Technical Information
Modifies file system
Creates the following files
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020090220200903\index.dat
Network activity
Connects to
- 'public-trust.com':80
TCP
HTTP GET requests
- http://ro##p.ir/view/2975050/Hormoz.js
- http://cd#.#ayan.ir/blog/templates/907/line2.png
- http://cd#.#ayan.ir/blog/templates/907/box-bg.png
- http://cd#.#ayan.ir/blog/templates/907/nav-bg.png
- http://cd#.#ayan.ir/blog/templates/907/nav-hover.png
- http://cd#.#ayan.ir/blog/templates/907/header_bg.jpg
- http://cd#.#ayan.ir/blog/templates/907/home.png
- http://cd#.#ayan.ir/blog/templates/907/footer-bg.jpg
- http://cd#.#ayan.ir/blog/templates/907/shadow.png
- http://cd#.#ayan.ir/blog/templates/907/box-shadow.png
- http://cd#.#ayan.ir/blog/templates/907/box-title.png
- http://cd#.#ayan.ir/blog/templates/907/sidebar-bullet.png
- http://www.we##ozar.ir/c.aspx?Co####################
- http://www.do###oadyha.com/wp-content/uploads/Dungeon-Maker.jpg
- http://cd#.#ayan.ir/blog/templates/907/details_ico.png
- http://ra###.bayan.ir/bl!x3HbfrTINCc/rb.gif?v=###################################################################################################################################################...
- http://cd#.#ayan.ir/blog/templates/907/footer-bg_shadow.jpg
- http://cd#.#ayan.ir/blog/templates/907/bg_footer.png
- http://cd#.#ayan.ir/blog/templates/shared/icon/rss-icon-dark.png
- http://cd#.#ayan.ir/blog/templates/shared/icon/bayan-icon-dark.png
- http://cd#.#ayan.ir/blog/templates/shared/icon/bayanbox-icon-dark.png
- http://cd#.#ayan.ir/blog/templates/shared/icon/blog-icon-dark.png
- http://cd#.#ayan.ir/blog/templates/shared/icon/templates-icon-dark.png
- http://www.we###zar.com/counter/pic/stat4.gif
- http://en####.webgozar.ir/counter/xstat.aspx?t=######################################################################################################################
- http://ho##ozdl.ir/favicon.ico
- http://cd#.#ayan.ir/blog/templates/907/big-btn-bg.png
- http://fp######ad2.macromedia.com/get/flashplayer/update/current/install/version.xml19.0.0.207~installVector=2&lang=en&cpuWordLength=64&playerType=ax&os=win&osVer=13
- http://ra###.bayan.ir/rb.js?v=##
- http://www.do###oadyha.com/wp-content/uploads/Brain-Marmelade-Cover.jpg
- http://www.do###oadyha.com/wp-content/uploads/a606938cfdbd1fbcd16f9b75385ef09e.jpg
- http://se####.rozblog.com/js/site.js
- http://ro##p.ir/view/2488330/tabke.png
- http://up.##ltijob.ir/kod/nod32key.js
- http://ho##ozdl.ir/
- http://www.mu##ijob.ir/page/test-users-key-control-all-other-pid2235550
- http://ro##log.com/temp/news_v3/responsiv/1.png
- http://ro##log.com/editor/Rb_editor/images/smileys/003.gif
- http://ho##ozdl.ir/static/CIqVapCieMo/2279571377/style.css
- http://po###zar.com/popup.php?id########
- http://ra###hoon.net/_WebsiteData/Article/ArticleImages/1/1388/Azar/Rasekhoon2.jpg
- http://bl#g.ir/media/script/blog.min.js?HN####
- http://bl#g.ir/media/css/sharedrtl.css?uM####
- http://ho###zmusic.ir/code/popup
- http://www.ho###zmusic.ir/code/popup
- http://ro##log.com/images/ads/logo_ads.png
- http://ro##log.com/images/refresh.gif
- http://ch#####i.sakura.ne.jp/blogparts/honehoneclock/honehone_clock_tr.js
- http://ro##log.com/temp/rang/like.png
- http://ch#####i.sakura.ne.jp/blogparts/honehoneclock/honehone_clock_tr.swf
- http://bl#g.ir/media/images/cleardot.gif
- http://dl.###nloadyha.com/image/PicsArt.Photo.Studio.jpg
- http://dl.###nloadyha.com/image/WhatsApp.Messenger.jpg
- http://www.do###oadyha.com/wp-content/uploads/NLL-Screen-Recorder-PRO-Cover.jpg
- http://www.do###oadyha.com/wp-content/uploads/Instagram-android.jpg
- http://www.do###oadyha.com/wp-content/uploads/Football-Fred-Cover.jpg
- http://www.do###oadyha.com/wp-content/uploads/Super-Backup-Restore-Full-Cover.jpg
- http://ro##log.com/editor/Rb_editor/images/smileys/004.gif
- http://oc##.#tartssl.com/sub/class2/code/ca/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBQSOgrhRCSnWfKxoWTjWxhk8hga9AQU0E4PQJlsuEsZbzsouODjiAc0qrcCAhAV
- http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
UDP
- DNS ASK se####.rozblog.com
- DNS ASK oc##.#tartssl.com
- DNS ASK microsoft.com
- DNS ASK en####.webgozar.ir
- DNS ASK we###zar.com
- DNS ASK fp######ad2.macromedia.com
- DNS ASK cd#.#ayan.ir
- DNS ASK we##ozar.ir
- DNS ASK dl.###nloadyha.com
- DNS ASK do###oadyha.com
- DNS ASK dl###zane.net
- DNS ASK ra###.bayan.ir
- DNS ASK oc##.thawte.com
- DNS ASK go#####analytics.com
- DNS ASK bl#g.ir
- DNS ASK po###zar.com
- DNS ASK ch#####i.sakura.ne.jp
- DNS ASK ra###hoon.net
- DNS ASK mu##ijob.ir
- DNS ASK up.##ltijob.ir
- DNS ASK ro##log.com
- DNS ASK ho##ozdl.ir
- DNS ASK ho###zmusic.ir
- DNS ASK ro##p.ir
- DNS ASK cd#.###ine.4dsply.com
- DNS ASK go#####agmanager.com
- DNS ASK public-trust.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
