Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021082820210829\index.dat
Modifies the following files
Network activity
Connects to
- 'tu###ideo.eu':80
- 'sh###per.org':80
- 'te###free.eu':80
- 'ad#.#xads.rocks':443
- 'a.###lsrv.com':443
- 'js.##nspace.io':443
- 'ma####.bootstrapcdn.com':443
- 'tu##4xxx.eu':80
- 'fo###.#oogleapis.com':443
- 'x1.#.lencr.org':80
- 'r3.#.lencr.org':80
- 'microsoft.com':80
- 'cd#####4682.ahacdn.me':443
- 'im#.#orntry.com':443
- 'cd#####2055.ahacdn.me':443
- 'cd#####8696.ahacdn.me':443
TCP
HTTP GET requests
- http://tu###ideo.eu/ojaftz11.html
- http://te###free.eu/js/theme4/ajax.js
- http://te###free.eu/js/theme4/user.min.js
- http://te###free.eu/js/theme4/notify.min.js
- http://te###free.eu/js/theme4/main.js
- http://te###free.eu/js/theme4/jquery-2.1.3.min.js
- http://te###free.eu/t.png
- http://te###free.eu/images/theme4/search.png
- http://te###free.eu/images/theme4/arrowd.png
- http://te###free.eu/images/theme4/logo.jpg
- http://x1.#.lencr.org/
- http://tu##4xxx.eu/icons/icons.eot?79######
- http://tu##4xxx.eu/css/main2.css
- http://tu##4xxx.eu/nl/?re##
- http://te###free.eu/nl/
- http://te###free.eu/
- http://te###free.eu/font/theme4/icomoon1.eot?ve####
- http://sh###per.org/ajn.cgi?14###########
- http://te###free.eu/nl/?re##
- http://tu###ideo.eu/qruleo.cgi?2&###################################################
- http://se##top.eu/favicon.ico
- http://tu###ideo.eu/agvv2.html
- http://te###free.eu/favicon/theme4/favicon.ico
- http://te###free.eu/?re##
Other
- 'a.###lsrv.com':443
- 'js.##nspace.io':443
- 'ma####.bootstrapcdn.com':443
- 'fo###.#oogleapis.com':443
- 'cd#####3788.ahacdn.me':443
- 'im#.#orntry.com':443
UDP
- DNS ASK tu###ideo.eu
- DNS ASK cd#####5446.ahacdn.me
- DNS ASK cd#####5720.ahacdn.me
- DNS ASK cd#####2055.ahacdn.me
- DNS ASK im#.#orntry.com
- DNS ASK cd#####4682.ahacdn.me
- DNS ASK cd#####3083.ahacdn.me
- DNS ASK cd#####3788.ahacdn.me
- DNS ASK microsoft.com
- DNS ASK r3.#.lencr.org
- DNS ASK cd#####8696.ahacdn.me
- DNS ASK x1.#.lencr.org
- DNS ASK tu##4xxx.eu
- DNS ASK ma####.bootstrapcdn.com
- DNS ASK js.##nspace.io
- DNS ASK a.###lsrv.com
- DNS ASK ad#.#xads.rocks
- DNS ASK te###free.eu
- DNS ASK sh###per.org
- DNS ASK po##otop.eu
- DNS ASK se##top.eu
- DNS ASK fo###.#oogleapis.com
- DNS ASK st####.rapidssl.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
