Technical Information
Modifies file system
Creates the following files
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
Network activity
TCP
HTTP GET requests
- http://ar#####iha.rozblog.com/js/site.js
- http://ar#####iha.rozblog.com/images/no_image.png
- http://ro##p.ir/up/rozex/rozex3.gif
- http://ro##p.ir/up/panis/Pictures/shahshahani/1545810_680322465352880_195984709_n.jpg
- http://s3.##cofile.com/file/8210872326/www_Campec_Ir_Behnoosh_Bakhtiari.jpg
- http://ro##log.com/images/refresh.gif
- http://www.mu##ijob.ir/page/random-viewlinks-introu-pid255655866
- http://up.##ltijob.ir/abzar/tools/mypoping/interupopredirecttomysitelinks/autolinkstooursiterandom.js
- http://up.##ltijob.ir/abzar/tools/popuponclickmod/operator/multijobpopputerpopads.js
- http://te##gram.me/joinchat/AAAAADwUKoUfci_AqAPAxQ
- http://up.##ltijob.ir/abzar/tools/popuponclickmod/operator/onclickpopup.js
- http://s1#.#####sic.org.bir-music1.ir/shahrivar94/Ali-Abdolmaleki-Chera-Man.jpg
- http://up.##ltijob.ir/abzar/tools/popuponclickmod/operator/onclickpopupoperator.js
- http://s3.##cofile.com/file/8210872968/www_Campec_Ir_Yekta_Naser.jpg
- http://s1#.#####sic.org.bir-music1.ir/cgi-sys/suspendedpage.cgi
- http://s6.##cofile.com/file/8210867726/www_Campec_Ir_Consert_Omid_Hajili.jpg
- http://ro##log.com/temp/rozex/bloob/scripts.js
- http://ro##p.ir/up/rozex/bloob/images/heart.png
- http://ro###.rozblog.com/user/Avatar/rozex/rozex.jpg
- http://fu#.###verdownload.com/wp-content/uploads/2014/03/serial-roozhaye-bad-bedar.jpg
- http://ro##log.com/temp/music3/MTForumBlock_row_over.png
- http://ro##log.com/temp/rozex/bloob/js_composer_front.js
- http://ro##log.com/temp/rozex/bloob/custom.js
- http://st####.hugedomains.com/images/logo_huge_domains.gif
- http://ro##log.com/temp/rozex/bloob/jquery.prettyPhoto.js
- http://ro##log.com/temp/rozex/bloob/jquery.fitvids.js
- http://ro##log.com/temp/rozex/bloob/jquery.li-scroller-rtl.1.0.js
- http://ro##log.com/temp/rozex/bloob/seven.min.js
- http://ro##log.com/temp/rozex/bloob/owl.carousel.min.js
- http://hw##.##set.lenzor.com/lp/375210-759-m.jpg
- http://www.be###sic254.com/wp-content/uploads/2014/05/Behnam-Safavi.jpg
- http://ro##log.com/temp/rozex/bloob/polls-js.js
- http://www.ta###ama.com/wp-content/uploads/2014/05/en613.jpg
- http://www.ta###ama.com/wp-content/uploads/picture/Neisan/1.jpg
- http://ro##log.com/temp/rozex/bloob/jquery.form.min.js
- http://mi##nd.ir/wp-content/uploads/2014/05/download-serial-secret-army.jpg
- http://se##.#ust.edu.cn/wp-content/uploads/2014/05/Behnam-Safavi.jpg
- http://s6.##cofile.com/file/8210879150/www_Campec_Ir_Nioosha_Zeighami.jpg
- http://s1#.#####sic.org.bir-music1.ir/shahrivar94/Mehdi%20Ahmadvand.JPG
- http://s1#.#####sic.org.bir-music1.ir/shahrivar94/Behnam-Alamshahi-Birdaneh.jpg
- http://ro##p.ir/up/rozex/bloob/font-awesome.min.css
- http://ro##p.ir/up/rozex/Documents/tool-contact/v2/black.css
- http://ro##p.ir/up/rozex/Documents/tool-contact/v2/style.css
- http://ro##p.ir/up/rozex/bloob/rtl.css
- http://ro##p.ir/up/rozex/bloob/masterslider.main.css
- http://ro##p.ir/up/rozex/bloob/js_composer.css
- http://ro##p.ir/up/rozex/bloob/responsive.css
- http://ro##p.ir/up/rozex/bloob/animate.css
- http://ro##p.ir/up/rozex/bloob/icons.css
- http://ro##p.ir/up/rozex/bloob/styles.css
- http://ro##p.ir/up/rozex/bloob/prettyPhoto.css
- http://ro##p.ir/up/rozex/bloob/symple_styles.css
- http://ro##p.ir/up/rozex/bloob/style.css
- http://ro##log.com/temp/rozex/bloob/recaptcha_ajax.js
- http://ro##p.ir/up/rozex/bloob/allStyle.css
- http://ro##p.ir/up/rozex/bloob/fonts/fontawesome-webfont.eot?
- http://ro##p.ir/up/rozex/bloob/font/dripicons.eot?
- http://ro##p.ir/up/rozex/bloob/fonts/MjCasablanca.eot?
- http://ro##p.ir/up/rozex/bloob/fonts/BYekan.eot?
- http://s3.##cofile.com/file/8212809326/www_Campec_Ir_Nioosha_Zeighami_494.JPG
- http://s1#.#####sic.org.bir-music1.ir/shahrivar94/majid%20kharatha%20-%20daram%20miram/144264116125465578untitled.jpeg
- http://s1#.#####sic.org.bir-music1.ir/mehr94/tataloo-video.jpg
- http://ro##p.ir/up/rozex/bloob/images/backgrounds/6.png
- http://ro##p.ir/up/rozex/bloob/images/logo1.png
- http://ro##log.com/temp/rozex/bloob/html5.js
- http://ro##log.com/temp/rozex/bloob/zilla-likes.js
- http://ro##log.com/temp/rozex/bloob/jquery-migrate.min.js?ve#######
- http://ro##log.com/temp/rozex/bloob/jquery.blockUI.js
- http://ro##p.ir/up/rozex/them-shop/barnar/fonts/dinarm.eot?
- http://ro##p.ir/up/rozex/them-shop/barnar/fonts/dinar.eot?
- http://ro##log.com/temp/rozex/bloob/jquery.js
- http://ro##p.ir/up/rozex/them-shop/barnar/fonts/BYekan.eot?
- http://we####iconfonts.com/api/fonts/entypo/entypo.eot?
- http://ro##p.ir/up/rozex/them-shop/barnar/fonts.css
- http://ro##p.ir/up/rozex/Documents/tool-contact/v2/fonticon.css
- http://s3.##cofile.com/file/8212905684/www_Campec_Ir_Narges_Mohammadi_267.JPG
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK cd#.###ine.4dsply.com
- DNS ASK go#####agmanager.com
- DNS ASK ax.##zjiz.ir
- DNS ASK pe####ntafrih.ir
- DNS ASK ta###ama.com
- DNS ASK hw##.##set.lenzor.com
- DNS ASK mi##nd.ir
- DNS ASK ir###rooz.com
- DNS ASK be###sic254.com
- DNS ASK fu#.###verdownload.com
- DNS ASK pa###ooz.com
- DNS ASK st####.hugedomains.com
- DNS ASK ro###.rozblog.com
- DNS ASK mu##ijob.ir
- DNS ASK te##gram.me
- DNS ASK up.##ltijob.ir
- DNS ASK s6.##cofile.com
- DNS ASK s1#.#####sic.org.bir-music1.ir
- DNS ASK s3.##cofile.com
- DNS ASK we####iconfonts.com
- DNS ASK ro##log.com
- DNS ASK ro##p.ir
- DNS ASK ar#####iha.rozblog.com
- DNS ASK re####sghari75.ir
- DNS ASK se##.#ust.edu.cn
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
