Техническая информация
Вредоносные функции
Для затруднения выявления своего присутствия в системе
добавляет исключения антивируса:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath '<SYSTEM32>'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath %ALLUSERSPROFILE%
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Users
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath <SYSTEM32>
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess Dism.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess where.exe
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\dism.exe
Патчит код
в динамической библиотеке
- Процесс dism.exe, модуль IPHLPAPI.DLL
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\is-sliml89jtj.tmp\<Имя файла>.tmp
- %TEMP%\is-3sy4ilq3a7.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-3sy4ilq3a7.tmp\_isetup\_is7z.dll
- %TEMP%\is-3sy4ilq3a7.tmp\_isetup\is-tjjru7m7u0.tmp\is-tuch8mvqsg.tmp
- %ProgramFiles%\printerdoctor\is-9wbpj8pclo.tmp
- %ProgramFiles%\printerdoctor\is-zpmjgoi6tu.tmp
- %ProgramFiles%\printerdoctor\is-vr3v7moqh8.tmp
- %ProgramFiles%\printerdoctor\7_files\is-vucaiz18jd.tmp
- %ProgramFiles%\printerdoctor\7_files\is-aoiymcd51x.tmp
- %ProgramFiles%\printerdoctor\7_files\is-ep5j55tkal.tmp
- %ProgramFiles%\printerdoctor\7_files\is-acbsaodq9w.tmp
- %ProgramFiles%\printerdoctor\7_files\is-ofgq60oucb.tmp
- %ProgramFiles%\printerdoctor\7_files\is-jcv7mjzttk.tmp
- %ProgramFiles%\printerdoctor\7_files\is-d44p6opabv.tmp
- %ProgramFiles%\printerdoctor\7_files\is-j6sfbeaotm.tmp
- %ProgramFiles%\printerdoctor\7_files\is-qv89v3weaz.tmp
- %ProgramFiles%\printerdoctor\7_files\is-xn05vz2bbq.tmp
- %ProgramFiles%\printerdoctor\7_files\is-4iwjejgsrq.tmp
- %ProgramFiles%\printerdoctor\7_files\is-sf1hhceg1z.tmp
- %ProgramFiles%\printerdoctor\7_files\is-vee1eapxg9.tmp
- %ProgramFiles%\printerdoctor\7_files\is-ucjvwwb33v.tmp
- %ProgramFiles%\printerdoctor\7_files\is-y059huqf3i.tmp
- %ProgramFiles%\printerdoctor\7_files\is-pwdikmtr2v.tmp
- %ProgramFiles%\printerdoctor\7_files\is-skc60s0q7l.tmp
- %ProgramFiles%\printerdoctor\7_files\is-2xolwhk09n.tmp
- %ProgramFiles%\printerdoctor\7_files\is-j768ixgyzm.tmp
- %ProgramFiles%\printerdoctor\7_files\is-8m6ejq1jjz.tmp
- %ProgramFiles%\printerdoctor\7_files\is-attn8d77j4.tmp
- %ProgramFiles%\printerdoctor\7_files\is-vfwn9dcpzv.tmp
- %ProgramFiles%\printerdoctor\7_files\is-7iovucrilc.tmp
- %ProgramFiles%\printerdoctor\7_files\is-d48aap3tar.tmp
- %ProgramFiles%\printerdoctor\7_files\is-6ji0p1ytkj.tmp
- %ProgramFiles%\printerdoctor\7_files\is-a4zef6zb7i.tmp
- %ProgramFiles%\printerdoctor\7_files\is-s0za67qrfa.tmp
- %ProgramFiles%\printerdoctor\7_files\is-tslg41vrbt.tmp
- %ProgramFiles%\printerdoctor\7_files\is-hntrewi3lg.tmp
- %ProgramFiles%\printerdoctor\7_files\is-c8y1f9n2hj.tmp
- %ProgramFiles%\printerdoctor\7_files\is-fa7idqiw4n.tmp
- %ProgramFiles%\printerdoctor\7_files\is-bymg761usw.tmp
- %ProgramFiles%\printerdoctor\7_files\is-fvk31923c1.tmp
- %ProgramFiles%\printerdoctor\7_files\is-gql72poc7s.tmp
- %ProgramFiles%\printerdoctor\7_files\is-9vft724xa6.tmp
- %ProgramFiles%\printerdoctor\7_files\is-4mmm5ddllh.tmp
- %ProgramFiles%\printerdoctor\7_files\is-f7efc3wrl4.tmp
- %ProgramFiles%\printerdoctor\7_files\is-61hao9ajsl.tmp
- %ProgramFiles%\printerdoctor\7_files\is-dngxmlmmpx.tmp
- %ProgramFiles%\printerdoctor\7_files\is-6yb8iushq3.tmp
- %ProgramFiles%\printerdoctor\7_files\is-99yqr59s5u.tmp
- %ProgramFiles%\printerdoctor\7_files\is-8tagjudlpr.tmp
- %ProgramFiles%\printerdoctor\7_files\is-98fen9kw38.tmp
- %ProgramFiles%\printerdoctor\7_files\is-is5a52aghn.tmp
- %ProgramFiles%\printerdoctor\7_files\is-vxmnjpsps5.tmp
- %ProgramFiles%\printerdoctor\7_files\is-2zdb3rmuc2.tmp
- %ProgramFiles%\printerdoctor\7_files\is-d2w3oh57ra.tmp
- %ProgramFiles%\printerdoctor\7_files\is-fx30oht1e0.tmp
- %ProgramFiles%\printerdoctor\7_files\is-pb50e6tjeu.tmp
- %ProgramFiles%\printerdoctor\7_files\is-o4eyx6vnsm.tmp
- %ProgramFiles%\printerdoctor\7_files\is-jj0sh6utoa.tmp
- %ProgramFiles%\printerdoctor\7_files\is-vvluiy8x91.tmp
- %ProgramFiles%\printerdoctor\7_files\is-hr2lxuhx8j.tmp
- %ProgramFiles%\printerdoctor\7_files\is-r31dj37u5s.tmp
- %ProgramFiles%\printerdoctor\7_files\is-9zcuioeo1x.tmp
- %ProgramFiles%\printerdoctor\7_files\is-33ner5rjpt.tmp
- %ProgramFiles%\printerdoctor\7_files\is-66u6fkpbgm.tmp
- %ProgramFiles%\printerdoctor\7_files\is-fabr1zkx99.tmp
- %ProgramFiles%\printerdoctor\7_files\is-j3awo4fcwh.tmp
- %ProgramFiles%\printerdoctor\7_files\is-14dfrrpmk3.tmp
- %ProgramFiles%\printerdoctor\7_files\is-ic8beyi6hl.tmp
- %ProgramFiles%\printerdoctor\7_files\is-2c8yazcjuk.tmp
- %ProgramFiles%\printerdoctor\7_files\is-2urkuz9dh3.tmp
- %ProgramFiles%\printerdoctor\7_files\is-c1fykny88m.tmp
- %ProgramFiles%\printerdoctor\7_files\is-p2p7no8d28.tmp
- %ProgramFiles%\printerdoctor\7_files\is-h6t6iiddaw.tmp
- %ProgramFiles%\printerdoctor\7_files\is-ptzrow59if.tmp
- %ProgramFiles%\printerdoctor\7_files\is-z2fkts96pm.tmp
- %ProgramFiles%\printerdoctor\7_files\is-48c4op1wkf.tmp
- %ProgramFiles%\printerdoctor\7_files\is-sk6ddbzv75.tmp
- %ProgramFiles%\printerdoctor\7_files\is-qjah73aq4g.tmp
- %ProgramFiles%\printerdoctor\7_files\is-yh8hrsax23.tmp
- %ProgramFiles%\printerdoctor\7_files\is-bo37rm4s84.tmp
- %ProgramFiles%\printerdoctor\7_files\is-l2g4z5h7sa.tmp
- %ProgramFiles%\printerdoctor\7_files\is-d6upsac270.tmp
- %ProgramFiles%\printerdoctor\7_files\is-loqu970i1s.tmp
- %ProgramFiles%\printerdoctor\7_files\is-7qpjc5aca5.tmp
- %ProgramFiles%\printerdoctor\7_files\is-8qo3jvn2oh.tmp
- %ProgramFiles%\printerdoctor\is-5wc139pu4i.tmp
- %ProgramFiles%\printerdoctor\unins000.dat
- %WINDIR%\temp\~df6bdf8b6c36ad6adc.tmp
- %WINDIR%\installer\sourcehash{27b05ca8-f1de-4496-be49-fd9c50fac16d}
- %WINDIR%\temp\~df5c5eda102e604fc0.tmp
- %WINDIR%\temp\~df9f8f48dfcadda5f2.tmp
- %WINDIR%\temp\~dfcd6d0a47db23d525.tmp
- %APPDATA%\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\babysrk.dll
- %APPDATA%\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\resource.png
- %APPDATA%\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\vcruntime140_1.dll
- %APPDATA%\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\msvcp140.dll
- %APPDATA%\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\vcruntime140.dll
- %APPDATA%\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\flashcenter_pp_ax_install_cn.exe
- %APPDATA%\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\emjio.tmp
- %ALLUSERSPROFILE%\_caphyon\skin_compress_dlg.xml
- %ALLUSERSPROFILE%\_caphyon\skin_main.xml
- %ALLUSERSPROFILE%\_caphyon\skin_select_folder.xml
- %ALLUSERSPROFILE%\_caphyon\tb_btn_test.png
- %ALLUSERSPROFILE%\_caphyon\aiview_btn_next.png
- %ALLUSERSPROFILE%\_caphyon\app_bg2.png
- %ALLUSERSPROFILE%\_caphyon\app_camera.png
- %ALLUSERSPROFILE%\_caphyon\app_honeyview.png
- %ALLUSERSPROFILE%\_caphyon\app_wooting.xml
- %ALLUSERSPROFILE%\_caphyon\resource.h
- %APPDATA%\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\j.xml
- %APPDATA%\wdbld75wq9po\emjio.tmp
- %APPDATA%\wdbld75wq9po\msvcp140.dll
- %APPDATA%\wdbld75wq9po\rubberized.exe
- %APPDATA%\wdbld75wq9po\sandrockbase.dll
- %APPDATA%\wdbld75wq9po\vcruntime140.dll
- %APPDATA%\wdbld75wq9po\vcruntime140_1.dll
- %ALLUSERSPROFILE%\venlnk\ntr_jing.lnk
- %WINDIR%\temp\~dfdd0aecfaa2b6b3d7.tmp
- %WINDIR%\temp\~df42a6ef0233bfc716.tmp
- %WINDIR%\temp\~dfee358a55d87c5267.tmp
- %WINDIR%\temp\~df6a6dc81468e488d2.tmp
- %WINDIR%\temp\~df88f919a95bda3c17.tmp
- %WINDIR%\temp\~df7b33b30532645b95.tmp
- %WINDIR%\temp\~df7011483ec19e7d61.tmp
- %WINDIR%\temp\~dfd2109df445361e8a.tmp
Удаляет файлы, которые сам же создал
- %ProgramFiles%\printerdoctor\souths.msi
- %TEMP%\is-3sy4ilq3a7.tmp\_isetup\is-tjjru7m7u0.tmp\ada.zip
- %TEMP%\is-3sy4ilq3a7.tmp\_isetup\_is7z.dll
- %TEMP%\is-3sy4ilq3a7.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-sliml89jtj.tmp\<Имя файла>.tmp
Перемещает следующие файлы
- %TEMP%\is-3sy4ilq3a7.tmp\_isetup\is-tjjru7m7u0.tmp\is-tuch8mvqsg.tmp в %TEMP%\is-3sy4ilq3a7.tmp\_isetup\is-tjjru7m7u0.tmp\ada.zip
- %ProgramFiles%\printerdoctor\is-9wbpj8pclo.tmp в %ProgramFiles%\printerdoctor\unins000.exe
- %ProgramFiles%\printerdoctor\is-zpmjgoi6tu.tmp в %ProgramFiles%\printerdoctor\souths.msi
- %ProgramFiles%\printerdoctor\is-vr3v7moqh8.tmp в %ProgramFiles%\printerdoctor\7.html
- %ProgramFiles%\printerdoctor\7_files\is-vucaiz18jd.tmp в %ProgramFiles%\printerdoctor\7_files\3b24b51bf11404089c4d66acd0c612539c77e7e7
- %ProgramFiles%\printerdoctor\7_files\is-aoiymcd51x.tmp в %ProgramFiles%\printerdoctor\7_files\3ce5793e0e2ab9e3dbc03c1cb23d538c8b86f1b7
- %ProgramFiles%\printerdoctor\7_files\is-ep5j55tkal.tmp в %ProgramFiles%\printerdoctor\7_files\5419.5fab78b2.css
- %ProgramFiles%\printerdoctor\7_files\is-acbsaodq9w.tmp в %ProgramFiles%\printerdoctor\7_files\60bfd4ad01d8d9142d88c3c0b73cea36bf327ea7
- %ProgramFiles%\printerdoctor\7_files\is-ofgq60oucb.tmp в %ProgramFiles%\printerdoctor\7_files\ab676161000051742113c21548ddabe305961c28
- %ProgramFiles%\printerdoctor\7_files\is-jcv7mjzttk.tmp в %ProgramFiles%\printerdoctor\7_files\ab6761610000517421a213a4fe1a6f9b45d3f7f9
- %ProgramFiles%\printerdoctor\7_files\is-d44p6opabv.tmp в %ProgramFiles%\printerdoctor\7_files\ab6761610000517469287c3f1b150bbead642499
- %ProgramFiles%\printerdoctor\7_files\is-j6sfbeaotm.tmp в %ProgramFiles%\printerdoctor\7_files\ab6761610000517487b0c6a4811964bd1b7d701f
- %ProgramFiles%\printerdoctor\7_files\is-qv89v3weaz.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616100005174ae81417d966e209b735b1160
- %ProgramFiles%\printerdoctor\7_files\is-xn05vz2bbq.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616100005174db59e1c017a93648b119f0cc
- %ProgramFiles%\printerdoctor\7_files\is-4iwjejgsrq.tmp в %ProgramFiles%\printerdoctor\7_files\ab6761610000f178d8139dde094f1b2609aeec15
- %ProgramFiles%\printerdoctor\7_files\is-sf1hhceg1z.tmp в %ProgramFiles%\printerdoctor\7_files\ab6761610000f178eaca358712b3fe4ed9814640
- %ProgramFiles%\printerdoctor\7_files\is-vee1eapxg9.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02039b95b846d039d78a2ca6a1
- %ProgramFiles%\printerdoctor\7_files\is-ucjvwwb33v.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e0204f7d57adcdf0c2f2decf4c4
- %ProgramFiles%\printerdoctor\7_files\is-y059huqf3i.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02055b322b3efb78f1082bc799
- %ProgramFiles%\printerdoctor\7_files\is-pwdikmtr2v.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e020cb65bb81eebf25f36de2999
- %ProgramFiles%\printerdoctor\7_files\is-skc60s0q7l.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02105086205323b81177c709d4
- %ProgramFiles%\printerdoctor\7_files\is-2xolwhk09n.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e021ddafc3aa34ad883ff27418f
- %ProgramFiles%\printerdoctor\7_files\is-j768ixgyzm.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02214f0bd9dc1ed0c65ae81760
- %ProgramFiles%\printerdoctor\7_files\is-8m6ejq1jjz.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e0223cc0f0a925845a3de4aca38
- %ProgramFiles%\printerdoctor\7_files\is-attn8d77j4.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e022c1f1f4512c99b738110035a
- %ProgramFiles%\printerdoctor\7_files\is-vfwn9dcpzv.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e022c90628cf534a426e3687b47
- %ProgramFiles%\printerdoctor\7_files\is-7iovucrilc.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e0231eb25ed004dd2e9b6f35d4f
- %ProgramFiles%\printerdoctor\7_files\is-d48aap3tar.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02374f450ee0a6c2036ee01b89
- %ProgramFiles%\printerdoctor\7_files\is-6ji0p1ytkj.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e023b67e4695d120ebfe9ca359a
- %ProgramFiles%\printerdoctor\7_files\is-a4zef6zb7i.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e024117e531f63855d072059d6e
- %ProgramFiles%\printerdoctor\7_files\is-s0za67qrfa.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e025c3742c1e50f5f272c92ae59
- %ProgramFiles%\printerdoctor\7_files\is-tslg41vrbt.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e0265af8f4075f3a6b96866e611
- %ProgramFiles%\printerdoctor\7_files\is-hntrewi3lg.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02685b70d40ae9fffdcc242a0a
- %ProgramFiles%\printerdoctor\7_files\is-c8y1f9n2hj.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e026a4175046856b90a9b5d67a1
- %ProgramFiles%\printerdoctor\7_files\is-fa7idqiw4n.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02897077217561a52898209cc5
- %ProgramFiles%\printerdoctor\7_files\is-bymg761usw.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e028a2ce3f148f57584269c3782
- %ProgramFiles%\printerdoctor\7_files\is-fvk31923c1.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02907f0d0884466966d6546767
- %ProgramFiles%\printerdoctor\7_files\is-gql72poc7s.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e029435ca4eaef0847e80d04b02
- %ProgramFiles%\printerdoctor\7_files\is-9vft724xa6.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e029564dd0f283e0a16440063c7
- %ProgramFiles%\printerdoctor\7_files\is-4mmm5ddllh.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02979637dbe8b71de7c13ab5cf
- %ProgramFiles%\printerdoctor\7_files\is-f7efc3wrl4.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02992d0e6aeb59f587a1e81ac8
- %ProgramFiles%\printerdoctor\7_files\is-61hao9ajsl.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e0299e49fe1e935d3d724627211
- %ProgramFiles%\printerdoctor\7_files\is-dngxmlmmpx.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e029e6f77c2aa67cab83fb412be
- %ProgramFiles%\printerdoctor\7_files\is-6yb8iushq3.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e029e8e0df48ff95de8d014f0b1
- %ProgramFiles%\printerdoctor\7_files\is-99yqr59s5u.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e029fefaca04a80b8b221954573
- %ProgramFiles%\printerdoctor\7_files\is-8tagjudlpr.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02ae0e62cc351978ad5203fcfa
- %ProgramFiles%\printerdoctor\7_files\is-98fen9kw38.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02b7fe0714ccb2ad8c61303911
- %ProgramFiles%\printerdoctor\7_files\is-is5a52aghn.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02c02ced489483042f820ad4b0
- %ProgramFiles%\printerdoctor\7_files\is-vxmnjpsps5.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02c093f4dd308ad9c41e20eee8
- %ProgramFiles%\printerdoctor\7_files\is-2zdb3rmuc2.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02c8da7970ca45b99fb2c51777
- %ProgramFiles%\printerdoctor\7_files\is-d2w3oh57ra.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02cf491ef0ed4e0d587b571724
- %ProgramFiles%\printerdoctor\7_files\is-fx30oht1e0.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02dd64809bbf416dde80e80f99
- %ProgramFiles%\printerdoctor\7_files\is-pb50e6tjeu.tmp в %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02e2829416e5011fb749cc3fde
- %ProgramFiles%\printerdoctor\7_files\is-o4eyx6vnsm.tmp в %ProgramFiles%\printerdoctor\7_files\adsct
- %ProgramFiles%\printerdoctor\7_files\is-jj0sh6utoa.tmp в %ProgramFiles%\printerdoctor\7_files\adsct(1)
- %ProgramFiles%\printerdoctor\7_files\is-vvluiy8x91.tmp в %ProgramFiles%\printerdoctor\7_files\anchor.html
- %ProgramFiles%\printerdoctor\7_files\is-hr2lxuhx8j.tmp в %ProgramFiles%\printerdoctor\7_files\c2c1b3612f38b206411173c168b912d306b5c196
- %ProgramFiles%\printerdoctor\7_files\is-r31dj37u5s.tmp в %ProgramFiles%\printerdoctor\7_files\cast_framework.js
- %ProgramFiles%\printerdoctor\7_files\is-9zcuioeo1x.tmp в %ProgramFiles%\printerdoctor\7_files\cast_sender(1).js
- %ProgramFiles%\printerdoctor\7_files\is-33ner5rjpt.tmp в %ProgramFiles%\printerdoctor\7_files\cast_sender.js
- %ProgramFiles%\printerdoctor\7_files\is-66u6fkpbgm.tmp в %ProgramFiles%\printerdoctor\7_files\dwp-feedback-bar.2f1f7eb4.css
- %ProgramFiles%\printerdoctor\7_files\is-fabr1zkx99.tmp в %ProgramFiles%\printerdoctor\7_files\dwp-now-playing-bar.88eac62f.css
- %ProgramFiles%\printerdoctor\7_files\is-j3awo4fcwh.tmp в %ProgramFiles%\printerdoctor\7_files\dwp-panel-section.db8179d5.css
- %ProgramFiles%\printerdoctor\7_files\is-14dfrrpmk3.tmp в %ProgramFiles%\printerdoctor\7_files\dwp-top-bar.2d1e7227.css
- %ProgramFiles%\printerdoctor\7_files\is-ic8beyi6hl.tmp в %ProgramFiles%\printerdoctor\7_files\dwp-video-player.a92a1bf1.css
- %ProgramFiles%\printerdoctor\7_files\is-2c8yazcjuk.tmp в %ProgramFiles%\printerdoctor\7_files\dwp-watch-feed-view-container.39b09463.css
- %ProgramFiles%\printerdoctor\7_files\is-2urkuz9dh3.tmp в %ProgramFiles%\printerdoctor\7_files\enterprise.js
- %ProgramFiles%\printerdoctor\7_files\is-c1fykny88m.tmp в %ProgramFiles%\printerdoctor\7_files\gtm.96d60fd6.js
- %ProgramFiles%\printerdoctor\7_files\is-p2p7no8d28.tmp в %ProgramFiles%\printerdoctor\7_files\heap_config.js
- %ProgramFiles%\printerdoctor\7_files\is-h6t6iiddaw.tmp в %ProgramFiles%\printerdoctor\7_files\listening-stats-modal.8c1b8d24.css
- %ProgramFiles%\printerdoctor\7_files\is-ptzrow59if.tmp в %ProgramFiles%\printerdoctor\7_files\otsdkstub.js
- %ProgramFiles%\printerdoctor\7_files\is-z2fkts96pm.tmp в %ProgramFiles%\printerdoctor\7_files\ot_company_logo.png
- %ProgramFiles%\printerdoctor\7_files\is-48c4op1wkf.tmp в %ProgramFiles%\printerdoctor\7_files\powered_by_logo.svg
- %ProgramFiles%\printerdoctor\7_files\is-sk6ddbzv75.tmp в %ProgramFiles%\printerdoctor\7_files\retargeting-pixels.02346b5d.js
- %ProgramFiles%\printerdoctor\7_files\is-qjah73aq4g.tmp в %ProgramFiles%\printerdoctor\7_files\saved_resource(1).html
- %ProgramFiles%\printerdoctor\7_files\is-yh8hrsax23.tmp в %ProgramFiles%\printerdoctor\7_files\saved_resource(2).html
- %ProgramFiles%\printerdoctor\7_files\is-bo37rm4s84.tmp в %ProgramFiles%\printerdoctor\7_files\saved_resource.html
- %ProgramFiles%\printerdoctor\7_files\is-l2g4z5h7sa.tmp в %ProgramFiles%\printerdoctor\7_files\sync.min.js
- %ProgramFiles%\printerdoctor\7_files\is-d6upsac270.tmp в %ProgramFiles%\printerdoctor\7_files\uwt.js
- %ProgramFiles%\printerdoctor\7_files\is-loqu970i1s.tmp в %ProgramFiles%\printerdoctor\7_files\xpui-root-dialogs.24c65f8c.css
- %ProgramFiles%\printerdoctor\7_files\is-7qpjc5aca5.tmp в %ProgramFiles%\printerdoctor\7_files\xpui-routes-track-v2.3643c9d7.css
- %ProgramFiles%\printerdoctor\7_files\is-8qo3jvn2oh.tmp в %ProgramFiles%\printerdoctor\7_files\xpui-routes-your-library-x.d077bf4b.css
- %ProgramFiles%\printerdoctor\is-5wc139pu4i.tmp в %ProgramFiles%\printerdoctor\shadow@2x.png
Сетевая активность
Подключается к
- 'do#####.##.ap-east-1.amazonaws.com':443
- 'ba##u.com':443
TCP
Запросы HTTP GET
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?78##############
Другие
- 'do#####.##.ap-east-1.amazonaws.com':443
- 'ba##u.com':443
UDP
- DNS ASK do#####.##.ap-east-1.amazonaws.com
- DNS ASK ba##u.com
- DNS ASK hk.##7imx.net
Другое
Создает и запускает на исполнение
- '%TEMP%\is-sliml89jtj.tmp\<Имя файла>.tmp' /SL5="$F01BA,3581697,1006592,<Полный путь к файлу>"
Запускает на исполнение
- '%WINDIR%\syswow64\msiexec.exe' /i "%ProgramFiles%\PrinterDoctor\souths.msi" /qn
- '<SYSTEM32>\dism.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%'" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath '<SYSTEM32>'" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'" (со скрытым окном)
