Technical Information
Modifies file system
Creates the following files
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\min[1]
- D:\users\user\appdata\local\temp\cab6456.tmp
- D:\users\user\appdata\local\temp\tar6457.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\fbevents[1].js
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
- D:\users\user\ntuser.dat.log1
- D:\users\user\ntuser.dat
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\system volume information\syscache.hve.log1
- D:\system volume information\syscache.hve
- D:\windows\system32\winevt\logs\security.evtx
- D:\windows\system32\winevt\logs\system.evtx
- D:\windows\system32\config\system.log1
- D:\windows\system32\config\system
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\windows\system32\winevt\logs\application.evtx
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\ea618097e393409afa316f0f87e2c202_1e65fd33f74047223af4d58cbfd34bce
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\ea618097e393409afa316f0f87e2c202_1e65fd33f74047223af4d58cbfd34bce
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\35ddedf268117918d1d277a171d8df7b_9afed9e237441d6c8bd22a2d0b441b5a
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\35ddedf268117918d1d277a171d8df7b_9afed9e237441d6c8bd22a2d0b441b5a
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\common-min[1].css
- D:\windows\system32\config\software.log1
- D:\windows\system32\config\software
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\benadorassociates.com[1].png
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\load_icon[1].gif
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\min[1]
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\home-sprite[1].png
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\shop-sprites[1].png
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\min[1]
- D:\users\user\appdata\local\temp\cab5e64.tmp
- D:\users\user\appdata\local\temp\tar5e65.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\error[1]
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\error[1]
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\warning[1]
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015
- D:\users\user\appdata\local\temp\cab6079.tmp
- D:\users\user\appdata\local\temp\tar607a.tmp
- D:\users\user\appdata\local\temp\cab60c9.tmp
- D:\users\user\appdata\local\temp\tar60d9.tmp
- D:\users\user\appdata\local\temp\cab61d4.tmp
- D:\users\user\appdata\local\temp\tar61d5.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive0.dat
Deletes the following files
- D:\users\user\appdata\local\temp\cab5e64.tmp
- D:\users\user\appdata\local\temp\tar5e65.tmp
- D:\users\user\appdata\local\temp\cab6079.tmp
- D:\users\user\appdata\local\temp\tar607a.tmp
- D:\users\user\appdata\local\temp\cab60c9.tmp
- D:\users\user\appdata\local\temp\tar60d9.tmp
- D:\users\user\appdata\local\temp\cab61d4.tmp
- D:\users\user\appdata\local\temp\tar61d5.tmp
- D:\users\user\appdata\local\temp\cab6456.tmp
- D:\users\user\appdata\local\temp\tar6457.tmp
Network activity
Connects to
- 'st###.##nadorassociates.com':80
- 'co#####.facebook.net':443
TCP
HTTP GET requests
- http://st###.##nadorassociates.com/myres/css/common-min.css
- http://st###.##nadorassociates.com/min/?b=##############################################################
- http://st###.##nadorassociates.com/myres/logo/benadorassociates.com.png
- http://st###.##nadorassociates.com/myres/images/load_icon.gif
- http://st###.##nadorassociates.com/min/?b=##################
- http://st###.##nadorassociates.com/myres/images/home-sprite.png
- http://st###.##nadorassociates.com/myres/images/shop-sprites.png
- http://st###.##nadorassociates.com/min/?b=##########################################################
- http://st###.##nadorassociates.com/myres/images/buying_request_banner_pic_g.png
Other
- 'co#####.facebook.net':443
UDP
- DNS ASK st###.##nadorassociates.com
- DNS ASK co#####.facebook.net
Miscellaneous
Searches for the following windows
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
