Technical Information
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\privacie\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012023111720231118\index.dat
Network activity
Connects to
- 'sh###per.org':80
- 'fr###enudism.eu':80
- 'xx##de.eu':80
- 'nu####sfamilys.eu':80
- 'fa#####collection.eu':80
- 'yo####nudists.top':80
- 'nu##play.me':80
- 'nu###ixel.eu':80
- 'te###orntop.top':80
- 's1#.#istats.com':80
- 's4.##stats.com':443
- 'im####2.imgbox.com':443
- 'x1.#.lencr.org':80
- 'r3.#.lencr.org':80
TCP
HTTP GET requests
- http://sh###per.org/sluxd.cgi?2&###################################################
- http://yo####nudists.top/ftt2/o.php
- http://nu##play.me/
- http://nu##play.me/ftt2/check.php?t=#############################################################
- http://nu##play.me/ftt2/cron.php
- http://nu##play.me/ftt2/o.php
- http://yo####nudists.top/ftt2/check.php?t=#############################################################
- http://yo####nudists.top/dissagent/a08f6c40a2cc.css
- http://nu###ixel.eu/
- http://te###orntop.top/
- http://te###orntop.top/cosmo.js
- http://s1#.#istats.com/js15_as.js
- http://te###orntop.top/no/in.php?p=###############################################
- http://te###orntop.top/favicon.ico
- http://nu###ixel.eu/ftt2/check.php?t=#############################################################
- http://nu###ixel.eu/ftt2/o.php
- http://yo####nudists.top/dissagent/c4d5a22e1e08.css
- http://yo####nudists.top/
- http://fa#####collection.eu/ftt2/o.php
- http://fr###enudism.eu/
- http://fr###enudism.eu/ftt2/check.php?t=#############################################################
- http://fr###enudism.eu/ftt2/o.php
- http://sh###per.org/sluxd.cgi?2&###############################
- http://xx##de.eu/
- http://nu####sfamilys.eu/
- http://sh###per.org/dvh.cgi?4
- http://sh###per.org/ajn.cgi?14###########
- http://sh###per.org/tzh.cgi?9&##########
- http://nu####sfamilys.eu/ftt2/check.php?t=#############################################################
- http://nu####sfamilys.eu/ftt2/o.php
- http://fa#####collection.eu/
- http://fa#####collection.eu/disainovms/base38.min.css
- http://fa#####collection.eu/ftt2/check.php?t=###########################################################
- http://nu####sfamilys.eu/dencasgj.js
- http://x1.#.lencr.org/
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgSF6o3OJ%2F18wz%2F3rZGNpqAU8Q%3D%3D
Other
- 'im####2.imgbox.com':443
- 's4.##stats.com':443
UDP
- DNS ASK sh###per.org
- DNS ASK fr###enudism.eu
- DNS ASK xx##de.eu
- DNS ASK nu####sfamilys.eu
- DNS ASK fa#####collection.eu
- DNS ASK yo####nudists.top
- DNS ASK nu##play.me
- DNS ASK nu###ixel.eu
- DNS ASK te###orntop.top
- DNS ASK s1#.#istats.com
- DNS ASK s4.##stats.com
- DNS ASK im####2.imgbox.com
- DNS ASK x1.#.lencr.org
- DNS ASK r3.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
