Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012023021720230218\index.dat
Modifies the following files
Network activity
Connects to
- 'sh###per.org':80
- 'im#.##xfiles.com':443
- 'im#.###yfreeporn.com':443
- 'di.##ncdn.com':443
- 'ei.##ncdn.com':443
- 'cd#####3788.ahacdn.me':443
- 'ic####lm.xhcdn.com':443
- 'th#####vlt.xhcdn.com':443
- 'cd#####4682.ahacdn.me':443
- 'fo###.gstatic.com':443
- 'fo###.#oogleapis.com':443
- 'a.###lsrv.com':443
- 'te###tube.eu':80
- 'fa#####collection.eu':80
- 'a.###srv.com':443
- 'mi###nudist.eu':80
- 'se###hxt.com':443
- 'to####nlinks.top':80
- 'yo###nudism.eu':80
- 'nu###tvoyour.eu':80
- 'ma###exxx.icu':80
- 'to##exx.eu':80
- 'cd#####5446.ahacdn.me':443
- 'im#.##rnpapa.com':443
TCP
HTTP GET requests
- http://sh###per.org/wehnvj.cgi?2&##################################################
- http://to####nlinks.top/link/u.php?id######################################
- http://sh###per.org/yzddqaz.cgi?2&###################################################
- http://mi###nudist.eu/
- http://mi###nudist.eu/safel/style.css
- http://mi###nudist.eu/ftt2/check.php?t=#############################################################
- http://sh###per.org/yzddqaz.cgi?2&###############################
- http://mi###nudist.eu/ftt2/o.php
- http://mi###nudist.eu/safel/fentai1.gif
- http://mi###nudist.eu/analiz.js
- http://fa#####collection.eu/
- http://fa#####collection.eu/disainovms/base38.min.css
- http://fa#####collection.eu/ftt2/check.php?t=#############################################################
- http://fa#####collection.eu/ftt2/o.php
- http://te###tube.eu/ru/
- http://te###tube.eu/css/main2.css
- http://te###tube.eu/t.png
- http://mi###nudist.eu/favicon.ico
- http://te###tube.eu/icons/icons.eot?79######
- http://sh###per.org/tzh.cgi?9&##########
- http://te###tube.eu/js/jquery-1.12.0.min.js
- http://te###tube.eu/js/main.js?v=###
- http://to####nlinks.top/
- http://te###tube.eu/
- http://yo###nudism.eu/ftt2/o.php
- http://yo###nudism.eu/analiz.js
- http://sh###per.org/toyu13.html
- http://sh###per.org/wehnvj.cgi?2&###############################
- http://sh###per.org/ami20.html
- http://sh###per.org/srlavm.cgi?20###################################################
- http://to##exx.eu/go.php?u=################################################
- http://to##exx.eu/favicon.ico
- http://sh###per.org/2.html
- http://sh###per.org/nbrbd.cgi?2&###################################################
- http://sh###per.org/dvh.cgi?4
- http://sh###per.org/cdsqwi.cgi?20####################################################
- http://sh###per.org/pte2.html
- http://sh###per.org/pejemijh.cgi?2&###################################################
- http://ma###exxx.icu/
- http://sh###per.org/ajn.cgi?14###########
- http://sh###per.org/cdsqwi.cgi?20################################
- http://ma###exxx.icu/ftt2/check.php?t=#############################################################
- http://ma###exxx.icu/ftt2/o.php
- http://nu###tvoyour.eu/
- http://nu###tvoyour.eu/ftt2/check.php?t=#############################################################
- http://nu###tvoyour.eu/ftt2/o.php
- http://yo###nudism.eu/
- http://yo###nudism.eu/ftt2/check.php?t=#############################################################
- http://te###tube.eu/favicon.ico
Other
- 'se###hxt.com':443
- 'a.###srv.com':443
- 'a.###lsrv.com':443
- 'fo###.#oogleapis.com':443
- 'fo###.gstatic.com':443
- 'cd#####4682.ahacdn.me':443
- 'th#####vlt.xhcdn.com':443
- 'ic####lm.xhcdn.com':443
- 'di.##ncdn.com':443
- 'ei.##ncdn.com':443
- 'im#.###yfreeporn.com':443
- 'im#.##rnpapa.com':443
- 'im#.##xfiles.com':443
UDP
- DNS ASK sh###per.org
- DNS ASK im#.##xfiles.com
- DNS ASK im#.##rnpapa.com
- DNS ASK im#.###yfreeporn.com
- DNS ASK di.##ncdn.com
- DNS ASK cd#####3788.ahacdn.me
- DNS ASK ei.##ncdn.com
- DNS ASK ic####lm.xhcdn.com
- DNS ASK cd#####4682.ahacdn.me
- DNS ASK th#####vlt.xhcdn.com
- DNS ASK fo###.gstatic.com
- DNS ASK microsoft.com
- DNS ASK cd#####2055.ahacdn.me
- DNS ASK fo###.#oogleapis.com
- DNS ASK fa#####collection.eu
- DNS ASK a.###srv.com
- DNS ASK mi###nudist.eu
- DNS ASK se###hxt.com
- DNS ASK to####nlinks.top
- DNS ASK yo###nudism.eu
- DNS ASK nu###tvoyour.eu
- DNS ASK ma###exxx.icu
- DNS ASK nu####4colony.eu
- DNS ASK to##exx.eu
- DNS ASK te###tube.eu
- DNS ASK a.###lsrv.com
- DNS ASK cd#####5446.ahacdn.me
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
