Trojan.Inject1.43485

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Control\Print\Monitors\doPDF 7 Monitor] 'Driver' = 'dopdfmn7.dll'

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\is-K4A82.tmp\i386\dopdfin7.exe' -install -name "doPDF v7" -pagesizes "" -nodefault -languages en -deflanguage en -hidepages -regpdfkey -nolog
'%TEMP%\lego.exe'
'%TEMP%\is-K4A82.tmp\dopdfin7.exe' -name "doPDF v7" -checkname -nolog
'%TEMP%\dopdf-7.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-TE099.tmp\dopdf-7.tmp' /SL5="$300DE,3507205,584704,%TEMP%\dopdf-7.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Внедряет код в

следующие системные процессы:

<SYSTEM32>\spoolsv.exe

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Softland\doPDF 7\is-JD33Q.tmp
%PROGRAM_FILES%\Softland\doPDF 7\is-ILN5F.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\doPDF 7\doPDF Help.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\doPDF 7\doPDF.lnk
%PROGRAM_FILES%\Softland\doPDF 7\is-8AHA2.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-R9AU5.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-B6CM0.tmp
%PROGRAM_FILES%\Softland\doPDF 7\is-EQVOK.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-PLSG6.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\doPDF 7\Uninstall doPDF 7.lnk
<SYSTEM32>\spool\drivers\w32x86\dopdf7.ctm
<SYSTEM32>\spool\drivers\w32x86\dopdf7.chm
<SYSTEM32>\dopdfmi7.dll
<SYSTEM32>\dopdfmn7.dll
<SYSTEM32>\spool\drivers\w32x86\dopdfui7.dll
%PROGRAM_FILES%\Softland\doPDF 7\unins000.dat
%PROGRAM_FILES%\Softland\doPDF 7\unins000.msg
<SYSTEM32>\spool\drivers\w32x86\dopdfpr7.dll
%TEMP%\is-K4A82.tmp\i386\dopdf7.clg
%TEMP%\is-K4A82.tmp\AMD64\is-O4102.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-632DM.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-E7B7G.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-6F9J8.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-1JH38.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-T4OSA.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-CNHCC.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-4JMJ0.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-EHQE7.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-3QCI0.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-K24B7.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-9MOM0.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-H3P97.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-H1EIG.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-SHCDQ.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-AASDB.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-CCP0M.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-ISQS1.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-RNEST.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
<SYSTEM32>\spool\drivers\w32x86\3\New\dopdfpr7.dll
<SYSTEM32>\spool\drivers\w32x86\3\New\dopdf7.clg
<SYSTEM32>\spool\drivers\w32x86\3\New\dopdf7.ctm
%ALLUSERSPROFILE%\Start Menu\Programs\doPDF 7\Visit the forum.lnk
<SYSTEM32>\spool\drivers\w32x86\3\New\dopdf7_en.lng
<SYSTEM32>\spool\drivers\w32x86\3\New\dopdfcl7.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
<SYSTEM32>\spool\drivers\w32x86\3\New\dopdf7.chm
<SYSTEM32>\spool\drivers\w32x86\3\New\dopdfui7.dll
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
<SYSTEM32>\dopdf7.ctm
<SYSTEM32>\spool\drivers\w32x86\dopdfcl7.exe
<SYSTEM32>\spool\drivers\w32x86\dopdf7_en.lng
<SYSTEM32>\spool\drivers\w32x86\dopdf7.clg
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
%TEMP%\is-K4A82.tmp\AMD64\is-7LOBR.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-6PCJE.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-5KOUM.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-7T8JV.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-1GIBA.tmp
%PROGRAM_FILES%\Softland\doPDF 7\AMD64\is-7TKR6.tmp
%TEMP%\is-K4A82.tmp\i386\is-5UUS4.tmp
%TEMP%\is-K4A82.tmp\i386\is-5QQM4.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-98V65.tmp
%PROGRAM_FILES%\Softland\doPDF 7\AMD64\is-7A1SJ.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-AHVLJ.tmp
%TEMP%\is-K4A82.tmp\i386\is-TAHVS.tmp
%TEMP%\is-K4A82.tmp\i386\is-KTQ1K.tmp
%TEMP%\is-K4A82.tmp\i386\is-EOJR4.tmp
%TEMP%\is-K4A82.tmp\i386\is-UG4UC.tmp
%TEMP%\is-K4A82.tmp\i386\is-JHKO1.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-JJQDB.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-721CR.tmp
%TEMP%\is-K4A82.tmp\i386\is-N3KHI.tmp
%TEMP%\is-K4A82.tmp\i386\is-J0DUN.tmp
%TEMP%\is-K4A82.tmp\dopdfin7.exe
%TEMP%\is-K4A82.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\Softland\doPDF 7\is-EB01K.tmp
%PROGRAM_FILES%\Softland\doPDF 7\is-4GBJE.tmp
%TEMP%\is-TE099.tmp\dopdf-7.tmp
%TEMP%\dopdf-7.exe
%TEMP%\aut1.tmp
%TEMP%\lego.exe
%TEMP%\aut2.tmp
%PROGRAM_FILES%\Softland\doPDF 7\is-E5IIQ.tmp
%TEMP%\is-K4A82.tmp\i386\is-A8D40.tmp
%TEMP%\is-K4A82.tmp\i386\is-86NNG.tmp
%TEMP%\is-K4A82.tmp\i386\is-ASHJJ.tmp
%TEMP%\is-K4A82.tmp\i386\is-7A64N.tmp
%TEMP%\is-K4A82.tmp\i386\is-QSANL.tmp
%PROGRAM_FILES%\Softland\doPDF 7\i386\is-0V4AH.tmp
%PROGRAM_FILES%\Softland\doPDF 7\is-H7KS2.tmp
%PROGRAM_FILES%\Softland\doPDF 7\i386\is-RLGA5.tmp
%TEMP%\is-K4A82.tmp\i386\is-PUDK3.tmp
%TEMP%\is-K4A82.tmp\i386\is-4LOJF.tmp
%TEMP%\is-K4A82.tmp\i386\is-NDDPB.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-5JSEJ.tmp
%TEMP%\is-K4A82.tmp\i386\is-QMPH9.tmp
%TEMP%\is-K4A82.tmp\i386\is-SABNP.tmp
%TEMP%\is-K4A82.tmp\i386\is-2OQ9G.tmp
%TEMP%\is-K4A82.tmp\i386\is-UV8NK.tmp
%TEMP%\is-K4A82.tmp\i386\is-31IMT.tmp
%TEMP%\is-K4A82.tmp\i386\is-GE0P6.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-MDAAD.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-87O34.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-A0SH0.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-261HC.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-KDJV4.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-AVAJQ.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-2J39N.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-A5K3O.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-449BE.tmp
%TEMP%\is-K4A82.tmp\AMD64\is-29EBQ.tmp
%TEMP%\is-K4A82.tmp\i386\is-ODI78.tmp
%TEMP%\is-K4A82.tmp\i386\is-83IL8.tmp
%TEMP%\is-K4A82.tmp\i386\is-JUJPL.tmp
%TEMP%\is-K4A82.tmp\i386\is-CB7TE.tmp
%TEMP%\is-K4A82.tmp\i386\is-B6SB4.tmp
%TEMP%\is-K4A82.tmp\i386\is-0AA2Q.tmp
%TEMP%\is-K4A82.tmp\i386\is-CDN01.tmp
%TEMP%\is-K4A82.tmp\i386\is-02TAB.tmp
%TEMP%\is-K4A82.tmp\i386\is-JB241.tmp
%TEMP%\is-K4A82.tmp\i386\is-EFK8V.tmp
%TEMP%\is-K4A82.tmp\i386\is-8VG03.tmp
%TEMP%\is-K4A82.tmp\i386\is-8G52B.tmp
%TEMP%\is-K4A82.tmp\i386\is-U82TS.tmp
%TEMP%\is-K4A82.tmp\i386\is-PBLF6.tmp
%TEMP%\is-K4A82.tmp\i386\is-VMOTE.tmp
%TEMP%\is-K4A82.tmp\i386\is-FAPG6.tmp
%TEMP%\is-K4A82.tmp\i386\is-4VO0Q.tmp
%TEMP%\is-K4A82.tmp\i386\is-A9HJM.tmp
%TEMP%\is-K4A82.tmp\i386\is-F6IMD.tmp

Удаляет следующие файлы:

%TEMP%\is-K4A82.tmp\i386\dopdf7_hu.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_it.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_he.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_fr.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_gr.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_ja.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_nl.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_no.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_ms.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_kr.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_lt.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_fi.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_bg.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_br.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_ar.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7.clg
%TEMP%\is-K4A82.tmp\i386\dopdf7.ctm
%TEMP%\is-K4A82.tmp\i386\dopdf7_cs.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_en.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_es.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_de.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_ct.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_da.lng
%TEMP%\is-K4A82.tmp\i386\dopdfmi7.dll
%TEMP%\is-K4A82.tmp\i386\dopdfmn7.dll
%TEMP%\is-K4A82.tmp\i386\dopdfin7.exe
%TEMP%\is-K4A82.tmp\i386\dopdf7_vi.lng
%TEMP%\is-K4A82.tmp\i386\dopdfcl7.exe
%TEMP%\is-K4A82.tmp\i386\dopdfpr7.dll
%TEMP%\dopdf-7.exe
%TEMP%\lego.exe
%TEMP%\is-TE099.tmp\dopdf-7.tmp
%TEMP%\is-K4A82.tmp\i386\dopdfui7.dll
%TEMP%\is-K4A82.tmp\_isetup\_shfoldr.dll
%TEMP%\is-K4A82.tmp\i386\dopdf7_uk.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_ru.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_sc.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_ro.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_pl.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_pt.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_si.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_th.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_tr.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_sv.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_sk.lng
%TEMP%\is-K4A82.tmp\i386\dopdf7_sr.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_gr.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_he.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_fr.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_es.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_fi.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_hu.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_lt.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_ms.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_kr.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_it.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_ja.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_en.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7.ctm
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_ar.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7.chm
%TEMP%\aut1.tmp
%TEMP%\aut2.tmp
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_bg.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_da.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_de.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_ct.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_br.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_cs.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdfcl7.exe
%TEMP%\is-K4A82.tmp\AMD64\dopdfin7.exe
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_vi.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_tr.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_uk.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdfmi7.dll
%TEMP%\is-K4A82.tmp\dopdfin7.exe
%TEMP%\is-K4A82.tmp\i386\dopdf7.chm
%TEMP%\is-K4A82.tmp\AMD64\dopdfui7.dll
%TEMP%\is-K4A82.tmp\AMD64\dopdfmn7.dll
%TEMP%\is-K4A82.tmp\AMD64\dopdfpr7.dll
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_th.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_pt.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_ro.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_pl.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_nl.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_no.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_ru.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_sr.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_sv.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_sk.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_sc.lng
%TEMP%\is-K4A82.tmp\AMD64\dopdf7_si.lng

Перемещает следующие файлы:

%TEMP%\is-K4A82.tmp\AMD64\is-261HC.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_cs.lng
%TEMP%\is-K4A82.tmp\AMD64\is-7LOBR.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_fr.lng
%TEMP%\is-K4A82.tmp\AMD64\is-CNHCC.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_it.lng
%TEMP%\is-K4A82.tmp\AMD64\is-A0SH0.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_sv.lng
%TEMP%\is-K4A82.tmp\AMD64\is-87O34.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_sr.lng
%TEMP%\is-K4A82.tmp\AMD64\is-KDJV4.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_uk.lng
%TEMP%\is-K4A82.tmp\AMD64\is-1JH38.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_si.lng
%TEMP%\is-K4A82.tmp\AMD64\is-632DM.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_sc.lng
%TEMP%\is-K4A82.tmp\AMD64\is-O4102.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_gr.lng
%TEMP%\is-K4A82.tmp\AMD64\is-T4OSA.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_br.lng
%TEMP%\is-K4A82.tmp\AMD64\is-EHQE7.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_pt.lng
%TEMP%\is-K4A82.tmp\AMD64\is-4JMJ0.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_de.lng
%TEMP%\is-K4A82.tmp\AMD64\is-AVAJQ.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_nl.lng
%TEMP%\is-K4A82.tmp\i386\is-NDDPB.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_lt.lng
%TEMP%\is-K4A82.tmp\i386\is-4LOJF.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_he.lng
%TEMP%\is-K4A82.tmp\i386\is-QMPH9.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_sk.lng
%TEMP%\is-K4A82.tmp\i386\is-GE0P6.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_da.lng
%TEMP%\is-K4A82.tmp\i386\is-31IMT.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_ms.lng
%TEMP%\is-K4A82.tmp\i386\is-SABNP.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_th.lng
%TEMP%\is-K4A82.tmp\AMD64\is-2J39N.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_ru.lng
%TEMP%\is-K4A82.tmp\AMD64\is-29EBQ.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_pl.lng
%TEMP%\is-K4A82.tmp\AMD64\is-449BE.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_ja.lng
%TEMP%\is-K4A82.tmp\AMD64\is-5JSEJ.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_en.lng
%TEMP%\is-K4A82.tmp\AMD64\is-MDAAD.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_ro.lng
%TEMP%\is-K4A82.tmp\AMD64\is-A5K3O.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_es.lng
%TEMP%\is-K4A82.tmp\AMD64\is-6F9J8.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_hu.lng
%PROGRAM_FILES%\Softland\doPDF 7\is-ILN5F.tmp в %PROGRAM_FILES%\Softland\doPDF 7\uninstall.ico
%PROGRAM_FILES%\Softland\doPDF 7\is-JD33Q.tmp в %PROGRAM_FILES%\Softland\doPDF 7\dopdf.ico
<SYSTEM32>\spool\drivers\w32x86\3\New\dopdfpr7.dll в <SYSTEM32>\spool\drivers\w32x86\3\dopdfpr7.dll
%TEMP%\is-K4A82.tmp\AMD64\is-PLSG6.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_sk.lng
%PROGRAM_FILES%\Softland\doPDF 7\is-EQVOK.tmp в %PROGRAM_FILES%\Softland\doPDF 7\dopdf.exe
%PROGRAM_FILES%\Softland\doPDF 7\is-8AHA2.tmp в %PROGRAM_FILES%\Softland\doPDF 7\License.rtf
<SYSTEM32>\spool\drivers\w32x86\3\New\dopdf7.ctm в <SYSTEM32>\spool\drivers\w32x86\3\dopdf7.ctm
<SYSTEM32>\spool\drivers\w32x86\3\New\dopdf7.clg в <SYSTEM32>\spool\drivers\w32x86\3\dopdf7.clg
<SYSTEM32>\spool\drivers\w32x86\3\New\dopdf7_en.lng в <SYSTEM32>\spool\drivers\w32x86\3\dopdf7_en.lng
<SYSTEM32>\spool\drivers\w32x86\3\New\dopdfui7.dll в <SYSTEM32>\spool\drivers\w32x86\3\dopdfui7.dll
<SYSTEM32>\spool\drivers\w32x86\3\New\dopdf7.chm в <SYSTEM32>\spool\drivers\w32x86\3\dopdf7.chm
<SYSTEM32>\spool\drivers\w32x86\3\New\dopdfcl7.exe в <SYSTEM32>\spool\drivers\w32x86\3\dopdfcl7.exe
%TEMP%\is-K4A82.tmp\AMD64\is-R9AU5.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_he.lng
%TEMP%\is-K4A82.tmp\AMD64\is-AASDB.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_bg.lng
%TEMP%\is-K4A82.tmp\AMD64\is-RNEST.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_ar.lng
%TEMP%\is-K4A82.tmp\AMD64\is-ISQS1.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_fi.lng
%TEMP%\is-K4A82.tmp\AMD64\is-E7B7G.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_vi.lng
%TEMP%\is-K4A82.tmp\AMD64\is-3QCI0.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_kr.lng
%TEMP%\is-K4A82.tmp\AMD64\is-CCP0M.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_ct.lng
%TEMP%\is-K4A82.tmp\AMD64\is-H1EIG.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_ms.lng
%TEMP%\is-K4A82.tmp\AMD64\is-H3P97.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_th.lng
%TEMP%\is-K4A82.tmp\AMD64\is-B6CM0.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_lt.lng
%TEMP%\is-K4A82.tmp\AMD64\is-SHCDQ.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_tr.lng
%TEMP%\is-K4A82.tmp\AMD64\is-9MOM0.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_no.lng
%TEMP%\is-K4A82.tmp\AMD64\is-K24B7.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7_da.lng
%TEMP%\is-K4A82.tmp\i386\is-2OQ9G.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_no.lng
%PROGRAM_FILES%\Softland\doPDF 7\AMD64\is-7TKR6.tmp в %PROGRAM_FILES%\Softland\doPDF 7\AMD64\dopdfin7.exe
%TEMP%\is-K4A82.tmp\AMD64\is-5KOUM.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdfin7.exe
%TEMP%\is-K4A82.tmp\AMD64\is-6PCJE.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdfcl7.exe
%TEMP%\is-K4A82.tmp\i386\is-5UUS4.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7.ctm
%PROGRAM_FILES%\Softland\doPDF 7\AMD64\is-7A1SJ.tmp в %PROGRAM_FILES%\Softland\doPDF 7\AMD64\dopdf7.ctm
%TEMP%\is-K4A82.tmp\AMD64\is-98V65.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7.chm
%TEMP%\is-K4A82.tmp\AMD64\is-721CR.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdfui7.dll
%TEMP%\is-K4A82.tmp\AMD64\is-JJQDB.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdf7.ctm
%TEMP%\is-K4A82.tmp\i386\is-J0DUN.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_en.lng
%TEMP%\is-K4A82.tmp\AMD64\is-1GIBA.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdfmn7.dll
%TEMP%\is-K4A82.tmp\AMD64\is-7T8JV.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdfmi7.dll
%TEMP%\is-K4A82.tmp\AMD64\is-AHVLJ.tmp в %TEMP%\is-K4A82.tmp\AMD64\dopdfpr7.dll
%TEMP%\is-K4A82.tmp\i386\is-5QQM4.tmp в %TEMP%\is-K4A82.tmp\i386\dopdfui7.dll
%PROGRAM_FILES%\Softland\doPDF 7\is-H7KS2.tmp в %PROGRAM_FILES%\Softland\doPDF 7\dopdf7.ctm
%PROGRAM_FILES%\Softland\doPDF 7\i386\is-0V4AH.tmp в %PROGRAM_FILES%\Softland\doPDF 7\i386\dopdf7.ctm
%TEMP%\is-K4A82.tmp\i386\is-PUDK3.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7.chm
%PROGRAM_FILES%\Softland\doPDF 7\is-4GBJE.tmp в %PROGRAM_FILES%\Softland\doPDF 7\unins000.exe
%PROGRAM_FILES%\Softland\doPDF 7\is-EB01K.tmp в %PROGRAM_FILES%\Softland\doPDF 7\dopdf-support.html
%PROGRAM_FILES%\Softland\doPDF 7\is-E5IIQ.tmp в %PROGRAM_FILES%\Softland\doPDF 7\dopdf7.chm
%TEMP%\is-K4A82.tmp\i386\is-A8D40.tmp в %TEMP%\is-K4A82.tmp\i386\dopdfmn7.dll
%TEMP%\is-K4A82.tmp\i386\is-7A64N.tmp в %TEMP%\is-K4A82.tmp\i386\dopdfmi7.dll
%TEMP%\is-K4A82.tmp\i386\is-ASHJJ.tmp в %TEMP%\is-K4A82.tmp\i386\dopdfpr7.dll
%PROGRAM_FILES%\Softland\doPDF 7\i386\is-RLGA5.tmp в %PROGRAM_FILES%\Softland\doPDF 7\i386\dopdfin7.exe
%TEMP%\is-K4A82.tmp\i386\is-QSANL.tmp в %TEMP%\is-K4A82.tmp\i386\dopdfin7.exe
%TEMP%\is-K4A82.tmp\i386\is-86NNG.tmp в %TEMP%\is-K4A82.tmp\i386\dopdfcl7.exe
%TEMP%\is-K4A82.tmp\i386\is-N3KHI.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_ro.lng
%TEMP%\is-K4A82.tmp\i386\is-FAPG6.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_gr.lng
%TEMP%\is-K4A82.tmp\i386\is-F6IMD.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_hu.lng
%TEMP%\is-K4A82.tmp\i386\is-A9HJM.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_vi.lng
%TEMP%\is-K4A82.tmp\i386\is-JUJPL.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_de.lng
%TEMP%\is-K4A82.tmp\i386\is-EFK8V.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_si.lng
%TEMP%\is-K4A82.tmp\i386\is-4VO0Q.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_sc.lng
%TEMP%\is-K4A82.tmp\i386\is-PBLF6.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_ar.lng
%TEMP%\is-K4A82.tmp\i386\is-U82TS.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_fi.lng
%TEMP%\is-K4A82.tmp\i386\is-UV8NK.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_tr.lng
%TEMP%\is-K4A82.tmp\i386\is-VMOTE.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_kr.lng
%TEMP%\is-K4A82.tmp\i386\is-8G52B.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_ct.lng
%TEMP%\is-K4A82.tmp\i386\is-8VG03.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_bg.lng
%TEMP%\is-K4A82.tmp\i386\is-CB7TE.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_pt.lng
%TEMP%\is-K4A82.tmp\i386\is-UG4UC.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_ja.lng
%TEMP%\is-K4A82.tmp\i386\is-EOJR4.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_nl.lng
%TEMP%\is-K4A82.tmp\i386\is-CDN01.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_sv.lng
%TEMP%\is-K4A82.tmp\i386\is-JHKO1.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_es.lng
%TEMP%\is-K4A82.tmp\i386\is-KTQ1K.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_ru.lng
%TEMP%\is-K4A82.tmp\i386\is-TAHVS.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_pl.lng
%TEMP%\is-K4A82.tmp\i386\is-B6SB4.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_fr.lng
%TEMP%\is-K4A82.tmp\i386\is-83IL8.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_it.lng
%TEMP%\is-K4A82.tmp\i386\is-ODI78.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_br.lng
%TEMP%\is-K4A82.tmp\i386\is-0AA2Q.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_sr.lng
%TEMP%\is-K4A82.tmp\i386\is-JB241.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_uk.lng
%TEMP%\is-K4A82.tmp\i386\is-02TAB.tmp в %TEMP%\is-K4A82.tmp\i386\dopdf7_cs.lng

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней