Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-fdikv.tmp\is-4vg11.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-c2jen.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-lcjpr.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-q8kdu.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-0kmt6.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-srfs3.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-eta2n.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-op2jg.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-mlrm4.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-bvv9m.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-v29l8.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-p50hd.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-bjoa9.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-v1dcn.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-tfpll.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-j0ket.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-aqp80.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-ai1ef.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-os7la.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-pt2de.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-53sqc.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-8fg09.tmp
- %ProgramFiles(x86)%\pres\unins000.dat
- %ProgramFiles(x86)%\pres\is-oclu9.tmp
- %ProgramFiles(x86)%\pres\tweaks\is-9nbv4.tmp
- %ProgramFiles(x86)%\pres\tweaks\is-n7t1b.tmp
- %ProgramFiles(x86)%\pres\tweaks\is-h57p7.tmp
- %ProgramFiles(x86)%\pres\tweaks\is-6v5ur.tmp
- %ProgramFiles(x86)%\pres\tweaks\is-1ode7.tmp
- %ProgramFiles(x86)%\pres\tweaks\is-uaqdo.tmp
- %ProgramFiles(x86)%\pres\tweaks\is-a41p6.tmp
- %ProgramFiles(x86)%\pres\tweaks\is-0f6lt.tmp
- %ProgramFiles(x86)%\pres\tweaks\is-i87va.tmp
- %ProgramFiles(x86)%\pres\tweaks\is-l9aai.tmp
- %ProgramFiles(x86)%\pres\tweaks\is-im5im.tmp
- %ProgramFiles(x86)%\pres\tweaks\is-lg73i.tmp
- %ProgramFiles(x86)%\pres\tweaks\is-ivj3i.tmp
- %ProgramFiles(x86)%\pres\tweaks\is-7mm81.tmp
- %ProgramFiles(x86)%\pres\tweaks\is-98hip.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-q63o5.tmp
- %ProgramFiles(x86)%\pres\pres918.exe
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-aj0c7.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-p7h77.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-ob71f.tmp
- %ProgramFiles(x86)%\pres\themes\is-mqnna.tmp
- %ProgramFiles(x86)%\pres\themes\is-d2e7a.tmp
- %ProgramFiles(x86)%\pres\is-s0siv.tmp
- %ProgramFiles(x86)%\pres\is-tj8pi.tmp
- %ProgramFiles(x86)%\pres\is-34e24.tmp
- %ProgramFiles(x86)%\pres\is-flfbm.tmp
- %ProgramFiles(x86)%\pres\is-7o53l.tmp
- %ProgramFiles(x86)%\pres\is-mb1tg.tmp
- %ProgramFiles(x86)%\pres\is-qqqan.tmp
- %ProgramFiles(x86)%\pres\is-ii560.tmp
- %ProgramFiles(x86)%\pres\is-alv8n.tmp
- %ProgramFiles(x86)%\pres\is-6h7lg.tmp
- %TEMP%\is-oec7a.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-oec7a.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-oec7a.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-oec7a.tmp\_isetup\_setup64.tmp
- %TEMP%\is-oec7a.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\pres\themes\is-dp5qe.tmp
- %ProgramFiles(x86)%\pres\themes\is-55dae.tmp
- %ProgramFiles(x86)%\pres\themes\is-mevrl.tmp
- %ProgramFiles(x86)%\pres\themes\is-t65o0.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-1s555.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-obg9j.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-plocu.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\funny\is-f8un2.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\is-ghign.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\is-2obpa.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\is-e944m.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\is-cdqkd.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\is-8sodj.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\is-8ro36.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\is-40j6u.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\is-24lte.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\is-iqckq.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\is-47vhn.tmp
- %ProgramFiles(x86)%\pres\themes\is-s3ilv.tmp
- %ProgramFiles(x86)%\pres\themes\is-lanvf.tmp
- %ProgramFiles(x86)%\pres\themes\is-2ig1q.tmp
- %ProgramFiles(x86)%\pres\themes\is-3cp4u.tmp
- %ProgramFiles(x86)%\pres\themes\built-in\nature\is-fn8c5.tmp
- %TEMP%\license.txt
Moves the following files
- from %ProgramFiles(x86)%\pres\is-6h7lg.tmp to %ProgramFiles(x86)%\pres\unins000.exe
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-os7la.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\timothy.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-c2jen.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\sunup.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-lcjpr.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\sunshine.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-q8kdu.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\sunglasses.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-0kmt6.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\sunflower.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-srfs3.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\sunbeach.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-eta2n.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\sun-smile.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-op2jg.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\seadawn.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-mlrm4.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\seabot.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-bvv9m.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\seaandsunglasses.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-v29l8.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\rain.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-p50hd.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\niceday.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-bjoa9.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\mountains.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-v1dcn.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\midnight.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-tfpll.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\colorstars.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-aqp80.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\clock.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-j0ket.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\colorfire.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-pt2de.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\tulips.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-53sqc.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\valley.themeb
- from %ProgramFiles(x86)%\pres\tweaks\is-n7t1b.tmp to %ProgramFiles(x86)%\pres\tweaks\tweaksdb.json
- from %ProgramFiles(x86)%\pres\tweaks\is-h57p7.tmp to %ProgramFiles(x86)%\pres\tweaks\tweaksdb.ini
- from %ProgramFiles(x86)%\pres\tweaks\is-6v5ur.tmp to %ProgramFiles(x86)%\pres\tweaks\nc010cortana.png
- from %ProgramFiles(x86)%\pres\tweaks\is-1ode7.tmp to %ProgramFiles(x86)%\pres\tweaks\nc009powertweaks.png
- from %ProgramFiles(x86)%\pres\tweaks\is-uaqdo.tmp to %ProgramFiles(x86)%\pres\tweaks\nc008lockscreen.png
- from %ProgramFiles(x86)%\pres\tweaks\is-0f6lt.tmp to %ProgramFiles(x86)%\pres\tweaks\nc007misctweaks.png
- from %ProgramFiles(x86)%\pres\tweaks\is-a41p6.tmp to %ProgramFiles(x86)%\pres\tweaks\nc006browsertweaks.png
- from %ProgramFiles(x86)%\pres\tweaks\is-l9aai.tmp to %ProgramFiles(x86)%\pres\tweaks\nc005defender.png
- from %ProgramFiles(x86)%\pres\themes\built-in\is-e944m.tmp to %ProgramFiles(x86)%\pres\themes\built-in\spinner.themeb
- from %ProgramFiles(x86)%\pres\tweaks\is-im5im.tmp to %ProgramFiles(x86)%\pres\tweaks\nc004security.png
- from %ProgramFiles(x86)%\pres\tweaks\is-lg73i.tmp to %ProgramFiles(x86)%\pres\tweaks\nc003privacy.png
- from %ProgramFiles(x86)%\pres\tweaks\is-ivj3i.tmp to %ProgramFiles(x86)%\pres\tweaks\nc002speedup.png
- from %ProgramFiles(x86)%\pres\tweaks\is-7mm81.tmp to %ProgramFiles(x86)%\pres\tweaks\nc002adsclean.png
- from %ProgramFiles(x86)%\pres\tweaks\is-98hip.tmp to %ProgramFiles(x86)%\pres\tweaks\nc001winantispy.png
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-q63o5.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\water.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-8fg09.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\vulkan.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-ai1ef.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\christmasdog.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-aj0c7.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\christmascandle.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-p7h77.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\chamomile.themeb
- from %ProgramFiles(x86)%\pres\themes\is-mevrl.tmp to %ProgramFiles(x86)%\pres\themes\circle_good_old.png
- from %ProgramFiles(x86)%\pres\themes\is-55dae.tmp to %ProgramFiles(x86)%\pres\themes\circle_blick.png
- from %ProgramFiles(x86)%\pres\themes\is-dp5qe.tmp to %ProgramFiles(x86)%\pres\themes\black_back.png
- from %ProgramFiles(x86)%\pres\themes\is-mqnna.tmp to %ProgramFiles(x86)%\pres\themes\black.themeb
- from %ProgramFiles(x86)%\pres\themes\is-d2e7a.tmp to %ProgramFiles(x86)%\pres\themes\back_good_to_go.png
- from %ProgramFiles(x86)%\pres\is-s0siv.tmp to %ProgramFiles(x86)%\pres\unusedhardware.png
- from %ProgramFiles(x86)%\pres\is-tj8pi.tmp to %ProgramFiles(x86)%\pres\software.png
- from %ProgramFiles(x86)%\pres\is-34e24.tmp to %ProgramFiles(x86)%\pres\servman-log.txt
- from %ProgramFiles(x86)%\pres\is-flfbm.tmp to %ProgramFiles(x86)%\pres\readme.txt
- from %ProgramFiles(x86)%\pres\is-7o53l.tmp to %ProgramFiles(x86)%\pres\optimize.nat
- from %ProgramFiles(x86)%\pres\is-mb1tg.tmp to %ProgramFiles(x86)%\pres\optimize.json
- from %ProgramFiles(x86)%\pres\is-qqqan.tmp to %ProgramFiles(x86)%\pres\license.txt
- from %ProgramFiles(x86)%\pres\is-ii560.tmp to %ProgramFiles(x86)%\pres\hyperv.png
- from %ProgramFiles(x86)%\pres\is-alv8n.tmp to %ProgramFiles(x86)%\pres\filesystem.png
- from %ProgramFiles(x86)%\pres\themes\is-3cp4u.tmp to %ProgramFiles(x86)%\pres\themes\classic.themeb
- from %ProgramFiles(x86)%\pres\themes\is-2ig1q.tmp to %ProgramFiles(x86)%\pres\themes\cosmos.themeb
- from %ProgramFiles(x86)%\pres\themes\is-t65o0.tmp to %ProgramFiles(x86)%\pres\themes\cirecle_flare.png
- from %ProgramFiles(x86)%\pres\themes\is-lanvf.tmp to %ProgramFiles(x86)%\pres\themes\glow.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-ob71f.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\budapest.themeb
- from %ProgramFiles(x86)%\pres\themes\is-s3ilv.tmp to %ProgramFiles(x86)%\pres\themes\rings.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-fn8c5.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\bokeyellow.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-1s555.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\bokered.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-obg9j.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\boke.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\nature\is-plocu.tmp to %ProgramFiles(x86)%\pres\themes\built-in\nature\bigmountains.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\funny\is-f8un2.tmp to %ProgramFiles(x86)%\pres\themes\built-in\funny\penguine.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\is-ghign.tmp to %ProgramFiles(x86)%\pres\themes\built-in\water.themeb
- from %ProgramFiles(x86)%\pres\tweaks\is-i87va.tmp to %ProgramFiles(x86)%\pres\tweaks\nc0060edgetweaks.png
- from %ProgramFiles(x86)%\pres\tweaks\is-9nbv4.tmp to %ProgramFiles(x86)%\pres\tweaks\tweaksdb.nat
- from %ProgramFiles(x86)%\pres\themes\built-in\is-cdqkd.tmp to %ProgramFiles(x86)%\pres\themes\built-in\rings.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\is-8ro36.tmp to %ProgramFiles(x86)%\pres\themes\built-in\glow.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\is-8sodj.tmp to %ProgramFiles(x86)%\pres\themes\built-in\daynight.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\is-40j6u.tmp to %ProgramFiles(x86)%\pres\themes\built-in\cosmos.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\is-24lte.tmp to %ProgramFiles(x86)%\pres\themes\built-in\classic.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\is-iqckq.tmp to %ProgramFiles(x86)%\pres\themes\built-in\bubble.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\is-47vhn.tmp to %ProgramFiles(x86)%\pres\themes\built-in\black.themeb
- from %ProgramFiles(x86)%\pres\themes\built-in\is-2obpa.tmp to %ProgramFiles(x86)%\pres\themes\built-in\square.themeb
- from %ProgramFiles(x86)%\pres\is-oclu9.tmp to %ProgramFiles(x86)%\pres\pres918.exe
Network activity
Connects to
- 'mi####njobs.works':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?43######
HTTP POST requests
- http://mi####njobs.works/new/net_api
UDP
- DNS ASK mi####njobs.works
Miscellaneous
Searches for the following windows
- ClassName: 'j5d8c9_pres918Class_j5d8c9' WindowName: ''
Creates and executes the following
- '%TEMP%\is-fdikv.tmp\is-4vg11.tmp' /SL4 $D017E "<Full path to file>" 3902491 52224
- '%ProgramFiles(x86)%\pres\pres918.exe'
- '%ProgramFiles(x86)%\pres\pres918.exe' b69305fd53f2c747aaf0bbf4bf1324b9
Executes the following
- '%WINDIR%\syswow64\net.exe' helpmsg 18
- '%WINDIR%\syswow64\net1.exe' helpmsg 18
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "PRES-918"
