Technical Information
Modifies file system
Creates the following files
- D:\windows\appcompat\programs\recentfilecache.bcf
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\px[2].js
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\px[1].js
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\min[1].js
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\montserrat-bold[1].eot
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\montserrat-regular[1].eot
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\bg1[1].png
- D:\windows\system32\config\software.log1
- D:\windows\system32\config\software
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\ww17_uhxqin_biz[1].txt
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\ww17_uhxqin_biz[1].txt
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\arrrow[1].png
- D:\users\user\ntuser.dat
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
- D:\windows\system32\winevt\logs\system.evtx
- D:\windows\system32\winevt\logs\security.evtx
- D:\windows\system32\config\system.log1
- D:\windows\system32\config\system
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- D:\users\user\ntuser.dat.log1
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
- D:\users\user\appdata\local\temp\mz_etilqs_et6paitkoyyr3n8
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\security_state\data.safe.bin
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\8bf87bb7e13934f2648153f6f818cd2f93455f69
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\7150f4ebaff6a9b3313a4538c93d17f0cc4d4995
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\7e1bdf2c04b6bb8e6516a288be95b19b21d7828a
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\1c071bef2bb8dc67ce789498a903116ea0c85f0a
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\cf675741c1efec8a3183da1a78119c33fc10872a
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\8d14b7d0efc523b59e3933e14fe44fb72beca8df
- D:\system volume information\syscache.hve.log1
- D:\system volume information\syscache.hve
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\8221a41daafa532836d3e8eded1aac94d3955d16
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\b9733f3de80e43d56dfe3dc1fe77a9ef8264df49
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\026a91c419276cf4863cd88d801b264a6313a475
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\8bef30daf9e2434eed4b7575bcd80c38a5a19d6a
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\4b90ddaeeeea60534fa3d5f56046728fba5f4989
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\f84b6a34b56cec15c1942664ffab6b65e0d2588f
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\d54da76e598693fed6a7f29197ea9cfafc48c386
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\74faa831a5ad1348de267780d4c0c2f10cbbec39
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\54dc5dc926acfd0f0401949db5cbca5383cb6b77
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\3abe6035282cf9d17dcb0d733614aca8c2c8cf59
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\db022c3d5e65699f640d8dea20ee25904d318c2e
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\9bcb0efbbfb5cb5c4bae2f361169e07b5604f4d8
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\d02765262ff82856f6b6d6bfe3a3c0adfde1f378
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\windows\system32\winevt\logs\application.evtx
Deletes the following files
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
Network activity
Connects to
- 'ww##.uhxqin.biz':80
- 'i3.###-image.com':80
TCP
HTTP GET requests
- http://ww##.uhxqin.biz/?fp#######################################################################################################################################################################...
- http://ww##.uhxqin.biz/?dn#########################
- http://ww##.uhxqin.biz/?do#######################################################################################################################################################################...
- http://ww##.uhxqin.biz/px.js?ch##
- http://i3.###-image.com/__media__/js/min.js?v2##
- http://i3.###-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot?
- http://i3.###-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot?
- http://i3.###-image.com/__media__/pics/29590/bg1.png
- http://i3.###-image.com/__media__/pics/28905/arrrow.png
Other
- 'localhost':49158
- '34.##1.73.144':443
- '35.##1.9.150':443
UDP
- DNS ASK ww##.uhxqin.biz
- DNS ASK i3.###-image.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
