Technical Information
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\privacie\index.dat
Network activity
Connects to
- 'sh###per.org':80
- 'if#####dn.amavalet.com':443
- 'ba######.f###youcash.com':80
- 'br####l334nutsz.com':80
- 'cr####ve.bbrdbr.com':443
- 'pl######-api.sharethis.com':443
- 'go#####agmanager.com':443
- '1t##9.top':80
- 'po####dby.jads.co':443
- 'cd###.#loudflare.com':443
- 'cd#.##yndicate.com':80
- 'cu##est.net':80
- 'ma###exxx.icu':80
- 'nu##vidi.eu':80
- 'se##as.pw':80
- 'te##free.eu':80
- 'pk#.goog':80
- 'oc##.#ectigo.com':80
TCP
HTTP GET requests
- http://sh###per.org/hdel.cgi?2&###################################################
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/a/305.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/Qa/94619.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/bb/105168.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/bb/105163.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/wa/74653.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/bb/105174.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/a/354.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/y/24135.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/a/340.jpg
- http://1t##9.top/show.php
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/Qa/94617.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/a/314.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/bb/105199.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/V/47206.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/c/2104.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/bb/105192.jpg
- http://www.cu##est.net/thumb_id-2805.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/bb/105166.jpg
- http://pk#.goog/gsr1/gsr1.crt
- http://ba######.f###youcash.com/?si############################################
- http://br####l334nutsz.com/lvesnk.html?zo############
- http://ts###icate.com/iframes2/606faf8eaeeb4fd7a1373d63eedfc52e.html?
- http://ts###icate.com/iframes2/9983cc529a22423f85d6dac502150516.html?ex###########
- http://ts###icate.com/iframes2/c90f7a603b654fc5923cd6d6dac56b2e.html?
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/bb/105164.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/u/20382.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/j/9530.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/bb/105198.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/Y/50476.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/a/357.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/Qa/94626.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/Qa/94614.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/bb/105181.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/V/47216.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/bb/105170.jpg
- http://se##as.pw/ftt2/o.php
- http://sh###per.org/ajn.cgi?14###########
- http://se##as.pw/
- http://sh###per.org/dvh.cgi?4
- http://sh###per.org/rbeqd.cgi?2&###################################################
- http://sh###per.org/pte2.html
- http://sh###per.org/oyszi.cgi?20####################################################
- http://se##as.pw/cs1s1/css
- http://sh###per.org/hmmorl.cgi?20####################################################
- http://te##free.eu/css/fontawesome-all.min.css
- http://te##free.eu/css/style.css
- http://te##free.eu/nl/?re##
- http://sh###per.org/hdel.cgi?2&###############################
- http://te##free.eu/?re##
- http://sh###per.org/toyu13.html
- http://sh###per.org/ami20.html
- http://cd#.##yndicate.com/sdk/v1/n.js
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/a/373.jpg
- http://sh###per.org/nhczj.cgi?2&###################################################
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/bb/105188.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/a/557.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/bb/105190.jpg
- http://www.cu##est.net/streamrotator/streamrotator/thumbs/bb/105195.jpg
- http://cd#.##yndicate.com/sdk/v1/p.js
- http://www.cu##est.net/logo-###test.jpg
- http://cd#.##yndicate.com/sdk/v1/inpage.push.js
- http://ma###exxx.icu/ftt2/check.php?t=#############################################################
- http://www.cu##est.net/
- http://nu##vidi.eu/ftt2/o.php
- http://ma###exxx.icu/
- http://nu##vidi.eu/ftt2/check.php?t=#############################################################
- http://sh###per.org/nhczj.cgi?2&###############################
- http://nu##vidi.eu/
- http://sh###per.org/oyszi.cgi?20################################
- http://oc##.#ectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEHJyQIYvow29Ew63GHrhBw4%3D
Other
- 'cd###.#loudflare.com':443
- 'po####dby.jads.co':443
- 'go#####agmanager.com':443
- 'pl######-api.sharethis.com':443
- 'cr####ve.bbrdbr.com':443
- 'if#####dn.amavalet.com':443
UDP
- DNS ASK sh###per.org
- DNS ASK if#####dn.amavalet.com
- DNS ASK ba######.f###youcash.com
- DNS ASK br####l334nutsz.com
- DNS ASK cr####ve.bbrdbr.com
- DNS ASK ts###icate.com
- DNS ASK go#####agmanager.com
- DNS ASK pl######-api.sharethis.com
- DNS ASK 1t##9.top
- DNS ASK po####dby.jads.co
- DNS ASK cd###.#loudflare.com
- DNS ASK cd#.##yndicate.com
- DNS ASK cu##est.net
- DNS ASK ma###exxx.icu
- DNS ASK nu##vidi.eu
- DNS ASK nu##1.eu
- DNS ASK se##as.pw
- DNS ASK te##free.eu
- DNS ASK pk#.goog
- DNS ASK oc##.#ectigo.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
