Technical Information
Modifies file system
Creates the following files
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
Network activity
TCP
HTTP GET requests
- http://st####.mihanblog.com//public/scripts/run/g.other.v3.js
- http://www.as##ora.biz/mazhabi-projects/tadabor/tadabbor_H_F/H2.png
- http://www.as##ora.biz/mazhabi-projects/tadabor/tadabbor_H_F/F2.png
- http://www.20##ols.com/salavat/view.php?bg####################
- http://20##ols.com/salavat/view.php?bg####################
- http://www.20##ols.com/salavat/start.php?co##########################
- http://bl##ers.ir/cod/useful/moarefi/blue.js
- http://www.as##ora.biz/mazhabi-projects/grank/png.js
- http://www.as##ora.biz/mazhabi-projects/grank/check.php?ur#######################################
- http://20##ols.com/salavat/start.php?co##########################
- http://www.as##ora.biz/mazhabi-projects/grank/gif/20-0.png
- http://up.##ltijob.ir/kod/nod32key.js
- http://www.mu##ijob.ir/page/test-users-key-control-all-other-pid2235550
- http://www.mu##ijob.ir/page/test-user32script-key-36985698-user-multijob-pid-596525365
- http://www.mu##ijob.ir/page/popsmusic-encodeplaner-soaliscript?/=###
- http://dl.##moviedl.ir/up/multimovie/javascripttools/irmoviedlantiroztelegram/irmoviedltelegrampowerencodedloader.js
- http://dl.##moviedl.ir/up/multimovie/rozipearning/roz-ip-earning.js
- http://ro##p.ir/up/multimovie/javascripttools/irmoviedlantiroztelegram/irmoviedltelegrampowercodeorigin.js
- http://pi##ak.net/blogcod/translator/cod.php?wi#####################################
- http://1a##ar.ir/abzar/tools/alexa/?bg#########################################################################
- http://pi##ak.net/upper/jquery.min.js
- http://jg.###olvermaps.com/c/65zohuey8dw.gif
- http://s1#.##agcounter.com/count/qpt9/bg_FFFFFF/txt_000000/border_CCCCCC/columns_2/maxflags_12/viewers_0/labels_1/pageviews_0/flags_0/
- http://pi##ak.net/upper/scrolltopcontrol.php?t=##
- http://pi##ak.net/nohe/b.js
- http://pi##ak.net/themes/59/05/image/footer.jpg
- http://www.go#####analytics.com/ga.js
- http://rg.###olvermaps.com/f/g.swf
- http://www.as##ora.biz/mazhabi-projects/tadabor/tadabor.php?mo###################################################################################
- http://fp######ad2.macromedia.com/get/flashplayer/update/current/install/version.xml19.0.0.207~installVector=2&lang=en&cpuWordLength=64&playerType=ax&os=win&osVer=13
- http://www.as##ora.biz/mazhabi-projects/tadabor/png.js
- http://www.as##ora.biz/mazhabi-projects/shohada/final%20shahid/Header_9_Final.png
- http://st####.mihanblog.com//public/images/publish/advert_close.gif
- http://pi##ak.net/themes/59/05/image/style.css
- http://pi##ak.net/themes/59/05/image/body.gif
- http://pi##ak.net/themes/59/05/image/sid1.gif
- http://pi##ak.net/themes/59/05/image/header.jpg
- http://fe##book.ir/ticket/tick.js
- http://pi##ak.net/themes/59/05/image/sid2.gif
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://fe##book.ir/ticketa/user:5681
- http://pi##ak.net/blogcod/google/pichak.net.gif
- http://pi##ak.net/themes/59/05/image/sid3.gif
- http://1a##ar.ir/abzar/tools/slider2/?no####################################################################
- http://1a##ar.ir/abzar/tools/slider2/slider2.php?pl##############################################
- http://pi##ak.net/themes/59/05/image/li.png
- http://www.he###t110.com/wp-content/uploads/2012/12/120-120-2.png
- http://mo######73.persiangig.com/image/hijab.jpg
- http://s2.##cofile.com/file/7851720000/12.jpg
- http://1a##ar.ir/abzar/tools/slider2/2/style.css
- http://st#####.mihanblog.com/public/user_data/user_files/153/458214/logo/Hijab.png
- http://1a##ar.ir/abzar/tools/slider2/2/jquery.js
- http://sm##ooz.ir/java/hadis.js
- http://sm##ooz.ir/java/beh.js
- http://www.ma##on.ir/dl/majoon.swf
- http://1a##ar.ir/abzar/tools/slider2/2/slider.js
- http://1a##ar.ir/abzar/tools/slider/2/logo.png
- http://www.as##ora.biz/mazhabi-projects/shohada/png.js
- http://www.as##ora.biz/mazhabi-projects/shohada/shohada.php?mo###############################################################################################
- http://www.as##ora.biz/mazhabi-projects/shohada/final%20shahid/Footer_9_Final.png
- http://rg.###olvermaps.com/d/m/1024/0.jpg
UDP
- DNS ASK st####.mihanblog.com
- DNS ASK go#####analytics.com
- DNS ASK ap#.##bavision.com
- DNS ASK s1#.##agcounter.com
- DNS ASK jg.###olvermaps.com
- DNS ASK ro##p.ir
- DNS ASK dl.##moviedl.ir
- DNS ASK mu##ijob.ir
- DNS ASK up.##ltijob.ir
- DNS ASK bl##ers.ir
- DNS ASK 20##ols.com
- DNS ASK as##ora.biz
- DNS ASK ma##on.ir
- DNS ASK sm##ooz.ir
- DNS ASK up#.ir
- DNS ASK sk##.#amentheme.ir
- DNS ASK ja####nghelabi.ir
- DNS ASK s2.##cofile.com
- DNS ASK mo######73.persiangig.com
- DNS ASK st#####.mihanblog.com
- DNS ASK he###t110.com
- DNS ASK cd#.#eizbook.ir
- DNS ASK 1a##ar.ir
- DNS ASK ge##p.ir
- DNS ASK fe##book.ir
- DNS ASK pi##ak.net
- DNS ASK rg.###olvermaps.com
- DNS ASK fp######ad2.macromedia.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
