Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\is-98fla.tmp\<Имя файла>.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-caqie.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-ahcqd.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-05k3f.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-6ksn1.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-p24o1.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-vg5pc.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-clfdc.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-l0tjj.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-845n0.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-04qtm.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-3p2tv.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-4i797.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-6btgv.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-qilc1.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-ofvoi.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-mprhi.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-01lhq.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-d4b36.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-gk0bb.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-3vta0.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-h87vg.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-a3dha.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-gmeke.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-kpolt.tmp
- %TEMP%\is-rt1i7.tmp\_isetup\_setup64.tmp
- %TEMP%\is-rt1i7.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-rt1i7.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-rt1i7.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-ho6er.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-77ll4.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-tqr8r.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-ojvgm.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-gt5i3.tmp
- %TEMP%\is-rt1i7.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-l6vsb.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-9uv2r.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-7oj7r.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-31jg4.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-9i65q.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\languages\is-2b2fe.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\languages\is-7aihs.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\data\is-6hnp8.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\data\is-6926c.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\skins\is-jffh8.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-kenvs.tmp
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\unins000.dat
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\duplicatefilefinder.exe
Перемещает следующие файлы
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-ho6er.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\unins000.exe
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-05k3f.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\rate.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-6ksn1.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\support.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-p24o1.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\update.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-vg5pc.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\vkontakte.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-clfdc.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\about.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-l0tjj.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\bug.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-caqie.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\mail.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-ahcqd.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\product.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-3p2tv.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\contact.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-4i797.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\home.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-6btgv.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\product.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-qilc1.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\rate.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-ofvoi.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\support.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-mprhi.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\twitter.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-01lhq.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\update.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-3vta0.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\facebook.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\is-h87vg.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\en\feedback.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-04qtm.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\home.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-845n0.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\feedback.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-a3dha.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\contact.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-tqr8r.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\vcl70.bpl
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-ojvgm.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\loc.dll
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-gt5i3.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\sys.dll
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-l6vsb.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\doc.dll
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-kenvs.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\xml.dll
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-9uv2r.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\click.dll
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-7oj7r.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\duplicatefilefinder.dll
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-77ll4.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\rtl70.bpl
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-31jg4.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\borlndmm.dll
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\languages\is-2b2fe.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\languages\1033.lng
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\languages\is-7aihs.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\languages\1049.lng
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\data\is-6hnp8.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\data\config.ini
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\data\is-6926c.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\data\logo.png
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\skins\is-jffh8.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\skins\wlm.asz
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-kpolt.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\about.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\is-gmeke.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\help\ru\bug.url
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-9i65q.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\fastmm_fulldebugmode.dll
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-d4b36.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\turbosearch.exe
- %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\is-gk0bb.tmp в %ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\duplicatefilefinder.exe
Сетевая активность
Подключается к
- 'tr####tolisames.ml':80
TCP
Запросы HTTP POST
- http://tr####tolisames.ml/new/net_api
Другие
- '34.##0.144.191':443
- '34.##7.121.53':443
UDP
- DNS ASK tr####tolisames.ml
Другое
Ищет следующие окна
- ClassName: '{fafb15c8-9a36-4b65-9fc6-45fb191cf62f}' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\is-98fla.tmp\<Имя файла>.tmp' /SL5="$E0242,7932022,53760,<Полный путь к файлу>"
- '%ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\duplicatefilefinder.exe'
- '%ProgramFiles(x86)%\hinvo\hinvo duplicate file finder\duplicatefilefinder.exe' b6b6cbbf32f76c50bca643b8f1de09d3
Запускает на исполнение
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "dff125"
