Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%low\microsoft\internet explorer\services\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012024042320240424\index.dat
- %APPDATA%\microsoft\windows\privacie\index.dat
Network activity
Connects to
- 'bing.com':80
- 'tu###ideo.eu':80
- 'po##otop.eu':80
- 'hd###dist.eu':80
- 'cd#.#opcash.net':80
- 'sh###per.org':80
- 'nu##play.me':80
- 'xm##ure.eu':80
- 'nu####sfamilys.eu':80
- 'ha###erm###.top':80
- 'nu####-movies.top':80
- 'te####rnhdxxx.com':443
TCP
HTTP GET requests
- http://www.bing.com/favicon.ico
- http://nu####-movies.top/disainqons/main.css
- http://nu####-movies.top/
- http://ha###erm###.top/ftt2/o.php
- http://ha###erm###.top/ftt2/check.php?t=#############################################################
- http://ha###erm###.top/
- http://nu####sfamilys.eu/ftt2/o.php
- http://nu####sfamilys.eu/ftt2/check.php?t=#############################################################
- http://sh###per.org/tzh.cgi?9&##########
- http://nu####sfamilys.eu/dencasgj.js
- http://nu####sfamilys.eu/
- http://xm##ure.eu/ftt2/o.php
- http://xm##ure.eu/ftt2/check.php?t=#############################################################
- http://nu####-movies.top/ftt2/check.php?t=#############################################################
- http://xm##ure.eu/a###iz.js
- http://hd###dist.eu/ftt2/o.php
- http://sh###per.org/ajn.cgi?14###########
- http://cd#.#opcash.net/pop.js
- http://hd###dist.eu/ftt2/check.php?t=#############################################################
- http://hd###dist.eu/
- http://tu###ideo.eu/vxjucrb.cgi?2&###################################################
- http://tu###ideo.eu/jry.cgi?3
- http://tu###ideo.eu/ymntpo.cgi?2&###############################
- http://tu###ideo.eu/2.html
- http://po##otop.eu/favicon.ico
- http://po##otop.eu/go.php?u=############################################
- http://tu###ideo.eu/ymntpo.cgi?2&##################################################
- http://xm##ure.eu/
- http://nu####-movies.top/ftt2/o.php
Other
- 'te####rnhdxxx.com':443
UDP
- DNS ASK bing.com
- DNS ASK tu###ideo.eu
- DNS ASK po##otop.eu
- DNS ASK nu##play.me
- DNS ASK hd###dist.eu
- DNS ASK sh###per.org
- DNS ASK cd#.#opcash.net
- DNS ASK xm##ure.eu
- DNS ASK nu####sfamilys.eu
- DNS ASK ha###erm###.top
- DNS ASK nu####-movies.top
- DNS ASK te####rnhdxxx.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
