Technical Information
Modifies file system
Creates the following files
- %TEMP%\000efcab.log
- %TEMP%\inh98220363211\locale\nl.locale
- %TEMP%\inh98220363211\locale\ja.locale
- %TEMP%\inh98220363211\locale\it.locale
- %TEMP%\inh98220363211\locale\fr.locale
- %TEMP%\inh98220363211\locale\es.locale
- %TEMP%\inh98220363211\locale\en.locale
- %TEMP%\inh98220363211\locale\de.locale
- %TEMP%\inh98220363211\locale\cs.locale
- %TEMP%\inh98220363211\libs\localassests\icut\icut_v2_2.cis
- %TEMP%\inh98220363211\libs\localassests\icc\icc_v5_8.cis
- %TEMP%\inh98220363211\images\sponsored.png
- %TEMP%\inh98220363211\images\resume_button.png
- %TEMP%\inh98220363211\images\quick_specs.png
- %TEMP%\inh98220363211\images\progressbar.png
- %TEMP%\inh98220363211\images\progress.png
- %TEMP%\inh98220363211\images\pause_button.png
- %TEMP%\inh98220363211\images\loader.gif
- %TEMP%\inh98220363211\images\grey_button_hover.png
- %TEMP%\inh98220363211\images\icon_generic.png
- %TEMP%\inh98220363211\locale\pl.locale
- %TEMP%\inh98220363211\locale\pt.locale
- %TEMP%\in633be9d5\18269a04_stp\wp24.html
- %TEMP%\in633be9d5\18269a04_stp\we23.html
- %TEMP%\in633b~1\18269a~1.tmp
- %TEMP%\in633b~1\18269a~1.par
- %TEMP%\in633b~1\6ebacc~1.par
- %TEMP%\in633be9d5\6e9f0533_stp\run.vbs
- %TEMP%\in633be9d5\6e9f0533_stp\osutils.vbs
- %TEMP%\in633b~1\6ebacc~1.tmp
- %TEMP%\in633b~1\6e9f05~1.par
- %TEMP%\inh98220363211\css\sdk-ui\_progress-bar.scss
- %ProgramFiles(x86)%\000f2d41.log
- %TEMP%\inh98220363211\bootstrap_30734.html
- %TEMP%\000f08a2.log
- %TEMP%\000f0892.log
- %TEMP%\inh98220363211\ssleay32.dll
- %TEMP%\inh98220363211\libeay32.dll
- %TEMP%\inh98220363211\locale\tr.locale
- %TEMP%\inh98220363211\locale\ru.locale
- %TEMP%\inh98220363211\images\grey_button.png
- %TEMP%\inh98220363211\images\color_button_hover.png
- %TEMP%\inh98220363211\images\color_button.png
- %TEMP%\inh98220363211\css\helpers\_colors.scss
- %TEMP%\inh98220363211\css\helpers\_clearfix.scss
- %TEMP%\inh98220363211\css\helpers\_border.scss
- %TEMP%\inh98220363211\css\helpers\_border-radius.scss
- %TEMP%\inh98220363211\css\helpers\_backgrounds.scss
- %TEMP%\inh98220363211\css\helpers\_align.scss
- %TEMP%\inh98220363211\css\_variables.scss
- %TEMP%\inh98220363211\css\_helpers.scss
- %TEMP%\inh98220363211\css\_functions.scss
- %TEMP%\inh98220363211\css\swagent.css
- %TEMP%\inh98220363211\css\main.scss
- %TEMP%\inh98220363211\css\main.css
- %TEMP%\inh98220363211\css\ie6_main.scss
- %TEMP%\inh98220363211\css\ie6_main.css
- %TEMP%\inh98220363211\form.bmp.mask
- %TEMP%\inh98220363211\csshover3.htc
- %TEMP%\inh98220363211\css\helpers\_float.scss
- %TEMP%\inh98220363211\css\helpers\_lists.scss
- %TEMP%\inh98220363211\css\helpers\_display.scss
- %TEMP%\inh98220363211\css\helpers\_margin.scss
- %TEMP%\inh98220363211\images\close_hover.png
- %TEMP%\inh98220363211\css\helpers\_padding.scss
- %TEMP%\inh98220363211\images\close.png
- %TEMP%\inh98220363211\images\bgt.png
- %TEMP%\inh98220363211\images\bgo.png
- %TEMP%\inh98220363211\images\bg.png
- %TEMP%\inh98220363211\css\sdk-ui\images\progress-bg2.png
- %TEMP%\inh98220363211\css\sdk-ui\images\progress-bg.png
- %TEMP%\inh98220363211\css\sdk-ui\images\progress-bg-corner.png
- %TEMP%\in633b~1\6e9f05~1.tmp
- %TEMP%\in633be9d5\6ebacc85_stp\icut.dat
- %TEMP%\inh98220363211\css\sdk-ui\_checkbox.scss
- %TEMP%\inh98220363211\css\sdk-ui\_button.scss
- %TEMP%\inh98220363211\css\sdk-ui\_browse.scss
- %TEMP%\inh98220363211\css\helpers\_z-index.scss
- %TEMP%\inh98220363211\css\helpers\_width-height.scss
- %TEMP%\inh98220363211\css\helpers\_visibility.scss
- %TEMP%\inh98220363211\css\helpers\_typography.scss
- %TEMP%\inh98220363211\css\helpers\_positions.scss
- %TEMP%\inh98220363211\css\sdk-ui\images\button-bg.png
- %TEMP%\000f966a.log
Deletes the following files
- %TEMP%\000efcab.log
- %TEMP%\000f0892.log
- %TEMP%\000f08a2.log
- %ProgramFiles(x86)%\000f2d41.log
- %TEMP%\inh98220363211\bootstrap_30734.html
- %TEMP%\000f966a.log
Moves the following files
- from %TEMP%\in633be9d5\18269a04_stp\we23.html to %TEMP%\bf_yl\we23.html
- from %TEMP%\in633be9d5\18269a04_stp\wp24.html to %TEMP%\bf_yl\wp24.html
Network activity
TCP
HTTP GET requests
- http://bb#.###ekol-mesir.com/ofr/Solululadul/osutils
- http://ww#.###ekol-mesir.com/img/Tavasat/15Feb17/v2/EN.png
- http://ww#.###ekol-mesir.com/img/Sibarasawi/TPC_win_bg.png
- http://bb#.###ekol-mesir.com/ofr/Solululadul/icut_v2_2
- http://ww#.###ekol-mesir.com/img/Sibarasawi/TPC_img_bg.png
- http://ww#.###ekol-mesir.com/ofr/Niniwic/YL/Niniwic_Tefenece_12Apr16
- http://ww#.###ekol-mesir.com/img/Sibarasawi/bg_comp.png
- http://ww#.###ekol-mesir.com/img/Sibarasawi/logo_comp.png
- http://ww#.###ekol-mesir.com/img/Jimomoromoj/Jimomoromoj_logo_080320.png
- http://ww#.###ekol-mesir.com/img/Tefenece/Tefenece_logo_black.png
- http://ww#.###ekol-mesir.com/img/Vavavag/V2/NL.png
HTTP POST requests
- http://gw.####kol-mesir.com/
- http://ww#.###ekol-mesir.com/
UDP
- DNS ASK ww#.###ekol-mesir.com
- DNS ASK gw.####kol-mesir.com
- DNS ASK bb#.###ekol-mesir.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '<Full path to file>' /_ShowProgress /mnl' (with hidden window)
