Technical Information
To ensure autorun and distribution
Changes the following executable system files
- %WINDIR%\serviceprofiles\localservice\appdata\roaming\microsoft\upnp device host\upnphost\udhisapi.dll
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020042220200423\index.dat
Network activity
TCP
HTTP GET requests
- http://mu###hamizh.com/xdoc
- http://mu###hamizh.com/assets/bxslider/jquery.bxslider.js
- http://mu###hamizh.com/js/jquery.flexslider.js
- http://mu###hamizh.com/js/hover-dropdown.js
- http://mu###hamizh.com/js/bootstrap.min.js
- http://mu###hamizh.com/js/jquery-1.8.3.min.js
- http://mu###hamizh.com/js/wow.min.js
- http://mu###hamizh.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
- http://mu###hamizh.com/img/n7.png
- http://mu###hamizh.com/img/n6.png
- http://mu###hamizh.com/img/n5.png
- http://mu###hamizh.com/img/n4.png
- http://mu###hamizh.com/img/n3.png
- http://mu###hamizh.com/img/n2.png
- http://mu###hamizh.com/admin.php?mo#######################
- http://mu###hamizh.com/img/4.png
- http://mu###hamizh.com/js/jquery.easing.min.js
- /video/4.mp4 via mu###hamizh.com
- /video/3.mp4 via mu###hamizh.com
- /video/2.mp4 via mu###hamizh.com
- /video/1.mp4 via mu###hamizh.com
- http://mu###hamizh.com/img/favicon.png
- http://mu###hamizh.com/img/triangle.png
- http://mu###hamizh.com/img/n1.png
- http://mu###hamizh.com/js/jquery.parallax-1.1.3.js
- http://se#####s.webestools.com/images/s9_0.gif
- http://mu###hamizh.com/img/visitor.png
- http://mu###hamizh.com/assets/owlcarousel/owl.carousel.js
- http://mu###hamizh.com/js/common-scripts.js
- http://mu###hamizh.com/js/parallax-slider/jquery.cslider.js
- http://mu###hamizh.com/js/superfish.js
- http://se#####s.webestools.com/images/s9_4.gif
- http://mu###hamizh.com/js/link-hover.js
- http://mu###hamizh.com/img/7.png
- http://mu###hamizh.com/img/6.png
- http://mu###hamizh.com/img/5.png
- http://mu###hamizh.com/css/bootstrap-reset.css
- http://mu###hamizh.com/css/bootstrap.min.css
- http://mu###hamizh.com/css/theme.css
- http://mu###hamizh.com/assets/font-awesome/css/font-awesome.css
- http://mu###hamizh.com/assets/bxslider/jquery.bxslider.css
- http://mu###hamizh.com/assets/owlcarousel/owl.carousel.css
- /video/5.mp4 via mu###hamizh.com
- http://mu###hamizh.com/css/superfish.css
- http://mu###hamizh.com/js/parallax-slider/modernizr.custom.28468.js
- http://mu###hamizh.com/css/animate.css
- http://mu###hamizh.com/assets/owlcarousel/owl.theme.css
- http://mu###hamizh.com/css/component.css
- http://mu###hamizh.com/css/style.css
- http://mu###hamizh.com/css/style-responsive.css
- http://mu###hamizh.com/css/flexslider.css
- http://se#####s.webestools.com/images/s9_8.gif
- http://mu###hamizh.com/js/html5shiv.js
- http://mu###hamizh.com/assets/font-awesome/fonts/fontawesome-webfont.eot?
- http://mu###hamizh.com/js/respond.min.js
- http://mu###hamizh.com/video/3.mp4
- http://se#####s.webestools.com/cpt_visitors/55984-9-5.js
- http://mu###hamizh.com/video/6.mp4
- http://mu###hamizh.com/video/5.mp4
- http://mu###hamizh.com/video/4.mp4
- http://mu###hamizh.com/fonts/glyphicons-halflings-regular.eot?
- http://mu###hamizh.com/video/2.mp4
- http://mu###hamizh.com/css/parallax-slider/parallax-slider.css
- http://mu###hamizh.com/img/3.png
- http://mu###hamizh.com/img/2.png
- http://mu###hamizh.com/img/1.png
- http://mu###hamizh.com/img/main-bg.jpg
- http://mu###hamizh.com/img/logo.png
- http://mu###hamizh.com/video/1.mp4
- /video/6.mp4 via mu###hamizh.com
UDP
- DNS ASK mu###hamizh.com
- DNS ASK fo###.#oogleapis.com
- DNS ASK fo###.gstatic.com
- DNS ASK se#####s.webestools.com
- '23#.#55.255.250':1900
- 'ff#2::c':1900
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'WMPlayerApp' WindowName: ''
- ClassName: '\MSITPro::EventQueue' WindowName: ''
- ClassName: 'Type32_Main_Window' WindowName: ''
Executes the following
- '%ProgramFiles(x86)%\windows media player\wmplayer.exe' /OCX /NoLibraryAdd /Play "http://mu###hamizh.com/video/1.mp4" /prefetch:10
- '%ProgramFiles(x86)%\windows media player\wmplayer.exe' /OCX /NoLibraryAdd /Play "http://mu###hamizh.com/video/2.mp4" /prefetch:10
- '%ProgramFiles(x86)%\windows media player\wmplayer.exe' /Cookies "PHPSESSID=kvrqsc51la702dp0qa6j3r9ac0" /OCX /NoLibraryAdd /Play "http://mu###hamizh.com/video/3.mp4" /prefetch:10
- '%ProgramFiles(x86)%\windows media player\wmplayer.exe' /Cookies "PHPSESSID=kvrqsc51la702dp0qa6j3r9ac0" /OCX /NoLibraryAdd /Play "http://mu###hamizh.com/video/4.mp4" /prefetch:10
- '%ProgramFiles(x86)%\windows media player\wmplayer.exe' /Cookies "PHPSESSID=kvrqsc51la702dp0qa6j3r9ac0" /OCX /NoLibraryAdd /Play "http://mu###hamizh.com/video/5.mp4" /prefetch:10
- '%ProgramFiles(x86)%\windows media player\wmplayer.exe' /Cookies "PHPSESSID=kvrqsc51la702dp0qa6j3r9ac0" /OCX /NoLibraryAdd /Play "http://mu###hamizh.com/video/6.mp4" /prefetch:10
