Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\is-77lc0.tmp\is-r8fpe.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-esb5q.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-e7v2h.tmp
- %ProgramFiles(x86)%\imagecomparer\is-00jga.tmp
- %ProgramFiles(x86)%\imagecomparer\is-kqmci.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-gmsdv.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-f0oq7.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-sg5hq.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-al7b0.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-0cghk.tmp
- %ProgramFiles(x86)%\imagecomparer\ic327.exe
- %ProgramFiles(x86)%\imagecomparer\languages\is-4sk1q.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-f7721.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-allfd.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-qhiff.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-h4k23.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-d3mqd.tmp
- %ProgramFiles(x86)%\imagecomparer\imagecomparer.url
- %ProgramFiles(x86)%\imagecomparer\unins000.dat
- %ProgramFiles(x86)%\imagecomparer\languages\is-7i7hu.tmp
- %ProgramFiles(x86)%\imagecomparer\is-0i2p8.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-t4cvj.tmp
- %ProgramFiles(x86)%\imagecomparer\is-84d4g.tmp
- %TEMP%\is-3tujb.tmp\_isetup\_regdll.tmp
- %TEMP%\is-3tujb.tmp\_isetup\_setup64.tmp
- %TEMP%\is-3tujb.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-3tujb.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\imagecomparer\is-dljtb.tmp
- %ProgramFiles(x86)%\imagecomparer\is-b06am.tmp
- %ProgramFiles(x86)%\imagecomparer\is-jthll.tmp
- %ProgramFiles(x86)%\imagecomparer\is-baulo.tmp
- %ProgramFiles(x86)%\imagecomparer\is-ua0lg.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-8h0t2.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-il2eo.tmp
- %ProgramFiles(x86)%\imagecomparer\is-s3k25.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-ftvde.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-bc0p5.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-u0qjv.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-1q2r8.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-hnn5s.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-7msqc.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-jf4np.tmp
- %TEMP%\license.txt
Перемещает следующие файлы
- %ProgramFiles(x86)%\imagecomparer\is-dljtb.tmp в %ProgramFiles(x86)%\imagecomparer\unins000.exe
- %ProgramFiles(x86)%\imagecomparer\languages\is-esb5q.tmp в %ProgramFiles(x86)%\imagecomparer\languages\bulgarian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-e7v2h.tmp в %ProgramFiles(x86)%\imagecomparer\languages\ukrainian.lng
- %ProgramFiles(x86)%\imagecomparer\is-00jga.tmp в %ProgramFiles(x86)%\imagecomparer\ichelprus.chm
- %ProgramFiles(x86)%\imagecomparer\is-kqmci.tmp в %ProgramFiles(x86)%\imagecomparer\ichelpeng.chm
- %ProgramFiles(x86)%\imagecomparer\languages\is-gmsdv.tmp в %ProgramFiles(x86)%\imagecomparer\languages\korean.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-f0oq7.tmp в %ProgramFiles(x86)%\imagecomparer\languages\polish.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-al7b0.tmp в %ProgramFiles(x86)%\imagecomparer\languages\finnish.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-ftvde.tmp в %ProgramFiles(x86)%\imagecomparer\languages\spanish.lng
- %ProgramFiles(x86)%\imagecomparer\is-0i2p8.tmp в %ProgramFiles(x86)%\imagecomparer\ichelpfin.chm
- %ProgramFiles(x86)%\imagecomparer\languages\is-0cghk.tmp в %ProgramFiles(x86)%\imagecomparer\languages\bosnian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-4sk1q.tmp в %ProgramFiles(x86)%\imagecomparer\languages\serbian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-f7721.tmp в %ProgramFiles(x86)%\imagecomparer\languages\romanian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-allfd.tmp в %ProgramFiles(x86)%\imagecomparer\languages\swedish.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-qhiff.tmp в %ProgramFiles(x86)%\imagecomparer\languages\greek.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-7i7hu.tmp в %ProgramFiles(x86)%\imagecomparer\languages\german.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-t4cvj.tmp в %ProgramFiles(x86)%\imagecomparer\languages\italiano.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-jf4np.tmp в %ProgramFiles(x86)%\imagecomparer\languages\dutch.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-8h0t2.tmp в %ProgramFiles(x86)%\imagecomparer\languages\hungarian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-7msqc.tmp в %ProgramFiles(x86)%\imagecomparer\languages\portuguese_br.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-hnn5s.tmp в %ProgramFiles(x86)%\imagecomparer\languages\macedonian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-1q2r8.tmp в %ProgramFiles(x86)%\imagecomparer\languages\lithuanian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-u0qjv.tmp в %ProgramFiles(x86)%\imagecomparer\languages\czech.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-bc0p5.tmp в %ProgramFiles(x86)%\imagecomparer\languages\turkish.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-sg5hq.tmp в %ProgramFiles(x86)%\imagecomparer\languages\french.lng
- %ProgramFiles(x86)%\imagecomparer\is-s3k25.tmp в %ProgramFiles(x86)%\imagecomparer\dcrawlib.dll
- %ProgramFiles(x86)%\imagecomparer\languages\is-il2eo.tmp в %ProgramFiles(x86)%\imagecomparer\languages\russian.lng
- %ProgramFiles(x86)%\imagecomparer\is-ua0lg.tmp в %ProgramFiles(x86)%\imagecomparer\fbclient.dll
- %ProgramFiles(x86)%\imagecomparer\is-84d4g.tmp в %ProgramFiles(x86)%\imagecomparer\bolide.url
- %ProgramFiles(x86)%\imagecomparer\is-baulo.tmp в %ProgramFiles(x86)%\imagecomparer\order.url
- %ProgramFiles(x86)%\imagecomparer\is-jthll.tmp в %ProgramFiles(x86)%\imagecomparer\license.rtf
- %ProgramFiles(x86)%\imagecomparer\is-b06am.tmp в %ProgramFiles(x86)%\imagecomparer\ic327.exe
- %ProgramFiles(x86)%\imagecomparer\languages\is-h4k23.tmp в %ProgramFiles(x86)%\imagecomparer\languages\chinese.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-d3mqd.tmp в %ProgramFiles(x86)%\imagecomparer\languages\danish.lng
Сетевая активность
Подключается к
- 'jo####rdmust.sbs':80
TCP
Запросы HTTP GET
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?64########
Запросы HTTP POST
- http://jo####rdmust.sbs/new/net_api
UDP
- DNS ASK jo####rdmust.sbs
Другое
Ищет следующие окна
- ClassName: 'zf3059_IC326Class_zf3059' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\is-77lc0.tmp\is-r8fpe.tmp' /SL4 $A022E "<Полный путь к файлу>" 4588560 51200
- '%ProgramFiles(x86)%\imagecomparer\ic327.exe'
- '%ProgramFiles(x86)%\imagecomparer\ic327.exe' 44afe6d70a9dc94851df02280b0f6a4f
Запускает на исполнение
- '%WINDIR%\syswow64\net.exe' helpmsg 21
- '%WINDIR%\syswow64\net1.exe' helpmsg 21
- '%WINDIR%\syswow64\net.exe' pause ImageComparer327
- '%WINDIR%\syswow64\net1.exe' pause ImageComparer327
