Technical Information
Modifies file system
Creates the following files
- %TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\ies.zip
- %TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\finish\script.js
- %TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\finish\index.html
- %TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\common\styles.css
- %TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\common\stats.js
- %TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\common\json3.min.js
- %TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\common\jquery.min.js
- %TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\finish\styles.css
- %TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\common\img\grey-btn.png
- %TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\common\dbg.js
- %TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\finish.zip
- %TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\ies\styles.css
- %TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\ies\script.js
- %TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\ies\index.html
- %TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\ies\ie.png
- %TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\common\img\green-btn.png
- %TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\easyspeedtest-36610948.exe
Deletes the following files
- %TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\ies.zip
- %TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\finish.zip
Network activity
TCP
HTTP GET requests
- http://www.ea####ownload.co/advplatform/4/IES.zip
- http://www.ea####ownload.co/advplatform/4/Finish.zip
- http://www.ea####ownload.co/impression.do?im#####################################################################################################################################################...
- http://www.pr#####all-download.com/cgi/adk/iesdl.cgi?os##########################################################################################################################################...
HTTP POST requests
- http://www.ea####ownload.co/advplatform/api.cgi?ac##################################
UDP
- DNS ASK ea####ownload.co
- DNS ASK pr#####all-download.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\a0ca6f5e-9454-4d8c-b1c4-df7874ca766a\easyspeedtest-36610948.exe'
