Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Ticno Tree' = '%PROGRAM_FILES%\Ticno\Ticno Tree\Tree.exe'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\Ticno\Ticno Tree\Tree.exe' -amaze
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\MessageListBg\1.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Main\close-press.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Main\close-norm.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\MessageListBg\2.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\MessageListBg\5.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\MessageListBg\4.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\MessageListBg\3.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Main\close-hover.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00137.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00136.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00135.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00138.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Main\ad-frame.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00140.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00139.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\bg_language.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\bg_center.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\bg_bottom.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\bg_language2.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\btn2_25.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\btn1_35.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\bg_top.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\arrow_8.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\MessageListBg\8.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\MessageListBg\7.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\MessageListBg\6.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\MessageListBg\left.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\MessageListBg\.viewer\thumb.cache
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\MessageListBg\.viewer\cache.config
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\MessageListBg\right.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00115.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00114.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00113.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00116.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00119.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00118.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00117.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00112.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00107.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00106.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00105.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00108.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00111.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00110.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00109.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00130.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00129.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00128.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00131.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00134.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00133.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00132.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00127.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00122.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00121.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00120.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00123.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00126.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00125.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00124.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\buttons\button_activate.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\buttons\button.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\buttons\btn_grey_right.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\buttons\button_buy.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\buttons\button_info.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\buttons\button_close_popup.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\buttons\button_close.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\buttons\btn_grey_left.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\tree.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\left-buy.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\key_input.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\buttons\btn_blue_1px.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\buttons\btn_grey_1px.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\buttons\btn_blue_right.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\buttons\btn_blue_left.png
- %TEMP%\nsm3.tmp\ShellExecAsUser.dll
- %PROGRAM_FILES%\Ticno\Ticno Tree\ping.txt
- %TEMP%\nsm3.tmp\NSISdl.dll
- %APPDATA%\ticno\Tree\config\tree.db-journal
- %APPDATA%\ticno\Tree\6c816bf5-7213-4459-8660-baee1cd180e6.dmp
- %APPDATA%\ticno\Tree\banners.xml
- %APPDATA%\ticno\Tree\config\tree.db
- %ALLUSERSPROFILE%\Desktop\Amaze me.lnk
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\buy\text_eng.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\buy\bg_right.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\buy\bg_left.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\buy\text_rus.png
- %ALLUSERSPROFILE%\Start Menu\Programs\Ticno\Ticno Tree.lnk
- %TEMP%\nsm3.tmp\System.dll
- %PROGRAM_FILES%\Ticno\Ticno Tree\Uninstall.exe
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\title2.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\title1.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\question_9.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\.viewer\cache.config
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\lang\ico_ru.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\lang\ico_en.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\.viewer\thumb.cache
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\line.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\close_9.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\checkbox_16.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\btn3_25.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\input_center.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\label.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\input_right.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Settings\input_left.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\button_close.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\button_buy.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\button_activate.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\button_close_popup.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\checking-big.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\buy-2eng.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\buy-2.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\button.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\bg_buy_left_en.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\bg3_rus.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\bg3_eng.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\bg_buy_left_ru.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\bg_right_small.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\bg_right_big.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\promo\bg_buy_right.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00025.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00024.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00023.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00026.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00029.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00028.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00027.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00022.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00017.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00016.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00015.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00018.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00021.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00020.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00019.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00040.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00039.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00038.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00041.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00044.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00043.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00042.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00037.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00032.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00031.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00030.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00033.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00036.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00035.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00034.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Fonts\dereza.TTF
- %PROGRAM_FILES%\Ticno\Ticno Tree\Config\words.xml
- %PROGRAM_FILES%\Ticno\Ticno Tree\Config\cookies
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Ads\treele-close.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\back.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\palette
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Ads\treele-logo.png
- %PROGRAM_FILES%\Ticno\Ticno Tree\Config\config.xml
- %TEMP%\Tree_un\KillProcDLL.dll
- %TEMP%\nsm3.tmp\UAC.dll
- %TEMP%\nsc2.tmp
- %PROGRAM_FILES%\Ticno\Ticno Tree\ShExtMng.dll
- %PROGRAM_FILES%\Ticno\Ticno Tree\libcurl.dll
- %PROGRAM_FILES%\Ticno\Ticno Tree\draw.dll
- %PROGRAM_FILES%\Ticno\Ticno Tree\Tree.exe
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00010.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00009.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00008.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00011.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00014.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00013.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00012.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00007.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00002.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00001.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00000.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00003.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00006.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00005.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00004.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00085.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00084.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00083.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00086.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00089.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00088.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00087.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00082.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00077.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00076.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00075.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00078.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00081.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00080.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00079.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00100.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00099.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00098.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00101.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00104.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00103.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00102.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00097.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00092.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00091.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00090.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00093.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00096.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00095.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00094.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00055.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00054.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00053.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00056.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00059.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00058.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00057.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00052.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00047.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00046.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00045.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00048.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00051.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00050.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00049.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00070.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00069.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00068.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00071.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00074.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00073.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00072.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00067.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00062.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00061.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00060.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00063.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00066.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00065.bmp.RLE
- %PROGRAM_FILES%\Ticno\Ticno Tree\Images\Animation\frames\tree_loop00064.bmp.RLE
Deletes the following files:
- %TEMP%\nsm3.tmp\UAC.dll
- %APPDATA%\ticno\Tree\config\tree.db-journal
- %TEMP%\nsm3.tmp\System.dll
- %TEMP%\nsm3.tmp\NSISdl.dll
- %TEMP%\nsm3.tmp\ShellExecAsUser.dll
Network activity:
Connects to:
- 'tr##le.com':80
- 'ad###.#tatrec.ticno.com':80
TCP:
HTTP GET requests:
- http://tr##le.com/xml/ad_feed.xml?la#####
- http://ad###.#tatrec.ticno.com/?pi##########################################################
- http://ad###.#tatrec.ticno.com/?pi#########################################
UDP:
- DNS ASK tr##le.com
- DNS ASK ad###.#tatrec.ticno.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
