Technical Information
Modifies file system
Creates the following files
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
Network activity
TCP
HTTP GET requests
- http://aj##.#oogleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js
- http://tr#####rsealchemy.com/wp-content/uploads/2011/04/AA3copy.jpg
- http://cl#####pornscenes.com/s/player/cps0010401.jpg
- http://im###.barelist.com/images/hosted/tgp/melissa-wolf-110311/pics/melissa-wolf-shows-off-her-great-80s-nude-body-10.jpg
- http://im#.##relist.com/images/hosted/tgp/joanne-szmereta-121511/pics/joanne-szmereta-shows-off-her-nude-80s-body-13.jpg
- http://www.re####exchicks.com/picpost/thmbs/557914_118685-175596-hairy-pussy-early-eighties-nude-laying-out.jpg
- http://www.su###nius.com/bigfist/pics13/1_Sector/Heart_Ignition-3/images/The-Nude-Eighties.jpg
- http://www.qu#####thumbnails.com/picpost/thmbs/553533_118936-175889-deborah-caprioglio-nude-showing-her-large-breasts-and-hairy-italian-pussy-in-the-eighties.jpg
- http://gr#####ffeebeanmaxx.com/418/nude-80s-girls-2.jpg
- http://tr#####rsealchemy.com/wp-content/uploads/2011/04/am_3_747524a.jpg
- http://www.nu####ntageporn.com/content/22/596_vintage_threesome.jpg
- http://www.tr####rdarepics.com/sexstoryarchive/house/images/girls21.jpg
- http://um###rance.com/352/80s-nude-girls.jpg
- http://www.yo####rtymind.com/galleries/pics/abbywinters/aw8006.jpg
- http://www.yo####rtymind.com/galleries/pics/abbywinters/aw8004.jpg
- http://www.qu#####thumbnails.com/picpost/thmbs/551427_118485-175344-lusty-eighties-girl-posing-non-nude-for-photo.jpg
- http://tr#####rsealchemy.com/wp-content/uploads/2011/04/1840948866a.jpg
- http://tr#####rsealchemy.com/wp-content/uploads/2011/04/1245287294a.jpg
- http://www.qu#####thumbnails.com/picpost/thmbs/746562_117921-174673-tan-lines-eighties-porn-star-nude.jpg
- http://c-####laboite.com/382/505459.jpg
- http://cl#####porntube.mobi/images/thumb_b/36/57/10/365710fa4f58dc732d8b97c0f9dd585182054ef0.jpg
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://2.##.#logspot.com/-jA7c8r1-gnc/Ud8qkoA9pNI/AAAAAAAAPBU/KDi2poM2GhA/s1600/p1376331813.jpg
- http://www.yo####rtymind.com/galleries/pics/abbywinters/aw8012.jpg
- http://me###.#ansmovies.com/media/galleries/54411e18897fe/14.jpg
- http://re##ust.com/wp-content/uploads/playmate_80/playmate_80_36.jpg
- http://www.yo####rtymind.com/galleries/pics/abbywinters/aw8005.jpg
- http://um###rance.com/352/51b69f4d8cb69fd66159945660efe05c.jpg
- http://2.##.#logspot.com/-hx3-k7W3Ah0/UV4PZWg0pJI/AAAAAAAALnQ/rlTkJoBjnQ0/s1600/Penthouse_best_4_Carol_scan21_123_770lo.jpg
- http://www.th####urprise.com/picpost/thmbs/765149_117881-174631-nude-eighties-porn-star-in-a-chair.jpg
- http://www.ch###ynudes.com/donna-edmondson-classic-playmate/8.jpg
- http://um###rance.com/352/834978.jpg
- http://me###.#ansmovies.com/media/galleries/54411e18897fe/12.jpg
- http://1.##.#logspot.com/-DYV63k10s3I/UV4PXVIJYtI/AAAAAAAALm4/GCri51_9Hy0/s1600/penthouse-vintage-1.jpg
- http://po###icture.org/media/galleries/5563643a8f67c/4.jpg
- http://cl#####porntube.mobi/images/thumb/34/56/45/345645fca61a239a128da01b2dac179735391651.jpg
- http://nu####ntageporn.com/content/22/596_vintage_threesome.jpg
- http://ba###rop.net/thumbs/tania_635479.jpg
- http://re##ust.com/wp-content/uploads/playmate_80/playmate_80_54.jpg
UDP
- DNS ASK st###ounter.com
- DNS ASK be###grit.com
- DNS ASK cs##t.eu
- DNS ASK fl###bak.com
- DNS ASK gr#####ffeebeanmaxx.com
- DNS ASK su###nius.com
- DNS ASK po###icture.org
- DNS ASK im#.##relist.com
- DNS ASK 1.##.#logspot.com
- DNS ASK im###.barelist.com
- DNS ASK tr####rdarepics.com
- DNS ASK cd#.###mbs.fapdu.com
- DNS ASK if##d.eu
- DNS ASK 4.##.#logspot.com
- DNS ASK se###olon.biz
- DNS ASK cd#.##lofteens.com
- DNS ASK ca##.#dn.z5o.net
- DNS ASK ca######.adultempire.com
- DNS ASK c-####laboite.com
- DNS ASK da#######ig.files.wordpress.com
- DNS ASK di.##ncdn.com
- DNS ASK im######.adultempire.com
- DNS ASK cl#####pornscenes.com
- DNS ASK ba###rop.net
- DNS ASK nu####ntageporn.com
- DNS ASK qu#####thumbnails.com
- DNS ASK i.###img.com
- DNS ASK sw###mining.win
- DNS ASK il###4ulih.com
- DNS ASK aj##.#oogleapis.com
- DNS ASK ht######v.googlecode.com
- DNS ASK m.####access.mobi
- DNS ASK microsoft.com
- DNS ASK um###rance.com
- DNS ASK th####urprise.com
- DNS ASK th###pslip.com
- DNS ASK ch###ynudes.com
- DNS ASK ci.##ncdn.com
- DNS ASK tr#####rsealchemy.com
- DNS ASK yo####rtymind.com
- DNS ASK 2.##.#logspot.com
- DNS ASK me###.#ansmovies.com
- DNS ASK nu###gals.com
- DNS ASK ni###cipio.com
- DNS ASK cl#####porntube.mobi
- DNS ASK re##ust.com
- DNS ASK co#####.wafflegirl.com
- DNS ASK re####exchicks.com
- DNS ASK im###s.sex.com
- DNS ASK 78.###ia.tumblr.com
- DNS ASK d3#####3.ssl.hwcdn.net
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
