Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\is-4176l.tmp\is-13hed.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-0lvj6.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-ms6rb.tmp
- %ProgramFiles(x86)%\imagecomparer\is-h02qf.tmp
- %ProgramFiles(x86)%\imagecomparer\is-t9d57.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-ct177.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-6cfej.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-q1g5j.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-hbrju.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-br2t0.tmp
- %ProgramFiles(x86)%\imagecomparer\ic329.exe
- %ProgramFiles(x86)%\imagecomparer\languages\is-a4a8o.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-dlqao.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-2dap0.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-1f5ld.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-3ivdm.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-ht8qd.tmp
- %ProgramFiles(x86)%\imagecomparer\imagecomparer.url
- %ProgramFiles(x86)%\imagecomparer\unins000.dat
- %ProgramFiles(x86)%\imagecomparer\languages\is-5201q.tmp
- %ProgramFiles(x86)%\imagecomparer\is-6943t.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-it41i.tmp
- %ProgramFiles(x86)%\imagecomparer\is-qet71.tmp
- %TEMP%\is-4uk70.tmp\_isetup\_regdll.tmp
- %TEMP%\is-4uk70.tmp\_isetup\_setup64.tmp
- %TEMP%\is-4uk70.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-4uk70.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\imagecomparer\is-ep3dm.tmp
- %ProgramFiles(x86)%\imagecomparer\is-e052e.tmp
- %ProgramFiles(x86)%\imagecomparer\is-dc1ad.tmp
- %ProgramFiles(x86)%\imagecomparer\is-iqqjf.tmp
- %ProgramFiles(x86)%\imagecomparer\is-ck781.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-p8hs1.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-jqi9c.tmp
- %ProgramFiles(x86)%\imagecomparer\is-epdtc.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-e4m3j.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-9rtdv.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-cu1q0.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-ieufg.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-h3np7.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-5jg0v.tmp
- %ProgramFiles(x86)%\imagecomparer\languages\is-ude8i.tmp
- %TEMP%\license.txt
Перемещает следующие файлы
- %ProgramFiles(x86)%\imagecomparer\is-ep3dm.tmp в %ProgramFiles(x86)%\imagecomparer\unins000.exe
- %ProgramFiles(x86)%\imagecomparer\languages\is-0lvj6.tmp в %ProgramFiles(x86)%\imagecomparer\languages\bulgarian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-ms6rb.tmp в %ProgramFiles(x86)%\imagecomparer\languages\ukrainian.lng
- %ProgramFiles(x86)%\imagecomparer\is-h02qf.tmp в %ProgramFiles(x86)%\imagecomparer\ichelprus.chm
- %ProgramFiles(x86)%\imagecomparer\is-t9d57.tmp в %ProgramFiles(x86)%\imagecomparer\ichelpeng.chm
- %ProgramFiles(x86)%\imagecomparer\languages\is-ct177.tmp в %ProgramFiles(x86)%\imagecomparer\languages\korean.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-6cfej.tmp в %ProgramFiles(x86)%\imagecomparer\languages\polish.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-hbrju.tmp в %ProgramFiles(x86)%\imagecomparer\languages\finnish.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-e4m3j.tmp в %ProgramFiles(x86)%\imagecomparer\languages\spanish.lng
- %ProgramFiles(x86)%\imagecomparer\is-6943t.tmp в %ProgramFiles(x86)%\imagecomparer\ichelpfin.chm
- %ProgramFiles(x86)%\imagecomparer\languages\is-br2t0.tmp в %ProgramFiles(x86)%\imagecomparer\languages\bosnian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-a4a8o.tmp в %ProgramFiles(x86)%\imagecomparer\languages\serbian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-dlqao.tmp в %ProgramFiles(x86)%\imagecomparer\languages\romanian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-2dap0.tmp в %ProgramFiles(x86)%\imagecomparer\languages\swedish.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-1f5ld.tmp в %ProgramFiles(x86)%\imagecomparer\languages\greek.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-5201q.tmp в %ProgramFiles(x86)%\imagecomparer\languages\german.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-it41i.tmp в %ProgramFiles(x86)%\imagecomparer\languages\italiano.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-ude8i.tmp в %ProgramFiles(x86)%\imagecomparer\languages\dutch.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-p8hs1.tmp в %ProgramFiles(x86)%\imagecomparer\languages\hungarian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-5jg0v.tmp в %ProgramFiles(x86)%\imagecomparer\languages\portuguese_br.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-h3np7.tmp в %ProgramFiles(x86)%\imagecomparer\languages\macedonian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-ieufg.tmp в %ProgramFiles(x86)%\imagecomparer\languages\lithuanian.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-cu1q0.tmp в %ProgramFiles(x86)%\imagecomparer\languages\czech.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-9rtdv.tmp в %ProgramFiles(x86)%\imagecomparer\languages\turkish.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-q1g5j.tmp в %ProgramFiles(x86)%\imagecomparer\languages\french.lng
- %ProgramFiles(x86)%\imagecomparer\is-epdtc.tmp в %ProgramFiles(x86)%\imagecomparer\dcrawlib.dll
- %ProgramFiles(x86)%\imagecomparer\languages\is-jqi9c.tmp в %ProgramFiles(x86)%\imagecomparer\languages\russian.lng
- %ProgramFiles(x86)%\imagecomparer\is-ck781.tmp в %ProgramFiles(x86)%\imagecomparer\fbclient.dll
- %ProgramFiles(x86)%\imagecomparer\is-qet71.tmp в %ProgramFiles(x86)%\imagecomparer\bolide.url
- %ProgramFiles(x86)%\imagecomparer\is-iqqjf.tmp в %ProgramFiles(x86)%\imagecomparer\order.url
- %ProgramFiles(x86)%\imagecomparer\is-dc1ad.tmp в %ProgramFiles(x86)%\imagecomparer\license.rtf
- %ProgramFiles(x86)%\imagecomparer\is-e052e.tmp в %ProgramFiles(x86)%\imagecomparer\ic329.exe
- %ProgramFiles(x86)%\imagecomparer\languages\is-3ivdm.tmp в %ProgramFiles(x86)%\imagecomparer\languages\chinese.lng
- %ProgramFiles(x86)%\imagecomparer\languages\is-ht8qd.tmp в %ProgramFiles(x86)%\imagecomparer\languages\danish.lng
Сетевая активность
Подключается к
- 'jo####rdmust.sbs':80
TCP
Запросы HTTP GET
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?64########
Запросы HTTP POST
- http://jo####rdmust.sbs/new/net_api
UDP
- DNS ASK jo####rdmust.sbs
Другое
Ищет следующие окна
- ClassName: 'vd4f55_IC329Class_vd4f55' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\is-4176l.tmp\is-13hed.tmp' /SL4 $11022C "<Полный путь к файлу>" 4592767 53248
- '%ProgramFiles(x86)%\imagecomparer\ic329.exe'
- '%ProgramFiles(x86)%\imagecomparer\ic329.exe' e787bece12d07bc53fdfafbada0d9023
Запускает на исполнение
- '%WINDIR%\syswow64\net.exe' helpmsg 23
- '%WINDIR%\syswow64\net1.exe' helpmsg 23
- '%WINDIR%\syswow64\net.exe' pause ImageComparer329
- '%WINDIR%\syswow64\net1.exe' pause ImageComparer329
