Technical Information
Modifies file system
Creates the following files
- D:\users\user\appdata\local\temp\~df3d5cf330857cad6a.tmp
- D:\windows\system32\winevt\logs\application.evtx
- D:\windows\system32\config\software
- D:\windows\system32\config\software.log1
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\windows\system32\config\system
- D:\windows\system32\config\system.log1
- D:\windows\system32\winevt\logs\security.evtx
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
- D:\windows\system32\winevt\logs\system.evtx
- D:\system volume information\syscache.hve
- D:\system volume information\syscache.hve.log1
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\parking.2.104.1[1].js
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\ww1_processingrealise_com[1].txt
- D:\programdata\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.000
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\sitesecurityservicestate.txt
- D:\programdata\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\0001000a.dir
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\64eu75334ynhfa85vinz.temp
- D:\users\user\appdata\roaming\microsoft\windows\cookies\user@processingrealise[2].txt
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\in[1].txt
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\appdata\roaming\microsoft\windows\cookies\user@processingrealise[1].txt
- D:\users\user\appdata\local\microsoft\internet explorer\frameiconcache.dat
- D:\users\user\appdata\local\temp\~dfe2a3f88227be773b.tmp
- D:\users\user\appdata\local\microsoft\internet explorer\recovery\high\active\{5a3c0543-dbf9-11ed-8631-d03aa858d129}.dat
- D:\users\user\appdata\local\temp\~df1b4dc196d501740c.tmp
- D:\users\user\appdata\local\microsoft\internet explorer\recovery\high\active\{5a3c0541-dbf9-11ed-8631-d03aa858d129}.dat
- D:\users\user\ntuser.dat
- D:\users\user\ntuser.dat.log1
- D:\users\user\appdata\local\microsoft\internet explorer\recovery\high\active\recoverystore.{2311cfa3-da64-11ed-8631-d03aa858d129}.dat
- D:\programdata\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\0001000a.ci
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive0.dat
Deletes the following files
- D:\users\user\appdata\roaming\microsoft\windows\cookies\user@processingrealise[1].txt
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\parking.2.104.1[1].js
Moves the following files
- from D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\in[1].txt to D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\in[1].htm
- from D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\64eu75334ynhfa85vinz.temp to D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\28c8b86deab549a1.customdestinations-ms
- from D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\ww1_processingrealise_com[1].txt to D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\ww1_processingrealise_com[1].htm
Substitutes the following files
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\in[1].txt
Network activity
Connects to
- 'pr#####ingrealise.com':80
TCP
HTTP GET requests
- http://pr#####ingrealise.com/in.cgi?18#####################################################################
- http://pr#####ingrealise.com/in.cgi?18########################################################
- http://pr#####ingrealise.com/in.cgi?18###########################################################################################################################################################...
- http://ww#.####essingrealise.com/
- http://ww#.####essingrealise.com/js/parking.2.104.1.js
- http://ww#.####essingrealise.com/favicon.ico
Other
- 'localhost':49158
- '34.##0.144.191':443
- '35.##1.9.150':443
- '34.##1.73.144':443
UDP
- DNS ASK pr#####ingrealise.com
- DNS ASK ww#.####essingrealise.com
Miscellaneous
Searches for the following windows
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
