Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012023062320230624\index.dat
- %APPDATA%\microsoft\windows\privacie\index.dat
Network activity
Connects to
- 'tu###ideo.eu':80
- 's1#.#istats.com':80
- 'r3.#.lencr.org':80
- 'x1.#.lencr.org':80
- 'ac##dn.com':80
- 'aj##ee.com':443
- 'oh###um.info':443
- 'im####2.imgbox.com':443
- 'na####icstop.top':80
- 'sm###nudist.eu':80
- 'nu###tvid.xyz':80
- 'sh###per.org':80
- 'cd#.#opcash.net':80
- 'vi####nudists.eu':80
- 'po##otop.eu':80
- 'nu####gallery.eu':80
- 's4.##stats.com':443
TCP
HTTP GET requests
- http://tu###ideo.eu/uvpmq.cgi?2&##################################################
- http://s1#.#istats.com/js15_as.js
- http://na####icstop.top/no/in.php?p=###############################################
- http://cd#.#opcash.net/show.js
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgSMBk7VWnSz2gmKvOtFy5XVUA%3D%3D
- http://x1.#.lencr.org/
- http://ac##dn.com/script/suv4.js
- http://na####icstop.top/
- http://nu####gallery.eu/ftt2/o.php
- http://nu####gallery.eu/ftt2/check.php?t=#############################################################
- http://nu###tvid.xyz/ftt2/check.php?t=#############################################################
- http://nu###tvid.xyz/ftt2/cron.php
- http://nu####gallery.eu/
- http://nu###tvid.xyz/
- http://sm###nudist.eu/ftt2/o.php
- http://na####icstop.top/favicon.ico
- http://sm###nudist.eu/ftt2/check.php?t=#############################################################
- http://sm###nudist.eu/
- http://vi####nudists.eu/ftt2/o.php
- http://vi####nudists.eu/ftt2/check.php?t=#############################################################
- http://sh###per.org/ajn.cgi?14###########
- http://vi####nudists.eu/a###izir.js
- http://cd#.#opcash.net/pop.js
- http://vi####nudists.eu/ftt2/cron.php
- http://vi####nudists.eu/
- http://tu###ideo.eu/uvpmq.cgi?2&###############################
- http://tu###ideo.eu/jry.cgi?3
- http://tu###ideo.eu/lofutstu.cgi?2&###################################################
- http://tu###ideo.eu/2.html
- http://po##otop.eu/favicon.ico
- http://po##otop.eu/go.php?u=############################################
- http://sm###nudist.eu/logpag.js
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgTZYNLJac2ymPGv44O7kgMvdg%3D%3D
Other
- 'oh###um.info':443
- 'aj##ee.com':443
- 'im####2.imgbox.com':443
- 's4.##stats.com':443
- '34.##9.100.209':443
UDP
- DNS ASK tu###ideo.eu
- DNS ASK s1#.#istats.com
- DNS ASK r3.#.lencr.org
- DNS ASK x1.#.lencr.org
- DNS ASK ac##dn.com
- DNS ASK oh###um.info
- DNS ASK aj##ee.com
- DNS ASK im####2.imgbox.com
- DNS ASK na####icstop.top
- DNS ASK sm###nudist.eu
- DNS ASK nu###tvid.xyz
- DNS ASK sh###per.org
- DNS ASK cd#.#opcash.net
- DNS ASK vi####nudists.eu
- DNS ASK po##otop.eu
- DNS ASK nu####gallery.eu
- DNS ASK s4.##stats.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
