Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Ticno Go' = '"%PROGRAM_FILES%\Ticno\Go\Go.exe" /autorun'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Ticno Go' = '"%PROGRAM_FILES%\Ticno\Go\Go.exe"'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\TicnoShExtMng] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\Ticno\Go\Temp\WeatherSetup.exe' /S _?="%APPDATA%\Ticno\Go\Temp"
- '%PROGRAM_FILES%\Ticno\Go\Go.exe'
- '%ALLUSERSPROFILE%\Application Data\ticno\Weather\Weather.exe' /geticon
- '%PROGRAM_FILES%\Ticno\ShExtMng\ShExtMng.exe'
- '%APPDATA%\Ticno\Go\Temp\ShExtMngSetup.exe' /S _?="%APPDATA%\Ticno\Go\Temp"
- '%PROGRAM_FILES%\Ticno\ShExtMng\ShExtMngService.exe' -i
- '%PROGRAM_FILES%\Ticno\ShExtMng\ShExtMngService.exe'
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_open_agile_left_top.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_open_agile_right_bottom.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_open_agile_left_bottom.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\scrollfone.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_arrow.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_open_center_left.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_open_center_right.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_open_center_center.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_open_agile_right_top.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_open_center_bottom.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\scroll.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\next.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\next1.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\main_window_bg.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\key_right.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\list-item.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\prev.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\prev1.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\planner_plus.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\on-off.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\on_off.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_open_center_top.png
- %ALLUSERSPROFILE%\Application Data\boost_interprocess\20150625163544.906250\ShExtMngPort
- %TEMP%\nsi6.tmp\NSISdl.dll
- %TEMP%\nsi6.tmp\System.dll
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\window-sidebar.png
- %PROGRAM_FILES%\Ticno\ShExtMng\Uninstall.exe
- %TEMP%\Weather_un\KillProcDLL.dll
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\ShExtMng.dll
- %TEMP%\nso9.tmp\UAC.dll
- %PROGRAM_FILES%\Ticno\ShExtMng\unping.txt
- %TEMP%\nsj8.tmp
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\window-right.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\slider_point.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\slider_right.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\slider_left.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\slider_center.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\slider_full.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\tab_plus.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\window-center.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\tab_active_tplus.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\tab.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\tab_active.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\key_left.png
- %PROGRAM_FILES%\Ticno\ShExtMng\ShExtMngService.exe
- %PROGRAM_FILES%\Ticno\ShExtMng\lang.ru.dll
- %PROGRAM_FILES%\Ticno\ShExtMng\ShExtMng.exe
- %TEMP%\nsi6.tmp\UAC.dll
- %PROGRAM_FILES%\Ticno\ShExtMng\ShExtMng.dll
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\add_plus.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\button.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\ScreenShooter.png
- %PROGRAM_FILES%\Ticno\ShExtMng\updater.dll
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\DESIGN.bmp
- %TEMP%\nsc5.tmp
- %TEMP%\nso3.tmp\System.dll
- %HOMEPATH%\Start Menu\Programs\Ticno\Ticno Go.lnk
- %PROGRAM_FILES%\Ticno\Go\Uninstall.exe
- %APPDATA%\Ticno\Go\apps\Urls\yandex.ru.png
- %APPDATA%\Ticno\Go\apps\Urls\youtube.com.png
- %HOMEPATH%\Desktop\Ticno Go.lnk
- %HOMEPATH%\Desktop\Ticno Games.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Ticno Games.lnk
- %HOMEPATH%\Start Menu\Programs\Ticno\Ticno Games.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Ticno Go.lnk
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\button_hover.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\ground_planner_top.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\ground_top.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\ground_planner_center.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\ground_center.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\ground_planner_bottom.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\key-button.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\key_center.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\input_right.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\input_center.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\input_left.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\ground_bottom.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\cliper_arrow_left.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\cliper_arrow_right.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\button_presshover.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\button_normal.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\button_press.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\closemain.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\delete.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\close_button.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\close.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\close1.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\Weather.exe
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\main\weather icons 32x32\cloud.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\main\weather icons 32x32\na.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\main\night-temp.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\main\frames.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\main\moon.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\menu\bg.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\menu\bg2.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\main\weather icons 32x32\sun.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\main\weather icons 32x32\rain.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\main\weather icons 32x32\snow.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\main\frame.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\controls\bg.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\controls\close.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\cb\slider.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\big\sun.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\cb\bg.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\controls\unpin.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\main\current-temp.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\controls\settings.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\controls\minimize.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\controls\pin.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\today\current-temp.png
- %PROGRAM_FILES%\Ticno\Go\ping.txt
- %TEMP%\nso3.tmp\ShellExecAsUser.dll
- %TEMP%\nso3.tmp\NSISdl.dll
- %TEMP%\nso9.tmp\NSISdl.dll
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\ping.txt
- %APPDATA%\Ticno\Go\config.xml
- %APPDATA%\Ticno\weather\config.xml
- %APPDATA%\Ticno\Go\apps\ShortCuts\Ticno Go.lnk
- %APPDATA%\Ticno\Go\newfeed-244.xml
- %APPDATA%\Ticno\Go\apps\ShortCuts\Ticno Games.lnk
- %TEMP%\nso9.tmp\System.dll
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\today\wind\n.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\today\wind\ne.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\today\wind\es.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\today\frame.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\today\wind\e.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\today\wind\wn.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\Uninstall.exe
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\today\wind\w.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\today\wind\s.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\today\wind\sw.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\big\snow.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\default.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\delete.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\cloud.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\city-field.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\close.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\moon.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\na.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\moon-clouds.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\left.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\main_bg.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\cancel.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\data\icons.csv
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\data\names.csv
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\data\dict.RU.csv
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\lang.ru.dll
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\libcurl.dll
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\add.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\bg.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\add-remove.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\C-button.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\F-button.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\rain.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\big\moon-clouds.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\big\moon.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\big\icy.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\128x128 bar icons\temp-indicator.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\big\cloud.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\big\snow-flash.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\big\snow-rain.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\big\rain.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\big\na.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\big\rain-flash.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\128x128 bar icons\sun.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\snow.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\sun.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\shadow.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\right.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\save.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\128x128 bar icons\rain.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\128x128 bar icons\snow.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\128x128 bar icons\na.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\temp-indicator.png
- %ALLUSERSPROFILE%\Application Data\ticno\Weather\skin\128x128 bar icons\cloud.png
- %PROGRAM_FILES%\Ticno\Go\skin\page\click-page.png
- %PROGRAM_FILES%\Ticno\Go\skin\page\current-page.png
- %PROGRAM_FILES%\Ticno\Go\skin\icon\small\normal-mask.png
- %PROGRAM_FILES%\Ticno\Go\skin\icon\small\hover-mask.png
- %PROGRAM_FILES%\Ticno\Go\skin\icon\small\normal-base.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\miarti\promo-1-en.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\miarti\promo-1-ru.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\preloader.png
- %PROGRAM_FILES%\Ticno\Go\skin\page\hover-page.png
- %PROGRAM_FILES%\Ticno\Go\skin\page\normal-page.png
- %PROGRAM_FILES%\Ticno\Go\skin\icon\small\hover-base.png
- %PROGRAM_FILES%\Ticno\Go\skin\icon\big\click-mask.png
- %PROGRAM_FILES%\Ticno\Go\skin\icon\big\hover-base.png
- %PROGRAM_FILES%\Ticno\Go\skin\icon\big\click-base.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\icon\weather.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\icon\web.png
- %PROGRAM_FILES%\Ticno\Go\skin\icon\small\click-base.png
- %PROGRAM_FILES%\Ticno\Go\skin\icon\small\click-mask.png
- %PROGRAM_FILES%\Ticno\Go\skin\icon\big\normal-mask.png
- %PROGRAM_FILES%\Ticno\Go\skin\icon\big\hover-mask.png
- %PROGRAM_FILES%\Ticno\Go\skin\icon\big\normal-base.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\miarti\promo-2-en.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\tree\promo-tree-bg-ru.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\tree\title1-en.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\tree\promo-tree-bg-en.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\tree\download-pressed.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\tree\download-ru.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\tree\title3-en.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\tree\title3-ru.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\tree\title2-ru.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\tree\title1-ru.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\tree\title2-en.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\tree\download-normal.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\miarti\promo1-en.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\miarti\promo2-en.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\miarti\promo-3-ru.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\miarti\promo-2-ru.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\miarti\promo-3-en.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\tree\download-en.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\tree\download-hover.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\tree\cancel-ru.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\miarti\promo3-en.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\tree\cancel-en.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\icon\soft.png
- %PROGRAM_FILES%\Ticno\Go\skin\Button\top.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\cancel_icon.png
- %PROGRAM_FILES%\Ticno\Go\skin\Button\right.png
- %PROGRAM_FILES%\Ticno\Go\skin\Button\center.png
- %PROGRAM_FILES%\Ticno\Go\skin\Button\left.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Bg\bottom_right.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Bg\center.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Bg\bottom_left.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\empty_icon.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Bg\bottom.png
- %PROGRAM_FILES%\Ticno\Go\skin\Button\bottom.png
- %PROGRAM_FILES%\Ticno\Go\Go.exe
- %PROGRAM_FILES%\Ticno\Go\ShExtMng.dll
- %TEMP%\nso3.tmp\UAC.dll
- %TEMP%\nso2.tmp
- %TEMP%\nso3.tmp\version.dll
- %PROGRAM_FILES%\Ticno\Go\skin\close.png
- %PROGRAM_FILES%\Ticno\Go\skin\icon.png
- %PROGRAM_FILES%\Ticno\Go\lang\lang.lng
- %PROGRAM_FILES%\Ticno\Go\feed-203.xml
- %PROGRAM_FILES%\Ticno\Go\games.ico
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Bg\left.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Separator\separator_y.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Title\title_center.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Separator\separator_x.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Hover\hover_topleft.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Hover\hover_topright.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\icon\games.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\icon\inspire.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\icon\amaze.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Title\title_left.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Title\title_right.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Hover\hover_top.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Bg\top_right.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Hover\hover_bottom.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Bg\top_left.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Bg\right.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Bg\top.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Hover\hover_left.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Hover\hover_right.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Hover\hover_inside.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Hover\hover_bottomleft.png
- %PROGRAM_FILES%\Ticno\Go\skin\Window\Hover\hover_bottomright.png
- %PROGRAM_FILES%\Ticno\Go\skin\promo\tree\title4-en.png
- %APPDATA%\Ticno\Go\apps\Games\96\96.jpg
- %APPDATA%\Ticno\Go\apps\Games\97\97.jpg
- %APPDATA%\Ticno\Go\apps\Games\95\95.jpg
- %APPDATA%\Ticno\Go\apps\Games\95\0f7b16113e6de7cdf41212bbf030344b37734219.jpg
- %APPDATA%\Ticno\Go\apps\Games\95\20c12059940cd9aa5453b6151fa6b57923999d51.jpg
- %APPDATA%\Ticno\Go\apps\Urls\avito.ru.png
- %APPDATA%\Ticno\Go\apps\Urls\championat.com.png
- %APPDATA%\Ticno\Go\apps\Urls\auto.ru.png
- %APPDATA%\Ticno\Go\apps\Urls\101.ru.png
- %APPDATA%\Ticno\Go\apps\Urls\afisha.ru.png
- %APPDATA%\Ticno\Go\apps\Games\95\0e89c53acfd3fe0f9756379a4c56abc395667efa.jpg
- %APPDATA%\Ticno\Go\apps\Games\79\9567a1edcbfe9f72a0bf17cc45f9a1e045d090c1.jpg
- %APPDATA%\Ticno\Go\apps\Games\79\abbc35c18b7a2ce0460e6ccd5d16b3f8f799989f.jpg
- %APPDATA%\Ticno\Go\apps\Games\79\7fe2066ee9479fc5c48ea1d3ade7024d3d2e6a56.jpg
- %APPDATA%\Ticno\Go\apps\Games\72\b968e70ffa83d6b7c4d481725bf82aed28bc30b5.jpg
- %APPDATA%\Ticno\Go\apps\Games\79\79.jpg
- %APPDATA%\Ticno\Go\apps\Games\88\88.jpg
- %APPDATA%\Ticno\Go\apps\Games\90\90.jpg
- %APPDATA%\Ticno\Go\apps\Games\88\1b52a9e560cf8121de866e5784fdfe57d1f015e9.jpg
- %APPDATA%\Ticno\Go\apps\Games\88\0276cfde9961bacee3bdb515d94c930af730ed05.jpg
- %APPDATA%\Ticno\Go\apps\Games\88\18839ae43884301dc2e321654582b55a628d0a43.jpg
- %APPDATA%\Ticno\Go\apps\Urls\echo.msk.ru.png
- %APPDATA%\Ticno\Go\apps\Urls\rambler.ru.png
- %APPDATA%\Ticno\Go\apps\Urls\rbc.ru.png
- %APPDATA%\Ticno\Go\apps\Urls\ozon.ru.png
- %APPDATA%\Ticno\Go\apps\Urls\my.mail.ru.png
- %APPDATA%\Ticno\Go\apps\Urls\odnoklassniki.ru.png
- %APPDATA%\Ticno\Go\apps\Urls\vk.com.png
- %APPDATA%\Ticno\Go\apps\Urls\woman.ru.png
- %APPDATA%\Ticno\Go\apps\Urls\tiu.ru.png
- %APPDATA%\Ticno\Go\apps\Urls\ru.wikipedia.org.png
- %APPDATA%\Ticno\Go\apps\Urls\softportal.com.png
- %APPDATA%\Ticno\Go\apps\Urls\mamba.ru.png
- %APPDATA%\Ticno\Go\apps\Urls\google.com.png
- %APPDATA%\Ticno\Go\apps\Urls\headhunter.ru.png
- %APPDATA%\Ticno\Go\apps\Urls\gismeteo.ru.png
- %APPDATA%\Ticno\Go\apps\Urls\facebook.com.png
- %APPDATA%\Ticno\Go\apps\Urls\fotostrana.ru.png
- %APPDATA%\Ticno\Go\apps\Urls\livejournal.com.png
- %APPDATA%\Ticno\Go\apps\Urls\mail.ru.png
- %APPDATA%\Ticno\Go\apps\Urls\lenta.ru.png
- %APPDATA%\Ticno\Go\apps\Urls\imhonet.ru.png
- %APPDATA%\Ticno\Go\apps\Urls\kinopoisk.ru.png
- %APPDATA%\Ticno\Go\apps\Games\72\84347e5579c8138956c37c8c2aacdea7244951fa.jpg
- %APPDATA%\Ticno\Go\apps\Games\122\122.jpg
- %APPDATA%\Ticno\Go\apps\Games\122\1dcccee2be6cbc91ba0292d8b078648b7293671a.jpg
- %APPDATA%\Ticno\Go\apps\Games\122\0a6486272e1ff779660fa504e131b7e94715ecd1.jpg
- %APPDATA%\Ticno\Go\apps\Games\107\45e7f2fae2feebbded8e4722753788211a6a005b.jpg
- %APPDATA%\Ticno\Go\apps\Games\107\76d067a4fc5d129551516d433faf2f5983db80e8.jpg
- %APPDATA%\Ticno\Go\apps\Games\129\c735a00498180e785c303a840a111b35d508cdf4.jpg
- %APPDATA%\Ticno\Go\apps\Games\129\d80c0405fd4bdf957544cc5a194bd303472db02e.jpg
- %APPDATA%\Ticno\Go\apps\Games\129\854c89d19feeeefc1379abb9af7c6eb06c61d6d7.jpg
- %APPDATA%\Ticno\Go\apps\Games\122\5d1e58406d1f02980c3879a46000365a1182a576.jpg
- %APPDATA%\Ticno\Go\apps\Games\129\129.jpg
- %APPDATA%\Ticno\Go\apps\Games\107\2222a770912000dc51c60915d952b71e505da0c2.jpg
- %APPDATA%\Ticno\Go\pin.vbs
- %APPDATA%\Ticno\Go\unpin.vbs
- %APPDATA%\Ticno\Go\Temp\WeatherSetup.exe
- %PROGRAM_FILES%\Ticno\Go\skin\promo\tree\title4-ru.png
- %APPDATA%\Ticno\Go\Temp\ShExtMngSetup.exe
- %APPDATA%\Ticno\Go\apps\Games\10\9ae315219b29672b453bc151ab26a8f8d92159de.jpg
- %APPDATA%\Ticno\Go\apps\Games\107\107.jpg
- %APPDATA%\Ticno\Go\apps\Games\10\951d24d97c472ffe056258615a641a43cf7f6865.jpg
- %APPDATA%\Ticno\Go\apps\Games\10\10.jpg
- %APPDATA%\Ticno\Go\apps\Games\10\87e0a870dc3b238a80b3b8a6ca62c364bd935011.jpg
- %APPDATA%\Ticno\Go\apps\Games\145\145.jpg
- %APPDATA%\Ticno\Go\apps\Games\66\82f4e5dd8d09b413766c245cd06665ae36427a54.jpg
- %APPDATA%\Ticno\Go\apps\Games\68\68.jpg
- %APPDATA%\Ticno\Go\apps\Games\66\66.jpg
- %APPDATA%\Ticno\Go\apps\Games\66\40f610649d39c99ce99afecad505ab438be99c66.jpg
- %APPDATA%\Ticno\Go\apps\Games\66\43b62c1b598b17858e4a657ce346b509e90021b0.jpg
- %APPDATA%\Ticno\Go\apps\Games\72\1aef9165729a5c4146bf8f8fbb6ad1db8c0e7a1e.jpg
- %APPDATA%\Ticno\Go\apps\Games\72\72.jpg
- %APPDATA%\Ticno\Go\apps\Games\68\f12a9749ecdd45e96344b4a9eb6590476f7857f9.jpg
- %APPDATA%\Ticno\Go\apps\Games\68\cc66e62d5ef8d2cd19e1319fe2779b95c0c816b2.jpg
- %APPDATA%\Ticno\Go\apps\Games\68\ddb0aec87eda783d92663f6ab621900e7fea5df9.jpg
- %APPDATA%\Ticno\Go\apps\Games\58\f54cb48d6fabf1f2a2447d3562e6ca73cc6d0d37.jpg
- %APPDATA%\Ticno\Go\apps\Games\45\36cb5380c2a0fe90800c7a62c14546ac6b90d2bc.jpg
- %APPDATA%\Ticno\Go\apps\Games\45\45.jpg
- %APPDATA%\Ticno\Go\apps\Games\161\161.jpg
- %APPDATA%\Ticno\Go\apps\Games\147\147.jpg
- %APPDATA%\Ticno\Go\apps\Games\154\154.jpg
- %APPDATA%\Ticno\Go\apps\Games\58\58.jpg
- %APPDATA%\Ticno\Go\apps\Games\58\80890fe9fd59a8374fbcc9be807ec02a1a7355be.jpg
- %APPDATA%\Ticno\Go\apps\Games\58\4c7e01333fb09b9d89d83269b5b929748c1d455b.jpg
- %APPDATA%\Ticno\Go\apps\Games\45\5ccbe8465ec5ae17a37e137a0fcb5280b70d86e1.jpg
- %APPDATA%\Ticno\Go\apps\Games\45\ea746ea375ccf60d150bbcc2b1c6b09c04f7a20c.jpg
Deletes the following files:
- %TEMP%\nso3.tmp\NSISdl.dll
- %APPDATA%\Ticno\Go\Temp\WeatherSetup.exe
- %TEMP%\nso9.tmp\UAC.dll
- %TEMP%\nso3.tmp\ShellExecAsUser.dll
- %TEMP%\nso3.tmp\version.dll
- %TEMP%\nso3.tmp\UAC.dll
- %TEMP%\nso3.tmp\System.dll
- %TEMP%\nso9.tmp\System.dll
- %TEMP%\nsi6.tmp\NSISdl.dll
- %APPDATA%\Ticno\Go\unpin.vbs
- %APPDATA%\Ticno\Go\pin.vbs
- %TEMP%\nsi6.tmp\System.dll
- %TEMP%\nso9.tmp\NSISdl.dll
- %APPDATA%\Ticno\Go\Temp\ShExtMngSetup.exe
- %TEMP%\nsi6.tmp\UAC.dll
Moves the following files:
- from %APPDATA%\Ticno\Go\newfeed-244.xml to %APPDATA%\Ticno\Go\feed-244.xml
Network activity:
Connects to:
- 'localhost':2000
- 'au#######ete.wunderground.com':80
- 'we####r.ticno.com':80
- 'da##.ticno.com':80
- 'ad###.#tatrec.ticno.com':80
- 'fe##.ticno.com':80
- 'st####c.ticno.com':80
TCP:
HTTP GET requests:
- http://da##.ticno.com/widgets/weather2/settings.xml
- http://da##.ticno.com/widgets/weather/city/city.php?ip############
- http://we####r.ticno.com/get/00000.1.27612
- http://au#######ete.wunderground.com/aq?qu########################
- http://ad###.#tatrec.ticno.com/?pi#######################################
- http://ad###.#tatrec.ticno.com/?pi###########################
- http://fe##.ticno.com/?co#########
- http://ad###.#tatrec.ticno.com/?pi########################################
UDP:
- DNS ASK da##.ticno.com
- DNS ASK au#######ete.wunderground.com
- DNS ASK we####r.ticno.com
- DNS ASK ad###.#tatrec.ticno.com
- DNS ASK fe##.ticno.com
- DNS ASK st####c.ticno.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MainMultibarWindow' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
