Technical Information
Modifies file system
Creates the following files
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
Network activity
TCP
HTTP GET requests
- http://fo####epr.myfw.us/ad/feed.php
- http://cl####ography.com/wp-content/themes/imago/fonts/Museo_Sans_500_400.font.js?ve########
- http://cl####ography.com/wp-content/themes/imago/images/patterns/flower5_pattern.png
- http://cl####ography.com/wp-content/themes/imago/images/widget-arrow-black.png
- http://i2.#p.com/clarkeography.com/wp-content/uploads/2013/03/TiiG-GroupShot1.jpg?fi#########
- http://i2.#p.com/clarkeography.com/wp-content/uploads/2012/09/Wheels0021s-1937-Buick1-wm.jpg?fi#########
- http://i1.#p.com/clarkeography.com/wp-content/uploads/2012/01/h0024-Rose-is-a-rose-is-a-rose-is-a-rose-wm-575x575-custom.jpg?re##############
- http://i1.#p.com/clarkeography.com/wp-content/uploads/2012/05/Dune-and-A-Boy-Torpedo-Factory.jpg?fi#########
- http://www.fl##kr.com/badge_code_v2.gne?co##################################################################
- http://i2.#p.com/clarkeography.com/wp-content/uploads/2012/05/Mobile-P1XELS-2012.jpg?fi#########
- http://x.##2.us/x.cer
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://cl####ography.com/wp-content/themes/imago/js/cufon-yui.js?ve########
- http://cl####ography.com/wp-content/themes/imago/js/custom.js?ve########
- http://o.##2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
- http://www.fa###ook.com/plugins/likebox.php?hr###################################################################################################################################################...
- http://cl####ography.com/wp-content/themes/imago/images/social-icons/32px/flickr.png
- http://cl####ography.com/wp-content/themes/imago/images/social-icons/32px/facebook.png
- http://cl####ography.com/wp-content/themes/imago/images/social-icons/32px/twitter.png
- http://cl####ography.com/wp-content/plugins/jetpack/modules/photon/photon.js?ve##########
- http://s0.#p.com/wp-content/js/devicepx-jetpack.js?ve########
- http://s.###vatar.com/js/gprofiles.js?ve###########
- http://cl####ography.com/wp-content/plugins/jetpack/modules/wpgroho.js?ve########
- http://cl####ography.com/wp-includes/js/comment-reply.min.js?ve########
- http://cl####ography.com/wp-includes/js/wp-embed.min.js?ve########
- http://st###.wp.com/e-202021.js
- http://oc##.###tg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
- http://oc##.####ca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
- http://cl####ography.com/wp-content/themes/imago/js/video.js?ve########
- http://cl####ography.com/wp-content/themes/imago/js/jquery.colorbox-min.js?ve########
- http://cl####ography.com/wp-content/themes/imago/js/jquery.tweet.js?ve########
- http://cl####ography.com/wp-content/themes/imago/styles/reset.css
- http://cl####ography.com/wp-content/themes/imago/styles/nivo-slider.css
- http://cl####ography.com/wp-content/themes/imago/styles/kwicks-slider.css
- http://do######rk.sitelutions.com/redir_not_found/redir_not_found.shtml?fo###############
- http://do######rk.sitelutions.com/include_files/css/sitelutions1.css
- http://cl####ography.com/wp-content/themes/imago/styles/coda-slider-2.0.css
- http://cl####ography.com/wp-content/themes/imago/styles/colorbox.css
- http://cl####ography.com/wp-content/themes/imago/styles/anythingslider.css
- http://do######rk.sitelutions.com/image_files/bg-blurbs-is.jpg
- http://pa#####.#ooglesyndication.com/pagead/show_ads.js
- http://do######rk.sitelutions.com/image_files/dot.gif
- http://do######rk.sitelutions.com/image_files/bg-blurbs-dm.jpg
- http://cl####ography.com/wp-content/themes/imago/style.css
- http://do######rk.sitelutions.com/image_files/bg-blurbs-cb.jpg
- http://do######rk.sitelutions.com/image_files/bg-blurbs-bm.jpg
- http://cl####ography.com/wp-content/plugins/wordpress-simple-paypal-shopping-cart/wp_shopping_cart_style.css?ve#######
- http://cl####ography.com/wp-includes/js/wp-emoji-release.min.js?ve########
- http://cl####ography.com/wp-content/plugins/jetpack/css/jetpack.css?ve#######
- http://cl####ography.com/wp-includes/js/jquery/jquery.js?ve########
- http://cl####ography.com/wp-includes/js/jquery/jquery-migrate.min.js?ve#######
- http://cl####ography.com/wp-content/themes/imago/js/jquery.easing.1.3.js?ve########
- http://cl####ography.com/wp-content/themes/imago/js/jquery.innerfade.js?ve########
- http://cl####ography.com/wp-content/themes/imago/js/jqueryslidemenu.js?ve########
- http://cl####ography.com/wp-content/themes/imago/js/jquery.swfobject.1-1-1.min.js?ve########
- http://cl####ography.com/wp-content/themes/imago/js/jquery.coda-slider-2.0.js?ve########
- http://cl####ography.com/wp-content/themes/imago/js/jquery.quicksand.js?ve########
- http://do######rk.sitelutions.com/image_files/sl_logo.png
- http://www.go#####analytics.com/ga.js
- http://cr#.####ca1.amazontrust.com/rootca1.crl
UDP
- DNS ASK fo####epr.myfw.us
- DNS ASK go#####analytics.com
- DNS ASK st###.wp.com
- DNS ASK s.###vatar.com
- DNS ASK s0.#p.com
- DNS ASK fa###ook.com
- DNS ASK oc##.####ca1.amazontrust.com
- DNS ASK oc##.###tg2.amazontrust.com
- DNS ASK o.##2.us
- DNS ASK x.##2.us
- DNS ASK fl##kr.com
- DNS ASK i1.#p.com
- DNS ASK i2.#p.com
- DNS ASK pa#####.#ooglesyndication.com
- DNS ASK do######rk.sitelutions.com
- DNS ASK cl####ography.com
- DNS ASK cr#.####ca1.amazontrust.com
- DNS ASK st####.xx.fbcdn.net
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
