Technical Information
Modifies file system
Creates the following files
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
Network activity
TCP
HTTP GET requests
- http://1a###.rozblog.com/js/site.js
- http://www.pi###git.com/wp-content/uploads/2013/03/Blue-Doors-Locked-iPad-Wallpaper.jpg
- http://ti##pic.com/images/goodbye.jpg
- http://ro##p.ir/up/1and1/Pictures/unlock.jpg
- http://ro##p.ir/up/1and1/Pictures/lock_android_logo.jpg
- http://1a##ar.ir/abzar/tools/page-rank/?ur#####################
- http://ro##p.ir/view/1863815/UNIMobile.png
- http://ro##log.com/temp/rang/like.png
- http://x.##2.us/x.cer
- http://s.##2.us/r.crl
- http://oc##.###tg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
- http://oc##.####ca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
- http://cr#.####ca1.amazontrust.com/rootca1.crl
- http://cr#.####g2.amazontrust.com/rootg2.crl
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://o.##2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
- http://cd##.#smarena.com/vv/pics/lg/lg-optimus-pro-1.jpg
- http://g0#.#.alicdn.com/kf/HTB1RBjRHVXXXXcLXXXXq6xXFXXX7/-font-b-ATF-b-font-font-b-box-b-font-Advance-Turbo-Flasher-free-ship.jpg
- http://na###roid.hu/wp-content/uploads/Samsung-Galaxy-J1.jpg
- http://ro##p.ir/view/1547803/%D8%B3%D8%B3%D8%B3.png
- http://ro##p.ir/view/1547811/Untitled-3.png
- http://www.ht#.com/managed-assets/shared/desktop/smartphones/htc-desire-820/pdp/htc-desire-820-global-sketchfab-white-jewel.png
- http://ro##log.com/images/ads/logo_ads.png
- http://www.gr###tar.com/avatar/d41d8cd98f00b204e9800998ecf8427e?d=#####
- http://www.gr###tar.com/avatar/16f0ee43de0d294df7d60753c6decafc?d=#####
- http://ro##log.com/temp/pro/ads_468.jpg
- http://ha###iweb.com/mobiles/LargeImages/2179_01.jpg
- http://i6#.#inypic.com/s4z7sk.jpg
- http://www.ht#.com/managed-assets/shared/desktop/smartphones/htc-desire-526Gplus-dual-sim/features/htc-desire-526Gplus-dual-sim-global-sketchfab-matte-black.png
- http://4.##.#logspot.com/-OWKM1x5iMrI/UzPQPYhNzyI/AAAAAAAABxs/sYoPnGHIN9A/s1600/Samsung+Android+Mobile+Phones+PIT+and+OPS+Files.jpg
- http://te###ave.com/data/files/mall/article/201303291130323537.jpg
- http://ro##log.com/images/refresh.gif
- http://vp#.pl/i/2014/04/10/DeskSoft_BWMeter_6_6_3.jpg
- http://t2.##tatic.com/images?q=############################################################
- http://oc##.#tartssl.com/sub/class2/code/ca/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBQSOgrhRCSnWfKxoWTjWxhk8hga9AQU0E4PQJlsuEsZbzsouODjiAc0qrcCAhAV
- http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
UDP
- DNS ASK 1a###.rozblog.com
- DNS ASK cr#.####g2.amazontrust.com
- DNS ASK oc##.####ca1.amazontrust.com
- DNS ASK cr#.####ca1.amazontrust.com
- DNS ASK oc##.###tg2.amazontrust.com
- DNS ASK s.##2.us
- DNS ASK o.##2.us
- DNS ASK x.##2.us
- DNS ASK 1a##ar.ir
- DNS ASK ti##pic.com
- DNS ASK p3##ank.ir
- DNS ASK g0#.#.alicdn.com
- DNS ASK pi###git.com
- DNS ASK vp#.pl
- DNS ASK cd##.#smarena.com
- DNS ASK te###ave.com
- DNS ASK na###roid.hu
- DNS ASK 4.##.#logspot.com
- DNS ASK an###idxda.net
- DNS ASK t2.##tatic.com
- DNS ASK i6#.#inypic.com
- DNS ASK en######d-tbn2.gstatic.com
- DNS ASK am###clebox.com
- DNS ASK gr###tar.com
- DNS ASK ha###iweb.com
- DNS ASK c1.###ticflickr.com
- DNS ASK ht#.com
- DNS ASK ro##p.ir
- DNS ASK ro##log.com
- DNS ASK cd#.###ine.4dsply.com
- DNS ASK oc##.#tartssl.com
- DNS ASK oc##.thawte.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
