Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\is-r3tmp.tmp\is-qhhud.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-ieemr.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-th7bv.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-lmp82.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-e0ajn.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-1glkn.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-s7epo.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-r2b9q.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-35cdf.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-bsv1c.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-frmtl.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-v961p.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-m8les.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-8314u.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-k84sj.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-1r856.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-5u3s5.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-115hp.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-80ga5.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-nao6h.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-gsig4.tmp
- %ProgramFiles(x86)%\nres\nres917.exe
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-urs4p.tmp
- %ProgramFiles(x86)%\nres\unins000.dat
- %ProgramFiles(x86)%\nres\is-0hq3l.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-r43tt.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-qpq9j.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-4rhsj.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-4hm8r.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-of294.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-lo5a1.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-5ert9.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-ur9i2.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-1abb6.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-94ti8.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-cb0vg.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-0ms5q.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-ii6ja.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-pcfof.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-1eim5.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-gm3q5.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-3fir8.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-ec8mv.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-0q4ti.tmp
- %ProgramFiles(x86)%\nres\themes\is-6deve.tmp
- %ProgramFiles(x86)%\nres\themes\is-92rgv.tmp
- %ProgramFiles(x86)%\nres\themes\is-m38gj.tmp
- %ProgramFiles(x86)%\nres\themes\is-i19qp.tmp
- %ProgramFiles(x86)%\nres\is-c3jof.tmp
- %ProgramFiles(x86)%\nres\is-c0sff.tmp
- %ProgramFiles(x86)%\nres\is-r1ora.tmp
- %ProgramFiles(x86)%\nres\is-21k5h.tmp
- %ProgramFiles(x86)%\nres\is-7ii41.tmp
- %ProgramFiles(x86)%\nres\themes\is-292j2.tmp
- %ProgramFiles(x86)%\nres\is-b0aop.tmp
- %ProgramFiles(x86)%\nres\is-pi9s7.tmp
- %ProgramFiles(x86)%\nres\is-d3d1v.tmp
- %ProgramFiles(x86)%\nres\is-9v7s5.tmp
- %TEMP%\is-8bea8.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-8bea8.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-8bea8.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-8bea8.tmp\_isetup\_setup64.tmp
- %TEMP%\is-8bea8.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\nres\is-s4ghp.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-f3996.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-os21g.tmp
- %ProgramFiles(x86)%\nres\themes\is-p2d22.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-eb17c.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-hjmvc.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-cvat8.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-6uvos.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\funny\is-1unkk.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-bfbhr.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-rh5eb.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-0evaf.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-nphvf.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-2l8ab.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-7q1a0.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-dpokk.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-9ng1p.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-94dtl.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-d72rg.tmp
- %ProgramFiles(x86)%\nres\themes\is-acnpg.tmp
- %ProgramFiles(x86)%\nres\themes\is-aa985.tmp
- %ProgramFiles(x86)%\nres\themes\is-icgbh.tmp
- %ProgramFiles(x86)%\nres\themes\is-fpluo.tmp
- %TEMP%\license.txt
Перемещает следующие файлы
- %ProgramFiles(x86)%\nres\is-9v7s5.tmp в %ProgramFiles(x86)%\nres\unins000.exe
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-th7bv.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\sunshine.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-lmp82.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\sunglasses.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-e0ajn.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\sunflower.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-1glkn.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\sunbeach.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-s7epo.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\sun-smile.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-r2b9q.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\seadawn.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-35cdf.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\seabot.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-nao6h.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\rain.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-bsv1c.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\timothy.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-v961p.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\niceday.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-m8les.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\mountains.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-8314u.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\midnight.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-k84sj.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\happynewyear.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-1r856.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\firework.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-5u3s5.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\colorstars.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-frmtl.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\seaandsunglasses.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-rh5eb.tmp в %ProgramFiles(x86)%\nres\themes\built-in\square.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-3fir8.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\tulips.themeb
- %ProgramFiles(x86)%\nres\tweaks\is-qpq9j.tmp в %ProgramFiles(x86)%\nres\tweaks\tweaksdb.json
- %ProgramFiles(x86)%\nres\tweaks\is-4rhsj.tmp в %ProgramFiles(x86)%\nres\tweaks\tweaksdb.ini
- %ProgramFiles(x86)%\nres\tweaks\is-4hm8r.tmp в %ProgramFiles(x86)%\nres\tweaks\nc010cortana.png
- %ProgramFiles(x86)%\nres\tweaks\is-of294.tmp в %ProgramFiles(x86)%\nres\tweaks\nc009powertweaks.png
- %ProgramFiles(x86)%\nres\tweaks\is-lo5a1.tmp в %ProgramFiles(x86)%\nres\tweaks\nc008lockscreen.png
- %ProgramFiles(x86)%\nres\tweaks\is-ur9i2.tmp в %ProgramFiles(x86)%\nres\tweaks\nc007misctweaks.png
- %ProgramFiles(x86)%\nres\tweaks\is-gsig4.tmp в %ProgramFiles(x86)%\nres\tweaks\nc006browsertweaks.png
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-115hp.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\colorfire.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-ieemr.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\sunup.themeb
- %ProgramFiles(x86)%\nres\tweaks\is-cb0vg.tmp в %ProgramFiles(x86)%\nres\tweaks\nc004security.png
- %ProgramFiles(x86)%\nres\tweaks\is-0ms5q.tmp в %ProgramFiles(x86)%\nres\tweaks\nc003privacy.png
- %ProgramFiles(x86)%\nres\tweaks\is-ii6ja.tmp в %ProgramFiles(x86)%\nres\tweaks\nc002speedup.png
- %ProgramFiles(x86)%\nres\tweaks\is-pcfof.tmp в %ProgramFiles(x86)%\nres\tweaks\nc002adsclean.png
- %ProgramFiles(x86)%\nres\tweaks\is-1eim5.tmp в %ProgramFiles(x86)%\nres\tweaks\nc001winantispy.png
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-gm3q5.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\water.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-urs4p.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\vulkan.themeb
- %ProgramFiles(x86)%\nres\tweaks\is-94ti8.tmp в %ProgramFiles(x86)%\nres\tweaks\nc005defender.png
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-ec8mv.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\valley.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-80ga5.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\clock.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-5ert9.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\christmasdog.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-0q4ti.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\christmascandle.themeb
- %ProgramFiles(x86)%\nres\is-c0sff.tmp в %ProgramFiles(x86)%\nres\software.png
- %ProgramFiles(x86)%\nres\themes\is-6deve.tmp в %ProgramFiles(x86)%\nres\themes\cirecle_flare.png
- %ProgramFiles(x86)%\nres\themes\is-fpluo.tmp в %ProgramFiles(x86)%\nres\themes\circle_good_old.png
- %ProgramFiles(x86)%\nres\themes\is-292j2.tmp в %ProgramFiles(x86)%\nres\themes\circle_blick.png
- %ProgramFiles(x86)%\nres\themes\is-92rgv.tmp в %ProgramFiles(x86)%\nres\themes\black_back.png
- %ProgramFiles(x86)%\nres\themes\is-m38gj.tmp в %ProgramFiles(x86)%\nres\themes\black.themeb
- %ProgramFiles(x86)%\nres\themes\is-i19qp.tmp в %ProgramFiles(x86)%\nres\themes\back_good_to_go.png
- %ProgramFiles(x86)%\nres\tweaks\is-r43tt.tmp в %ProgramFiles(x86)%\nres\tweaks\tweaksdb.nat
- %ProgramFiles(x86)%\nres\themes\is-icgbh.tmp в %ProgramFiles(x86)%\nres\themes\cosmos.themeb
- %ProgramFiles(x86)%\nres\is-r1ora.tmp в %ProgramFiles(x86)%\nres\servman-log.txt
- %ProgramFiles(x86)%\nres\is-21k5h.tmp в %ProgramFiles(x86)%\nres\readme.txt
- %ProgramFiles(x86)%\nres\is-7ii41.tmp в %ProgramFiles(x86)%\nres\optimize.nat
- %ProgramFiles(x86)%\nres\is-b0aop.tmp в %ProgramFiles(x86)%\nres\optimize.json
- %ProgramFiles(x86)%\nres\is-s4ghp.tmp в %ProgramFiles(x86)%\nres\license.txt
- %ProgramFiles(x86)%\nres\is-pi9s7.tmp в %ProgramFiles(x86)%\nres\hyperv.png
- %ProgramFiles(x86)%\nres\is-d3d1v.tmp в %ProgramFiles(x86)%\nres\filesystem.png
- %ProgramFiles(x86)%\nres\is-c3jof.tmp в %ProgramFiles(x86)%\nres\unusedhardware.png
- %ProgramFiles(x86)%\nres\tweaks\is-1abb6.tmp в %ProgramFiles(x86)%\nres\tweaks\nc0060edgetweaks.png
- %ProgramFiles(x86)%\nres\themes\is-aa985.tmp в %ProgramFiles(x86)%\nres\themes\glow.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-94dtl.tmp в %ProgramFiles(x86)%\nres\themes\built-in\bubble.themeb
- %ProgramFiles(x86)%\nres\themes\is-acnpg.tmp в %ProgramFiles(x86)%\nres\themes\rings.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-nphvf.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\chamomile.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-os21g.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\budapest.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-eb17c.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\bokeyellow.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-hjmvc.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\bokered.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-cvat8.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\boke.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-6uvos.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\bigmountains.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-d72rg.tmp в %ProgramFiles(x86)%\nres\themes\built-in\black.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\funny\is-1unkk.tmp в %ProgramFiles(x86)%\nres\themes\built-in\funny\penguine.themeb
- %ProgramFiles(x86)%\nres\themes\is-p2d22.tmp в %ProgramFiles(x86)%\nres\themes\classic.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-0evaf.tmp в %ProgramFiles(x86)%\nres\themes\built-in\spinner.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-2l8ab.tmp в %ProgramFiles(x86)%\nres\themes\built-in\rings.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-f3996.tmp в %ProgramFiles(x86)%\nres\themes\built-in\glow.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-7q1a0.tmp в %ProgramFiles(x86)%\nres\themes\built-in\daynight.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-dpokk.tmp в %ProgramFiles(x86)%\nres\themes\built-in\cosmos.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-9ng1p.tmp в %ProgramFiles(x86)%\nres\themes\built-in\classic.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-bfbhr.tmp в %ProgramFiles(x86)%\nres\themes\built-in\water.themeb
- %ProgramFiles(x86)%\nres\is-0hq3l.tmp в %ProgramFiles(x86)%\nres\nres917.exe
Сетевая активность
Подключается к
- 'mi####njobs.works':80
TCP
Запросы HTTP GET
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?43######
Запросы HTTP POST
- http://mi####njobs.works/new/net_api
UDP
- DNS ASK mi####njobs.works
Другое
Ищет следующие окна
- ClassName: 'f749b9_nres917Class_f749b9' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\is-r3tmp.tmp\is-qhhud.tmp' /SL4 $9024C "<Полный путь к файлу>" 3963194 52224
- '%ProgramFiles(x86)%\nres\nres917.exe'
- '%ProgramFiles(x86)%\nres\nres917.exe' 6123cf642f17d6a97cff61f11a280793
Запускает на исполнение
- '%WINDIR%\syswow64\net.exe' helpmsg 17
- '%WINDIR%\syswow64\net1.exe' helpmsg 17
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "NRES-917"
