Trojan.Siggen32.45871

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%'"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath '<SYSTEM32>'"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath %ALLUSERSPROFILE%
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Users
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath <SYSTEM32>
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess Dism.exe
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess where.exe

Injects code into

the following system processes:

<SYSTEM32>\dism.exe

Patches code

in dll

dism.exe process, IPHLPAPI.DLL module

Modifies file system

Creates the following files

%TEMP%\is-sliml89jtj.tmp\<File name>.tmp
%TEMP%\is-3sy4ilq3a7.tmp\_isetup\_isdecmp.dll
%TEMP%\is-3sy4ilq3a7.tmp\_isetup\_is7z.dll
%TEMP%\is-3sy4ilq3a7.tmp\_isetup\is-tjjru7m7u0.tmp\is-tuch8mvqsg.tmp
%ProgramFiles%\printerdoctor\is-9wbpj8pclo.tmp
%ProgramFiles%\printerdoctor\is-zpmjgoi6tu.tmp
%ProgramFiles%\printerdoctor\is-vr3v7moqh8.tmp
%ProgramFiles%\printerdoctor\7_files\is-vucaiz18jd.tmp
%ProgramFiles%\printerdoctor\7_files\is-aoiymcd51x.tmp
%ProgramFiles%\printerdoctor\7_files\is-ep5j55tkal.tmp
%ProgramFiles%\printerdoctor\7_files\is-acbsaodq9w.tmp
%ProgramFiles%\printerdoctor\7_files\is-ofgq60oucb.tmp
%ProgramFiles%\printerdoctor\7_files\is-jcv7mjzttk.tmp
%ProgramFiles%\printerdoctor\7_files\is-d44p6opabv.tmp
%ProgramFiles%\printerdoctor\7_files\is-j6sfbeaotm.tmp
%ProgramFiles%\printerdoctor\7_files\is-qv89v3weaz.tmp
%ProgramFiles%\printerdoctor\7_files\is-xn05vz2bbq.tmp
%ProgramFiles%\printerdoctor\7_files\is-4iwjejgsrq.tmp
%ProgramFiles%\printerdoctor\7_files\is-sf1hhceg1z.tmp
%ProgramFiles%\printerdoctor\7_files\is-vee1eapxg9.tmp
%ProgramFiles%\printerdoctor\7_files\is-ucjvwwb33v.tmp
%ProgramFiles%\printerdoctor\7_files\is-y059huqf3i.tmp
%ProgramFiles%\printerdoctor\7_files\is-pwdikmtr2v.tmp
%ProgramFiles%\printerdoctor\7_files\is-skc60s0q7l.tmp
%ProgramFiles%\printerdoctor\7_files\is-2xolwhk09n.tmp
%ProgramFiles%\printerdoctor\7_files\is-j768ixgyzm.tmp
%ProgramFiles%\printerdoctor\7_files\is-8m6ejq1jjz.tmp
%ProgramFiles%\printerdoctor\7_files\is-attn8d77j4.tmp
%ProgramFiles%\printerdoctor\7_files\is-vfwn9dcpzv.tmp
%ProgramFiles%\printerdoctor\7_files\is-7iovucrilc.tmp
%ProgramFiles%\printerdoctor\7_files\is-d48aap3tar.tmp
%ProgramFiles%\printerdoctor\7_files\is-6ji0p1ytkj.tmp
%ProgramFiles%\printerdoctor\7_files\is-a4zef6zb7i.tmp
%ProgramFiles%\printerdoctor\7_files\is-s0za67qrfa.tmp
%ProgramFiles%\printerdoctor\7_files\is-tslg41vrbt.tmp
%ProgramFiles%\printerdoctor\7_files\is-hntrewi3lg.tmp
%ProgramFiles%\printerdoctor\7_files\is-c8y1f9n2hj.tmp
%ProgramFiles%\printerdoctor\7_files\is-fa7idqiw4n.tmp
%ProgramFiles%\printerdoctor\7_files\is-bymg761usw.tmp
%ProgramFiles%\printerdoctor\7_files\is-fvk31923c1.tmp
%ProgramFiles%\printerdoctor\7_files\is-gql72poc7s.tmp
%ProgramFiles%\printerdoctor\7_files\is-9vft724xa6.tmp
%ProgramFiles%\printerdoctor\7_files\is-4mmm5ddllh.tmp
%ProgramFiles%\printerdoctor\7_files\is-f7efc3wrl4.tmp
%ProgramFiles%\printerdoctor\7_files\is-61hao9ajsl.tmp
%ProgramFiles%\printerdoctor\7_files\is-dngxmlmmpx.tmp
%ProgramFiles%\printerdoctor\7_files\is-6yb8iushq3.tmp
%ProgramFiles%\printerdoctor\7_files\is-99yqr59s5u.tmp
%ProgramFiles%\printerdoctor\7_files\is-8tagjudlpr.tmp
%ProgramFiles%\printerdoctor\7_files\is-98fen9kw38.tmp
%ProgramFiles%\printerdoctor\7_files\is-is5a52aghn.tmp
%ProgramFiles%\printerdoctor\7_files\is-vxmnjpsps5.tmp
%ProgramFiles%\printerdoctor\7_files\is-2zdb3rmuc2.tmp
%ProgramFiles%\printerdoctor\7_files\is-d2w3oh57ra.tmp
%ProgramFiles%\printerdoctor\7_files\is-fx30oht1e0.tmp
%ProgramFiles%\printerdoctor\7_files\is-pb50e6tjeu.tmp
%ProgramFiles%\printerdoctor\7_files\is-o4eyx6vnsm.tmp
%ProgramFiles%\printerdoctor\7_files\is-jj0sh6utoa.tmp
%ProgramFiles%\printerdoctor\7_files\is-vvluiy8x91.tmp
%ProgramFiles%\printerdoctor\7_files\is-hr2lxuhx8j.tmp
%ProgramFiles%\printerdoctor\7_files\is-r31dj37u5s.tmp
%ProgramFiles%\printerdoctor\7_files\is-9zcuioeo1x.tmp
%ProgramFiles%\printerdoctor\7_files\is-33ner5rjpt.tmp
%ProgramFiles%\printerdoctor\7_files\is-66u6fkpbgm.tmp
%ProgramFiles%\printerdoctor\7_files\is-fabr1zkx99.tmp
%ProgramFiles%\printerdoctor\7_files\is-j3awo4fcwh.tmp
%ProgramFiles%\printerdoctor\7_files\is-14dfrrpmk3.tmp
%ProgramFiles%\printerdoctor\7_files\is-ic8beyi6hl.tmp
%ProgramFiles%\printerdoctor\7_files\is-2c8yazcjuk.tmp
%ProgramFiles%\printerdoctor\7_files\is-2urkuz9dh3.tmp
%ProgramFiles%\printerdoctor\7_files\is-c1fykny88m.tmp
%ProgramFiles%\printerdoctor\7_files\is-p2p7no8d28.tmp
%ProgramFiles%\printerdoctor\7_files\is-h6t6iiddaw.tmp
%ProgramFiles%\printerdoctor\7_files\is-ptzrow59if.tmp
%ProgramFiles%\printerdoctor\7_files\is-z2fkts96pm.tmp
%ProgramFiles%\printerdoctor\7_files\is-48c4op1wkf.tmp
%ProgramFiles%\printerdoctor\7_files\is-sk6ddbzv75.tmp
%ProgramFiles%\printerdoctor\7_files\is-qjah73aq4g.tmp
%ProgramFiles%\printerdoctor\7_files\is-yh8hrsax23.tmp
%ProgramFiles%\printerdoctor\7_files\is-bo37rm4s84.tmp
%ProgramFiles%\printerdoctor\7_files\is-l2g4z5h7sa.tmp
%ProgramFiles%\printerdoctor\7_files\is-d6upsac270.tmp
%ProgramFiles%\printerdoctor\7_files\is-loqu970i1s.tmp
%ProgramFiles%\printerdoctor\7_files\is-7qpjc5aca5.tmp
%ProgramFiles%\printerdoctor\7_files\is-8qo3jvn2oh.tmp
%ProgramFiles%\printerdoctor\is-5wc139pu4i.tmp
%ProgramFiles%\printerdoctor\unins000.dat
%WINDIR%\temp\~df6bdf8b6c36ad6adc.tmp
%WINDIR%\installer\sourcehash{27b05ca8-f1de-4496-be49-fd9c50fac16d}
%WINDIR%\temp\~df5c5eda102e604fc0.tmp
%WINDIR%\temp\~df9f8f48dfcadda5f2.tmp
%WINDIR%\temp\~dfcd6d0a47db23d525.tmp
%APPDATA%\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\babysrk.dll
%APPDATA%\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\resource.png
%APPDATA%\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\vcruntime140_1.dll
%APPDATA%\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\msvcp140.dll
%APPDATA%\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\vcruntime140.dll
%APPDATA%\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\flashcenter_pp_ax_install_cn.exe
%APPDATA%\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\emjio.tmp
%ALLUSERSPROFILE%\_caphyon\skin_compress_dlg.xml
%ALLUSERSPROFILE%\_caphyon\skin_main.xml
%ALLUSERSPROFILE%\_caphyon\skin_select_folder.xml
%ALLUSERSPROFILE%\_caphyon\tb_btn_test.png
%ALLUSERSPROFILE%\_caphyon\aiview_btn_next.png
%ALLUSERSPROFILE%\_caphyon\app_bg2.png
%ALLUSERSPROFILE%\_caphyon\app_camera.png
%ALLUSERSPROFILE%\_caphyon\app_honeyview.png
%ALLUSERSPROFILE%\_caphyon\app_wooting.xml
%ALLUSERSPROFILE%\_caphyon\resource.h
%APPDATA%\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\j.xml
%APPDATA%\wdbld75wq9po\emjio.tmp
%APPDATA%\wdbld75wq9po\msvcp140.dll
%APPDATA%\wdbld75wq9po\rubberized.exe
%APPDATA%\wdbld75wq9po\sandrockbase.dll
%APPDATA%\wdbld75wq9po\vcruntime140.dll
%APPDATA%\wdbld75wq9po\vcruntime140_1.dll
%ALLUSERSPROFILE%\venlnk\ntr_jing.lnk
%WINDIR%\temp\~dfdd0aecfaa2b6b3d7.tmp
%WINDIR%\temp\~df42a6ef0233bfc716.tmp
%WINDIR%\temp\~dfee358a55d87c5267.tmp
%WINDIR%\temp\~df6a6dc81468e488d2.tmp
%WINDIR%\temp\~df88f919a95bda3c17.tmp
%WINDIR%\temp\~df7b33b30532645b95.tmp
%WINDIR%\temp\~df7011483ec19e7d61.tmp
%WINDIR%\temp\~dfd2109df445361e8a.tmp

Deletes following files that it created itself

%ProgramFiles%\printerdoctor\souths.msi
%TEMP%\is-3sy4ilq3a7.tmp\_isetup\is-tjjru7m7u0.tmp\ada.zip
%TEMP%\is-3sy4ilq3a7.tmp\_isetup\_is7z.dll
%TEMP%\is-3sy4ilq3a7.tmp\_isetup\_isdecmp.dll
%TEMP%\is-sliml89jtj.tmp\<File name>.tmp

Moves the following files

from %TEMP%\is-3sy4ilq3a7.tmp\_isetup\is-tjjru7m7u0.tmp\is-tuch8mvqsg.tmp to %TEMP%\is-3sy4ilq3a7.tmp\_isetup\is-tjjru7m7u0.tmp\ada.zip
from %ProgramFiles%\printerdoctor\is-9wbpj8pclo.tmp to %ProgramFiles%\printerdoctor\unins000.exe
from %ProgramFiles%\printerdoctor\is-zpmjgoi6tu.tmp to %ProgramFiles%\printerdoctor\souths.msi
from %ProgramFiles%\printerdoctor\is-vr3v7moqh8.tmp to %ProgramFiles%\printerdoctor\7.html
from %ProgramFiles%\printerdoctor\7_files\is-vucaiz18jd.tmp to %ProgramFiles%\printerdoctor\7_files\3b24b51bf11404089c4d66acd0c612539c77e7e7
from %ProgramFiles%\printerdoctor\7_files\is-aoiymcd51x.tmp to %ProgramFiles%\printerdoctor\7_files\3ce5793e0e2ab9e3dbc03c1cb23d538c8b86f1b7
from %ProgramFiles%\printerdoctor\7_files\is-ep5j55tkal.tmp to %ProgramFiles%\printerdoctor\7_files\5419.5fab78b2.css
from %ProgramFiles%\printerdoctor\7_files\is-acbsaodq9w.tmp to %ProgramFiles%\printerdoctor\7_files\60bfd4ad01d8d9142d88c3c0b73cea36bf327ea7
from %ProgramFiles%\printerdoctor\7_files\is-ofgq60oucb.tmp to %ProgramFiles%\printerdoctor\7_files\ab676161000051742113c21548ddabe305961c28
from %ProgramFiles%\printerdoctor\7_files\is-jcv7mjzttk.tmp to %ProgramFiles%\printerdoctor\7_files\ab6761610000517421a213a4fe1a6f9b45d3f7f9
from %ProgramFiles%\printerdoctor\7_files\is-d44p6opabv.tmp to %ProgramFiles%\printerdoctor\7_files\ab6761610000517469287c3f1b150bbead642499
from %ProgramFiles%\printerdoctor\7_files\is-j6sfbeaotm.tmp to %ProgramFiles%\printerdoctor\7_files\ab6761610000517487b0c6a4811964bd1b7d701f
from %ProgramFiles%\printerdoctor\7_files\is-qv89v3weaz.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616100005174ae81417d966e209b735b1160
from %ProgramFiles%\printerdoctor\7_files\is-xn05vz2bbq.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616100005174db59e1c017a93648b119f0cc
from %ProgramFiles%\printerdoctor\7_files\is-4iwjejgsrq.tmp to %ProgramFiles%\printerdoctor\7_files\ab6761610000f178d8139dde094f1b2609aeec15
from %ProgramFiles%\printerdoctor\7_files\is-sf1hhceg1z.tmp to %ProgramFiles%\printerdoctor\7_files\ab6761610000f178eaca358712b3fe4ed9814640
from %ProgramFiles%\printerdoctor\7_files\is-vee1eapxg9.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02039b95b846d039d78a2ca6a1
from %ProgramFiles%\printerdoctor\7_files\is-ucjvwwb33v.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e0204f7d57adcdf0c2f2decf4c4
from %ProgramFiles%\printerdoctor\7_files\is-y059huqf3i.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02055b322b3efb78f1082bc799
from %ProgramFiles%\printerdoctor\7_files\is-pwdikmtr2v.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e020cb65bb81eebf25f36de2999
from %ProgramFiles%\printerdoctor\7_files\is-skc60s0q7l.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02105086205323b81177c709d4
from %ProgramFiles%\printerdoctor\7_files\is-2xolwhk09n.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e021ddafc3aa34ad883ff27418f
from %ProgramFiles%\printerdoctor\7_files\is-j768ixgyzm.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02214f0bd9dc1ed0c65ae81760
from %ProgramFiles%\printerdoctor\7_files\is-8m6ejq1jjz.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e0223cc0f0a925845a3de4aca38
from %ProgramFiles%\printerdoctor\7_files\is-attn8d77j4.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e022c1f1f4512c99b738110035a
from %ProgramFiles%\printerdoctor\7_files\is-vfwn9dcpzv.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e022c90628cf534a426e3687b47
from %ProgramFiles%\printerdoctor\7_files\is-7iovucrilc.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e0231eb25ed004dd2e9b6f35d4f
from %ProgramFiles%\printerdoctor\7_files\is-d48aap3tar.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02374f450ee0a6c2036ee01b89
from %ProgramFiles%\printerdoctor\7_files\is-6ji0p1ytkj.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e023b67e4695d120ebfe9ca359a
from %ProgramFiles%\printerdoctor\7_files\is-a4zef6zb7i.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e024117e531f63855d072059d6e
from %ProgramFiles%\printerdoctor\7_files\is-s0za67qrfa.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e025c3742c1e50f5f272c92ae59
from %ProgramFiles%\printerdoctor\7_files\is-tslg41vrbt.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e0265af8f4075f3a6b96866e611
from %ProgramFiles%\printerdoctor\7_files\is-hntrewi3lg.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02685b70d40ae9fffdcc242a0a
from %ProgramFiles%\printerdoctor\7_files\is-c8y1f9n2hj.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e026a4175046856b90a9b5d67a1
from %ProgramFiles%\printerdoctor\7_files\is-fa7idqiw4n.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02897077217561a52898209cc5
from %ProgramFiles%\printerdoctor\7_files\is-bymg761usw.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e028a2ce3f148f57584269c3782
from %ProgramFiles%\printerdoctor\7_files\is-fvk31923c1.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02907f0d0884466966d6546767
from %ProgramFiles%\printerdoctor\7_files\is-gql72poc7s.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e029435ca4eaef0847e80d04b02
from %ProgramFiles%\printerdoctor\7_files\is-9vft724xa6.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e029564dd0f283e0a16440063c7
from %ProgramFiles%\printerdoctor\7_files\is-4mmm5ddllh.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02979637dbe8b71de7c13ab5cf
from %ProgramFiles%\printerdoctor\7_files\is-f7efc3wrl4.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02992d0e6aeb59f587a1e81ac8
from %ProgramFiles%\printerdoctor\7_files\is-61hao9ajsl.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e0299e49fe1e935d3d724627211
from %ProgramFiles%\printerdoctor\7_files\is-dngxmlmmpx.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e029e6f77c2aa67cab83fb412be
from %ProgramFiles%\printerdoctor\7_files\is-6yb8iushq3.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e029e8e0df48ff95de8d014f0b1
from %ProgramFiles%\printerdoctor\7_files\is-99yqr59s5u.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e029fefaca04a80b8b221954573
from %ProgramFiles%\printerdoctor\7_files\is-8tagjudlpr.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02ae0e62cc351978ad5203fcfa
from %ProgramFiles%\printerdoctor\7_files\is-98fen9kw38.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02b7fe0714ccb2ad8c61303911
from %ProgramFiles%\printerdoctor\7_files\is-is5a52aghn.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02c02ced489483042f820ad4b0
from %ProgramFiles%\printerdoctor\7_files\is-vxmnjpsps5.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02c093f4dd308ad9c41e20eee8
from %ProgramFiles%\printerdoctor\7_files\is-2zdb3rmuc2.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02c8da7970ca45b99fb2c51777
from %ProgramFiles%\printerdoctor\7_files\is-d2w3oh57ra.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02cf491ef0ed4e0d587b571724
from %ProgramFiles%\printerdoctor\7_files\is-fx30oht1e0.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02dd64809bbf416dde80e80f99
from %ProgramFiles%\printerdoctor\7_files\is-pb50e6tjeu.tmp to %ProgramFiles%\printerdoctor\7_files\ab67616d00001e02e2829416e5011fb749cc3fde
from %ProgramFiles%\printerdoctor\7_files\is-o4eyx6vnsm.tmp to %ProgramFiles%\printerdoctor\7_files\adsct
from %ProgramFiles%\printerdoctor\7_files\is-jj0sh6utoa.tmp to %ProgramFiles%\printerdoctor\7_files\adsct(1)
from %ProgramFiles%\printerdoctor\7_files\is-vvluiy8x91.tmp to %ProgramFiles%\printerdoctor\7_files\anchor.html
from %ProgramFiles%\printerdoctor\7_files\is-hr2lxuhx8j.tmp to %ProgramFiles%\printerdoctor\7_files\c2c1b3612f38b206411173c168b912d306b5c196
from %ProgramFiles%\printerdoctor\7_files\is-r31dj37u5s.tmp to %ProgramFiles%\printerdoctor\7_files\cast_framework.js
from %ProgramFiles%\printerdoctor\7_files\is-9zcuioeo1x.tmp to %ProgramFiles%\printerdoctor\7_files\cast_sender(1).js
from %ProgramFiles%\printerdoctor\7_files\is-33ner5rjpt.tmp to %ProgramFiles%\printerdoctor\7_files\cast_sender.js
from %ProgramFiles%\printerdoctor\7_files\is-66u6fkpbgm.tmp to %ProgramFiles%\printerdoctor\7_files\dwp-feedback-bar.2f1f7eb4.css
from %ProgramFiles%\printerdoctor\7_files\is-fabr1zkx99.tmp to %ProgramFiles%\printerdoctor\7_files\dwp-now-playing-bar.88eac62f.css
from %ProgramFiles%\printerdoctor\7_files\is-j3awo4fcwh.tmp to %ProgramFiles%\printerdoctor\7_files\dwp-panel-section.db8179d5.css
from %ProgramFiles%\printerdoctor\7_files\is-14dfrrpmk3.tmp to %ProgramFiles%\printerdoctor\7_files\dwp-top-bar.2d1e7227.css
from %ProgramFiles%\printerdoctor\7_files\is-ic8beyi6hl.tmp to %ProgramFiles%\printerdoctor\7_files\dwp-video-player.a92a1bf1.css
from %ProgramFiles%\printerdoctor\7_files\is-2c8yazcjuk.tmp to %ProgramFiles%\printerdoctor\7_files\dwp-watch-feed-view-container.39b09463.css
from %ProgramFiles%\printerdoctor\7_files\is-2urkuz9dh3.tmp to %ProgramFiles%\printerdoctor\7_files\enterprise.js
from %ProgramFiles%\printerdoctor\7_files\is-c1fykny88m.tmp to %ProgramFiles%\printerdoctor\7_files\gtm.96d60fd6.js
from %ProgramFiles%\printerdoctor\7_files\is-p2p7no8d28.tmp to %ProgramFiles%\printerdoctor\7_files\heap_config.js
from %ProgramFiles%\printerdoctor\7_files\is-h6t6iiddaw.tmp to %ProgramFiles%\printerdoctor\7_files\listening-stats-modal.8c1b8d24.css
from %ProgramFiles%\printerdoctor\7_files\is-ptzrow59if.tmp to %ProgramFiles%\printerdoctor\7_files\otsdkstub.js
from %ProgramFiles%\printerdoctor\7_files\is-z2fkts96pm.tmp to %ProgramFiles%\printerdoctor\7_files\ot_company_logo.png
from %ProgramFiles%\printerdoctor\7_files\is-48c4op1wkf.tmp to %ProgramFiles%\printerdoctor\7_files\powered_by_logo.svg
from %ProgramFiles%\printerdoctor\7_files\is-sk6ddbzv75.tmp to %ProgramFiles%\printerdoctor\7_files\retargeting-pixels.02346b5d.js
from %ProgramFiles%\printerdoctor\7_files\is-qjah73aq4g.tmp to %ProgramFiles%\printerdoctor\7_files\saved_resource(1).html
from %ProgramFiles%\printerdoctor\7_files\is-yh8hrsax23.tmp to %ProgramFiles%\printerdoctor\7_files\saved_resource(2).html
from %ProgramFiles%\printerdoctor\7_files\is-bo37rm4s84.tmp to %ProgramFiles%\printerdoctor\7_files\saved_resource.html
from %ProgramFiles%\printerdoctor\7_files\is-l2g4z5h7sa.tmp to %ProgramFiles%\printerdoctor\7_files\sync.min.js
from %ProgramFiles%\printerdoctor\7_files\is-d6upsac270.tmp to %ProgramFiles%\printerdoctor\7_files\uwt.js
from %ProgramFiles%\printerdoctor\7_files\is-loqu970i1s.tmp to %ProgramFiles%\printerdoctor\7_files\xpui-root-dialogs.24c65f8c.css
from %ProgramFiles%\printerdoctor\7_files\is-7qpjc5aca5.tmp to %ProgramFiles%\printerdoctor\7_files\xpui-routes-track-v2.3643c9d7.css
from %ProgramFiles%\printerdoctor\7_files\is-8qo3jvn2oh.tmp to %ProgramFiles%\printerdoctor\7_files\xpui-routes-your-library-x.d077bf4b.css
from %ProgramFiles%\printerdoctor\is-5wc139pu4i.tmp to %ProgramFiles%\printerdoctor\shadow@2x.png

Network activity

Connects to

'do#####.##.ap-east-1.amazonaws.com':443
'ba##u.com':443

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?78##############

Other

'do#####.##.ap-east-1.amazonaws.com':443
'ba##u.com':443

UDP

DNS ASK do#####.##.ap-east-1.amazonaws.com
DNS ASK ba##u.com
DNS ASK hk.##7imx.net

Miscellaneous

Creates and executes the following

'%TEMP%\is-sliml89jtj.tmp\<File name>.tmp' /SL5="$F01BA,3581697,1006592,<Full path to file>"

Executes the following

'%WINDIR%\syswow64\msiexec.exe' /i "%ProgramFiles%\PrinterDoctor\souths.msi" /qn
'<SYSTEM32>\dism.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%'"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath '<SYSTEM32>'"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"' (with hidden window)

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial