Technical Information
Modifies file system
Creates the following files
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
Network activity
TCP
HTTP GET requests
- http://ro##p.ir/up/rozex/bloob/allStyle.css
- http://ro##log.com/temp/rozex/bloob/html5.js
- http://ro##p.ir/up/rozex/bloob/images/logo1.png
- http://www.dl##x.com/wp-content/uploads/2017/09/Need-For-Speed-Payback.jpg
- http://www.dl##x.com/wp-content/uploads/2018/02/Fortnite.jpg
- http://www.dl##x.com/wp-content/uploads/2018/02/Age-of-Empires-Definitive-Edition.jpg
- http://www.dl##x.com/wp-content/uploads/2017/11/amdup.jpg
- http://www.dl##x.com/wp-content/uploads/2017/07/Dying-Light-The-Fo.jpg
- http://www.dl##x.com/wp-content/uploads/2017/09/Assassins-Creed-Origins.jpg
- http://www.dl##x.com/wp-content/uploads/2017/11/Life-is-Strange-Before-the-Storm.jpg
- http://www.dl##x.com/wp-content/uploads/2017/12/The-Legend-of-Zelda-Breath-of-The-Wild.jpg
- http://www.dl##x.com/wp-content/uploads/2015/12/Dying-Light-Co.jpg
- http://www.dl##x.com/wp-content/uploads/2017/09/Forza-Motorsport-7.jpg
- http://www.dl##x.com/wp-content/uploads/2015/01/Microsoft-Flight.jpg
- http://ro##log.com/temp/rozex/bloob/jquery.form.min.js
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://re#o.st/self/f97f4d021904c1b49ba65bd268658c31a8c1d01e.jpg
- http://ga###lay.net/wp-content/uploads/2017/03/Tom-Clancys-Rainbow-Six-Siege-Free-Download.jpg
- http://www.ga#####easedates.net/images/covers/pc/cover-pc-destiny-2.jpg
- http://www.dl##x.com/wp-content/uploads/2017/12/AUTOBAHN-POLICE-SIMULATOR-2.jpg
- http://www.dl##x.com/wp-content/uploads/2016/11/AMD.jpg
- http://ro##p.ir/up/rozex/rozex3.gif
- http://www.dl##x.com/wp-content/uploads/2017/05/DIABLO3.jpg
- http://www.dl##x.com/wp-content/uploads/2017/10/WWE-2K18.jpg
- http://www.dl##x.com/wp-content/uploads/2017/10/WIIUP01.jpg
- http://www.dl##x.com/wp-content/uploads/2017/09/Call-of-Duty%C2%AE-WWII-.jpg
- http://ro##log.com/temp/rozex/bloob/scripts.js
- http://ro##log.com/temp/rozex/bloob/polls-js.js
- http://x.##2.us/x.cer
- http://ro##log.com/temp/rozex/bloob/zilla-likes.js
- http://ro##p.ir/view/2376608/%D9%BE%DA%86-%D9%81%D9%88%D8%AA%D8%A8%D8%A7%D9%84-%D8%AE%DB%8C%D8%A7%D8%A8%D8%A7%D9%86%DB%8C-FIFA18.jpg
- http://ro##log.com/temp/rozex/bloob/jquery.blockUI.js
- http://ro##p.ir/up/rozex/bloob/rtl.css
- http://ge####ire.rzb.ir/js/site.js
- http://ro##log.com/temp/rozex/bloob/recaptcha_ajax.js
- http://ro##log.com/include/rozblog_ads_js.php?si########
- http://ro##log.com/temp/rozex/bloob/jquery.js
- http://ro##p.ir/up/rozex/bloob/style.css
- http://ad#.rzb.ir/admin/banners/333260.gif
- http://ro##p.ir/up/rozex/bloob/symple_styles.css
- http://ro##p.ir/up/rozex/bloob/prettyPhoto.css
- http://ro##p.ir/up/rozex/bloob/styles.css
- http://ro##p.ir/up/rozex/bloob/icons.css
- http://ro##p.ir/up/rozex/bloob/responsive.css
- http://ro##p.ir/up/rozex/bloob/js_composer.css
- http://ro##p.ir/up/rozex/bloob/masterslider.main.css
- http://ro##p.ir/up/rozex/Documents/tool-contact/v2/style.css
- http://ro##p.ir/up/rozex/them-shop/barnar/fonts/dinarm.eot?
- http://ro##p.ir/up/rozex/bloob/font-awesome.min.css
- http://ro##p.ir/up/rozex/bloob/animate.css
- http://ro##p.ir/up/rozex/bloob/font/dripicons.eot?
- http://ro##p.ir/up/rozex/bloob/images/backgrounds/6.png
- http://ro##p.ir/up/rozex/bloob/fonts/BYekan.eot?
- http://ro##p.ir/up/rozex/bloob/fonts/MjCasablanca.eot?
- http://ro##p.ir/up/rozex/Documents/tool-contact/v2/fonticon.css
- http://ro##p.ir/up/rozex/them-shop/barnar/fonts.css
- http://ro##p.ir/up/rozex/Documents/tool-contact/v2/black.css
- http://we####iconfonts.com/api/fonts/entypo/entypo.eot?
- http://ro##p.ir/up/rozex/bloob/fonts/fontawesome-webfont.eot?
- http://ro##p.ir/up/rozex/them-shop/barnar/fonts/BYekan.eot?
- http://ro##p.ir/up/rozex/them-shop/barnar/fonts/dinar.eot?
- http://ro##log.com/temp/rozex/bloob/jquery-migrate.min.js?ve#######
- http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
UDP
- DNS ASK ro##log.com
- DNS ASK or####.deviantart.net
- DNS ASK ga###lay.net
- DNS ASK st####.raru.co.za
- DNS ASK s1.###ing-cdn.com
- DNS ASK im#######.ssl-images-amazon.com
- DNS ASK co###.dlfox.com
- DNS ASK mo###ngway.ir
- DNS ASK ga####rketstore.com
- DNS ASK cd##.#confinder.com
- DNS ASK d3#######7xlg0.cloudfront.net
- DNS ASK tn###als.com
- DNS ASK fi###team.com
- DNS ASK st#######images-a.akamaihd.net
- DNS ASK x.##2.us
- DNS ASK de####andu.com.np
- DNS ASK re#o.st
- DNS ASK cd#.#ox-cdn.com
- DNS ASK ga##x10.com
- DNS ASK vi######.wikia.nocookie.net
- DNS ASK ga#####easedates.net
- DNS ASK ga####orrents.gdn
- DNS ASK cd##ys.com
- DNS ASK im######ds-ssl.xboxlive.com
- DNS ASK op###ameart.org
- DNS ASK cd#.#lfox.com
- DNS ASK dl##x.com
- DNS ASK im#.#ame.co.uk
- DNS ASK we####iconfonts.com
- DNS ASK ad#.rzb.ir
- DNS ASK ro##p.ir
- DNS ASK ge####ire.rzb.ir
- DNS ASK microsoft.com
- DNS ASK oc##.thawte.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
