Trojan.DownLoader36.61733

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'aisino_qd_yshs_server' = '"%ProgramFiles(x86)%\Tax Service\ctibls_deamon.exe" auto_start'
[<HKLM>\Software\Classes\fwkplocalsvrctibls\shell\open\command] '' = '%ProgramFiles(x86)%\Tax Service\ctibls.exe %1'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'SocialInvoice' = '"%ProgramFiles(x86)%\Aisino\TaxCloud\MainExecuteS.exe"'
[<HKLM>\Software\Classes\AisinoPrinter\shell\open\command] '' = '"%ProgramFiles(x86)%\·¢Æ±´òÓ¡\Bin\Aisino.Printer.exe" "%1"'

Modifies file system

Creates the following files

<Current directory>\setup.exe
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\aisino.fwkp.commonlibrary.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\aisino.fwkp.businessobject.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\aisino.framework.qrcode.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\aisino.framework.plugin.core.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\aisino.framework.pdf417code.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\aisino.printer.autoupdate.exe
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\aisino.framework.mainform.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\aisino.ftaxbase.dll
%TEMP%\nsy6fd3.tmp\io.ini
%TEMP%\nsy6fd3.tmp\system.dll
%TEMP%\nsy6fd3.tmp\findprocdll.dll
%ProgramFiles(x86)%\tax service\fp_print_v2.0.200609.exe
%ProgramFiles(x86)%\aisino\taxcloud\log\aisino.log
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\aisino.framework.dao.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\system.data.sqlite.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\aisino.printer.exe
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\printer.xml.bak
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\printer.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\npgsql.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\newtonsoft.json.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\npoi.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\mono.security.dll
%ProgramFiles(x86)%\aisino\taxcloud\uninst.exe
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\aisino.fwkp.print.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\icsharpcode.sharpziplib.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\com.aisino.printer.tlb
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\com.aisino.printer.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\clientlib.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\bsdc.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\ashsencode.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\keycertscom.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\aisino.printer.exe.config
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\makehashcode.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\sqlite.interop.dll
%ProgramFiles(x86)%\aisino\taxcloud\ysbase01.dll
%ProgramFiles(x86)%\aisino\taxcloud\imgdecoder-png.dll
%ProgramFiles(x86)%\aisino\taxcloud\libcrypto-1_1.dll
%ProgramFiles(x86)%\aisino\taxcloud\libcurl.dll
%ProgramFiles(x86)%\aisino\taxcloud\libeay32.dll
%ProgramFiles(x86)%\aisino\taxcloud\libssl-1_1.dll
%ProgramFiles(x86)%\aisino\taxcloud\log4cxx.dll
%ProgramFiles(x86)%\aisino\taxcloud\msvcm80.dll
%ProgramFiles(x86)%\aisino\taxcloud\msvcm90.dll
%ProgramFiles(x86)%\aisino\taxcloud\msvcp120.dll
%ProgramFiles(x86)%\aisino\taxcloud\msvcp140.dll
%ProgramFiles(x86)%\aisino\taxcloud\msvcp80.dll
%ProgramFiles(x86)%\aisino\taxcloud\msvcp90.dll
%ProgramFiles(x86)%\aisino\taxcloud\msvcr100.dll
%ProgramFiles(x86)%\aisino\taxcloud\msvcr120.dll
%ProgramFiles(x86)%\aisino\taxcloud\msvcr80.dll
%ProgramFiles(x86)%\aisino\taxcloud\vcruntime140.dll
%ProgramFiles(x86)%\aisino\taxcloud\soui-sys-resource.dll
%ProgramFiles(x86)%\aisino\taxcloud\soui.dll
%ProgramFiles(x86)%\aisino\taxcloud\vccorlib120.dll
%ProgramFiles(x86)%\aisino\taxcloud\utilities.dll
%ProgramFiles(x86)%\aisino\taxcloud\ucrtbase.dll
%ProgramFiles(x86)%\aisino\taxcloud\trust.txt
%ProgramFiles(x86)%\aisino\taxcloud\ssleay32.dll
%ProgramFiles(x86)%\aisino\taxcloud\zlibwapi.dll
%ProgramFiles(x86)%\aisino\taxcloud\ysbase02.dll
%ProgramFiles(x86)%\aisino\taxcloud\getparentpid.dll
%ProgramFiles(x86)%\aisino\taxcloud\sangfor.dll
%ProgramFiles(x86)%\aisino\taxcloud\render-gdi.dll
%ProgramFiles(x86)%\aisino\taxcloud\regasm.exe.config
%ProgramFiles(x86)%\aisino\taxcloud\msvcrt.dll
%ProgramFiles(x86)%\aisino\taxcloud\msvcr90.dll
%ProgramFiles(x86)%\aisino\taxcloud\shhpt.cait
%ProgramFiles(x86)%\aisino\taxcloud\microsoft.vc90.crt.manifest
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\toolforprint.exe.config
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\cgssbb.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\jdcfp_new.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\jdcfp108.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\hyyqhpxxb.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\hyhpxxb.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\hwysyfp108.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\ptfp108.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\hwysyfp.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\fpxf.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\escfp.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\dkzyfp84.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\dkzyfp108.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\dkptfp84.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\dkptfp108.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\hpsqd.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\cc3268.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\ptfp84.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\uninst.exe
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\uninstall.dat
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\zyyqhpxxb.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\zyhpxxb.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\zyfphxm.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\yn76mmx177mmv.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\zyfp84.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\jdcfp_old.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\qdtd.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\qdqd.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\qdfwtd.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\qdfwqd.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\ptfphxm.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\zyfp108.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\yn76mmx177mmh.xml
%APPDATA%\microsoft\windows\start menu\programs\В·ВўГ¦В±ВґГІГіВЎ\В·ВўГ¦В±ВґГІГіВЎ.lnk
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\yn76mmx127mmv.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\yn76mmx127mmh.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\defaultprintermanager.xml
%ProgramFiles(x86)%\aisino\taxcloud\decodecert.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\fonts\ocraext.ttf
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\libeay32.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\log4net.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\msvcr71.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\regasm.exe
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\hlj76mmx177mmv.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\regasm.exe.config
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\fonts\cour.ttf
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\hlj76mmx177mmh.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\fonts\courbd.ttf
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\fonts\courbi.ttf
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\fonts\couri.ttf
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\bj76mmx177mmh.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\common\log.cfg
%ProgramFiles(x86)%\aisino\taxcloud\imgdecoder-gdip.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\new57mmx127mmv.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\new76mmx152mmh.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\new76mmx152mmv.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\sh76mmx177mmh.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\printermanager.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\printconfig.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\new76mmx177mmv.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\new76mmx177mmh.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\sh76mmx177mmv.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\new57mmx127mmh.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\bj76mmx177mmv.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\new76mmx127mmh.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\new57mmx177mmv.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\new57mmx177mmh.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\new57mmx152mmv.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\new57mmx152mmh.xml
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\new76mmx127mmv.xml
%ProgramFiles(x86)%\aisino\taxcloud\cryp_api.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-utility-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-time-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-synch-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-synch-l1-2-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-sysinfo-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-timezone-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-util-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-crt-conio-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-crt-convert-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-crt-environment-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-crt-filesystem-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-crt-heap-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-crt-locale-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-crt-math-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-crt-multibyte-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-crt-private-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-crt-process-l1-1-0.dll
%ProgramFiles(x86)%\tax service\vcruntime140.dll
%ProgramFiles(x86)%\tax service\msvcm90.dll
%ProgramFiles(x86)%\tax service\msvcp100.dll
%ProgramFiles(x86)%\tax service\ucrtbase.dll
%ProgramFiles(x86)%\tax service\msvcr90.dll
%ProgramFiles(x86)%\tax service\msvcr100.dll
%ProgramFiles(x86)%\tax service\msvcp90.dll
%ProgramFiles(x86)%\tax service\msvcp140.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-string-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-profile-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-processthreads-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-crt-utility-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-crt-time-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-crt-string-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-crt-stdio-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-crt-runtime-l1-1-0.dll
%ProgramFiles(x86)%\tax service\mfc140u.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-processthreads-l1-1-1.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-processenvironment-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-file-l2-1-0.dll
%ProgramFiles(x86)%\tax service\dll_activex.dll
%TEMP%\nsx5734.tmp
%TEMP%\nsx5735.tmp\killprocdll.dll
%ProgramFiles(x86)%\tax service\ctibls_deamon.exe
%ProgramFiles(x86)%\tax service\ctibls.exe
%ProgramFiles(x86)%\tax service\floatbtn.exe
%ProgramFiles(x86)%\tax service\qdys0001.pfx
%ProgramFiles(x86)%\tax service\dll_activex_operation.exe
%ProgramFiles(x86)%\tax service\readareacode.dll
%ProgramFiles(x86)%\tax service\libcrypto-1_1.dll
%ProgramFiles(x86)%\tax service\libcurl.dll
%ProgramFiles(x86)%\tax service\libssl-1_1.dll
%ProgramFiles(x86)%\tax service\nihility.dll
%ProgramFiles(x86)%\tax service\sofc.dll
%ProgramFiles(x86)%\tax service\ldkpdll.dll
%APPDATA%\microsoft\windows\start menu\programs\В·ВўГ¦В±ВґГІГіВЎ\Г°В¶ГґГё.lnk
%ProgramFiles(x86)%\tax service\lddll.ini
%ProgramFiles(x86)%\tax service\api-ms-win-core-console-l1-1-0.dll
%ProgramFiles(x86)%\tax service\xml.db
%ProgramFiles(x86)%\tax service\api-ms-win-core-namedpipe-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-memory-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-localization-l1-2-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-libraryloader-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-interlocked-l1-1-0.dll
%ProgramFiles(x86)%\tax service\microsoft.vc90.crt.manifest
%ProgramFiles(x86)%\tax service\api-ms-win-core-heap-l1-1-0.dll
%ProgramFiles(x86)%\tax service\jsdiskdll.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-file-l1-2-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-file-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-errorhandling-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-debug-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-datetime-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-handle-l1-1-0.dll
%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\config\print\yqsqd.xml
%ProgramFiles(x86)%\tax service\favicon_link_64.ico
%ProgramFiles(x86)%\aisino\taxcloud\autoupdateextra.exe
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-processthreads-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-processenvironment-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-namedpipe-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-memory-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-rtlsupport-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-localization-l1-2-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-interlocked-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-heap-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-handle-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-file-l2-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-file-l1-2-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-file-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-libraryloader-l1-1-0.dll
%ProgramFiles(x86)%\tax service\api-ms-win-core-rtlsupport-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-string-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-string-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-filesystem-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-heap-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-stdio-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-runtime-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-multibyte-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-math-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-locale-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-processthreads-l1-1-1.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-errorhandling-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-synch-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-convert-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-util-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-timezone-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-sysinfo-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-synch-l1-2-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-environment-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-profile-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-debug-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-datetime-l1-1-0.dll
%ProgramFiles(x86)%\tax service\trust.txt
%ProgramFiles(x86)%\tax service\taxcloudsetup_1.7.5.0.exe
%APPDATA%\microsoft\windows\start menu\programs\ГґГ¦Г«В°В»Г»Г©Г¬\ГґГ¦Г«В°В»Г»Г©Г¬В·ГѕГ®Г±.lnk
%APPDATA%\microsoft\windows\start menu\programs\ГґГ¦Г«В°В»Г»Г©Г¬\ГґГ¦Г«В°В»Г»Г©Г¬ГГёГµВѕ.lnk
%ProgramFiles(x86)%\tax service\uninst.exe
%APPDATA%\microsoft\windows\start menu\programs\ГґГ¦Г«В°В»Г»Г©Г¬\ГґГ¦Г«В°В»Г»Г©Г¬Г°В¶ГґГё.lnk
%ProgramFiles(x86)%\aisino\taxcloud\jsdevinfodll.dll
%ProgramFiles(x86)%\tax service\log\20210301.txt
%TEMP%\nsd4b2.tmp\system.dll
%ProgramFiles(x86)%\aisino\taxcloud\gm_x86.dll
%TEMP%\nsd4b2.tmp\killprocdll.dll
%TEMP%\nsd4b2.tmp\killer.dll
%ProgramFiles(x86)%\aisino\taxcloud\autoupdate.exe
%ProgramFiles(x86)%\aisino\taxcloud\autoupdate.exe.config
%HOMEPATH%\desktop\云税慧商.lnk
%ProgramFiles(x86)%\tax service\ГґГ¦Г«В°Г¦В±В№ГјВјГІ.cer
%ProgramFiles(x86)%\aisino\taxcloud\logctrl.cfg
%ProgramFiles(x86)%\aisino\taxcloud\mainexecutes.exe
%ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-console-l1-1-0.dll
%ProgramFiles(x86)%\aisino\taxcloud\localcryptapidll.dll
%ProgramFiles(x86)%\aisino\taxcloud\taxukeybase.dll
%ProgramFiles(x86)%\aisino\taxcloud\sm2clt.dll
%ProgramFiles(x86)%\aisino\taxcloud\sofc.dll
%ProgramFiles(x86)%\aisino\taxcloud\regasm.exe
%ProgramFiles(x86)%\aisino\taxcloud\mainexecutem.exe
%ProgramFiles(x86)%\aisino\taxcloud\pcomserver.dll
%ProgramFiles(x86)%\aisino\taxcloud\nisec_ukeyc.dll
%ProgramFiles(x86)%\aisino\taxcloud\gmty.dll
%ProgramFiles(x86)%\aisino\taxcloud\microsoft.vc80.crt.manifest
%ProgramFiles(x86)%\aisino\taxcloud\microsoft.vc80.crt.cat
%ProgramFiles(x86)%\aisino\taxcloud\mainexecutex.exe
%ProgramFiles(x86)%\aisino\taxcloud\mainexecutet.exe
%ProgramFiles(x86)%\aisino\taxcloud\net_util.dll
%HOMEPATH%\desktop\В·ВўГ¦В±ВґГІГіВЎ.lnk

Deletes the following files

%TEMP%\nsx5735.tmp\killprocdll.dll
%TEMP%\nsd4b2.tmp\killer.dll
%TEMP%\nsd4b2.tmp\killprocdll.dll
%TEMP%\nsd4b2.tmp\system.dll
%TEMP%\nsy6fd3.tmp\findprocdll.dll
%TEMP%\nsy6fd3.tmp\io.ini
%TEMP%\nsy6fd3.tmp\system.dll

Network activity

Connects to

'91###cloud.com':80
'91###cloud.com':443
'localhost':49178
'ta#.#1fapiao.cn':443

TCP

'91###cloud.com':443
'localhost':49178
'localhost':49179
'ta#.#1fapiao.cn':443

UDP

DNS ASK 91###cloud.com
DNS ASK ta#.#1fapiao.cn

Miscellaneous

Creates and executes the following

'<Current directory>\setup.exe'
'%ProgramFiles(x86)%\tax service\ctibls_deamon.exe' -yshs_install
'%ProgramFiles(x86)%\tax service\ctibls.exe' -deamon_start
'%ProgramFiles(x86)%\tax service\taxcloudsetup_1.7.5.0.exe'
'%ProgramFiles(x86)%\aisino\taxcloud\mainexecutes.exe'
'%ProgramFiles(x86)%\tax service\fp_print_v2.0.200609.exe' /S
'%ProgramFiles(x86)%\В·ВўГ¦В±ВґГІГіВЎ\bin\regasm.exe' "%ProgramFiles(x86)%\В·ВўГ†В±ВґГІГ“ВЎ\Bin\Com.Aisino.Printer.dll" /codebase /silent

Executes the following

'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%ProgramFiles(x86)%\tax service\...
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%ProgramFiles(x86)%\aisino\taxcl...

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней