Technical Information
Modifies file system
Creates the following files
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
Network activity
Connects to
- 'do#####ark.mrdomain.ir':443
TCP
HTTP GET requests
- http://ro##log.com/include/rozblog_ads_js.php?si########
- http://ro##p.ir/view/2047974/%D9%85%D9%87%D8%B1%D8%A7%D9%86%20%D9%85.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/316271_475.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/111807115.jpg
- http://en####.webgozar.ir/counter/xstat.aspx?t=##################################################################################################################################################...
- http://www.we###zar.com/counter/pic/stat5.gif
- http://up.##zahor.ir/up/tazahor/Pictures/865810_526.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/dfdfdf.jpg
- http://ro##p.ir/view/2054539/aroomam.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/dq24856453.gif
- http://up.##zahor.ir/up/tazahor/Pictures/dq24.gif
- http://ro##p.ir/view/2054558/%D8%B4%D8%A7%D8%AF%D9%85%D9%87%D8%B1.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/0.9.1.7.7.0.3.7.2347971.5gif
- http://up.##zahor.ir/up/tazahor/Pictures/123321.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/AsMa.gif
- http://up.##zahor.ir/up/tazahor/Pictures/0.206508001318690964_parsnaz_ir.jpg
- http://ro##p.ir/view/2112288/123456.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/tazahor.arab.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/3e7c3c24a9d3e999b0ff1966ab76473c-290x180.jpg
- http://www.we##ozar.ir/c.aspx?Co####################
- http://ro##p.ir/view/2439568/2039495289.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/Fars4pic_(9)163202.jpg
- http://www.pa##naz.ir/upload/83/0.223903001395227840_parsnaz_ir.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/hghgfzz.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/Untitled-145479.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/1016928392.jpg
- http://ro##p.ir/view/309059/farhangnews_131113-372719-1434541368.jpg
- http://ro##p.ir/view/712848/%D9%BE%D8%B3%D8%AA%D8%A7%D9%86.jpg
- http://ro##p.ir/view/712861/%D8%B3%D8%B3%D8%B3%D9%84%D9%84%D9%84%D9%88.jpg
- http://ro##p.ir/view/768032/azade.jpg
- http://ro##p.ir/view/768038/%D8%A7%DB%8C%D8%B1%D8%A7%D9%86%D9%85%D9%86%D8%B4.jpg
- http://ro##p.ir/view/768047/%D8%AF%D8%A7%DB%8C%DB%8C1.jpg
- http://ro##p.ir/view/769352/masoudi-joole.jpg
- http://ro##p.ir/view/782995/ALI-DAEI-SHADYA.jpg
- http://ro##p.ir/view/812973/ostokhna%20no.jpg
- http://www.ir##naz.com/user_files/image/image39/0.907337001322695509_irannaz_com.jpg
- http://ro##p.ir/view/1003878/717385_553_851262.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/2090187024.jpg
- http://ro##p.ir/view/1006656/852087201.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/647647_607.jpg
- http://ro##p.ir/view/1006699/13940912000330_PhotoL.jpg
- http://ro##p.ir/view/1006724/716146_758.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/ghomi.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/270162_963.jpg
- http://ro##p.ir/view/1006749/payam.jpg
- http://ro##p.ir/view/1009442/13940825000848_PhotoA.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/index.jpeg
- http://up.##zahor.ir/up/tazahor/Pictures/69070_122.jpg
- http://www.pa##naz.ir/upload/83/0.115670001394972236_parsnaz_ir.jpg
- http://ro##p.ir/view/2448245/hamid-hirad-pishvaz_815295.png
- http://up.##zahor.ir/up/tazahor/Pictures/1405437448.jpg
- http://ta####r.rozblog.com/user/tazahor.jpg
- http://mi###store.net/pic/byfila-2.gif
- http://www.ir##naz.com/images/2014/03/spring-type-farhad-majidi-photo.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/0.490914001306182193.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/864703_605.jpg
- http://ro##p.ir/view/335096/pictures-of-humor-volleyball-aynstagram.jpg
- http://ro##p.ir/view/329917/qjhavzgywr7fld3tsvw.jpg
- http://ta##az.ir/upload/66/0.432469001332088912_taknaz_ir.gif
- http://mi###store.net/pic/pilates-1.jpg
- http://ta#####.mihanstore.net/partner/show_ads.php?ad#################################################################
- http://ro##log.com/images/ads/logo_ads.png
- http://mi###store.net/pic/1311-w.jpg
- http://ta#####.mihanstore.net/partner/buy_post.gif
- http://ta#####.mihanstore.net/partner/show_ads.php?ad##########################################################
- http://www.fu###togh.com/uploads/admin/7a282944569d50a1ce859bb76985bc6b1979466_661978523839891_304579670_n.jpg
- http://ro##log.com/temp/rang/like.png
- http://ro##log.com/temp/nuke/FBarrow.gif
- http://ad#.rzb.ir/admin/banners/333260.gif
- http://ro##log.com/temp/pro/ads_468.jpg
- http://ta####r.rozblog.com/js/site.js
- http://mi###store.net/pic/bespre-2.gif
- http://www.ir##naz.com/user_files/L13153686559.jpg
- http://ro##log.com/images/refresh.gif
- http://www.pa##naz.ir/upload/83/0.969912001396336712_parsnaz_ir.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/Dokhtar_Kamarbarik_German_Patogh69_ir.jpg
- http://www.pa##naz.ir/upload/81/0.927204001393754221_parsnaz_ir.jpg
- http://www.pa##naz.ir/upload/83/0.766386001394964329_parsnaz_ir.jpg
- http://www.pa##naz.ir/upload/83/0.804890001395216691_parsnaz_ir.jpg
- http://ro##p.ir/view/3031522/yaraneh.jpg
- http://sh##af.ir/files/fa/news/1392/4/1/76453_776.jpg
- http://www.ta##az.ir/user_files/L131529925553.jpg
- http://ro##p.ir/view/3035700/%DA%AF%D9%88%D8%AC%D9%87.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/9306-7t1074.jpg
- http://www.be###ote.com/images/stories/fun/fun793-1.jpg
- http://www.be###ote.com/images/stories/fun/fu1909.jpg
- http://ro##p.ir/view/815649/mazdakkk.jpg
- http://ro##p.ir/view/192301/ghatel-29sale-2.jpg
- http://www.fu###togh.com/uploads/admin/13687212661.jpg
- http://www.pa##naz.ir/user_files/L139590857836.jpg
- http://www.pa##naz.ir/upload/83/0.537306001395910443_parsnaz_ir.jpg
- http://mi###store.net/pic/bpato-2.gif
- http://mi###store.net/banner/Sekare-B.gif
- http://ro##p.ir/view/191504/%D9%85%D8%AD%D9%85%D8%AF.jpg
- http://ta##az.ir/upload/73/0.620492001354969432_taknaz_ir.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/resized_710773_482.jpg
- http://up.##zahor.ir/up/tazahor/Pictures/pic664_www.jahaniha.com_.jpg
- http://dl.##angol.ir/wp-content/uploads/2014/01/Ugly-Dog-17-570x376.jpg
- http://va###esh.com/wp-content/uploads/2014/03/102043_248.jpg
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK ro##log.com
- DNS ASK we###zar.com
- DNS ASK pa##naz.com
- DNS ASK do#####ark.mrdomain.ir
- DNS ASK we##ozar.ir
- DNS ASK me###.farsnews.com
- DNS ASK sh##af.ir
- DNS ASK ke##she.com
- DNS ASK be###ote.com
- DNS ASK pi#.##rsianv.com
- DNS ASK ir##naz.com
- DNS ASK en####.webgozar.ir
- DNS ASK dl.##angol.ir
- DNS ASK pa##naz.ir
- DNS ASK im####.seemorgh.com
- DNS ASK ta##az.ir
- DNS ASK up.##zahor.ir
- DNS ASK ro##p.ir
- DNS ASK mi###store.net
- DNS ASK ta#####.mihanstore.net
- DNS ASK fu###togh.com
- DNS ASK ad#.rzb.ir
- DNS ASK ta####r.rozblog.com
- DNS ASK va###esh.com
- DNS ASK go#####agmanager.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
