Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\is-486in.tmp\is-gp139.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-sqc1a.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-p7jg8.tmp
- %ProgramFiles(x86)%\imagecomparer\is-9qia7.tmp
- %ProgramFiles(x86)%\imagecomparer\is-64job.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-q37s5.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-rvl1h.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-qo9nj.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-1bne5.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-l9aoq.tmp
- %ProgramFiles(x86)%\imagecomparer\ic330.exe
- %ProgramFiles(x86)%\imagecomparer\languages\is-msmj1.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-pcoqc.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-plfk8.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-io3vs.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-natda.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-d06gm.tmp
- %ProgramFiles(x86)%\imagecomparer\imagecomparer.url
- %ProgramFiles(x86)%\imagecomparer\unins000.dat
- %ProgramFiles(x86)%\imagecomparer\languages\is-mi296.tmp
- %ProgramFiles(x86)%\imagecomparer\is-km387.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-9jce6.tmp
- %ProgramFiles(x86)%\imagecomparer\is-0d8ei.tmp
- %TEMP%\is-kbrms.tmp\_isetup\_regdll.tmp
- %TEMP%\is-kbrms.tmp\_isetup\_setup64.tmp
- %TEMP%\is-kbrms.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-kbrms.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\imagecomparer\is-u8s8b.tmp
- %ProgramFiles(x86)%\imagecomparer\is-q69vt.tmp
- %ProgramFiles(x86)%\imagecomparer\is-8vdmu.tmp
- %ProgramFiles(x86)%\imagecomparer\is-n43ga.tmp
- %ProgramFiles(x86)%\imagecomparer\is-6r120.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-a8nst.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-v43gf.tmp
- %ProgramFiles(x86)%\imagecomparer\is-prsr1.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-ph4r4.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-263jo.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-k4n87.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-mc2co.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-mueqo.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-4tskt.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-hgmv8.tmp
- %TEMP%\license.txt
Перемещает следующие файлы
- %ProgramFiles(x86)%\imagecomparer\is-u8s8b.tmp в %ProgramFiles(x86)%\imagecomparer\unins000.exe
- %ProgramFiles(x86)%\imagecomparer\languages\is-sqc1a.tmp в %ProgramFiles(x86)%\imagecomparer\languages\bulgarian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-p7jg8.tmp в %ProgramFiles(x86)%\imagecomparer\languages\ukrainian.lng
- %ProgramFiles(x86)%\imagecomparer\is-9qia7.tmp в %ProgramFiles(x86)%\imagecomparer\ichelprus.chm
- %ProgramFiles(x86)%\imagecomparer\is-64job.tmp в %ProgramFiles(x86)%\imagecomparer\ichelpeng.chm
- %ProgramFiles(x86)%\imagecomparer\languages\is-q37s5.tmp в %ProgramFiles(x86)%\imagecomparer\languages\korean.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-rvl1h.tmp в %ProgramFiles(x86)%\imagecomparer\languages\polish.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-1bne5.tmp в %ProgramFiles(x86)%\imagecomparer\languages\finnish.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-ph4r4.tmp в %ProgramFiles(x86)%\imagecomparer\languages\spanish.lng
- %ProgramFiles(x86)%\imagecomparer\is-km387.tmp в %ProgramFiles(x86)%\imagecomparer\ichelpfin.chm
- %ProgramFiles(x86)%\imagecomparer\languages\is-l9aoq.tmp в %ProgramFiles(x86)%\imagecomparer\languages\bosnian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-msmj1.tmp в %ProgramFiles(x86)%\imagecomparer\languages\serbian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-pcoqc.tmp в %ProgramFiles(x86)%\imagecomparer\languages\romanian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-plfk8.tmp в %ProgramFiles(x86)%\imagecomparer\languages\swedish.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-io3vs.tmp в %ProgramFiles(x86)%\imagecomparer\languages\greek.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-mi296.tmp в %ProgramFiles(x86)%\imagecomparer\languages\german.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-9jce6.tmp в %ProgramFiles(x86)%\imagecomparer\languages\italiano.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-hgmv8.tmp в %ProgramFiles(x86)%\imagecomparer\languages\dutch.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-a8nst.tmp в %ProgramFiles(x86)%\imagecomparer\languages\hungarian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-4tskt.tmp в %ProgramFiles(x86)%\imagecomparer\languages\portuguese_br.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-mueqo.tmp в %ProgramFiles(x86)%\imagecomparer\languages\macedonian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-mc2co.tmp в %ProgramFiles(x86)%\imagecomparer\languages\lithuanian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-k4n87.tmp в %ProgramFiles(x86)%\imagecomparer\languages\czech.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-263jo.tmp в %ProgramFiles(x86)%\imagecomparer\languages\turkish.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-qo9nj.tmp в %ProgramFiles(x86)%\imagecomparer\languages\french.lng
- %ProgramFiles(x86)%\imagecomparer\is-prsr1.tmp в %ProgramFiles(x86)%\imagecomparer\dcrawlib.dll
- %ProgramFiles(x86)%\imagecomparer\languages\is-v43gf.tmp в %ProgramFiles(x86)%\imagecomparer\languages\russian.lng
- %ProgramFiles(x86)%\imagecomparer\is-6r120.tmp в %ProgramFiles(x86)%\imagecomparer\fbclient.dll
- %ProgramFiles(x86)%\imagecomparer\is-0d8ei.tmp в %ProgramFiles(x86)%\imagecomparer\bolide.url
- %ProgramFiles(x86)%\imagecomparer\is-n43ga.tmp в %ProgramFiles(x86)%\imagecomparer\order.url
- %ProgramFiles(x86)%\imagecomparer\is-8vdmu.tmp в %ProgramFiles(x86)%\imagecomparer\license.rtf
- %ProgramFiles(x86)%\imagecomparer\is-q69vt.tmp в %ProgramFiles(x86)%\imagecomparer\ic330.exe
- %ProgramFiles(x86)%\imagecomparer\languages\is-natda.tmp в %ProgramFiles(x86)%\imagecomparer\languages\chinese.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-d06gm.tmp в %ProgramFiles(x86)%\imagecomparer\languages\danish.lng
Сетевая активность
Подключается к
- 'jo####rdmust.sbs':80
TCP
Запросы HTTP GET
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?64########
Запросы HTTP POST
- http://jo####rdmust.sbs/new/net_api
UDP
- DNS ASK jo####rdmust.sbs
Другое
Ищет следующие окна
- ClassName: 'zd1759_IC330Class_zd1759' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\is-486in.tmp\is-gp139.tmp' /SL4 $C013E "<Полный путь к файлу>" 4576883 52736
- '%ProgramFiles(x86)%\imagecomparer\ic330.exe'
- '%ProgramFiles(x86)%\imagecomparer\ic330.exe' 6ace64c7930744675e48a69696e198b5
Запускает на исполнение
- '%WINDIR%\syswow64\net.exe' helpmsg 24
- '%WINDIR%\syswow64\net1.exe' helpmsg 24
- '%WINDIR%\syswow64\net.exe' pause ImageComparer330
- '%WINDIR%\syswow64\net1.exe' pause ImageComparer330
