Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-nt600.tmp\<File name>.tmp
- %ProgramFiles(x86)%\timerlib\audio\is-dmdli.tmp
- %ProgramFiles(x86)%\timerlib\bearer\is-c88em.tmp
- %ProgramFiles(x86)%\timerlib\iconengines\is-s530k.tmp
- %ProgramFiles(x86)%\timerlib\imageformats\is-c3mvh.tmp
- %ProgramFiles(x86)%\timerlib\imageformats\is-6iekd.tmp
- %ProgramFiles(x86)%\timerlib\imageformats\is-iag01.tmp
- %ProgramFiles(x86)%\timerlib\imageformats\is-klma9.tmp
- %ProgramFiles(x86)%\timerlib\imageformats\is-q4req.tmp
- %ProgramFiles(x86)%\timerlib\imageformats\is-0torq.tmp
- %ProgramFiles(x86)%\timerlib\imageformats\is-pq6bu.tmp
- %ProgramFiles(x86)%\timerlib\imageformats\is-6um8q.tmp
- %ProgramFiles(x86)%\timerlib\imageformats\is-opbmi.tmp
- %ProgramFiles(x86)%\timerlib\is-2pi43.tmp
- %ProgramFiles(x86)%\timerlib\audio\is-rlj1v.tmp
- %ProgramFiles(x86)%\timerlib\mediaservice\is-posde.tmp
- %ProgramFiles(x86)%\timerlib\platforms\is-6b6hf.tmp
- %ProgramFiles(x86)%\timerlib\playlistformats\is-e8bf3.tmp
- %ProgramFiles(x86)%\timerlib\position\is-fbbaf.tmp
- %ProgramFiles(x86)%\timerlib\position\is-mvmnj.tmp
- %ProgramFiles(x86)%\timerlib\position\is-sckec.tmp
- %ProgramFiles(x86)%\timerlib\printsupport\is-1e8ah.tmp
- %ProgramFiles(x86)%\timerlib\styles\is-qdgak.tmp
- %ProgramFiles(x86)%\timerlib\is-1onba.tmp
- %ProgramFiles(x86)%\timerlib\is-u3tfv.tmp
- %ProgramFiles(x86)%\timerlib\is-q4jdf.tmp
- %ProgramFiles(x86)%\timerlib\is-f1t0b.tmp
- %ProgramFiles(x86)%\timerlib\unins000.dat
- %ProgramFiles(x86)%\timerlib\mediaservice\is-1jjr5.tmp
- %ProgramFiles(x86)%\timerlib\mediaservice\is-ae480.tmp
- %ProgramFiles(x86)%\timerlib\is-35c36.tmp
- %ProgramFiles(x86)%\timerlib\is-04q1e.tmp
- %ProgramFiles(x86)%\timerlib\is-q223b.tmp
- %TEMP%\is-sqn9e.tmp\_isetup\_setup64.tmp
- %TEMP%\is-sqn9e.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-sqn9e.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-sqn9e.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\timerlib\is-pmujl.tmp
- %ProgramFiles(x86)%\timerlib\is-7u00u.tmp
- %ProgramFiles(x86)%\timerlib\is-v4v6i.tmp
- %ProgramFiles(x86)%\timerlib\is-j5riv.tmp
- %ProgramFiles(x86)%\timerlib\is-bok2a.tmp
- %ProgramFiles(x86)%\timerlib\is-snb56.tmp
- %ProgramFiles(x86)%\timerlib\is-mjm2r.tmp
- %ProgramFiles(x86)%\timerlib\is-c6a3d.tmp
- %ProgramFiles(x86)%\timerlib\is-ag93d.tmp
- %TEMP%\is-sqn9e.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\timerlib\is-a7iln.tmp
- %ProgramFiles(x86)%\timerlib\is-oij6f.tmp
- %ProgramFiles(x86)%\timerlib\is-1i7hn.tmp
- %ProgramFiles(x86)%\timerlib\is-r6vo8.tmp
- %ProgramFiles(x86)%\timerlib\is-vlt05.tmp
- %ProgramFiles(x86)%\timerlib\is-ajcbt.tmp
- %ProgramFiles(x86)%\timerlib\is-dhirv.tmp
- %ProgramFiles(x86)%\timerlib\is-srrmh.tmp
- %ProgramFiles(x86)%\timerlib\is-31pel.tmp
- %ProgramFiles(x86)%\timerlib\is-qne7g.tmp
- %ProgramFiles(x86)%\timerlib\is-h3u4u.tmp
- %ProgramFiles(x86)%\timerlib\is-uctuc.tmp
- %ProgramFiles(x86)%\timerlib\is-dslso.tmp
- %ProgramFiles(x86)%\timerlib\is-90igv.tmp
- %ProgramFiles(x86)%\timerlib\is-mhjcf.tmp
- %ProgramFiles(x86)%\timerlib\timerlib.exe
- %TEMP%\license.txt
Moves the following files
- from %ProgramFiles(x86)%\timerlib\is-pmujl.tmp to %ProgramFiles(x86)%\timerlib\unins000.exe
- from %ProgramFiles(x86)%\timerlib\audio\is-dmdli.tmp to %ProgramFiles(x86)%\timerlib\audio\qtaudio_windows.dll
- from %ProgramFiles(x86)%\timerlib\bearer\is-c88em.tmp to %ProgramFiles(x86)%\timerlib\bearer\qgenericbearer.dll
- from %ProgramFiles(x86)%\timerlib\iconengines\is-s530k.tmp to %ProgramFiles(x86)%\timerlib\iconengines\qsvgicon.dll
- from %ProgramFiles(x86)%\timerlib\imageformats\is-c3mvh.tmp to %ProgramFiles(x86)%\timerlib\imageformats\qgif.dll
- from %ProgramFiles(x86)%\timerlib\imageformats\is-6iekd.tmp to %ProgramFiles(x86)%\timerlib\imageformats\qicns.dll
- from %ProgramFiles(x86)%\timerlib\imageformats\is-iag01.tmp to %ProgramFiles(x86)%\timerlib\imageformats\qico.dll
- from %ProgramFiles(x86)%\timerlib\imageformats\is-klma9.tmp to %ProgramFiles(x86)%\timerlib\imageformats\qjpeg.dll
- from %ProgramFiles(x86)%\timerlib\imageformats\is-q4req.tmp to %ProgramFiles(x86)%\timerlib\imageformats\qsvg.dll
- from %ProgramFiles(x86)%\timerlib\imageformats\is-0torq.tmp to %ProgramFiles(x86)%\timerlib\imageformats\qtga.dll
- from %ProgramFiles(x86)%\timerlib\imageformats\is-pq6bu.tmp to %ProgramFiles(x86)%\timerlib\imageformats\qtiff.dll
- from %ProgramFiles(x86)%\timerlib\imageformats\is-6um8q.tmp to %ProgramFiles(x86)%\timerlib\imageformats\qwbmp.dll
- from %ProgramFiles(x86)%\timerlib\mediaservice\is-posde.tmp to %ProgramFiles(x86)%\timerlib\mediaservice\dsengine.dll
- from %ProgramFiles(x86)%\timerlib\is-q4jdf.tmp to %ProgramFiles(x86)%\timerlib\spout_licence.txt
- from %ProgramFiles(x86)%\timerlib\mediaservice\is-1jjr5.tmp to %ProgramFiles(x86)%\timerlib\mediaservice\qtmedia_audioengine.dll
- from %ProgramFiles(x86)%\timerlib\mediaservice\is-ae480.tmp to %ProgramFiles(x86)%\timerlib\mediaservice\wmfengine.dll
- from %ProgramFiles(x86)%\timerlib\platforms\is-6b6hf.tmp to %ProgramFiles(x86)%\timerlib\platforms\qwindows.dll
- from %ProgramFiles(x86)%\timerlib\playlistformats\is-e8bf3.tmp to %ProgramFiles(x86)%\timerlib\playlistformats\qtmultimedia_m3u.dll
- from %ProgramFiles(x86)%\timerlib\position\is-fbbaf.tmp to %ProgramFiles(x86)%\timerlib\position\qtposition_positionpoll.dll
- from %ProgramFiles(x86)%\timerlib\position\is-mvmnj.tmp to %ProgramFiles(x86)%\timerlib\position\qtposition_serialnmea.dll
- from %ProgramFiles(x86)%\timerlib\position\is-sckec.tmp to %ProgramFiles(x86)%\timerlib\position\qtposition_winrt.dll
- from %ProgramFiles(x86)%\timerlib\printsupport\is-1e8ah.tmp to %ProgramFiles(x86)%\timerlib\printsupport\windowsprintersupport.dll
- from %ProgramFiles(x86)%\timerlib\styles\is-qdgak.tmp to %ProgramFiles(x86)%\timerlib\styles\qwindowsvistastyle.dll
- from %ProgramFiles(x86)%\timerlib\is-1onba.tmp to %ProgramFiles(x86)%\timerlib\libssl-1_1.dll
- from %ProgramFiles(x86)%\timerlib\is-u3tfv.tmp to %ProgramFiles(x86)%\timerlib\spoutlibrary.dll
- from %ProgramFiles(x86)%\timerlib\audio\is-rlj1v.tmp to %ProgramFiles(x86)%\timerlib\audio\qtaudio_wasapi.dll
- from %ProgramFiles(x86)%\timerlib\imageformats\is-opbmi.tmp to %ProgramFiles(x86)%\timerlib\imageformats\qwebp.dll
- from %ProgramFiles(x86)%\timerlib\is-2pi43.tmp to %ProgramFiles(x86)%\timerlib\qtwebengineprocess.exe
- from %ProgramFiles(x86)%\timerlib\is-1i7hn.tmp to %ProgramFiles(x86)%\timerlib\maintainer_business.md
- from %ProgramFiles(x86)%\timerlib\is-7u00u.tmp to %ProgramFiles(x86)%\timerlib\concrt140.dll
- from %ProgramFiles(x86)%\timerlib\is-v4v6i.tmp to %ProgramFiles(x86)%\timerlib\msvcp140.dll
- from %ProgramFiles(x86)%\timerlib\is-j5riv.tmp to %ProgramFiles(x86)%\timerlib\showmysky-qt5.dll
- from %ProgramFiles(x86)%\timerlib\is-bok2a.tmp to %ProgramFiles(x86)%\timerlib\vcruntime140.dll
- from %ProgramFiles(x86)%\timerlib\is-snb56.tmp to %ProgramFiles(x86)%\timerlib\stellarium.url
- from %ProgramFiles(x86)%\timerlib\is-mjm2r.tmp to %ProgramFiles(x86)%\timerlib\stellarium-devdocs.url
- from %ProgramFiles(x86)%\timerlib\is-c6a3d.tmp to %ProgramFiles(x86)%\timerlib\qt.conf
- from %ProgramFiles(x86)%\timerlib\is-ag93d.tmp to %ProgramFiles(x86)%\timerlib\backers.md
- from %ProgramFiles(x86)%\timerlib\is-a7iln.tmp to %ProgramFiles(x86)%\timerlib\building.md
- from %ProgramFiles(x86)%\timerlib\is-mhjcf.tmp to %ProgramFiles(x86)%\timerlib\contributing.md
- from %ProgramFiles(x86)%\timerlib\is-oij6f.tmp to %ProgramFiles(x86)%\timerlib\credits.md
- from %ProgramFiles(x86)%\timerlib\is-r6vo8.tmp to %ProgramFiles(x86)%\timerlib\readme.md
- from %ProgramFiles(x86)%\timerlib\is-04q1e.tmp to %ProgramFiles(x86)%\timerlib\qt5webchannel.dll
- from %ProgramFiles(x86)%\timerlib\is-vlt05.tmp to %ProgramFiles(x86)%\timerlib\gpl.txt
- from %ProgramFiles(x86)%\timerlib\is-ajcbt.tmp to %ProgramFiles(x86)%\timerlib\changelog.txt
- from %ProgramFiles(x86)%\timerlib\is-dhirv.tmp to %ProgramFiles(x86)%\timerlib\libegl.dll
- from %ProgramFiles(x86)%\timerlib\is-srrmh.tmp to %ProgramFiles(x86)%\timerlib\qt5multimedia.dll
- from %ProgramFiles(x86)%\timerlib\is-31pel.tmp to %ProgramFiles(x86)%\timerlib\qt5multimediawidgets.dll
- from %ProgramFiles(x86)%\timerlib\is-qne7g.tmp to %ProgramFiles(x86)%\timerlib\qt5opengl.dll
- from %ProgramFiles(x86)%\timerlib\is-h3u4u.tmp to %ProgramFiles(x86)%\timerlib\qt5positioning.dll
- from %ProgramFiles(x86)%\timerlib\is-uctuc.tmp to %ProgramFiles(x86)%\timerlib\qt5printsupport.dll
- from %ProgramFiles(x86)%\timerlib\is-dslso.tmp to %ProgramFiles(x86)%\timerlib\qt5quickwidgets.dll
- from %ProgramFiles(x86)%\timerlib\is-90igv.tmp to %ProgramFiles(x86)%\timerlib\qt5serialport.dll
- from %ProgramFiles(x86)%\timerlib\is-q223b.tmp to %ProgramFiles(x86)%\timerlib\qt5svg.dll
- from %ProgramFiles(x86)%\timerlib\is-35c36.tmp to %ProgramFiles(x86)%\timerlib\qt5webenginewidgets.dll
- from %ProgramFiles(x86)%\timerlib\is-f1t0b.tmp to %ProgramFiles(x86)%\timerlib\timerlib.exe
Network activity
Connects to
- 'mi####njobs.works':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?43######
HTTP POST requests
- http://mi####njobs.works/new/net_api
UDP
- DNS ASK mi####njobs.works
Miscellaneous
Searches for the following windows
- ClassName: 'jb2f7d_TL12022Class_jb2f7d' WindowName: ''
Creates and executes the following
- '%TEMP%\is-nt600.tmp\<File name>.tmp' /SL5="$60250,7058819,95744,<Full path to file>"
- '%ProgramFiles(x86)%\timerlib\timerlib.exe'
- '%ProgramFiles(x86)%\timerlib\timerlib.exe' 4ef3225e47c8d86d66835340da999df2
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "TL12022"
- '%WINDIR%\syswow64\schtasks.exe' /Query
