Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022091220220913\index.dat
Modifies the following files
Network activity
Connects to
- 'fr###oll.ru.com':80
- 'go#####agmanager.com':443
- 'microsoft.com':80
- 'sc####ofsquirt.com':443
- 'p.###ekit.net':443
- 'us#.#ypekit.net':443
- 'pi###.wp.com':445
TCP
HTTP GET requests
- http://www.fr###oll.ru.com/jquery-1.11.0.min.js
- http://www.fr###oll.ru.com/fonts/generatepress.eot
- http://www.fr###oll.ru.com/404.php
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/sos-logo-tiny-1.png
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/click-box.jpg
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/1f609.svg
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/wap-megan-small_002.jpg
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/wap-katia-small_002.jpg
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/wap-chrissy-small_002.jpg
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/stroke-video_002.jpg
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/e-202115.js
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/sticky.js
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/front.js
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/imagesloaded.js
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/masonry.js
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/frontend_002.js
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/main.js
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/frontend.js
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/wp-embed.js
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/fonts/thrvicomoon/icomoon.eot?
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/wap-arrow-small_002.jpg
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/edc2avj.css
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/font-icons.css
- http://www.fr###oll.ru.com/offer.php?id##########################################################################################################################################################...
- http://www.fr###oll.ru.com/favicon.ico
- http://www.fr###oll.ru.com/clicks/wts_ss2.php?si#################################################################################################################################################...
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/gtm.js
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/analytics.js
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/style.css
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/thrive_flat.css
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/style_002.css
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/style_003.css
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/jquery.js
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/sticky.css
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/menu-logo.css
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/wp-emoji-release.js
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/screen.css
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/unsemantic-grid.css
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/mobile.css
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/jetpack.css
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/jquery-migrate.js
- http://www.fr###oll.ru.com/clicks/SquirtingSchool2_files/jquery_002.js
Other
- 'go#####agmanager.com':443
- 'sc####ofsquirt.com':443
- 'p.###ekit.net':443
- 'us#.#ypekit.net':443
UDP
- DNS ASK fr###oll.ru.com
- DNS ASK go#####agmanager.com
- DNS ASK microsoft.com
- DNS ASK sc####ofsquirt.com
- DNS ASK p.###ekit.net
- DNS ASK us#.#ypekit.net
- DNS ASK pi###.wp.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
