Technical Information
Modifies file system
Creates the following files
- %TEMP%\001041cd.log
- %TEMP%\inh106543760446\locale\id.locale
- %TEMP%\inh106543760446\locale\fr.locale
- %TEMP%\inh106543760446\locale\fi.locale
- %TEMP%\inh106543760446\locale\es.locale
- %TEMP%\inh106543760446\locale\en.locale
- %TEMP%\inh106543760446\locale\el.locale
- %TEMP%\inh106543760446\locale\de.locale
- %TEMP%\inh106543760446\locale\da.locale
- %TEMP%\inh106543760446\libs\localassests\icut\icut_v2_2.cis
- %TEMP%\inh106543760446\locale\ja.locale
- %TEMP%\inh106543760446\libs\localassests\icc\icc_v5_8.cis
- %TEMP%\inh106543760446\images\sponsored.png
- %TEMP%\inh106543760446\images\resume_button.png
- %TEMP%\inh106543760446\images\quick_specs.png
- %TEMP%\inh106543760446\images\progressbar.png
- %TEMP%\inh106543760446\images\progress.png
- %TEMP%\inh106543760446\images\pause_button.png
- %TEMP%\inh106543760446\locale\cs.locale
- %TEMP%\inh106543760446\css\sdk-ui\images\button-bg.png
- %TEMP%\inh106543760446\locale\ko.locale
- %TEMP%\in5d78~1\43b9f3~1.tmp
- %TEMP%\in5d78~1\43b9f3~1.par
- %APPDATA%\microsoft\internet explorer\userdata\y9hrrzj0\localstorage[1].xml
- %APPDATA%\microsoft\internet explorer\userdata\jm4pum3x\localstorage[1].xml
- %APPDATA%\microsoft\internet explorer\userdata\index.dat
- %ProgramFiles(x86)%\001058ef.log
- %TEMP%\inh106543760446\bootstrap_11544.html
- %TEMP%\00104c7c.log
- %TEMP%\inh106543760446\images\loader.gif
- %TEMP%\inh106543760446\locale\it.locale
- %TEMP%\inh106543760446\libeay32.dll
- %TEMP%\inh106543760446\locale\zh.locale
- %TEMP%\inh106543760446\locale\tr.locale
- %TEMP%\inh106543760446\locale\sv.locale
- %TEMP%\inh106543760446\locale\ru.locale
- %TEMP%\inh106543760446\locale\pt.locale
- %TEMP%\inh106543760446\locale\pl.locale
- %TEMP%\inh106543760446\locale\no.locale
- %TEMP%\inh106543760446\ssleay32.dll
- %TEMP%\inh106543760446\locale\nl.locale
- %TEMP%\inh106543760446\images\icon_generic.png
- %TEMP%\inh106543760446\images\grey_button_hover.png
- %TEMP%\inh106543760446\images\grey_button.png
- %TEMP%\inh106543760446\css\_helpers.scss
- %TEMP%\inh106543760446\css\helpers\_display.scss
- %TEMP%\inh106543760446\css\helpers\_colors.scss
- %TEMP%\inh106543760446\css\helpers\_clearfix.scss
- %TEMP%\inh106543760446\css\helpers\_border.scss
- %TEMP%\inh106543760446\css\helpers\_border-radius.scss
- %TEMP%\inh106543760446\css\helpers\_backgrounds.scss
- %TEMP%\inh106543760446\css\helpers\_align.scss
- %TEMP%\in5d7830f2\43b9f3d6_stp\osutils.vbs
- %TEMP%\inh106543760446\css\helpers\_lists.scss
- %TEMP%\inh106543760446\css\_functions.scss
- %TEMP%\inh106543760446\css\swagent.css
- %TEMP%\inh106543760446\css\main.scss
- %TEMP%\inh106543760446\css\main.css
- %TEMP%\inh106543760446\css\ie6_main.scss
- %TEMP%\inh106543760446\css\ie6_main.css
- %TEMP%\inh106543760446\form.bmp.mask
- %TEMP%\inh106543760446\csshover3.htc
- %TEMP%\inh106543760446\css\_variables.scss
- %TEMP%\00104c6c.log
- %TEMP%\inh106543760446\css\helpers\_margin.scss
- %TEMP%\inh106543760446\css\helpers\_typography.scss
- %TEMP%\inh106543760446\css\helpers\_padding.scss
- %TEMP%\inh106543760446\images\color_button_hover.png
- %TEMP%\inh106543760446\images\color_button.png
- %TEMP%\inh106543760446\images\close_hover.png
- %TEMP%\inh106543760446\images\close.png
- %TEMP%\inh106543760446\images\bg_m.png
- %TEMP%\inh106543760446\images\bg.png
- %TEMP%\inh106543760446\css\sdk-ui\images\progress-bg2.png
- %TEMP%\inh106543760446\css\helpers\_positions.scss
- %TEMP%\inh106543760446\css\sdk-ui\images\progress-bg.png
- %TEMP%\inh106543760446\css\helpers\_float.scss
- %TEMP%\inh106543760446\css\sdk-ui\_progress-bar.scss
- %TEMP%\inh106543760446\css\sdk-ui\_checkbox.scss
- %TEMP%\inh106543760446\css\sdk-ui\_button.scss
- %TEMP%\inh106543760446\css\sdk-ui\_browse.scss
- %TEMP%\inh106543760446\css\helpers\_z-index.scss
- %TEMP%\inh106543760446\css\helpers\_width-height.scss
- %TEMP%\inh106543760446\css\helpers\_visibility.scss
- %TEMP%\inh106543760446\css\sdk-ui\images\progress-bg-corner.png
- %TEMP%\in5d7830f2\43b9f3d6_stp\run.vbs
Deletes the following files
- %TEMP%\001041cd.log
- %TEMP%\00104c6c.log
- %TEMP%\00104c7c.log
- %ProgramFiles(x86)%\001058ef.log
- %TEMP%\inh106543760446\bootstrap_11544.html
- %APPDATA%\microsoft\internet explorer\userdata\jm4pum3x\localstorage[1].xml
Network activity
TCP
HTTP GET requests
- http://dn##.######loads.com.s3.amazonaws.com/backup_dnld_bucket/public/Firebug/firebug-lite.js
- http://we#####.timeh-ton.com/img/Tavasat/15Feb17/v2/EN.png
- http://we#####.timeh-ton.com/img/Sibarasawi/bg_comp.png
- http://we#####.timeh-ton.com/img/Sibarasawi/logo_comp.png
- http://we#####.timeh-ton.com/img/Sibarasawi/TPC_win_bg.png
- http://we#####.timeh-ton.com/img/Sibarasawi/TPC_img_bg.png
- http://we#####.timeh-ton.com/img/Vavavag/V2/NL.png
- http://my###.timeh-ton.com/ofr/Solululadul/osutils
HTTP POST requests
- http://si#.##meh-ton.com/
- http://wh#.##meh-ton.com/
UDP
- DNS ASK si#.##meh-ton.com
- DNS ASK wh#.##meh-ton.com
- DNS ASK dn##.######loads.com.s3.amazonaws.com
- DNS ASK we#####.timeh-ton.com
- DNS ASK my###.timeh-ton.com
- DNS ASK ge###rebug.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
