Trojan.Siggen17.39148

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\System\CurrentControlSet\Control\Print\Monitors\REMOTEPCPRINTER] 'Driver' = 'RemotePCmon.dll'

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\remotepc
<SYSTEM32>\tasks\servicemonitor
<SYSTEM32>\tasks\rpcservicehealthcheck
<SYSTEM32>\tasks\startrpcservice

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\RPCService] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\RPCService] 'ImagePath' = '"%ProgramFiles(x86)%\RemotePC Host\RemotePCService.exe"'
[<HKLM>\System\CurrentControlSet\Services\RPCPerformanceService] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\RPCPerformanceService] 'ImagePath' = '%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RPCPerformanceService.exe'
[<HKLM>\System\CurrentControlSet\Services\clr_optimization_v4.0.30319_64] 'Start' = '00000002'

Создает следующие сервисы

'RPCService' "%ProgramFiles(x86)%\RemotePC Host\RemotePCService.exe"
'RPCService' %ProgramFiles(x86)%\RemotePC Host\RemotePCService.exe
'RPCPerformanceService' %ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RPCPerformanceService.exe

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="RPCCodecEngineHost" dir=in action=allow program="%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RpcApp\RPCCodecEngine.exe" enable=yes profile=public,p...

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-4vd1u.tmp\<Имя файла>.tmp
%ALLUSERSPROFILE%\remotepc performance host\proxysettings.json
%ALLUSERSPROFILE%\remotepc performance host\settings.json
%WINDIR%\temp\nshf392.tmp\nsprocess.dll
%WINDIR%\temp\nshf392.tmp\simplesc.dll
%ALLUSERSPROFILE%\remotepc performance host\logs\performancesetup.log
%WINDIR%\temp\nshf392.tmp\system.dll
%WINDIR%\temp\nshf392.tmp\logex.dll
%ALLUSERSPROFILE%\remotepc host\codec\remotepcperformance.exe
%ALLUSERSPROFILE%\remotepc host\printersetup\printer.msi
%ALLUSERSPROFILE%\remotepc host\rpcsuite.log
%ProgramFiles(x86)%\remotepc\easyhook32svc.exe
%ProgramFiles(x86)%\remotepc\easyhook64svc.exe
%ProgramFiles(x86)%\remotepc\dragdrop-console.exe
%ProgramFiles(x86)%\remotepc\dragdrop-dll_x64.dll
%ProgramFiles(x86)%\remotepc\dragdrop-dll_x32.dll
%ProgramFiles(x86)%\remotepc host\easyhook.dll
%ProgramFiles(x86)%\remotepc\easyhook.dll
%WINDIR%\temp\nshf392.tmp\nsexec.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\plugininstaller.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\wmfencdeclib.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\licence.txt
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\d3dcompiler_47.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\xaudio2_9redist.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\rpcbhs.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\rpcauthprovider.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\rpcdnd.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\rpcdatahandler.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\scribbleroverlay.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\rpccodecengine.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcperformanceservice.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\microsoft.xaml.behaviors.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepcsuite.service.dll.config
%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepcsuite.service.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepcsuite.model.dll.config
%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepcsuite.model.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepc.websockets.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepc.common.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\newtonsoft.json.dll
%ProgramFiles(x86)%\remotepc host\easyload64.dll
%WINDIR%\temp\nshf392.tmp\dotnetchecker.dll
%ProgramFiles(x86)%\remotepc\easyload64.dll
%ProgramFiles(x86)%\remotepc host\is-fkkfo.tmp
%ALLUSERSPROFILE%\remotepc host\is-r6243.tmp
%TEMP%\is-ehc3b.tmp
%TEMP%\is-e5r07.tmp
%ProgramFiles(x86)%\remotepc host\virtualaudiodriver\is-gbafl.tmp
%ProgramFiles(x86)%\remotepc host\virtualaudiodriver\is-ueq06.tmp
%ProgramFiles(x86)%\remotepc host\virtualaudiodriver\is-uh5li.tmp
%ProgramFiles(x86)%\remotepc host\virtualaudiodriver\is-a0q19.tmp
%ProgramFiles(x86)%\remotepc host\is-au57l.tmp
%ProgramFiles(x86)%\remotepc host\is-egvk0.tmp
%ProgramFiles(x86)%\remotepc host\is-nkh2t.tmp
%ProgramFiles(x86)%\remotepc host\is-7g0u5.tmp
%ProgramFiles(x86)%\remotepc host\is-jj68e.tmp
%ProgramFiles(x86)%\remotepc host\is-r4gco.tmp
%ProgramFiles(x86)%\remotepc host\is-mvc7l.tmp
%ProgramFiles(x86)%\remotepc host\is-fcdm3.tmp
%ProgramFiles(x86)%\remotepc host\is-6iuo7.tmp
%ProgramFiles(x86)%\remotepc host\is-km1bn.tmp
%ProgramFiles(x86)%\remotepc host\is-mdqu5.tmp
%APPDATA%\microsoft\windows\start menu\programs\remotepc host\remotepc host.lnk
%ProgramFiles(x86)%\remotepc\easyload32.dll
%APPDATA%\microsoft\windows\start menu\programs\remotepc host\uninstall remotepc host.lnk
%ProgramFiles(x86)%\remotepc host\easyhook64.dll
%ProgramFiles(x86)%\remotepc\easyhook64.dll
%ProgramFiles(x86)%\remotepc host\easyhook32.dll
%ProgramFiles(x86)%\remotepc\easyhook32.dll
%ALLUSERSPROFILE%\remotepc host\rpcpreuninstall.log
%APPDATA%\remotepc\rpcapplauncherlogfile.txt
%ALLUSERSPROFILE%\remotepc host\rpcdownloaderlogfile.txt
%ALLUSERSPROFILE%\remotepc host\rpcprinterdownloader.txt
<SYSTEM32>\rpcprinterdownloader.txt
%ProgramFiles(x86)%\remotepc host\rpcsuitelaunch.txt
%ProgramFiles(x86)%\remotepc host\path.ini
%WINDIR%\syswow64\remotepcservice.txt
%ALLUSERSPROFILE%\remotepc host\rpccertificate.log
%ProgramFiles(x86)%\remotepc host\rpccertificate.log
%ProgramFiles(x86)%\remotepc host\unins000.dat
%ProgramFiles(x86)%\remotepc host\unins000.msg
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\remotepc host.lnk
%ProgramFiles(x86)%\remotepc host\easyload32.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\nvidiadeclib.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\nvidiaencoder.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\easyhook64.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\microsoft.windowsapicodepack.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\microsoft.windowsapicodepack.shell.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\emoji.wpf.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\communications.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\transferserver.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\transferclient.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\chat.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\libx264-164.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\swscale-6.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\swresample-4.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\avutil-57.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\avformat-59.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\avcodec-59.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\p2p-win.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\mp4recorddll.dll
%WINDIR%\temp\nsx89d8.tmp\system.dll
%WINDIR%\temp\~df5dd5e0a039add6df.tmp
<SYSTEM32>\spool\drivers\x64\3\remotepcscpdfprn.bpd
%WINDIR%\installer\{aa4b39d8-f8d7-43d2-9797-4e887760e360}\rpc.ico
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\newtonsoft.json.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\ninja.websockets.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\es-es\transferclient.resources.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\es-es\chat.resources.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\de-de\transferclient.resources.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\de-de\chat.resources.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\en\transferclient.resources.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\log4nets.config
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\log4net.config
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\transferserver.exe.config
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\communications.dll.config
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\ja-jp\chat.resources.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\chat.exe.config
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\log4net.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\typography.openfont.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\typography.glyphlayout.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\system.valuetuple.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\system.threading.tasks.dataflow.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\system.net.websockets.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\shellicons.dll
<SYSTEM32>\spool\drivers\x64\3\new\remotepcpscript.ntf
<SYSTEM32>\spool\drivers\x64\3\new\remotepcpscript.hlp
<SYSTEM32>\spool\drivers\x64\3\new\remotepcscpdfprn.ppd
%ProgramFiles%\remotepcprinter\remotepcmon.dll
%ProgramFiles%\remotepcprinter\pstopdfconsole.exe
%ProgramFiles%\remotepcprinter\gsdll64.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepcperformanceplugins.exe
%WINDIR%\temp\~df9913ba30c35a4701.tmp
%ALLUSERSPROFILE%\remotepc performance host\logs\plugininstaller.log
%ProgramFiles(x86)%\remotepc host\remotepcperformance\uninst.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepcperformance.url
%ALLUSERSPROFILE%\remotepc performance host\logs\rpcperformanceservice.log
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\rpcaccessnotifier.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\aw_sas32.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\rpcutility.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\resources\ja.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\resources\es.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\resources\de.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\networkhandler.dll
%ProgramFiles%\remotepcprinter\remotepcprinter.exe.config
%ProgramFiles%\remotepcprinter\remotepcprinter.pdb
%ProgramFiles%\remotepcprinter\remotepcprinter.exe
%ProgramFiles%\remotepcprinter\remotepcprintercore.dll
<SYSTEM32>\spool\drivers\x64\3\new\remotepcps5ui.dll
%ProgramFiles%\remotepcprinter\remotepcprintercore.pdb
<SYSTEM32>\spool\drivers\x64\3\new\remotepcpscript5.dll
<SYSTEM32>\spool\drivers\x64\remotepcpscript.ntf
<SYSTEM32>\spool\drivers\x64\remotepcscpdfprn.ppd
<SYSTEM32>\spool\drivers\x64\remotepcpscript.hlp
<SYSTEM32>\spool\drivers\x64\remotepcps5ui.dll
<SYSTEM32>\spool\drivers\x64\remotepcpscript5.dll
<SYSTEM32>\gsdll64.dll
%WINDIR%\installer\msi5459.tmp-\customaction.config
%ProgramFiles(x86)%\remotepc host\fr\is-mp042.tmp
%WINDIR%\installer\msi5459.tmp-\remotepcprintercore.dll
%WINDIR%\installer\msi5459.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msi5459.tmp-\remotepcprinterinstallcustomaction.dll
%ProgramFiles%\remotepcprinter\remotepcscpdfprn.ppd
%ProgramFiles%\remotepcprinter\remotepcpscript5.dll
%ProgramFiles%\remotepcprinter\remotepcpscript.ntf
%ProgramFiles%\remotepcprinter\remotepcpscript.hlp
%ProgramFiles%\remotepcprinter\remotepcps5ui.dll
<SYSTEM32>\remotepcmon.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\transferclient.exe.config
%ProgramFiles(x86)%\remotepc host\fr\is-456sc.tmp
%ProgramFiles(x86)%\remotepc host\pt\is-m9r5i.tmp
%ProgramFiles(x86)%\remotepc host\is-rft5m.tmp
%ProgramFiles(x86)%\remotepc host\is-t8mc0.tmp
%ALLUSERSPROFILE%\remotepc host\is-sv4o4.tmp
%ALLUSERSPROFILE%\remotepc host\is-b3i4c.tmp
%ALLUSERSPROFILE%\remotepc host\is-6t23m.tmp
%ALLUSERSPROFILE%\remotepc host\is-rafaj.tmp
%ALLUSERSPROFILE%\remotepc host\is-njrar.tmp
%ProgramFiles(x86)%\remotepc host\is-0hdbu.tmp
%ProgramFiles(x86)%\remotepc host\is-2vig6.tmp
%ProgramFiles(x86)%\remotepc host\is-gn98t.tmp
%ProgramFiles(x86)%\remotepc host\is-6ke0m.tmp
%ProgramFiles(x86)%\remotepc host\is-qd5na.tmp
%ProgramFiles(x86)%\remotepc host\is-o1ddf.tmp
%ProgramFiles(x86)%\remotepc host\is-1plk5.tmp
%ProgramFiles(x86)%\remotepc host\is-aeulu.tmp
%ProgramFiles(x86)%\remotepc host\is-hbd5o.tmp
%ProgramFiles(x86)%\remotepc host\is-ua81o.tmp
%ProgramFiles(x86)%\remotepc host\is-b7gld.tmp
%ProgramFiles(x86)%\remotepc host\is-0iqjr.tmp
%ProgramFiles(x86)%\remotepc host\is-jp3jo.tmp
%ProgramFiles(x86)%\remotepc host\is-1r8nv.tmp
%ProgramFiles(x86)%\remotepc host\is-b0a9g.tmp
%ProgramFiles(x86)%\remotepc host\is-bt1in.tmp
%ProgramFiles(x86)%\remotepc host\is-gugmq.tmp
%ProgramFiles(x86)%\remotepc host\is-ce64s.tmp
%ProgramFiles(x86)%\remotepc host\is-itpab.tmp
%ProgramFiles(x86)%\remotepc host\is-vl4ts.tmp
%ProgramFiles(x86)%\remotepc host\is-jjb1k.tmp
%ProgramFiles(x86)%\remotepc host\is-k5j3k.tmp
%ProgramFiles(x86)%\remotepc host\is-lrung.tmp
%ProgramFiles(x86)%\remotepc host\is-6te8a.tmp
%ProgramFiles(x86)%\remotepc host\is-3ujlu.tmp
%ProgramFiles(x86)%\remotepc host\is-amjka.tmp
%ProgramFiles(x86)%\remotepc host\is-r2qo7.tmp
%ProgramFiles(x86)%\remotepc host\is-ivs08.tmp
%ProgramFiles(x86)%\remotepc host\is-8urst.tmp
%ProgramFiles(x86)%\remotepc host\is-dafv3.tmp
%ProgramFiles(x86)%\remotepc host\is-96q7p.tmp
%ProgramFiles(x86)%\remotepc host\is-datdk.tmp
%ProgramFiles(x86)%\remotepc host\is-9mhg9.tmp
%ProgramFiles(x86)%\remotepc host\is-c6qar.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-ko0kr.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-qgh6k.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-qipa3.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-vah97.tmp
%ProgramFiles(x86)%\remotepc host\is-vcoug.tmp
%ProgramFiles(x86)%\remotepc host\is-0vgg0.tmp
%ProgramFiles(x86)%\remotepc host\is-0nvm5.tmp
%ProgramFiles(x86)%\remotepc host\is-grnml.tmp
%ProgramFiles(x86)%\remotepc host\is-08omj.tmp
%ProgramFiles(x86)%\remotepc host\is-dh3b1.tmp
%ProgramFiles(x86)%\remotepc host\is-60b2i.tmp
%ALLUSERSPROFILE%\remotepc host\rpcsettings.ini
%TEMP%\is-nsq7a.tmp\_isetup\_shfoldr.dll
%TEMP%\is-nsq7a.tmp\_isetup\_setup64.tmp
%TEMP%\is-jodm6.tmp\remotepchost1.tmp
%TEMP%\is-cnhrv.tmp\remotepchost1.exe
%TEMP%\is-cnhrv.tmp\_isetup\_shfoldr.dll
%TEMP%\is-cnhrv.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-sbvek.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-m8gb3.tmp
%ProgramFiles(x86)%\remotepc host\is-u0vna.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-ovnel.tmp
%ProgramFiles(x86)%\remotepc host\is-ajbah.tmp
%ProgramFiles(x86)%\remotepc host\is-9kr3k.tmp
%ProgramFiles(x86)%\remotepc host\is-lfmcs.tmp
%ProgramFiles(x86)%\remotepc host\is-lebsc.tmp
%ProgramFiles(x86)%\remotepc host\is-rnlk4.tmp
%ProgramFiles(x86)%\remotepc host\is-oga8h.tmp
%ProgramFiles(x86)%\remotepc host\is-68f82.tmp
%ProgramFiles(x86)%\remotepc host\is-pgg37.tmp
%ProgramFiles(x86)%\remotepc host\is-v387n.tmp
%ProgramFiles(x86)%\remotepc host\is-9h25r.tmp
%ProgramFiles(x86)%\remotepc host\is-ohpbb.tmp
%ProgramFiles(x86)%\remotepc host\is-dfe23.tmp
%ProgramFiles(x86)%\remotepc host\is-hvemf.tmp
%ProgramFiles(x86)%\remotepc host\is-rqgbq.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-k3lpu.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-m2nj6.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-v7u5m.tmp
%ProgramFiles(x86)%\remotepc host\is-q0uah.tmp
%ProgramFiles(x86)%\remotepc host\is-bvf06.tmp
%ProgramFiles(x86)%\remotepc host\is-skfsi.tmp
%ProgramFiles(x86)%\remotepc host\is-ge41o.tmp
%ProgramFiles(x86)%\remotepc host\ko\is-0o94r.tmp
%ProgramFiles(x86)%\remotepc host\ko\is-uebsu.tmp
%ProgramFiles(x86)%\remotepc host\ko\is-l2206.tmp
%ProgramFiles(x86)%\remotepc host\ko\is-29i33.tmp
%ProgramFiles(x86)%\remotepc host\ko\is-p7gtn.tmp
%ProgramFiles(x86)%\remotepc host\ko\is-5ktig.tmp
%ProgramFiles(x86)%\remotepc host\it\is-jnk94.tmp
%ProgramFiles(x86)%\remotepc host\it\is-j8h0m.tmp
%ProgramFiles(x86)%\remotepc host\it\is-b1q08.tmp
%ProgramFiles(x86)%\remotepc host\it\is-aen0d.tmp
%ProgramFiles(x86)%\remotepc host\it\is-oemd9.tmp
%ProgramFiles(x86)%\remotepc host\it\is-hi6jn.tmp
%ProgramFiles(x86)%\remotepc host\en\is-87bgl.tmp
%ProgramFiles(x86)%\remotepc host\es\is-3budt.tmp
%ProgramFiles(x86)%\remotepc host\es\is-7vkr0.tmp
%ProgramFiles(x86)%\remotepc host\es\is-3kq5f.tmp
%ProgramFiles(x86)%\remotepc host\es\is-1hbn7.tmp
%ProgramFiles(x86)%\remotepc host\es\is-5mo4f.tmp
%ProgramFiles(x86)%\remotepc host\es\is-046m7.tmp
%ProgramFiles(x86)%\remotepc host\nl\is-l7u5n.tmp
%ProgramFiles(x86)%\remotepc host\nl\is-odt8a.tmp
%ProgramFiles(x86)%\remotepc host\fr\is-pc2sb.tmp
%ProgramFiles(x86)%\remotepc host\fr\is-5clo7.tmp
%ProgramFiles(x86)%\remotepc host\pt-br\is-79lhr.tmp
%ProgramFiles(x86)%\remotepc host\pt-br\is-dsa57.tmp
%ProgramFiles(x86)%\remotepc host\pt-br\is-rfpoo.tmp
%ProgramFiles(x86)%\remotepc host\pt-br\is-7q04t.tmp
%ProgramFiles(x86)%\remotepc host\pt-br\is-pv6s6.tmp
%ProgramFiles(x86)%\remotepc host\pt-br\is-j5s6a.tmp
%ProgramFiles(x86)%\remotepc host\pt\is-gg2hm.tmp
%ProgramFiles(x86)%\remotepc host\fr\is-57964.tmp
%ProgramFiles(x86)%\remotepc host\pt\is-n4pmi.tmp
%ProgramFiles(x86)%\remotepc host\pt\is-aomqi.tmp
%ProgramFiles(x86)%\remotepc host\pt\is-1pgj1.tmp
%ProgramFiles(x86)%\remotepc host\pt\is-9pa1p.tmp
%ProgramFiles(x86)%\remotepc host\nl\is-b8rr5.tmp
%ProgramFiles(x86)%\remotepc host\nl\is-51r79.tmp
%ProgramFiles(x86)%\remotepc host\nl\is-frolc.tmp
%ProgramFiles(x86)%\remotepc host\nl\is-g8ece.tmp
%ProgramFiles(x86)%\remotepc host\es\is-ahoj5.tmp
%ProgramFiles(x86)%\remotepc host\es\is-os205.tmp
%ProgramFiles(x86)%\remotepc host\es\is-8598j.tmp
%ProgramFiles(x86)%\remotepc host\is-9ieoi.tmp
%ProgramFiles(x86)%\remotepc host\printer\is-mjll4.tmp
%ProgramFiles(x86)%\remotepc host\printer\is-1742m.tmp
%ProgramFiles(x86)%\remotepc host\is-dvsel.tmp
%ProgramFiles(x86)%\remotepc host\is-k9jcg.tmp
%ProgramFiles(x86)%\remotepc host\is-n6ndn.tmp
%ProgramFiles(x86)%\remotepc host\is-aphd0.tmp
%ProgramFiles(x86)%\remotepc host\is-5583n.tmp
%ProgramFiles(x86)%\remotepc host\is-nqskg.tmp
%ProgramFiles(x86)%\remotepc host\is-5vmqa.tmp
%ProgramFiles(x86)%\remotepc host\is-f2cuh.tmp
%ProgramFiles(x86)%\remotepc host\is-dl8td.tmp
%ProgramFiles(x86)%\remotepc host\is-pvhjr.tmp
%ProgramFiles(x86)%\remotepc host\is-h9jl6.tmp
%ProgramFiles(x86)%\remotepc host\is-me1sg.tmp
%ProgramFiles(x86)%\remotepc host\is-gvvg0.tmp
%ProgramFiles(x86)%\remotepc host\is-a43ea.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-ka1qa.tmp
%ProgramFiles(x86)%\remotepc host\is-crqdv.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-u8o9e.tmp
%ProgramFiles(x86)%\remotepc host\es\is-sgmvu.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-929le.tmp
%ProgramFiles(x86)%\remotepc host\de\is-ksue2.tmp
%ProgramFiles(x86)%\remotepc host\de\is-nporn.tmp
%ProgramFiles(x86)%\remotepc host\de\is-6n08a.tmp
%ProgramFiles(x86)%\remotepc host\de\is-n887m.tmp
%ProgramFiles(x86)%\remotepc host\de\is-1p1rd.tmp
%ProgramFiles(x86)%\remotepc host\de\is-2uvu6.tmp
%ProgramFiles(x86)%\remotepc host\de\is-340cj.tmp
%ProgramFiles(x86)%\remotepc host\de\is-m0ske.tmp
%ProgramFiles(x86)%\remotepc host\fr\is-m3819.tmp
%ProgramFiles(x86)%\remotepc host\de\is-andvq.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-bnj0n.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-ep9ov.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-edm6f.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-1k2sq.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-20g3u.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-86ab0.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-1adil.tmp
%ProgramFiles(x86)%\remotepc host\de\is-l4kpu.tmp
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\ja-jp\transferclient.resources.dll

Удаляет следующие файлы

%ProgramFiles(x86)%\remotepc host\pthreadgc2.dll
%WINDIR%\installer\msi5459.tmp-\remotepcprinterinstallcustomaction.dll
%WINDIR%\installer\msi5459.tmp-\remotepcprintercore.dll
%WINDIR%\installer\msi5459.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msi5459.tmp-\customaction.config
%TEMP%\is-4vd1u.tmp\<Имя файла>.tmp
%TEMP%\is-cnhrv.tmp\_isetup\_shfoldr.dll
%TEMP%\is-cnhrv.tmp\_isetup\_setup64.tmp
%WINDIR%\temp\nsx89d8.tmp\system.dll
%TEMP%\is-cnhrv.tmp\remotepchost1.exe
%TEMP%\is-nsq7a.tmp\_isetup\_shfoldr.dll
%TEMP%\is-nsq7a.tmp\_isetup\_setup64.tmp
%ALLUSERSPROFILE%\remotepc host\easyhook.dll
%ALLUSERSPROFILE%\remotepc host\easyload64.dll
%ALLUSERSPROFILE%\remotepc host\easyload32.dll
%ALLUSERSPROFILE%\remotepc host\easyhook64.dll
%ALLUSERSPROFILE%\remotepc host\easyhook32.dll
%TEMP%\is-jodm6.tmp\remotepchost1.tmp
%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepcperformanceplugins.exe

Перемещает следующие файлы

%ProgramFiles(x86)%\remotepc host\is-60b2i.tmp в %ProgramFiles(x86)%\remotepc host\unins000.exe
%ProgramFiles(x86)%\remotepc host\es\is-ahoj5.tmp в %ProgramFiles(x86)%\remotepc host\es\rpcdownloader.resources.dll
%ProgramFiles(x86)%\remotepc host\es\is-5mo4f.tmp в %ProgramFiles(x86)%\remotepc host\es\rpcfthost.resources.dll
%ProgramFiles(x86)%\remotepc host\es\is-046m7.tmp в %ProgramFiles(x86)%\remotepc host\es\rpcftviewer.resources.dll
%ProgramFiles(x86)%\remotepc host\es\is-1hbn7.tmp в %ProgramFiles(x86)%\remotepc host\es\rpcutilityhost.resources.dll
%ProgramFiles(x86)%\remotepc host\es\is-3kq5f.tmp в %ProgramFiles(x86)%\remotepc host\es\rpcutilityviewer.resources.dll
%ProgramFiles(x86)%\remotepc host\es\is-7vkr0.tmp в %ProgramFiles(x86)%\remotepc host\es\rpcvieweruiu.resources.dll
%ProgramFiles(x86)%\remotepc host\es\is-3budt.tmp в %ProgramFiles(x86)%\remotepc host\es\viewerhostkeypopup.resources.dll
%ProgramFiles(x86)%\remotepc host\en\is-87bgl.tmp в %ProgramFiles(x86)%\remotepc host\en\rpcsuite.resources.dll
%ProgramFiles(x86)%\remotepc host\it\is-hi6jn.tmp в %ProgramFiles(x86)%\remotepc host\it\remotepchostui.resources.dll
%ProgramFiles(x86)%\remotepc host\it\is-oemd9.tmp в %ProgramFiles(x86)%\remotepc host\it\remotepcuiu.resources.dll
%ProgramFiles(x86)%\remotepc host\it\is-aen0d.tmp в %ProgramFiles(x86)%\remotepc host\it\rpcdownloader.resources.dll
%ProgramFiles(x86)%\remotepc host\it\is-b1q08.tmp в %ProgramFiles(x86)%\remotepc host\it\rpcfthost.resources.dll
%ProgramFiles(x86)%\remotepc host\it\is-j8h0m.tmp в %ProgramFiles(x86)%\remotepc host\it\rpcutilityhost.resources.dll
%ProgramFiles(x86)%\remotepc host\it\is-jnk94.tmp в %ProgramFiles(x86)%\remotepc host\it\viewerhostkeypopup.resources.dll
%ProgramFiles(x86)%\remotepc host\ko\is-5ktig.tmp в %ProgramFiles(x86)%\remotepc host\ko\remotepchostui.resources.dll
%ProgramFiles(x86)%\remotepc host\ko\is-p7gtn.tmp в %ProgramFiles(x86)%\remotepc host\ko\remotepcuiu.resources.dll
%ProgramFiles(x86)%\remotepc host\ko\is-29i33.tmp в %ProgramFiles(x86)%\remotepc host\ko\rpcdownloader.resources.dll
%ProgramFiles(x86)%\remotepc host\ko\is-l2206.tmp в %ProgramFiles(x86)%\remotepc host\ko\rpcfthost.resources.dll
%ProgramFiles(x86)%\remotepc host\ko\is-uebsu.tmp в %ProgramFiles(x86)%\remotepc host\ko\rpcutilityhost.resources.dll
%ProgramFiles(x86)%\remotepc host\es\is-os205.tmp в %ProgramFiles(x86)%\remotepc host\es\remotepcuiu.resources.dll
%ProgramFiles(x86)%\remotepc host\ko\is-0o94r.tmp в %ProgramFiles(x86)%\remotepc host\ko\viewerhostkeypopup.resources.dll
%ProgramFiles(x86)%\remotepc host\es\is-8598j.tmp в %ProgramFiles(x86)%\remotepc host\es\remotepclauncher.resources.dll
%ProgramFiles(x86)%\remotepc host\de\is-ksue2.tmp в %ProgramFiles(x86)%\remotepc host\de\viewerhostkeypopup.resources.dll
%ProgramFiles(x86)%\remotepc host\ja\is-ka1qa.tmp в %ProgramFiles(x86)%\remotepc host\ja\remotepchostui.resources.dll
%ProgramFiles(x86)%\remotepc host\ja\is-u8o9e.tmp в %ProgramFiles(x86)%\remotepc host\ja\remotepclauncher.resources.dll
%ProgramFiles(x86)%\remotepc host\ja\is-929le.tmp в %ProgramFiles(x86)%\remotepc host\ja\remotepcuiu.resources.dll
%ProgramFiles(x86)%\remotepc host\ja\is-1adil.tmp в %ProgramFiles(x86)%\remotepc host\ja\rpcdownloader.resources.dll
%ProgramFiles(x86)%\remotepc host\ja\is-86ab0.tmp в %ProgramFiles(x86)%\remotepc host\ja\rpcfthost.resources.dll
%ProgramFiles(x86)%\remotepc host\ja\is-20g3u.tmp в %ProgramFiles(x86)%\remotepc host\ja\rpcftviewer.resources.dll
%ProgramFiles(x86)%\remotepc host\ja\is-1k2sq.tmp в %ProgramFiles(x86)%\remotepc host\ja\rpcutilityhost.resources.dll
%ProgramFiles(x86)%\remotepc host\ja\is-edm6f.tmp в %ProgramFiles(x86)%\remotepc host\ja\rpcutilityviewer.resources.dll
%ProgramFiles(x86)%\remotepc host\ja\is-ep9ov.tmp в %ProgramFiles(x86)%\remotepc host\ja\rpcvieweruiu.resources.dll
%ProgramFiles(x86)%\remotepc host\ja\is-bnj0n.tmp в %ProgramFiles(x86)%\remotepc host\ja\viewerhostkeypopup.resources.dll
%ProgramFiles(x86)%\remotepc host\de\is-andvq.tmp в %ProgramFiles(x86)%\remotepc host\de\remotepchostui.resources.dll
%ProgramFiles(x86)%\remotepc host\de\is-m0ske.tmp в %ProgramFiles(x86)%\remotepc host\de\remotepclauncher.resources.dll
%ProgramFiles(x86)%\remotepc host\de\is-l4kpu.tmp в %ProgramFiles(x86)%\remotepc host\de\remotepcuiu.resources.dll
%ProgramFiles(x86)%\remotepc host\de\is-340cj.tmp в %ProgramFiles(x86)%\remotepc host\de\rpcdownloader.resources.dll
%ProgramFiles(x86)%\remotepc host\de\is-2uvu6.tmp в %ProgramFiles(x86)%\remotepc host\de\rpcfthost.resources.dll
%ProgramFiles(x86)%\remotepc host\de\is-1p1rd.tmp в %ProgramFiles(x86)%\remotepc host\de\rpcftviewer.resources.dll
%ProgramFiles(x86)%\remotepc host\de\is-n887m.tmp в %ProgramFiles(x86)%\remotepc host\de\rpcutilityhost.resources.dll
%ProgramFiles(x86)%\remotepc host\de\is-6n08a.tmp в %ProgramFiles(x86)%\remotepc host\de\rpcutilityviewer.resources.dll
%ProgramFiles(x86)%\remotepc host\de\is-nporn.tmp в %ProgramFiles(x86)%\remotepc host\de\rpcvieweruiu.resources.dll
%ProgramFiles(x86)%\remotepc host\es\is-sgmvu.tmp в %ProgramFiles(x86)%\remotepc host\es\remotepchostui.resources.dll
%ProgramFiles(x86)%\remotepc host\nl\is-l7u5n.tmp в %ProgramFiles(x86)%\remotepc host\nl\remotepchostui.resources.dll
%ProgramFiles(x86)%\remotepc host\nl\is-odt8a.tmp в %ProgramFiles(x86)%\remotepc host\nl\remotepcuiu.resources.dll
%ProgramFiles(x86)%\remotepc host\nl\is-g8ece.tmp в %ProgramFiles(x86)%\remotepc host\nl\rpcdownloader.resources.dll
%ProgramFiles(x86)%\remotepc host\is-r4gco.tmp в %ProgramFiles(x86)%\remotepc host\rpccoreviewer_ko_ko.dll
%ProgramFiles(x86)%\remotepc host\is-jj68e.tmp в %ProgramFiles(x86)%\remotepc host\rpccoreviewer_nl_nl.dll
%ProgramFiles(x86)%\remotepc host\is-7g0u5.tmp в %ProgramFiles(x86)%\remotepc host\rpccoreviewer_pt_br.dll
%ProgramFiles(x86)%\remotepc host\is-nkh2t.tmp в %ProgramFiles(x86)%\remotepc host\rpccoreviewer_fr_fr.dll
%ProgramFiles(x86)%\remotepc host\is-egvk0.tmp в %ProgramFiles(x86)%\remotepc host\rpccoreviewer_it_it.dll
%ProgramFiles(x86)%\remotepc host\is-au57l.tmp в %ProgramFiles(x86)%\remotepc host\rpccoreviewer_pt_pt.dll
%ProgramFiles(x86)%\remotepc host\virtualaudiodriver\is-a0q19.tmp в %ProgramFiles(x86)%\remotepc host\virtualaudiodriver\devcon.exe
%ProgramFiles(x86)%\remotepc host\virtualaudiodriver\is-uh5li.tmp в %ProgramFiles(x86)%\remotepc host\virtualaudiodriver\remotepcvad.cat
<SYSTEM32>\spool\drivers\x64\3\new\remotepcpscript.hlp в <SYSTEM32>\spool\drivers\x64\3\remotepcpscript.hlp
%ProgramFiles(x86)%\remotepc host\virtualaudiodriver\is-ueq06.tmp в %ProgramFiles(x86)%\remotepc host\virtualaudiodriver\remotepcvad.inf
%TEMP%\is-e5r07.tmp в %TEMP%\addtrust external ca root.cer
%TEMP%\is-ehc3b.tmp в %TEMP%\user_t_auth.cer
%ALLUSERSPROFILE%\remotepc host\is-r6243.tmp в %ALLUSERSPROFILE%\remotepc host\hostdesc.ini
%ProgramFiles(x86)%\remotepc host\is-mdqu5.tmp в %ProgramFiles(x86)%\remotepc host\unzip32.dll
%ProgramFiles(x86)%\remotepc host\is-fkkfo.tmp в %ProgramFiles(x86)%\remotepc host\zip32.dll
<SYSTEM32>\spool\drivers\x64\3\new\remotepcpscript5.dll в <SYSTEM32>\spool\drivers\x64\3\remotepcpscript5.dll
<SYSTEM32>\spool\drivers\x64\3\new\remotepcps5ui.dll в <SYSTEM32>\spool\drivers\x64\3\remotepcps5ui.dll
<SYSTEM32>\spool\drivers\x64\3\new\remotepcscpdfprn.ppd в <SYSTEM32>\spool\drivers\x64\3\remotepcscpdfprn.ppd
%ProgramFiles(x86)%\remotepc host\is-fcdm3.tmp в %ProgramFiles(x86)%\remotepc host\rpccoreviewer_en_en.dll
%ProgramFiles(x86)%\remotepc host\is-mvc7l.tmp в %ProgramFiles(x86)%\remotepc host\rpccoreviewer_jp_jp.dll
%ProgramFiles(x86)%\remotepc host\is-6iuo7.tmp в %ProgramFiles(x86)%\remotepc host\rpccoreviewer_es_es.dll
%ProgramFiles(x86)%\remotepc host\is-km1bn.tmp в %ProgramFiles(x86)%\remotepc host\rpccoreviewer_de_de.dll
%ProgramFiles(x86)%\remotepc host\fr\is-mp042.tmp в %ProgramFiles(x86)%\remotepc host\fr\viewerhostkeypopup.resources.dll
%ProgramFiles(x86)%\remotepc host\nl\is-51r79.tmp в %ProgramFiles(x86)%\remotepc host\nl\rpcutilityhost.resources.dll
%ProgramFiles(x86)%\remotepc host\nl\is-b8rr5.tmp в %ProgramFiles(x86)%\remotepc host\nl\viewerhostkeypopup.resources.dll
%ProgramFiles(x86)%\remotepc host\pt\is-9pa1p.tmp в %ProgramFiles(x86)%\remotepc host\pt\remotepchostui.resources.dll
%ProgramFiles(x86)%\remotepc host\pt\is-1pgj1.tmp в %ProgramFiles(x86)%\remotepc host\pt\remotepcuiu.resources.dll
%ProgramFiles(x86)%\remotepc host\pt\is-aomqi.tmp в %ProgramFiles(x86)%\remotepc host\pt\rpcdownloader.resources.dll
%ProgramFiles(x86)%\remotepc host\pt\is-n4pmi.tmp в %ProgramFiles(x86)%\remotepc host\pt\rpcfthost.resources.dll
%ProgramFiles(x86)%\remotepc host\pt\is-gg2hm.tmp в %ProgramFiles(x86)%\remotepc host\pt\rpcutilityhost.resources.dll
%ProgramFiles(x86)%\remotepc host\pt\is-m9r5i.tmp в %ProgramFiles(x86)%\remotepc host\pt\viewerhostkeypopup.resources.dll
%ProgramFiles(x86)%\remotepc host\is-a43ea.tmp в %ProgramFiles(x86)%\remotepc host\unregister.reg
%ProgramFiles(x86)%\remotepc host\pt-br\is-pv6s6.tmp в %ProgramFiles(x86)%\remotepc host\pt-br\remotepcuiu.resources.dll
%ProgramFiles(x86)%\remotepc host\pt-br\is-j5s6a.tmp в %ProgramFiles(x86)%\remotepc host\pt-br\remotepchostui.resources.dll
%ProgramFiles(x86)%\remotepc host\pt-br\is-rfpoo.tmp в %ProgramFiles(x86)%\remotepc host\pt-br\rpcfthost.resources.dll
%ProgramFiles(x86)%\remotepc host\pt-br\is-dsa57.tmp в %ProgramFiles(x86)%\remotepc host\pt-br\rpcutilityhost.resources.dll
%ProgramFiles(x86)%\remotepc host\pt-br\is-79lhr.tmp в %ProgramFiles(x86)%\remotepc host\pt-br\viewerhostkeypopup.resources.dll
%ProgramFiles(x86)%\remotepc host\fr\is-5clo7.tmp в %ProgramFiles(x86)%\remotepc host\fr\remotepchostui.resources.dll
%ProgramFiles(x86)%\remotepc host\fr\is-pc2sb.tmp в %ProgramFiles(x86)%\remotepc host\fr\remotepcuiu.resources.dll
%ProgramFiles(x86)%\remotepc host\fr\is-57964.tmp в %ProgramFiles(x86)%\remotepc host\fr\rpcdownloader.resources.dll
%ProgramFiles(x86)%\remotepc host\fr\is-m3819.tmp в %ProgramFiles(x86)%\remotepc host\fr\rpcfthost.resources.dll
%ProgramFiles(x86)%\remotepc host\fr\is-456sc.tmp в %ProgramFiles(x86)%\remotepc host\fr\rpcutilityhost.resources.dll
%ProgramFiles(x86)%\remotepc host\nl\is-frolc.tmp в %ProgramFiles(x86)%\remotepc host\nl\rpcfthost.resources.dll
%ProgramFiles(x86)%\remotepc host\pt-br\is-7q04t.tmp в %ProgramFiles(x86)%\remotepc host\pt-br\rpcdownloader.resources.dll
%ProgramFiles(x86)%\remotepc host\virtualaudiodriver\is-gbafl.tmp в %ProgramFiles(x86)%\remotepc host\virtualaudiodriver\remotepcvad.sys
%ProgramFiles(x86)%\remotepc host\is-crqdv.tmp в %ProgramFiles(x86)%\remotepc host\register.reg
%ProgramFiles(x86)%\remotepc host\is-f2cuh.tmp в %ProgramFiles(x86)%\remotepc host\arial.ttf
%ProgramFiles(x86)%\remotepc host\is-68f82.tmp в %ProgramFiles(x86)%\remotepc host\rpcfthost.exe
%ProgramFiles(x86)%\remotepc host\is-oga8h.tmp в %ProgramFiles(x86)%\remotepc host\rpcproxylatency.exe
%ProgramFiles(x86)%\remotepc host\is-rnlk4.tmp в %ProgramFiles(x86)%\remotepc host\preuninstall.exe
%ProgramFiles(x86)%\remotepc host\is-lebsc.tmp в %ProgramFiles(x86)%\remotepc host\remotepcdesktop.exe
%ProgramFiles(x86)%\remotepc host\is-lfmcs.tmp в %ProgramFiles(x86)%\remotepc host\remotepcservice.exe
%ProgramFiles(x86)%\remotepc host\is-9kr3k.tmp в %ProgramFiles(x86)%\remotepc host\rpcgae.exe
%ProgramFiles(x86)%\remotepc host\is-ajbah.tmp в %ProgramFiles(x86)%\remotepc host\rpcclipboard.exe
%ProgramFiles(x86)%\remotepc host\is-u0vna.tmp в %ProgramFiles(x86)%\remotepc host\rpcdownloader.exe
%ProgramFiles(x86)%\remotepc host\is-q0uah.tmp в %ProgramFiles(x86)%\remotepc host\servicemonitor.exe
%ProgramFiles(x86)%\remotepc host\is-c6qar.tmp в %ProgramFiles(x86)%\remotepc host\rpcprintuninstall.exe
%ProgramFiles(x86)%\remotepc host\is-datdk.tmp в %ProgramFiles(x86)%\remotepc host\viewerhostkeypopup.exe
%ProgramFiles(x86)%\remotepc host\is-ua81o.tmp в %ProgramFiles(x86)%\remotepc host\dragdrop-console.exe
%ProgramFiles(x86)%\remotepc host\is-hbd5o.tmp в %ProgramFiles(x86)%\remotepc host\easyhook32svc.exe
%ProgramFiles(x86)%\remotepc host\is-aeulu.tmp в %ProgramFiles(x86)%\remotepc host\easyhook64svc.exe
%ProgramFiles(x86)%\remotepc host\is-1plk5.tmp в %ProgramFiles(x86)%\remotepc host\rpcprinterdownloader.exe
%ProgramFiles(x86)%\remotepc host\is-o1ddf.tmp в %ProgramFiles(x86)%\remotepc host\rpcdnd_console.exe
%ProgramFiles(x86)%\remotepc host\is-qd5na.tmp в %ProgramFiles(x86)%\remotepc host\rpcdndlibrary.dll
%ProgramFiles(x86)%\remotepc host\is-6ke0m.tmp в %ProgramFiles(x86)%\remotepc host\rpcutilityhost.exe
%ProgramFiles(x86)%\remotepc host\is-gn98t.tmp в %ProgramFiles(x86)%\remotepc host\rpcutilityviewer.exe
%ProgramFiles(x86)%\remotepc host\is-pgg37.tmp в %ProgramFiles(x86)%\remotepc host\remotepchostui.exe
%ProgramFiles(x86)%\remotepc host\is-2vig6.tmp в %ProgramFiles(x86)%\remotepc host\dragdrop-dll_x32.dll
%ProgramFiles(x86)%\remotepc host\is-v387n.tmp в %ProgramFiles(x86)%\remotepc host\remotepcuiu.exe
%ProgramFiles(x86)%\remotepc host\is-ohpbb.tmp в %ProgramFiles(x86)%\remotepc host\system.windows.interactivity.dll
%ProgramFiles(x86)%\remotepc host\is-dh3b1.tmp в %ProgramFiles(x86)%\remotepc host\suitelauncher.exe
%ProgramFiles(x86)%\remotepc host\is-08omj.tmp в %ProgramFiles(x86)%\remotepc host\remotepclauncher.exe
%ProgramFiles(x86)%\remotepc host\is-grnml.tmp в %ProgramFiles(x86)%\remotepc host\remotepcblackscreenapp.exe
%ProgramFiles(x86)%\remotepc host\is-0nvm5.tmp в %ProgramFiles(x86)%\remotepc host\remotepcdrivercontrollerapi.dll
%ProgramFiles(x86)%\remotepc host\is-0vgg0.tmp в %ProgramFiles(x86)%\remotepc host\ccdwrapper.dll
%ProgramFiles(x86)%\remotepc host\is-vcoug.tmp в %ProgramFiles(x86)%\remotepc host\devcon.exe
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-vah97.tmp в %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcddriver.cat
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-qipa3.tmp в %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcddriver.inf
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-qgh6k.tmp в %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcddriverumode1_0.dll
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-sbvek.tmp в %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcddriverumode1_2.dll
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-ko0kr.tmp в %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcude.cat
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-m8gb3.tmp в %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcude.inf
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-ovnel.tmp в %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcude.sys
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-v7u5m.tmp в %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcudehost.cat
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-m2nj6.tmp в %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcudehost.inf
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-k3lpu.tmp в %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcudehost.sys
%ProgramFiles(x86)%\remotepc host\is-rqgbq.tmp в %ProgramFiles(x86)%\remotepc host\galasoft.mvvmlight.dll
%ProgramFiles(x86)%\remotepc host\is-hvemf.tmp в %ProgramFiles(x86)%\remotepc host\galasoft.mvvmlight.extras.dll
%ProgramFiles(x86)%\remotepc host\is-dfe23.tmp в %ProgramFiles(x86)%\remotepc host\microsoft.practices.servicelocation.dll
%ProgramFiles(x86)%\remotepc host\is-9h25r.tmp в %ProgramFiles(x86)%\remotepc host\wpfanimatedgif.dll
%ProgramFiles(x86)%\remotepc host\is-0hdbu.tmp в %ProgramFiles(x86)%\remotepc host\dragdrop-dll_x64.dll
%ALLUSERSPROFILE%\remotepc host\is-njrar.tmp в %ALLUSERSPROFILE%\remotepc host\easyhook32.dll
%ALLUSERSPROFILE%\remotepc host\is-rafaj.tmp в %ALLUSERSPROFILE%\remotepc host\easyhook64.dll
%ProgramFiles(x86)%\remotepc host\is-b0a9g.tmp в %ProgramFiles(x86)%\remotepc host\libwinpthread-1.dll
%ProgramFiles(x86)%\remotepc host\is-jp3jo.tmp в %ProgramFiles(x86)%\remotepc host\sdl.dll
%ProgramFiles(x86)%\remotepc host\is-bvf06.tmp в %ProgramFiles(x86)%\remotepc host\swresample-3.dll
%ProgramFiles(x86)%\remotepc host\is-skfsi.tmp в %ProgramFiles(x86)%\remotepc host\swscale-5.dll
%ProgramFiles(x86)%\remotepc host\is-ge41o.tmp в %ProgramFiles(x86)%\remotepc host\rpcfirewall.exe
%ProgramFiles(x86)%\remotepc host\is-me1sg.tmp в %ProgramFiles(x86)%\remotepc host\ssleay32.dll
%ProgramFiles(x86)%\remotepc host\is-h9jl6.tmp в %ProgramFiles(x86)%\remotepc host\newtonsoft.json.dll
%ProgramFiles(x86)%\remotepc host\is-pvhjr.tmp в %ProgramFiles(x86)%\remotepc host\madxlib.dll
%ProgramFiles(x86)%\remotepc host\printer\is-mjll4.tmp в %ProgramFiles(x86)%\remotepc host\printer\rpcprintinstall.exe
%ProgramFiles(x86)%\remotepc host\is-dl8td.tmp в %ProgramFiles(x86)%\remotepc host\dotnetfx45_full_setup.exe
%ProgramFiles(x86)%\remotepc host\is-5vmqa.tmp в %ProgramFiles(x86)%\remotepc host\rootcert.pem
%ProgramFiles(x86)%\remotepc host\is-nqskg.tmp в %ProgramFiles(x86)%\remotepc host\swresample-2.dll
%ProgramFiles(x86)%\remotepc host\is-5583n.tmp в %ProgramFiles(x86)%\remotepc host\msvcr90.dll
%ProgramFiles(x86)%\remotepc host\is-aphd0.tmp в %ProgramFiles(x86)%\remotepc host\microsoft.vc90.crt.manifest
%ProgramFiles(x86)%\remotepc host\is-n6ndn.tmp в %ProgramFiles(x86)%\remotepc host\lame_enc.dll
%ProgramFiles(x86)%\remotepc host\is-k9jcg.tmp в %ProgramFiles(x86)%\remotepc host\rpduilaunch.exe
%ProgramFiles(x86)%\remotepc host\is-dvsel.tmp в %ProgramFiles(x86)%\remotepc host\microsoft.win32.taskscheduler.dll
%ProgramFiles(x86)%\remotepc host\printer\is-1742m.tmp в %ProgramFiles(x86)%\remotepc host\printer\remotepcprintercore.dll
%ProgramFiles(x86)%\remotepc host\is-gugmq.tmp в %ProgramFiles(x86)%\remotepc host\avformat-58.dll
%ProgramFiles(x86)%\remotepc host\is-bt1in.tmp в %ProgramFiles(x86)%\remotepc host\libgcc_s_sjlj-1.dll
%ProgramFiles(x86)%\remotepc host\is-ce64s.tmp в %ProgramFiles(x86)%\remotepc host\avutil-56.dll
%ProgramFiles(x86)%\remotepc host\is-itpab.tmp в %ProgramFiles(x86)%\remotepc host\sas.dll
%ProgramFiles(x86)%\remotepc host\is-vl4ts.tmp в %ProgramFiles(x86)%\remotepc host\websocket-sharp.dll
%ALLUSERSPROFILE%\remotepc host\is-b3i4c.tmp в %ALLUSERSPROFILE%\remotepc host\easyload64.dll
%ALLUSERSPROFILE%\remotepc host\is-sv4o4.tmp в %ALLUSERSPROFILE%\remotepc host\easyhook.dll
%ProgramFiles(x86)%\remotepc host\is-t8mc0.tmp в %ProgramFiles(x86)%\remotepc host\resample.dll
%ProgramFiles(x86)%\remotepc host\is-rft5m.tmp в %ProgramFiles(x86)%\remotepc host\msvcp110.dll
%ProgramFiles(x86)%\remotepc host\is-b7gld.tmp в %ProgramFiles(x86)%\remotepc host\msvcr110.dll
%ProgramFiles(x86)%\remotepc host\is-9mhg9.tmp в %ProgramFiles(x86)%\remotepc host\aw_sas32.dll
%ProgramFiles(x86)%\remotepc host\is-0iqjr.tmp в %ProgramFiles(x86)%\remotepc host\vccorlib110.dll
%ProgramFiles(x86)%\remotepc host\is-1r8nv.tmp в %ProgramFiles(x86)%\remotepc host\msvcr100.dll
%ProgramFiles(x86)%\remotepc host\is-9ieoi.tmp в %ProgramFiles(x86)%\remotepc host\rpccredentialprovider.dll
%ProgramFiles(x86)%\remotepc host\is-dafv3.tmp в %ProgramFiles(x86)%\remotepc host\avcodec-58.dll
%ProgramFiles(x86)%\remotepc host\is-96q7p.tmp в %ProgramFiles(x86)%\remotepc host\libx264.dll
%ProgramFiles(x86)%\remotepc host\is-ivs08.tmp в %ProgramFiles(x86)%\remotepc host\libeay32.dll
%ProgramFiles(x86)%\remotepc host\is-r2qo7.tmp в %ProgramFiles(x86)%\remotepc host\d3dx9_43.dll
%ProgramFiles(x86)%\remotepc host\is-amjka.tmp в %ProgramFiles(x86)%\remotepc host\remotepc_installer.ico
%ProgramFiles(x86)%\remotepc host\is-3ujlu.tmp в %ProgramFiles(x86)%\remotepc host\remotepc__installer_noborder.ico
%ProgramFiles(x86)%\remotepc host\is-6te8a.tmp в %ProgramFiles(x86)%\remotepc host\odyssey.dll
%ProgramFiles(x86)%\remotepc host\is-lrung.tmp в %ProgramFiles(x86)%\remotepc host\cbthook.dll
%ProgramFiles(x86)%\remotepc host\is-k5j3k.tmp в %ProgramFiles(x86)%\remotepc host\windowshook.dll
%ProgramFiles(x86)%\remotepc host\is-jjb1k.tmp в %ProgramFiles(x86)%\remotepc host\zlib.net.dll
%ALLUSERSPROFILE%\remotepc host\is-6t23m.tmp в %ALLUSERSPROFILE%\remotepc host\easyload32.dll
%ProgramFiles(x86)%\remotepc host\is-8urst.tmp в %ProgramFiles(x86)%\remotepc host\pthreadgc2.dll
<SYSTEM32>\spool\drivers\x64\3\new\remotepcpscript.ntf в <SYSTEM32>\spool\drivers\x64\3\remotepcpscript.ntf

Подменяет следующие файлы

%ProgramFiles(x86)%\remotepc host\pthreadgc2.dll

Сетевая активность

Подключается к

'st####.remotepc.com':443
'we##.#emotepc.com':443

TCP

Другие

'st####.remotepc.com':443

UDP

DNS ASK st####.remotepc.com
DNS ASK we##.#emotepc.com
DNS ASK ca#####nia.remotepc.com
DNS ASK as##.#emotepc.com

Другое

Добавляет корневой сертификат

Ищет следующие окна

ClassName: 'TrayNotifyWnd' WindowName: ''
ClassName: 'SysPager' WindowName: ''
ClassName: 'ToolbarWindow32' WindowName: 'Notification Area'
ClassName: 'ToolbarWindow32' WindowName: 'User Promoted Notification Area'
ClassName: 'NotifyIconOverflowWindow' WindowName: ''
ClassName: 'ToolbarWindow32' WindowName: 'Overflow Notification Area'
ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: '#32770' WindowName: ''
ClassName: 'SysListView32' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-4vd1u.tmp\<Имя файла>.tmp' /SL5="$14023E,20426831,209408,<Полный путь к файлу>"
'%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepcperformanceplugins.exe' /S /D=%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance
'%ProgramFiles(x86)%\remotepc host\remotepcperformance\plugininstaller.exe' "https://static.remotepc.com/downloads/RemotePCPerformancePlugins.exe"
'%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcperformanceservice.exe'
'%ALLUSERSPROFILE%\remotepc host\codec\remotepcperformance.exe' /S /HostOnly /D=%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance
'%ProgramFiles(x86)%\remotepc host\remotepchostui.exe'
'%ProgramFiles(x86)%\remotepc host\rpcdownloader.exe' suitelaunch
'%ProgramFiles(x86)%\remotepc host\rpcdownloader.exe' servicestatus
'%ProgramFiles(x86)%\remotepc host\rpcdownloader.exe'
'%ProgramFiles(x86)%\remotepc host\remotepcperformance\plugininstaller.exe' "https://static.remotepc.com/downloads/RemotePCPerformancePrinter.exe"
'%ProgramFiles(x86)%\remotepc host\preuninstall.exe' 1
'%ProgramFiles(x86)%\remotepc host\suitelauncher.exe'
'%ProgramFiles(x86)%\remotepc host\remotepcservice.exe'
'%ProgramFiles(x86)%\remotepc host\rpcprinterdownloader.exe'
'%TEMP%\is-cnhrv.tmp\remotepchost1.exe' /NORESTART /DeployementID= /Groupname= /PersonalKey= /AutoUpdate= /HideTray= /ConnectPermission=
'%ProgramFiles(x86)%\remotepc host\remotepclauncher.exe' 4
'%TEMP%\is-jodm6.tmp\remotepchost1.tmp' /SL5="$C0224,19746857,209408,%TEMP%\is-CNHRV.tmp\RemotePCHost1.exe" /NORESTART /DeployementID= /Groupname= /PersonalKey= /AutoUpdate= /HideTray= /ConnectPermission=
'%ProgramFiles(x86)%\remotepc host\rpcfirewall.exe'
'%ProgramFiles(x86)%\remotepc host\rpduilaunch.exe' 1
'<SYSTEM32>\cmd.exe' /user:Administrator "cmd /K sc start Spooler binpath=<SYSTEM32>\spoolsv.exe"' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="RPCCodecEngineHost" dir=in action=allow program="%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RpcApp\RPCCodecEngine.exe" enable=yes profile=public,p...' (со скрытым окном)
'%WINDIR%\syswow64\sc.exe' start RPCService' (со скрытым окном)
'%ProgramFiles(x86)%\remotepc host\remotepcperformance\plugininstaller.exe' "https://static.remotepc.com/downloads/RemotePCPerformancePlugins.exe"' (со скрытым окном)
'%WINDIR%\syswow64\sc.exe' failure RPCService reset= INFINITE actions= restart/2000/restart/2000/restart/2000' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe' /u /silent "%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RpcApp\NetworkHandler.dll"' (со скрытым окном)
'%TEMP%\is-cnhrv.tmp\remotepchost1.exe' /NORESTART /DeployementID= /Groupname= /PersonalKey= /AutoUpdate= /HideTray= /ConnectPermission=' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /user:Administrator "cmd /K sc stop Spooler"' (со скрытым окном)
'%WINDIR%\syswow64\sc.exe' create RPCService start= auto binPath= "\"%ProgramFiles(x86)%\RemotePC Host\RemotePCService.exe\""' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /user:Administrator cmd /K sc create RPCService start=auto binpath="%ProgramFiles(x86)%\RemotePC Host\RemotePCService.exe"' (со скрытым окном)
'%ProgramFiles(x86)%\remotepc host\remotepclauncher.exe' 4' (со скрытым окном)
'%ProgramFiles(x86)%\remotepc host\rpcdownloader.exe' suitelaunch' (со скрытым окном)
'%ProgramFiles(x86)%\remotepc host\preuninstall.exe' 1' (со скрытым окном)
'%ProgramFiles(x86)%\remotepc host\suitelauncher.exe' ' (со скрытым окном)
'%ProgramFiles(x86)%\remotepc host\rpcfirewall.exe' ' (со скрытым окном)
'%ProgramFiles(x86)%\remotepc host\rpcdownloader.exe' servicestatus' (со скрытым окном)
'%ProgramFiles(x86)%\remotepc host\rpduilaunch.exe' 1' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\regasm.exe' /tlb /register /codebase /nologo /silent "%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RpcApp\NetworkHandler.dll"' (со скрытым окном)
'%ProgramFiles(x86)%\remotepc host\remotepcperformance\plugininstaller.exe' "https://static.remotepc.com/downloads/RemotePCPerformancePrinter.exe"' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\sc.exe' create RPCService start= auto binPath= "\"%ProgramFiles(x86)%\RemotePC Host\RemotePCService.exe\""
'%WINDIR%\microsoft.net\framework64\v4.0.30319\ngen.exe' install "%ProgramFiles%\RemotePCPrinter\RemotePCPrinterCore.dll" /queue:1
'<SYSTEM32>\rundll32.exe' "%WINDIR%\Installer\MSI5459.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1267024 15 RemotepcPrinterInstallCustomAction!PdfScribeInstallCustomAction.CustomActions.InstallPdfScribePrinter
'<SYSTEM32>\msiexec.exe' /qn /i "%ALLUSERSPROFILE%\RemotePC Host\PrinterSetup\Printer.msi"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\regasm.exe' /tlb /register /codebase /nologo /silent "%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RpcApp\NetworkHandler.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RpcApp\RPCDataHandler.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RpcApp\RPCDataHandler.dll"
'<SYSTEM32>\spoolsv.exe'
'<SYSTEM32>\sc.exe' start Spooler binpath=<SYSTEM32>\spoolsv.exe"
'<SYSTEM32>\cmd.exe' /user:Administrator "cmd /K sc start Spooler binpath=<SYSTEM32>\spoolsv.exe"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe' /u /silent "%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RpcApp\NetworkHandler.dll"
'<SYSTEM32>\sc.exe' stop Spooler"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\ngen.exe' install "%ProgramFiles%\RemotePCPrinter\RemotePCPrinter.exe" /queue:1
'%WINDIR%\syswow64\regsvr32.exe' /u /s "%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RpcApp\RPCDataHandler.dll"
'<SYSTEM32>\msiexec.exe' /x {AA4B39D8-F8D7-43D2-9797-4E887760E360} /quiet
'<SYSTEM32>\msiexec.exe' /x {4011606E-CB2A-46D7-8A5E-7EF535C3DEA7} /quiet
'<SYSTEM32>\sc.exe' create RPCService start=auto binpath="%ProgramFiles(x86)%\RemotePC Host\RemotePCService.exe"
'<SYSTEM32>\cmd.exe' /user:Administrator cmd /K sc create RPCService start=auto binpath="%ProgramFiles(x86)%\RemotePC Host\RemotePCService.exe"
'%WINDIR%\regedit.exe' /s "%ProgramFiles(x86)%\RemotePC Host\\Register.reg"
'<SYSTEM32>\msiexec.exe' /x {609B0019-4E60-4701-B998-BFA115415694} /quiet
'<SYSTEM32>\msiexec.exe' /x {68155655-B909-4294-8A9B-D60E2CF5362F} /quiet
'<SYSTEM32>\msiexec.exe' /x {99826982-7148-412E-8CFA-D5F14F1A26C4} /quiet
'<SYSTEM32>\msiexec.exe' /x {90515785-8089-4070-975A-15F0252A9BB5} /quiet
'%WINDIR%\syswow64\sc.exe' start RPCService
'%WINDIR%\syswow64\sc.exe' failure RPCService reset= INFINITE actions= restart/2000/restart/2000/restart/2000
'<SYSTEM32>\cmd.exe' /user:Administrator "cmd /K sc stop Spooler"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\ngen.exe' update /queue

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней