.vbs
%TEMP%\ckz_fn28\reinstallequitracpromptlogin.vbs
%WINDIR%\sccmlogs\sccm_uninstall_sprint_equitrac_office_client_5.4.24.5978_x86_2021_9_13.log
%TEMP%\ckz_fn28\reinstallequitrac.cmd
%TEMP%\ckz_fn28\progresstestbar.exe
%TEMP%\ckz_fn28\gestq.reg
%TEMP%\ckz_fn28\externaldata.ini
%TEMP%\ckz_fn28\eq_client_cert.cer
%TEMP%\ckz_fn28\equitrac.office.client.x86.msi
%TEMP%\ckz_fn28\equitrac.office.client.x64.msi
%WINDIR%\sccmlogs\sccm_sprint_equitrac_office_client_5.5.26.9137_manual_out_domain.log
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set3b64.tmp
%WINDIR%\installer\msid79b.tmp-\nant.visualcpptasks.dll
%WINDIR%\installer\msid79b.tmp-\nantcontrib.dll
%WINDIR%\installer\msifdb3.tmp-\nant.msnettasks.dll
%WINDIR%\installer\msifdb3.tmp-\nant.sourcecontroltasks.dll
%WINDIR%\installer\msifdb3.tmp-\nant.visualcpptasks.dll
%WINDIR%\installer\msifdb3.tmp-\nant.vsnettasks.dll
%WINDIR%\installer\msifdb3.tmp-\nant.win32tasks.dll
%WINDIR%\installer\msid79b.tmp-\nant.vsnettasks.dll
%WINDIR%\installer\msifdb3.tmp-\nant.extensions.tasks.dll
%WINDIR%\installer\msifdb3.tmp-\nant.dotnettasks.dll
%WINDIR%\installer\msifdb3.tmp-\nant.exe
%WINDIR%\installer\msifdb3.tmp-\scvs.exe
%WINDIR%\installer\msifdb3.tmp-\slingshot.exe
%WINDIR%\installer\msifdb3.tmp-\customaction.config
%ProgramFiles%\equitrac\office\document routing engine\eqdre.cfg
%WINDIR%\installer\msifdb3.tmp-\nantcontrib.dll
%WINDIR%\installer\msifdb3.tmp-\slingshot.core.dll
%WINDIR%\installer\msid79b.tmp-\nant.win32tasks.dll
%WINDIR%\installer\msifdb3.tmp-\ndoc.documenter.nant.dll
%WINDIR%\sccmlogs\sccm_uninstall_sprint_equitrac_office_client_5.5.26.9137_x86_2021_9_13.log
%WINDIR%\installer\msid79b.tmp-\ndoc.documenter.nant.dll
%WINDIR%\installer\msid79b.tmp-\slingshot.core.dll
%WINDIR%\installer\msid79b.tmp-\nant.exe
%WINDIR%\installer\msid79b.tmp-\scvs.exe
%WINDIR%\installer\msid79b.tmp-\slingshot.exe
%WINDIR%\installer\msifdb3.tmp-\nant.compressiontasks.dll
%WINDIR%\installer\msifdb3.tmp-\nant.core.dll
%WINDIR%\installer\msifdb3.tmp-\nant.contrib.tasks.dll
%WINDIR%\installer\msifdb3.tmp-\customactions.net.dll
%WINDIR%\installer\msifdb3.tmp-\collectiongen.dll
%WINDIR%\installer\msifdb3.tmp-\icsharpcode.sharpziplib.dll
%WINDIR%\installer\msifdb3.tmp-\log4net.dll
%WINDIR%\installer\msifdb3.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msid79b.tmp-\customaction.config
%BOOT_VOL%\boot\bcd
%WINDIR%\installer\wix{b43e9d3b-1572-482c-b9ce-f8c864c16707}.schedserviceconfig.rmi

Присваивает атрибут 'скрытый' для следующих файлов

<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat

Удаляет следующие файлы

%WINDIR%\installer\msid79b.tmp-\collectiongen.dll
%WINDIR%\installer\msifdb3.tmp-\nant.exe
%WINDIR%\installer\msifdb3.tmp-\nant.extensions.tasks.dll
%WINDIR%\installer\msifdb3.tmp-\nant.msnettasks.dll
%WINDIR%\installer\msifdb3.tmp-\nant.sourcecontroltasks.dll
%WINDIR%\installer\msifdb3.tmp-\nant.visualcpptasks.dll
%WINDIR%\installer\msifdb3.tmp-\nant.vsnettasks.dll
%WINDIR%\installer\msifdb3.tmp-\nant.win32tasks.dll
%WINDIR%\installer\msifdb3.tmp-\nantcontrib.dll
%WINDIR%\installer\msifdb3.tmp-\ndoc.documenter.nant.dll
%WINDIR%\installer\msifdb3.tmp-\scvs.exe
%WINDIR%\installer\msifdb3.tmp-\slingshot.core.dll
%WINDIR%\installer\msid79b.tmp-\nant.visualcpptasks.dll
%WINDIR%\installer\msifdb3.tmp-\slingshot.exe
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\nuannup.gpd
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\nuanstapling.gpd
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\nuanwmark.gpd
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\nuanxpsdrv-pipelineconfig.xml
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\nuanxpsdrv.cat
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\nuanxpsdrv.gpd
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\nuanxpsdrv.inf
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\nuanxpsdrv.ini
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\x64\nuannup.dll
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\x64\nuanwmark.dll
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\x64\nuanxpsdrvui.dll
%WINDIR%\installer\msifdb3.tmp-\nant.core.dll
%WINDIR%\installer\msifdb3.tmp-\nant.dotnettasks.dll
%WINDIR%\installer\msifdb3.tmp-\nant.contrib.tasks.dll
%WINDIR%\installer\msifdb3.tmp-\nant.compressiontasks.dll
%WINDIR%\installer\msifdb3.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msid79b.tmp-\customactions.net.dll
%WINDIR%\installer\msid79b.tmp-\icsharpcode.sharpziplib.dll
%WINDIR%\installer\msid79b.tmp-\log4net.dll
%WINDIR%\installer\msid79b.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msid79b.tmp-\nant.compressiontasks.dll
%WINDIR%\installer\msid79b.tmp-\nant.contrib.tasks.dll
%WINDIR%\installer\msid79b.tmp-\nant.core.dll
%WINDIR%\installer\msid79b.tmp-\nant.dotnettasks.dll
%WINDIR%\installer\msid79b.tmp-\nant.exe
%WINDIR%\installer\msid79b.tmp-\nant.extensions.tasks.dll
%WINDIR%\installer\msid79b.tmp-\nant.msnettasks.dll
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\xdcmykprinter.icc
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\nuannames.gpd
%WINDIR%\installer\msid79b.tmp-\nant.sourcecontroltasks.dll
%WINDIR%\installer\msid79b.tmp-\nant.win32tasks.dll
%WINDIR%\installer\msid79b.tmp-\nantcontrib.dll
%WINDIR%\installer\msid79b.tmp-\ndoc.documenter.nant.dll
%WINDIR%\installer\msid79b.tmp-\scvs.exe
%WINDIR%\installer\msid79b.tmp-\slingshot.core.dll
%WINDIR%\installer\msid79b.tmp-\slingshot.exe
%WINDIR%\installer\msifdb3.tmp-\collectiongen.dll
%WINDIR%\installer\msifdb3.tmp-\customaction.config
%WINDIR%\installer\msifdb3.tmp-\customactions.net.dll
%WINDIR%\installer\msifdb3.tmp-\icsharpcode.sharpziplib.dll
%WINDIR%\installer\msifdb3.tmp-\log4net.dll
%WINDIR%\installer\msid79b.tmp-\customaction.config
%WINDIR%\installer\msid79b.tmp-\nant.vsnettasks.dll
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\xdwscrgb.icc

Перемещает следующие файлы

%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set3284.tmp в %TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\nuannup.gpd
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set336f.tmp в %TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\nuanstapling.gpd
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set345a.tmp в %TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\xdwscrgb.icc
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set3516.tmp в %TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\xdcmykprinter.icc
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set35f2.tmp в %TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\nuannames.gpd
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set36cd.tmp в %TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\nuanwmark.gpd
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set3799.tmp в %TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\nuanxpsdrv.cat
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set3855.tmp в %TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\nuanxpsdrv.gpd
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set3931.tmp в %TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\nuanxpsdrv.inf
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set3a2b.tmp в %TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\nuanxpsdrv.ini
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\set3b64.tmp в %TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\nuanxpsdrv-pipelineconfig.xml
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\x64\set3c9d.tmp в %TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\x64\nuanwmark.dll
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\x64\set3d69.tmp в %TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\x64\nuannup.dll
%TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\x64\set3e35.tmp в %TEMP%\{17851790-7837-5d35-5b00-030a90d44748}\x64\nuanxpsdrvui.dll

Изменяет следующие файлы

%LOCALAPPDATA%\microsoft\windows\usrclass.dat.log1
%LOCALAPPDATA%\microsoft\windows\usrclass.dat

Сетевая активность

Подключается к

'ce######ates.godaddy.com':80
'cr#.#odaddy.com':80
'microsoft.com':80

UDP

DNS ASK ce######ates.godaddy.com
DNS ASK cr#.#odaddy.com
DNS ASK microsoft.com

Другое

Создает и запускает на исполнение

'%WINDIR%\syswow64\wscript.exe' "%TEMP%\ckz_FN28\ReinstallEquitracPromptLogin_START.vbs"
'%WINDIR%\syswow64\wscript.exe' "%TEMP%\ckz_FN28\ReinstallEquitracPromptLogin.vbs"
'%TEMP%\ckz_fn28\progresstestbar.exe'
'%ProgramFiles%\equitrac\office\client\eqsharedengine.exe'
'%ProgramFiles%\equitrac\office\slp\eqslpd.exe'
'%WINDIR%\syswow64\wscript.exe' "%TEMP%\ckz_FN28\ReinstallEquitracPromptLogin.vbs"' (со скрытым окном)
'%TEMP%\ckz_fn28\progresstestbar.exe' ' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c net stop PcaSvc' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c md %WINDIR%\Xerox' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c xcopy "%TEMP%\ckz_FN28\CommonConfiguration.xml" %WINDIR%\Xerox /Y' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c regedit /S "%TEMP%\ckz_FN28\gestq.reg"' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c rd /S /Q %WINDIR%\Xerox' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c REG DELETE HKLM\SOFTWARE\Xerox\PrinterDriver\V5.0\Configuration /f /reg:64' (со скрытым окном)
'%WINDIR%\syswow64\net.exe' stop EQSharedEngine' (со скрытым окном)
'%WINDIR%\syswow64\net.exe' start EQSharedEngine' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c md %WINDIR%\SCCMLOGS
'%WINDIR%\syswow64\net1.exe' stop EQSharedEngine
'%WINDIR%\syswow64\reg.exe' DELETE HKLM\SOFTWARE\Xerox\PrinterDriver\V5.0\Configuration /f /reg:64
'%WINDIR%\syswow64\cmd.exe' /c REG DELETE HKLM\SOFTWARE\Xerox\PrinterDriver\V5.0\Configuration /f /reg:64
'%WINDIR%\syswow64\cmd.exe' /c rd /S /Q %WINDIR%\Xerox
'%WINDIR%\syswow64\regedit.exe' /S "%TEMP%\ckz_FN28\gestq.reg"
'%WINDIR%\syswow64\cmd.exe' /c regedit /S "%TEMP%\ckz_FN28\gestq.reg"
'%WINDIR%\syswow64\xcopy.exe' "%TEMP%\ckz_FN28\CommonConfiguration.xml" %WINDIR%\Xerox /Y
'%WINDIR%\syswow64\cmd.exe' /c xcopy "%TEMP%\ckz_FN28\CommonConfiguration.xml" %WINDIR%\Xerox /Y
'%WINDIR%\syswow64\cmd.exe' /c md %WINDIR%\Xerox
'%WINDIR%\syswow64\net.exe' start EQSharedEngine
'<SYSTEM32>\spoolsv.exe'
'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Installer\MSID79B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_449064 1 CustomActions.NET!CustomActions.NET.CustomActions.Substring
'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\ckz_FN28\Equitrac.Office.Client.x64.msi" CASNAME=10.12.10.158 LANGUAGE=en ADDLOCAL=Common,DesktopPrinting,PromptForLogin,DRC,IQueue IQUEUE_DEFAULT_PAPERSIZE=9 IQUEUE_DEFAULT_COLOR=1 ...
'%WINDIR%\syswow64\certutil.exe' -f -addstore "TrustedPublisher" "%TEMP%\ckz_FN28\eq_client_cert.cer"
'%WINDIR%\syswow64\msiexec.exe' /x{B43E9D3B-1572-482C-B9CE-F8C864C16707} /q /norestart /l*v %WINDIR%\SCCMLOGS\SCCM_UNINSTALL_SPRINT_Equitrac_Office_Client_5.5.26.9137_x64_2021_9_13.log
'%WINDIR%\syswow64\msiexec.exe' /x{787B08E5-8EDC-45C3-959D-FDDB1D9C767A} /q /norestart /l*v %WINDIR%\SCCMLOGS\SCCM_UNINSTALL_SPRINT_Equitrac_Office_Client_5.5.26.9137_x86_2021_9_13.log
'%WINDIR%\syswow64\msiexec.exe' /x{F93711DD-E045-4C14-96D4-6A351F21D06A} /q /norestart /l*v %WINDIR%\SCCMLOGS\SCCM_UNINSTALL_SPRINT_Equitrac_Office_Client_5.4.24.5978_x64_2021_9_13.log
'%WINDIR%\syswow64\msiexec.exe' /x{9992C9DC-C3C8-474B-BF38-93FF239EF48F} /q /norestart /l*v %WINDIR%\SCCMLOGS\SCCM_UNINSTALL_SPRINT_Equitrac_Office_Client_5.4.24.5978_x86_2021_9_13.log
'%WINDIR%\syswow64\net1.exe' stop PcaSvc
'%WINDIR%\syswow64\cmd.exe' /c net stop PcaSvc
'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Installer\MSIFDB3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_458190 7 CustomActions.NET!CustomActions.NET.ServiceCustomActions.EnumRunningSpoolerDependentServices
'%WINDIR%\syswow64\net1.exe' start EQSharedEngine

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней