Техническая информация
Вредоносные функции
Внедряет код в
следующие пользовательские процессы:
- app.exe
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\is-cjq4cc6ykw.tmp\<Имя файла>.tmp
- %TEMP%\is-jwzq7x7iz5.tmp\_isetup\_setup64.tmp
- %TEMP%\is-jwzq7x7iz5.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-b7ey8unepa.tmp\<Имя файла>.tmp
- %TEMP%\is-ia03j0g6pf.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ia03j0g6pf.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-yiqbck9kwb.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-cukf6g0jhh.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-jcnod7aib2.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-w01g5b1sbl.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-tjb0fdd44a.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-xcpa1rwt0k.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-bn1thm52e7.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-brq0rnrucu.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-bua16i737o.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-w4n2b53wby.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-4rz3nnbv04.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-5usqyns5qp.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-j0w6d1zkx2.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-xvcuvxetn6.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-tay8e3zuo0.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-24w4lcfq1g.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-mccvjxrw7v.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-zpsg0umka1.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-jyzva4f6aw.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-7te3271qar.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-4go2tmx9di.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-bmoyhnwxtj.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-r3is7hyo31.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-rzcnjirw14.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-jtwfk4hcbr.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-a5rlieciwn.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-6ayl12uqu1.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-craacjix2v.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-9i47s0ca7i.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-9fbp0m8ilh.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-wf6cpc18p6.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-a06d5h48ug.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-ow9f25stzt.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-hsqwr33zz2.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-ie0owvjt1u.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-0jrilgrmad.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-msl9f27tzm.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-sgyegdyygx.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-oj2c2kwyry.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-swg2jq7uq0.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-3snve2s3vn.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-m7wjumqg80.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-flw07taqgv.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-mxdvagbpl6.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-yv862ln3jh.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-8hmh07wgdf.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-vs1yaeo805.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-c1oz95go9j.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-9vdkj90x7x.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-u5zzxz05re.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-7iaasl9m8b.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-glnv1bv70d.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-8o68ywavot.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-ize0f8v3bh.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-yph0b04ycv.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-gef82bnbf9.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-1qrinhj5cu.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-y2wwv6kx9l.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-phozmbqbyg.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-etgiazprwh.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-jt84jawyyj.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-cm0o4habt2.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-xqp05s28i1.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-cvikiqqkub.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-5p25fot97h.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-lbdsmjkbgm.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-q4yqr36fu8.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-6xh16m3t9v.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-tpp8l6wlvt.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\resources\is-uphsr47s6d.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\resources\is-xzudr5d778.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\swiftshader\is-ejholvc979.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\swiftshader\is-zqp9vp1zgi.tmp
Удаляет файлы, которые сам же создал
- %TEMP%\is-jwzq7x7iz5.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-jwzq7x7iz5.tmp\_isetup\_setup64.tmp
- %TEMP%\is-cjq4cc6ykw.tmp\<Имя файла>.tmp
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\app.exe
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\chrome_100_percent.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\chrome_200_percent.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\d3dcompiler_47.dll
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\ffmpeg.dll
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\libegl.dll
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\libglesv2.dll
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\license.electron.txt
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\licenses.chromium.html
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\am.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\ar.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\bg.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\bn.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\ca.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\cs.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\da.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\de.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\el.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\en-gb.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\en-us.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\es-419.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\es.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\et.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\fa.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\fi.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\fil.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\fr.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\gu.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\he.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\hi.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\hr.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\hu.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\id.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\it.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\ja.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\kn.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\ko.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\lt.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\lv.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\ml.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\mr.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\ms.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\nb.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\nl.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\pl.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\pt-br.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\pt-pt.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\ro.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\ru.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\sk.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\sl.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\sr.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\sv.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\sw.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\ta.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\te.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\th.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\tr.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\uk.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\vi.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\zh-cn.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\zh-tw.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\resources\elevate.exe
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\resources.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\snapshot_blob.bin
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\swiftshader\libegl.dll
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\swiftshader\libglesv2.dll
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\vk_swiftshader.dll
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\vk_swiftshader_icd.json
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\vulkan-1.dll
- %TEMP%\is-ia03j0g6pf.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-ia03j0g6pf.tmp\_isetup\_setup64.tmp
- %TEMP%\is-b7ey8unepa.tmp\<Имя файла>.tmp
Перемещает следующие файлы
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-yiqbck9kwb.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\app.exe
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-cukf6g0jhh.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\chrome_100_percent.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-jcnod7aib2.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\chrome_200_percent.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-w01g5b1sbl.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\d3dcompiler_47.dll
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-tjb0fdd44a.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\ffmpeg.dll
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-xcpa1rwt0k.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\icudtl.dat
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-bn1thm52e7.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\libegl.dll
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-brq0rnrucu.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\libglesv2.dll
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-bua16i737o.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\license.electron.txt
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-w4n2b53wby.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\licenses.chromium.html
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-4rz3nnbv04.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\resources.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-5usqyns5qp.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\snapshot_blob.bin
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-j0w6d1zkx2.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\v8_context_snapshot.bin
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-xvcuvxetn6.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\vk_swiftshader.dll
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-tay8e3zuo0.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\vk_swiftshader_icd.json
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\is-24w4lcfq1g.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\vulkan-1.dll
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-mccvjxrw7v.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\am.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-zpsg0umka1.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\ar.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-jyzva4f6aw.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\bg.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-7te3271qar.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\bn.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-4go2tmx9di.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\ca.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-bmoyhnwxtj.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\cs.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-r3is7hyo31.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\da.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-rzcnjirw14.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\de.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-jtwfk4hcbr.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\el.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-a5rlieciwn.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\en-gb.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-6ayl12uqu1.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\en-us.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-craacjix2v.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\es-419.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-9i47s0ca7i.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\es.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-9fbp0m8ilh.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\et.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-wf6cpc18p6.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\fa.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-a06d5h48ug.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\fi.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-ow9f25stzt.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\fil.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-hsqwr33zz2.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\fr.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-ie0owvjt1u.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\gu.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-0jrilgrmad.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\he.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-msl9f27tzm.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\hi.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-sgyegdyygx.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\hr.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-oj2c2kwyry.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\hu.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-swg2jq7uq0.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\id.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-3snve2s3vn.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\it.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-m7wjumqg80.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\ja.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-flw07taqgv.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\kn.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-mxdvagbpl6.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\ko.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-yv862ln3jh.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\lt.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-8hmh07wgdf.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\lv.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-vs1yaeo805.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\ml.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-c1oz95go9j.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\mr.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-9vdkj90x7x.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\ms.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-u5zzxz05re.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\nb.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-7iaasl9m8b.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\nl.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-glnv1bv70d.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\pl.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-8o68ywavot.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\pt-br.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-ize0f8v3bh.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\pt-pt.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-yph0b04ycv.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\ro.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-gef82bnbf9.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\ru.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-1qrinhj5cu.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\sk.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-y2wwv6kx9l.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\sl.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-phozmbqbyg.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\sr.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-etgiazprwh.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\sv.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-jt84jawyyj.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\sw.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-cm0o4habt2.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\ta.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-xqp05s28i1.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\te.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-cvikiqqkub.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\th.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-5p25fot97h.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\tr.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-lbdsmjkbgm.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\uk.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-q4yqr36fu8.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\vi.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-6xh16m3t9v.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\zh-cn.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\is-tpp8l6wlvt.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\locales\zh-tw.pak
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\resources\is-uphsr47s6d.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\resources\app.asar
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\resources\is-xzudr5d778.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\resources\elevate.exe
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\swiftshader\is-ejholvc979.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\swiftshader\libegl.dll
- %TEMP%\is-ia03j0g6pf.tmp\reactiojs\swiftshader\is-zqp9vp1zgi.tmp в %TEMP%\is-ia03j0g6pf.tmp\reactiojs\swiftshader\libglesv2.dll
Другое
Создает и запускает на исполнение
- '%TEMP%\is-cjq4cc6ykw.tmp\<Имя файла>.tmp' /SL5="$802BA,76982790,899072,<Полный путь к файлу>"
- '%TEMP%\is-b7ey8unepa.tmp\<Имя файла>.tmp' /SL5="$902BA,76982790,899072,<Полный путь к файлу>" /SILENT
- '%TEMP%\is-ia03j0g6pf.tmp\reactiojs\app.exe'
Перезапускает анализируемый образец
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /d /s /c "chcp" (со скрытым окном)
- '<SYSTEM32>\chcp.com'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%" (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log"" (со скрытым окном)
- '<SYSTEM32>\findstr.exe' /C:"Detected boot environment" "%WINDIR%\Panther\setupact.log"
- '<Полный путь к файлу>' /SILENT (со скрытым окном)
