Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
Сетевая активность
TCP
Запросы HTTP GET
- http://www.fa###amoz.ir/js/site.js
- http://ro##p.ir/view/1853832/%DA%86%D9%84%D9%87%20%DA%A9%D8%B4%DB%8C%20%D8%AF%D8%A7%D8%B1%20%D9%81%D8%B1%D8%B4.jpg
- http://up.####hara-farsh.ir/view/2780366/nagshara-farsh-1398-9.gif
- http://up.####hara-farsh.ir/view/2959919/160-600.jpg
- http://ro##p.ir/view/2774189/farshamoz3.jpg
- http://ro##p.ir/view/2849262/farshamoz-282.jpg
- http://ro##p.ir/view/2819824/farshamoz-68-compressor.jpg
- http://ro##p.ir/view/2827757/farshamoz-107_233775.jpg
- http://up.##ghtheme.ir/up/kamyab4u/codes/rightheme-owlcarousel/owl.carousel.js
- http://ro##p.ir/view/2849277/farshamoz-283.jpg
- http://ro##p.ir/view/2849294/farshamoz-284.jpg
- http://ro##p.ir/view/2815804/jsfile1.js
- http://ro##p.ir/view/2850203/farshamoz-292-compressor.jpg
- http://ro##p.ir/view/2850202/farshamoz-291-compressor.jpg
- http://ro##p.ir/view/2850204/farshamoz-293-compressor.jpg
- http://ro##p.ir/view/2827303/farshamoz-102-compressor.jpg
- http://ro##p.ir/view/2819303/farshamoz-60-compressor.jpg
- http://ro##p.ir/view/2827360/1111-222-compressor.jpg
- http://ro##p.ir/view/2821981/farshamoz-88-compressor.jpg
- http://ro##p.ir/view/2821980/farshamoz-86-compressor.jpg
- http://ro##p.ir/view/2819124/farshamoz-51-compressor.jpg
- http://up.####hara-farsh.ir/view/2810816/d109-2-compressor_878114.jpg
- http://ro##p.ir/view/2842196/farshamoz-193-compressor_762257.jpg
- http://up.####hara-farsh.ir/view/2830192/131-compressor_666357.jpg
- http://ro##p.ir/view/2817403/farshamoz-59-compressor.png
- http://up.##ghtheme.ir/up/kamyab4u/theme/halva/style.css
- http://up.##ghtheme.ir/up/kamyab4u/codes/rightheme-sans/fonts.css
- http://up.##ghtheme.ir/up/kamyab4u/theme/halva/main.css
- http://up.##ghtheme.ir/up/kamyab4u/theme/halva/print.css
- http://up.##ghtheme.ir/up/kamyab4u/codes/rightheme-jquery/jquery.js
- http://up.##ghtheme.ir/up/kamyab4u/codes/rightheme-sans/fonts/IRANSansWeb(FaNum)_Bold.eot?
- http://up.##ghtheme.ir/up/kamyab4u/codes/rightheme-sans/fonts/IRANSansWeb(FaNum).eot?
- http://up.##ghtheme.ir/up/kamyab4u/codes/rightheme-sans/fonts/IRANSansWeb_Bold.eot?
- http://www.fa###amoz.ir/user/iran-military.jpg
- http://ro##p.ir/view/2850447/farshamoz-295-compressor.jpg
- http://up.##ghtheme.ir/up/kamyab4u/codes/rightheme-sans/fonts/fontawesome-webfont.eot?
- http://www.sh###kema.com/video/6257/%D8%A8%D8%A7%D9%81%D8%AA-%D9%81%D8%B1%D8%B4---%DA%86%D9%84%D9%87-%DA%A9%D8%B4%DB%8C-%D8%AA%D8%B1%DA%A9%DB%8C?em########
- http://up.##ghtheme.ir/up/kamyab4u/codes/rightheme-sans/fonts/IRANSansWeb_Light.eot?
- http://up.##ghtheme.ir/up/kamyab4u/codes/rightheme-sans/fonts/OpenSans-Bold.eot?
- http://up.####hara-farsh.ir/view/2987958/agahifarsh-99.jpg
- http://up.####hara-farsh.ir/view/2813052/600-300.gif
- http://ro##p.ir/view/2821074/telegran-chanell-farsh.gif
- http://ro##p.ir/view/2818681/812-812-compressor.jpg
- http://up.##ghtheme.ir/up/kamyab4u/codes/rightheme-sans/fonts/OpenSans-light.eot?
- http://ro##p.ir/view/2815559/farshamoz-26-compressor.jpg
- http://up.##ghtheme.ir/up/kamyab4u/codes/rightheme-ajax/ajax.js
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK fa###amoz.ir
- DNS ASK up.##ghtheme.ir
- DNS ASK ro##p.ir
- DNS ASK up.####hara-farsh.ir
- DNS ASK sh###kema.com
- DNS ASK go#####agmanager.com
- DNS ASK go#####analytics.com
Другое
Ищет следующие окна
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
