Technical Information
Modifies file system
Creates the following files
- %TEMP%\mz_etilqs_0pe9rtgb6o77ldp
- %TEMP%\mz_etilqs_3mi6ikwj14ro1dd
- %TEMP%\mz_etilqs_qynninqqiupmtms
- %TEMP%\mz_etilqs_ctu4kbjj4b2xi3g
- %TEMP%\mz_etilqs_ntugrhyzdeu8i6j
Network activity
Connects to
- 'ma####.bootstrapcdn.com':443
- 'se###tape.net':80
- 'aj##.#oogleapis.com':443
- 'pk#.goog':80
- 'go#####a###ytics.com':80
- 'c1.##pads.net':80
- 'sy######ion.exoclick.com':80
- 'ad#####r.juicyads.com':80
TCP
HTTP GET requests
- http://www.se###tape.net/css/stylesheet.css
- http://www.se###tape.net/thumbs/fu2vuw8.jpg
- http://www.se###tape.net/thumbs/cr3a3la.jpg
- http://www.se###tape.net/thumbs/d6vtxkp.jpg
- http://www.se###tape.net/thumbs/pfnmafa.jpg
- http://www.se###tape.net/thumbs/x4e3fxy.jpg
- http://www.se###tape.net/thumbs/hmm1bpz.jpg
- http://www.se###tape.net/thumbs/0zb5fj9.jpg
- http://www.se###tape.net/thumbs/86ibv3r.jpg
- http://www.se###tape.net/thumbs/fi6fbsm.jpg
- http://www.se###tape.net/thumbs/6ox678c.jpg
- http://www.se###tape.net/thumbs/snh2vpd.jpg
- http://www.se###tape.net/thumbs/8sw2en3.jpg
- http://www.se###tape.net/thumbs/82jugk1.jpg
- http://www.se###tape.net/thumbs/ezw3kqm.jpg
- http://www.se###tape.net/thumbs/e78twrd.jpg
- http://www.se###tape.net/thumbs/tu03sks.jpg
- http://www.se###tape.net/thumbs/har1dud.jpg
- http://www.se###tape.net/thumbs/el6ahk7.jpg
- http://www.se###tape.net/thumbs/rf5432f.jpg
- http://www.se###tape.net/thumbs/m31h87w.jpg
- http://www.se###tape.net/thumbs/0nct0d7.jpg
- http://www.se###tape.net/thumbs/ihljidp.jpg
- http://www.se###tape.net/thumbs/u8a8y0z.jpg
- http://www.se###tape.net/thumbs/4392hrg.jpg
- http://www.se###tape.net/thumbs/80dparf.jpg
- http://www.se###tape.net/thumbs/u12vemk.jpg
- http://www.se###tape.net/thumbs/999j9xy.jpg
- http://www.se###tape.net/thumbs/gyzpvnt.jpg
- http://www.se###tape.net/thumbs/4mnvebx.jpg
- http://www.se###tape.net/thumbs/cl8ml3s.jpg
- http://www.se###tape.net/thumbs/vsqm89w.jpg
- http://www.se###tape.net/thumbs/bovoeiz.jpg
- http://www.se###tape.net/thumbs/c6tjtuy.jpg
- http://www.se###tape.net/thumbs/4jvyv8w.jpg
- http://www.se###tape.net/thumbs/8wbvpvq.jpg
- http://www.se###tape.net/thumbs/f686uij.jpg
- http://www.se###tape.net/thumbs/okyc9zg.jpg
- http://www.se###tape.net/thumbs/jk5ynuw.jpg
- http://www.se###tape.net/thumbs/xihjb36.jpg
- http://www.se###tape.net/thumbs/5olnm0r.jpg
- http://www.se###tape.net/thumbs/89cffbs.jpg
- http://www.se###tape.net/images/120x60_RTA-5042-1996-1400-1577-RTA_c.gif
- http://www.se###tape.net/thumbs/d0vrzde.jpg
- http://www.se###tape.net/images/corner.jpg
- http://www.se###tape.net/images/corner_left.jpg
- http://www.se###tape.net/images/grad_bg.gif
- http://www.se###tape.net/thumbs/n0pn4y8.jpg
- http://www.se###tape.net/thumbs/r7by7tc.jpg
- http://www.se###tape.net/thumbs/38ese8q.jpg
- http://www.se###tape.net/thumbs/660c33j.jpg
- http://www.se###tape.net/thumbs/b1yx151.jpg
- http://www.se###tape.net/thumbs/jc2rwf8.jpg
- http://www.se###tape.net/thumbs/70a0wdh.jpg
- http://www.se###tape.net/thumbs/iwiqcc6.jpg
- http://www.se###tape.net/thumbs/7biqg3u.jpg
- http://www.se###tape.net/thumbs/e8wabs3.jpg
- http://www.se###tape.net/thumbs/s83ewfw.jpg
- http://www.se###tape.net/thumbs/4b6pnp6.jpg
- http://www.se###tape.net/thumbs/e0h7lj1.jpg
- http://www.se###tape.net/thumbs/55h14gn.jpg
- http://www.se###tape.net/thumbs/lpomne4.jpg
- http://www.se###tape.net/thumbs/11lnh9z.jpg
- http://www.se###tape.net/thumbs/z1m60pk.jpg
- http://www.se###tape.net/thumbs/osbo7y5.jpg
- http://www.se###tape.net/thumbs/cle932z.jpg
- http://www.se###tape.net/thumbs/kzjr243.jpg
- http://www.se###tape.net/thumbs/63ovftu.jpg
- http://www.se###tape.net/thumbs/fffivgg.jpg
- http://www.se###tape.net/thumbs/plb8zyl.jpg
- http://www.se###tape.net/thumbs/bo7qmca.jpg
- http://www.se###tape.net/thumbs/qeh2myl.jpg
- http://www.se###tape.net/thumbs/yl35r6h.jpg
- http://www.se###tape.net/thumbs/yfljrss.jpg
- http://www.se###tape.net/thumbs/re4pe3j.jpg
- http://www.se###tape.net/images/site_bg.gif
- http://www.se###tape.net/thumbs/9snatqt.jpg
- http://www.se###tape.net/thumbs/hx3vq1y.jpg
- http://www.se###tape.net/thumbs/tb4kcrl.jpg
- http://sy######ion.exoclick.com/splash.php?id###################
- http://www.se###tape.net/thumbs/jnoyijn.jpg
- http://www.se###tape.net/thumbs/wtauigr.jpg
- http://www.se###tape.net/thumbs/qp62dv0.jpg
- http://www.se###tape.net/thumbs/8ig4x76.jpg
- http://www.se###tape.net/thumbs/svabgs8.jpg
- http://www.se###tape.net/thumbs/sg76x8t.jpg
- http://www.se###tape.net/thumbs/15a42q6.jpg
- http://www.se###tape.net/thumbs/8bksyrc.jpg
- http://www.se###tape.net/thumbs/arux0x2.jpg
- http://www.se###tape.net/images/logo_mobile.jpg
- http://www.se###tape.net/images/logo2.jpg
- http://www.se###tape.net/images/logo1.jpg
- http://ad#####r.juicyads.com/adshow.php?ad###########
- http://www.se###tape.net/images/logo.jpg
- http://www.se###tape.net/webmasters/mootools.svn.js
- http://www.se###tape.net/thumbs/1d9w4tc.jpg
- http://www.se###tape.net/reklame.js
- http://c1.##pads.net/pop.js
- http://www.go#####a###ytics.com/a###ytics.js
- http://www.se###tape.net/js/bootstrap.min.js
- http://pk#.goog/gsr1/gsr1.crt
- http://www.se###tape.net/fonts/glyphicons-halflings-regular.eot?
- http://www.se###tape.net/css/bootstrap.min.css
- http://www.se###tape.net/thumbs/0xoslao.jpg
- http://www.se###tape.net/thumbs/dl0o8wg.jpg
- http://www.se###tape.net/thumbs/eekuxux.jpg
- http://www.se###tape.net/thumbs/lfn32ji.jpg
- http://www.se###tape.net/thumbs/p4910oi.jpg
- http://www.se###tape.net/thumbs/lru6ndu.jpg
- http://www.se###tape.net/thumbs/d1tgzf0.jpg
- http://www.se###tape.net/thumbs/iazref2.jpg
- http://www.se###tape.net/thumbs/5lgqvc8.jpg
- http://www.se###tape.net/thumbs/0u47g0j.jpg
- http://www.se###tape.net/thumbs/usrtt1u.jpg
- http://www.se###tape.net/thumbs/5vr89j4.jpg
- http://www.se###tape.net/thumbs/0dm43kq.jpg
- http://www.se###tape.net/thumbs/fuvm2wp.jpg
- http://www.se###tape.net/thumbs/52w8e92.jpg
- http://www.se###tape.net/thumbs/pwp9ia0.jpg
- http://www.se###tape.net/thumbs/i6c4tio.jpg
- http://www.se###tape.net/thumbs/jokoq3g.jpg
- http://www.se###tape.net/thumbs/rp25318.jpg
- http://www.se###tape.net/thumbs/2zcs6ne.jpg
- http://www.se###tape.net/thumbs/mvnhvi8.jpg
- http://www.se###tape.net/thumbs/rz3d17f.jpg
- http://www.se###tape.net/thumbs/flzs6pk.jpg
- http://www.se###tape.net/thumbs/e4da5px.jpg
- http://www.se###tape.net/thumbs/6lhn47f.jpg
- http://www.se###tape.net/thumbs/j99bhwr.jpg
- http://www.se###tape.net/thumbs/jwrhkh5.jpg
- http://www.se###tape.net/thumbs/vf2otlt.jpg
- http://www.se###tape.net/thumbs/riq92fq.jpg
- http://www.se###tape.net/thumbs/j72mu32.jpg
- http://www.se###tape.net/thumbs/jz874rl.jpg
- http://www.se###tape.net/thumbs/w8sakz8.jpg
- http://www.se###tape.net/thumbs/n034csq.jpg
- http://www.se###tape.net/thumbs/4kvwldw.jpg
- http://www.se###tape.net/thumbs/xuytkin.jpg
- http://www.se###tape.net/thumbs/0ti8by5.jpg
- http://www.se###tape.net/thumbs/n1sfzij.jpg
- http://www.se###tape.net/thumbs/ty70k7o.jpg
Other
- 'ma####.bootstrapcdn.com':443
- 'aj##.#oogleapis.com':443
UDP
- DNS ASK se###tape.net
- DNS ASK ma####.bootstrapcdn.com
- DNS ASK aj##.#oogleapis.com
- DNS ASK pk#.goog
- DNS ASK os#.#axcdn.com
- DNS ASK go#####a###ytics.com
- DNS ASK c1.##pads.net
- DNS ASK sy######ion.exoclick.com
- DNS ASK ad#####r.juicyads.com
- DNS ASK fe########alog-cdn.prod.mozaws.net
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '<SYSTEM32>\searchprotocolhost.exe' Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "%...
- '<SYSTEM32>\searchfilterhost.exe' 0 508 512 520 65536 516
