Technical Information
Modifies file system
Creates the following files
- %TEMP%\00105fd5.log
- %TEMP%\inh107312547270\locale\fi.locale
- %TEMP%\inh107312547270\locale\es.locale
- %TEMP%\inh107312547270\locale\en.locale
- %TEMP%\inh107312547270\locale\el.locale
- %TEMP%\inh107312547270\locale\de.locale
- %TEMP%\inh107312547270\locale\da.locale
- %TEMP%\inh107312547270\locale\cs.locale
- %TEMP%\inh107312547270\libs\localassests\icut\icut_v2_2.cis
- %TEMP%\inh107312547270\libs\localassests\icc\icc_v5_8.cis
- %TEMP%\inh107312547270\images\sponsored.png
- %TEMP%\inh107312547270\images\resume_button.png
- %TEMP%\inh107312547270\images\quick_specs.png
- %TEMP%\inh107312547270\images\progressbar.png
- %TEMP%\inh107312547270\images\progress.png
- %TEMP%\inh107312547270\images\pause_button.png
- %TEMP%\inh107312547270\images\loader.gif
- %TEMP%\inh107312547270\images\icon_generic.png
- %TEMP%\inh107312547270\locale\fr.locale
- %TEMP%\inh107312547270\locale\id.locale
- %TEMP%\inh107312547270\locale\it.locale
- %TEMP%\inh107312547270\locale\ja.locale
- %TEMP%\in6af0~1\47105b~1.tmp
- %TEMP%\in6af0~1\47105b~1.par
- %ProgramFiles(x86)%\00107f53.log
- %TEMP%\inh107312547270\bootstrap_55663.html
- %TEMP%\0010709e.log
- %TEMP%\0010708e.log
- %TEMP%\inh107312547270\ssleay32.dll
- %TEMP%\inh107312547270\libeay32.dll
- %TEMP%\inh107312547270\locale\vi.locale
- %TEMP%\inh107312547270\locale\zh.locale
- %TEMP%\inh107312547270\locale\tr.locale
- %TEMP%\inh107312547270\locale\sv.locale
- %TEMP%\inh107312547270\locale\ru.locale
- %TEMP%\inh107312547270\locale\pt.locale
- %TEMP%\inh107312547270\locale\pl.locale
- %TEMP%\inh107312547270\locale\no.locale
- %TEMP%\inh107312547270\locale\nl.locale
- %TEMP%\inh107312547270\locale\ko.locale
- %TEMP%\in6af024e8\47105bbe_stp\osutils.vbs
- %TEMP%\inh107312547270\images\grey_button_hover.png
- %TEMP%\inh107312547270\images\grey_button.png
- %TEMP%\inh107312547270\images\color_button_hover.png
- %TEMP%\inh107312547270\css\helpers\_display.scss
- %TEMP%\inh107312547270\css\helpers\_colors.scss
- %TEMP%\inh107312547270\css\helpers\_clearfix.scss
- %TEMP%\inh107312547270\css\helpers\_border.scss
- %TEMP%\inh107312547270\css\helpers\_border-radius.scss
- %TEMP%\inh107312547270\css\helpers\_backgrounds.scss
- %TEMP%\inh107312547270\css\helpers\_align.scss
- %TEMP%\inh107312547270\css\_variables.scss
- %TEMP%\inh107312547270\css\_helpers.scss
- %TEMP%\inh107312547270\css\_functions.scss
- %TEMP%\inh107312547270\css\swagent.css
- %TEMP%\inh107312547270\css\main.scss
- %TEMP%\inh107312547270\css\main.css
- %TEMP%\inh107312547270\css\ie6_main.scss
- %TEMP%\inh107312547270\css\ie6_main.css
- %TEMP%\inh107312547270\form.bmp.mask
- %TEMP%\inh107312547270\csshover3.htc
- %TEMP%\inh107312547270\css\helpers\_float.scss
- %TEMP%\inh107312547270\css\helpers\_lists.scss
- %TEMP%\inh107312547270\css\helpers\_margin.scss
- %TEMP%\inh107312547270\css\helpers\_padding.scss
- %TEMP%\inh107312547270\images\close_hover.png
- %TEMP%\inh107312547270\images\close.png
- %TEMP%\inh107312547270\images\bgw.png
- %TEMP%\inh107312547270\images\bgr.png
- %TEMP%\inh107312547270\images\bg.png
- %TEMP%\inh107312547270\css\sdk-ui\images\progress-bg2.png
- %TEMP%\inh107312547270\css\sdk-ui\images\progress-bg.png
- %TEMP%\inh107312547270\css\sdk-ui\images\progress-bg-corner.png
- %TEMP%\inh107312547270\css\sdk-ui\_progress-bar.scss
- %TEMP%\inh107312547270\css\sdk-ui\images\button-bg.png
- %TEMP%\inh107312547270\css\sdk-ui\_checkbox.scss
- %TEMP%\inh107312547270\css\sdk-ui\_button.scss
- %TEMP%\inh107312547270\css\sdk-ui\_browse.scss
- %TEMP%\inh107312547270\css\helpers\_z-index.scss
- %TEMP%\inh107312547270\css\helpers\_width-height.scss
- %TEMP%\inh107312547270\css\helpers\_visibility.scss
- %TEMP%\inh107312547270\css\helpers\_typography.scss
- %TEMP%\inh107312547270\css\helpers\_positions.scss
- %TEMP%\inh107312547270\images\color_button.png
- %TEMP%\in6af024e8\47105bbe_stp\run.vbs
Deletes the following files
- %TEMP%\00105fd5.log
- %TEMP%\0010708e.log
- %TEMP%\0010709e.log
- %ProgramFiles(x86)%\00107f53.log
- %TEMP%\inh107312547270\bootstrap_55663.html
Network activity
TCP
HTTP GET requests
- http://im#.###aser-roto.com/img/FF_logo_new.png
- http://im#.###aser-roto.com/img/IE_logo_new.png
- http://my###.#iyaser-roto.com/img/Fonawemi/logoNewText39.png
- http://my###.#iyaser-roto.com/img/Fonawemi/logoNew39.png
- http://ba####.wiyaser-roto.com/ofr/Solululadul/osutils
- http://my###.#iyaser-roto.com/img/Fonawemi/logoNewTextWhite39.png
- http://my###.#iyaser-roto.com/img/Sibarasawi/bg_comp.png
- http://my###.#iyaser-roto.com/img/Sibarasawi/logo_comp.png
- http://my###.#iyaser-roto.com/img/Sibarasawi/TPC_win_bg.png
- http://my###.#iyaser-roto.com/img/Sibarasawi/TPC_img_bg.png
- http://my###.#iyaser-roto.com/img/Tavasat/15Feb17/v2/EN.png
- http://my###.#iyaser-roto.com/img/Vavavag/V2/NL.png
HTTP POST requests
- http://li##.##yaser-roto.com/
- http://sq#.###aser-roto.com/
UDP
- DNS ASK li##.##yaser-roto.com
- DNS ASK sq#.###aser-roto.com
- DNS ASK ba####.wiyaser-roto.com
- DNS ASK im#.###aser-roto.com
- DNS ASK my###.#iyaser-roto.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '<Full path to file>' /_ShowProgress /mnl' (with hidden window)
