Technical Information
Network activity
Connects to
- 'c.####erving.com':80
- 'sh###.version.ml':80
- 'ww#.#ersion.ml':80
- 'google.com':443
- 'oc##.thawte.com':80
- 'oc##.#tartssl.com':80
TCP
HTTP GET requests
- http://c.####erving.com/rmgjsc/zcFilters.js?1
- http://sh###.version.ml/?ga######################################################################################################################################################################...
- http://sh###.version.ml/px.js?ch##
- http://ww#.#ersion.ml/
- http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
- http://oc##.#tartssl.com/sub/class2/code/ca/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBQSOgrhRCSnWfKxoWTjWxhk8hga9AQU0E4PQJlsuEsZbzsouODjiAc0qrcCAhAV
Other
- 'google.com':443
UDP
- DNS ASK c.####erving.com
- DNS ASK sh###.version.ml
- DNS ASK ww#.#ersion.ml
- DNS ASK google.com
- DNS ASK oc##.thawte.com
- DNS ASK oc##.#tartssl.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
