Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012023122820231229\index.dat
- %APPDATA%\microsoft\windows\privacie\index.dat
Network activity
Connects to
- 'tu###ideo.eu':80
- 'x1.#.lencr.org':80
- 'pk#.goog':80
- 's4.##stats.com':443
- 's1#.#istats.com':80
- 'mc##as.com':443
- 'aj##ee.com':443
- 'zm##ei.com':443
- 'r3.#.lencr.org':80
- 'sw####uties18.xyz':80
- 'to###udism.eu':80
- 'fa####naturism.eu':80
- 'cd#.#opcash.net':80
- 'be###nudist.eu':80
- 'sh###per.org':80
- 'nu###mtown.eu':80
- 'po##otop.eu':80
- 'se##as.pw':80
- 'x2.#.lencr.org':80
TCP
HTTP GET requests
- http://tu###ideo.eu/iuvjj.cgi?2&###################################################
- http://fa####naturism.eu/paxota/styles.css
- http://fa####naturism.eu/paxota/normalize.css
- http://fa####naturism.eu/ftt2/check.php?t=#############################################################
- http://fa####naturism.eu/ftt2/o.php
- http://to###udism.eu/
- http://to###udism.eu/ftt2/check.php?t=#############################################################
- http://to###udism.eu/ftt2/o.php
- http://se##as.pw/
- http://se##as.pw/cs1s1/css
- http://se##as.pw/ftt2/o.php
- http://sw####uties18.xyz/
- http://sw####uties18.xyz/cosmo.js
- http://s1#.#istats.com/js15_as.js
- http://pk#.goog/gsr1/gsr1.crt
- http://x1.#.lencr.org/
- http://fa####naturism.eu/andcasgj.js
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgM4q7sy5ZjP7bKwnv3YaanWGQ%3D%3D
- http://fa####naturism.eu/
- http://cd#.#opcash.net/pop.js
- http://po##otop.eu/go.php?u=############################################
- http://po##otop.eu/favicon.ico
- http://tu###ideo.eu/iuvjj.cgi?2&###############################
- http://tu###ideo.eu/2.html
- http://tu###ideo.eu/jry.cgi?3
- http://tu###ideo.eu/dhfu.cgi?2&###################################################
- http://nu###mtown.eu/
- http://nu###mtown.eu/ftt2/cron.php
- http://sh###per.org/ajn.cgi?14###########
- http://nu###mtown.eu/ftt2/check.php?t=#############################################################
- http://nu###mtown.eu/ftt2/o.php
- http://be###nudist.eu/
- http://nu###mtown.eu/a###iz.js
- http://be###nudist.eu/tanolsew.js
- http://be###nudist.eu/ftt2/check.php?t=#############################################################
- http://be###nudist.eu/ftt2/o.php
- http://x2.#.lencr.org/
Other
- 'zm##ei.com':443
- 'aj##ee.com':443
- 'mc##as.com':443
- 's4.##stats.com':443
UDP
- DNS ASK tu###ideo.eu
- DNS ASK x1.#.lencr.org
- DNS ASK pk#.goog
- DNS ASK s4.##stats.com
- DNS ASK s1#.#istats.com
- DNS ASK mc##as.com
- DNS ASK zm##ei.com
- DNS ASK aj##ee.com
- DNS ASK sw####uties18.xyz
- DNS ASK se##as.pw
- DNS ASK to###udism.eu
- DNS ASK fa####naturism.eu
- DNS ASK cd#.#opcash.net
- DNS ASK be###nudist.eu
- DNS ASK sh###per.org
- DNS ASK nu###mtown.eu
- DNS ASK nu###tup.com
- DNS ASK po##otop.eu
- DNS ASK r3.#.lencr.org
- DNS ASK x2.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
