Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\is-aq09g.tmp\<Имя файла>.tmp
- %ProgramFiles(x86)%\nggedfrog\translation\is-ihfto.tmp
- %ProgramFiles(x86)%\nggedfrog\translation\is-pbg9g.tmp
- %ProgramFiles(x86)%\nggedfrog\is-gagve.tmp
- %ProgramFiles(x86)%\nggedfrog\is-ppmlc.tmp
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\is-8q6ca.tmp
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\is-2ktd9.tmp
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\is-8a2pc.tmp
- %ProgramFiles(x86)%\nggedfrog\is-v23ov.tmp
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\is-8h0q3.tmp
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\is-45hor.tmp
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\is-4m1a5.tmp
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\is-tvl0t.tmp
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\is-obtk1.tmp
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\is-2vept.tmp
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\is-9ubmg.tmp
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\is-0i71l.tmp
- %ProgramFiles(x86)%\nggedfrog\translation\is-esjbi.tmp
- %ProgramFiles(x86)%\nggedfrog\translation\is-nb3v2.tmp
- %ProgramFiles(x86)%\nggedfrog\translation\is-nan3n.tmp
- %ProgramFiles(x86)%\nggedfrog\translation\is-2c5od.tmp
- %ProgramFiles(x86)%\nggedfrog\translation\is-inp7d.tmp
- %TEMP%\is-k2tk1.tmp\_isetup\_setup64.tmp
- %TEMP%\is-k2tk1.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-k2tk1.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\nggedfrog\is-d5m1p.tmp
- %ProgramFiles(x86)%\nggedfrog\is-a5k5t.tmp
- %ProgramFiles(x86)%\nggedfrog\is-g76mn.tmp
- %ProgramFiles(x86)%\nggedfrog\is-jsmo2.tmp
- %ProgramFiles(x86)%\nggedfrog\unins000.dat
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\is-8heir.tmp
- %ProgramFiles(x86)%\nggedfrog\is-m1g10.tmp
- %ProgramFiles(x86)%\nggedfrog\translation\is-05aia.tmp
- %ProgramFiles(x86)%\nggedfrog\translation\is-hc5v7.tmp
- %ProgramFiles(x86)%\nggedfrog\translation\is-rgfn3.tmp
- %ProgramFiles(x86)%\nggedfrog\translation\is-ufc2k.tmp
- %ProgramFiles(x86)%\nggedfrog\translation\is-2ks1g.tmp
- %ProgramFiles(x86)%\nggedfrog\translation\is-tkum7.tmp
- %ProgramFiles(x86)%\nggedfrog\translation\is-kei11.tmp
- %TEMP%\is-k2tk1.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\nggedfrog\translation\is-o3p8v.tmp
- %ProgramFiles(x86)%\nggedfrog\nggedfrog21.exe
Удаляет следующие файлы
- %TEMP%\is-aq09g.tmp\<Имя файла>.tmp
Перемещает следующие файлы
- %ProgramFiles(x86)%\nggedfrog\is-d5m1p.tmp в %ProgramFiles(x86)%\nggedfrog\unins000.exe
- %ProgramFiles(x86)%\nggedfrog\translation\is-ihfto.tmp в %ProgramFiles(x86)%\nggedfrog\translation\spanish.xml
- %ProgramFiles(x86)%\nggedfrog\translation\is-pbg9g.tmp в %ProgramFiles(x86)%\nggedfrog\translation\turkish.xml
- %ProgramFiles(x86)%\nggedfrog\is-gagve.tmp в %ProgramFiles(x86)%\nggedfrog\license.txt
- %ProgramFiles(x86)%\nggedfrog\is-ppmlc.tmp в %ProgramFiles(x86)%\nggedfrog\whatsnew.txt
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\is-8q6ca.tmp в %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\meta_english.xml
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\is-2ktd9.tmp в %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\meta_german.xml
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\is-8h0q3.tmp в %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\meta_japanese.xml
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\is-9ubmg.tmp в %ProgramFiles(x86)%\nggedfrog\extensions\meta\interop.dsolefile.dll
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\is-8heir.tmp в %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\meta_portuguese-br.xml
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\is-45hor.tmp в %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\meta_romanian.xml
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\is-4m1a5.tmp в %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\meta_russian.xml
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\is-tvl0t.tmp в %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\meta_spanish.xml
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\is-obtk1.tmp в %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\meta_turkish.xml
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\is-2vept.tmp в %ProgramFiles(x86)%\nggedfrog\extensions\meta\dsofile.dll
- %ProgramFiles(x86)%\nggedfrog\translation\is-nb3v2.tmp в %ProgramFiles(x86)%\nggedfrog\translation\slovak.xml
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\is-8a2pc.tmp в %ProgramFiles(x86)%\nggedfrog\extensions\meta\translation\meta_hungarian.xml
- %ProgramFiles(x86)%\nggedfrog\translation\is-esjbi.tmp в %ProgramFiles(x86)%\nggedfrog\translation\russian.xml
- %ProgramFiles(x86)%\nggedfrog\translation\is-05aia.tmp в %ProgramFiles(x86)%\nggedfrog\translation\chinese-traditional.xml
- %ProgramFiles(x86)%\nggedfrog\is-a5k5t.tmp в %ProgramFiles(x86)%\nggedfrog\nggedfrog21.exe
- %ProgramFiles(x86)%\nggedfrog\is-g76mn.tmp в %ProgramFiles(x86)%\nggedfrog\wildfrog.dll
- %ProgramFiles(x86)%\nggedfrog\is-jsmo2.tmp в %ProgramFiles(x86)%\nggedfrog\taggedfrog.extensions.dll
- %ProgramFiles(x86)%\nggedfrog\is-m1g10.tmp в %ProgramFiles(x86)%\nggedfrog\tfshellmenu.dll
- %ProgramFiles(x86)%\nggedfrog\is-v23ov.tmp в %ProgramFiles(x86)%\nggedfrog\componentfactory.krypton.toolkit.dll
- %ProgramFiles(x86)%\nggedfrog\translation\is-o3p8v.tmp в %ProgramFiles(x86)%\nggedfrog\translation\chinese-simplified.xml
- %ProgramFiles(x86)%\nggedfrog\translation\is-hc5v7.tmp в %ProgramFiles(x86)%\nggedfrog\translation\dutch.xml
- %ProgramFiles(x86)%\nggedfrog\translation\is-2c5od.tmp в %ProgramFiles(x86)%\nggedfrog\translation\portuguese-br.xml
- %ProgramFiles(x86)%\nggedfrog\translation\is-rgfn3.tmp в %ProgramFiles(x86)%\nggedfrog\translation\english.xml
- %ProgramFiles(x86)%\nggedfrog\translation\is-ufc2k.tmp в %ProgramFiles(x86)%\nggedfrog\translation\french.xml
- %ProgramFiles(x86)%\nggedfrog\translation\is-2ks1g.tmp в %ProgramFiles(x86)%\nggedfrog\translation\german.xml
- %ProgramFiles(x86)%\nggedfrog\translation\is-tkum7.tmp в %ProgramFiles(x86)%\nggedfrog\translation\hungarian.xml
- %ProgramFiles(x86)%\nggedfrog\translation\is-kei11.tmp в %ProgramFiles(x86)%\nggedfrog\translation\italian.xml
- %ProgramFiles(x86)%\nggedfrog\translation\is-inp7d.tmp в %ProgramFiles(x86)%\nggedfrog\translation\japanese.xml
- %ProgramFiles(x86)%\nggedfrog\translation\is-nan3n.tmp в %ProgramFiles(x86)%\nggedfrog\translation\romanian.xml
- %ProgramFiles(x86)%\nggedfrog\extensions\meta\is-0i71l.tmp в %ProgramFiles(x86)%\nggedfrog\extensions\meta\taggedfrog.extensions.meta.dll
Сетевая активность
UDP
- 'localhost':50487
- 'localhost':54726
Другое
Ищет следующие окна
- ClassName: '523ab867-21C0-A478-9F8D-a6239D841cb5' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\is-aq09g.tmp\<Имя файла>.tmp' /SL5="$11022A,1859712,198656,<Полный путь к файлу>"
- '%ProgramFiles(x86)%\nggedfrog\nggedfrog21.exe'
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "NggedFrog21.exe" /f & erase "%ProgramFiles(x86)%\NggedFrog\NggedFrog21.exe" & exit' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\NggedFrog\TFShellMenu.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\NggedFrog\extensions\Meta\dsofile.dll"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "NggedFrog21.exe" /f & erase "%ProgramFiles(x86)%\NggedFrog\NggedFrog21.exe" & exit
