Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021091120210912\index.dat
Modifies the following files
Network activity
Connects to
- 'pu####ruhihad.cf':80
- 'ww#.###yguruhihad.cf':80
- 'google.com':443
- 'im##.wsimg.com':443
- 'oc##.##arfieldtech.com':80
- 'cr#.###rfieldtech.com':80
TCP
HTTP GET requests
- http://pu####ruhihad.cf/px.js?ch##
- http://ww#.###yguruhihad.cf/
- http://oc##.##arfieldtech.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCAzkUhA%3D%3D
- http://oc##.##arfieldtech.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQUwPiEZQ6%2FsVZNPaFToNfxx8ZwqAQUfAwyH6fZMH%2FEfWijYqihzqsHWycCAQc%3D
- http://oc##.##arfieldtech.com//MEkwRzBFMEMwQTAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM%2BuArAQUJUWBaFAmOD07LSy%2BzWrZtj2zZmMCCG2DS9qTDyby
- http://cr#.###rfieldtech.com/sfig2s2-3.crl
Other
- 'google.com':443
- 'im##.wsimg.com':443
UDP
- DNS ASK pu####ruhihad.cf
- DNS ASK ww#.###yguruhihad.cf
- DNS ASK im##.wsimg.com
- DNS ASK google.com
- DNS ASK microsoft.com
- DNS ASK oc##.##arfieldtech.com
- DNS ASK cr#.###rfieldtech.com
- DNS ASK st####.rapidssl.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
