Trojan.InstallCore.2958

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\00104364.log
%TEMP%\inh106~1\locale\cs.locale
%TEMP%\inh106~1\locale\el.locale
%TEMP%\inh106~1\locale\en.locale
%TEMP%\inh106~1\locale\id.locale
%TEMP%\inh106~1\locale\ja.locale
%TEMP%\inh106~1\locale\nl.locale
%TEMP%\00104548.log
%TEMP%\inh106584327846\bootstrap_30586.html
%TEMP%\in364b~1\60453c~1.cis
%TEMP%\inh106~1\images\sponsored.png
%TEMP%\inh106~1\images\text-bg.png
%TEMP%\in364b~1\66b911~1.par
%TEMP%\in364b~1\378f56~1.cis
%TEMP%\in364bb553\378f56a5_stp\we23.html
%TEMP%\in364bb553\378f56a5_stp\wp24.html
%TEMP%\00109ffb.log
%TEMP%\in364bb553\66b911ba_stp\yt13.html
%TEMP%\in364bb553\66b911ba_stp\yt17.html
%TEMP%\in364b~1\60453c~1.par
%TEMP%\0010a078.log
%TEMP%\in364bb553\60453cd6_stp\icut.dat
%TEMP%\in364b~1\66b911~1.cis
%TEMP%\in364b~1\378f56~1.par
%TEMP%\inh106~1\images\resume_button.png
%TEMP%\inh106~1\images\quick_specs.png
%TEMP%\inh106~1\images\progressbar.png
%TEMP%\inh106~1\css\main.css
%TEMP%\inh106~1\css\sdk-ui\browse.css
%TEMP%\inh106~1\css\sdk-ui\button.css
%TEMP%\inh106~1\css\sdk-ui\checkbox.css
%TEMP%\inh106~1\css\sdk-ui\images\button-bg.png
%TEMP%\inh106~1\css\sdk-ui\images\progress-bg-corner.png
%TEMP%\inh106~1\css\sdk-ui\images\progress-bg.png
%TEMP%\inh106~1\css\sdk-ui\images\progress-bg2.png
%TEMP%\inh106~1\css\sdk-ui\progress-bar.css
%TEMP%\inh106~1\csshover3.htc
%TEMP%\inh106~1\css\ie6_main.css
%TEMP%\inh106~1\form.bmp.mask
%TEMP%\inh106~1\images\close.png
%TEMP%\inh106~1\images\close_hover.png
%TEMP%\inh106~1\images\color_button.png
%TEMP%\inh106~1\images\color_button_hover.png
%TEMP%\inh106~1\images\grey_button.png
%TEMP%\inh106~1\images\grey_button_hover.png
%TEMP%\inh106~1\images\icon_generic.png
%TEMP%\inh106~1\images\loader.gif
%TEMP%\inh106~1\images\pause_button.png
%TEMP%\inh106~1\images\progress.png
%TEMP%\inh106~1\images\bg.jpg
%TEMP%\in364b~1\46f737~1.dat
%TEMP%\in364b~1\46f737~1.par

Удаляет следующие файлы

%TEMP%\00104364.log
%TEMP%\00104548.log
%TEMP%\inh106584327846\bootstrap_30586.html
%TEMP%\00109ffb.log
%TEMP%\0010a078.log

Перемещает следующие файлы

%TEMP%\in364bb553\378f56a5_stp\we23.html в %TEMP%\bf_yl\we23.html
%TEMP%\in364bb553\378f56a5_stp\wp24.html в %TEMP%\bf_yl\wp24.html
%TEMP%\in364bb553\66b911ba_stp\yt13.html в %TEMP%\bl\yt13.html
%TEMP%\in364bb553\66b911ba_stp\yt17.html в %TEMP%\bl\yt17.html

Подменяет следующие файлы

%TEMP%\00104548.log

Сетевая активность

TCP

Запросы HTTP GET

http://im####.#ownloadastro.com/downloader/en/microsoft_paint.jpeg
http://cd###.##wnloadastrocdn.com/img/Tavasat/15Feb17/v2/EN.png
http://cd###.##wnloadastrocdn.com/img/Sibarasawi/bg_comp.png
http://cd###.##wnloadastrocdn.com/ofr/Solululadul/icut_v2_2
http://cd###.##wnloadastrocdn.com/ofr/Webinebinec/Webinebinec_Links_13Oct15
http://cd###.##wnloadastrocdn.com/ofr/Niniwic/YL/Niniwic_Tefenece_12Apr16
http://cd###.##wnloadastrocdn.com/img/Sibarasawi/logo_comp.png
http://cd###.##wnloadastrocdn.com/img/Jimomoromoj/Jimomoromoj_logo.png
http://cd###.##wnloadastrocdn.com/img/Tefenece/Tefenece_logo_black.png
http://cd###.##wnloadastrocdn.com/img/Webinebinec/teal_logo.png
http://cd###.##wnloadastrocdn.com/img/Webinebinec/teal_logo_white.png
http://oc##.#tartssl.com/sub/class2/code/ca/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBQSOgrhRCSnWfKxoWTjWxhk8hga9AQU0E4PQJlsuEsZbzsouODjiAc0qrcCAhAV