Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\is-64jp8.tmp\<Имя файла>.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-raibi.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-fc1dp.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-947h1.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-chjqk.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-5ru8p.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-sqr6t.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-tcvhm.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-gpvcq.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-0tvsh.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-83pep.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-5kadf.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-p2tmn.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-44or9.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-18e1c.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-0m3c4.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-unev2.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-bklg2.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-0gt08.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-r2g7p.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-lo8dc.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-jaafn.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-ngmtb.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-3p26b.tmp
- %TEMP%\is-lcct6.tmp\_isetup\_setup64.tmp
- %TEMP%\is-lcct6.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-lcct6.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-lcct6.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-ets3m.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-8uija.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-s7vdm.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-v8leu.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\unins000.dat
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-539rr.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-29p7a.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-3kbjr.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-e4gqv.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\languages\is-u025r.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\languages\is-8el0f.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\data\is-8s7qo.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\data\is-5kl8d.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\skins\is-o7d00.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-urim6.tmp
- %TEMP%\is-lcct6.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-afces.tmp
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\duplicatefilefinder.exe
Перемещает следующие файлы
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-ets3m.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\unins000.exe
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-947h1.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\support.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-chjqk.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\update.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-5ru8p.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\vkontakte.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-sqr6t.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\about.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-tcvhm.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\bug.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-gpvcq.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\contact.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\languages\is-u025r.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\languages\1033.lng
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-83pep.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\facebook.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-5kadf.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\home.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-p2tmn.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\product.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-44or9.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\rate.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-18e1c.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\support.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-0m3c4.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\twitter.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-unev2.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\update.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-raibi.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\product.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-fc1dp.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\rate.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-lo8dc.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\mail.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-r2g7p.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\home.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-jaafn.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\feedback.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-s7vdm.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\sys.dll
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-v8leu.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\doc.dll
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-29p7a.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\xml.dll
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-0tvsh.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\click.dll
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-afces.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\duplicatefilefinder.dll
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-3kbjr.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\borlndmm.dll
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-bklg2.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\turbosearch.exe
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\is-539rr.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\en\feedback.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-e4gqv.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\fastmm_fulldebugmode.dll
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\data\is-8s7qo.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\data\config.ini
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\data\is-5kl8d.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\data\logo.png
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\skins\is-o7d00.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\skins\wlm.asz
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-urim6.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\about.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-3p26b.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\bug.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\is-ngmtb.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\help\ru\contact.url
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-8uija.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\loc.dll
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\languages\is-8el0f.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\languages\1049.lng
- %ProgramFiles(x86)%\minvo\minvo duplicate file finder\is-0gt08.tmp в %ProgramFiles(x86)%\minvo\minvo duplicate file finder\duplicatefilefinder.exe
Сетевая активность
Подключается к
- 'tr####tolisames.ml':80
TCP
Запросы HTTP POST
- http://tr####tolisames.ml/new/net_api
UDP
- DNS ASK tr####tolisames.ml
Другое
Ищет следующие окна
- ClassName: '{5a98241fca3b6b969165c1bf4f54c26f}' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\is-64jp8.tmp\<Имя файла>.tmp' /SL5="$F010C,6936419,162816,<Полный путь к файлу>"
- '%ProgramFiles(x86)%\minvo\minvo duplicate file finder\duplicatefilefinder.exe'
- '%ProgramFiles(x86)%\minvo\minvo duplicate file finder\duplicatefilefinder.exe' 266e8b5da0f0bc00ef223d59cc9bdb3a
Запускает на исполнение
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "dff129"
