Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022101620221017\index.dat
Modifies the following files
Network activity
Connects to
- 'tu###ideo.eu':80
- 'po##otop.eu':80
- 'nu###mphoto.top':80
- 'sh###per.org':80
- 'ho##ay.biz':80
TCP
HTTP GET requests
- http://tu###ideo.eu/iwysakhmr.cgi?2&###################################################
- http://i.###day.biz/streamrotator/thumbs/Gh/448693.jpg
- http://i.###day.biz/streamrotator/thumbs/nj/533679.jpg
- http://i.###day.biz/streamrotator/thumbs/fi/473433.jpg
- http://i.###day.biz/streamrotator/thumbs/ui/488503.jpg
- http://i.###day.biz/streamrotator/thumbs/Tg/409651.jpg
- http://i.###day.biz/streamrotator/thumbs/bh/417965.jpg
- http://i.###day.biz/streamrotator/thumbs/zi/493365.jpg
- http://i.###day.biz/streamrotator/thumbs/Fi/499427.jpg
- http://i.###day.biz/streamrotator/thumbs/Yg/414061.jpg
- http://i.###day.biz/streamrotator/thumbs/Ij/554068.jpg
- http://i.###day.biz/streamrotator/thumbs/yb/128796.jpg
- http://i.###day.biz/streamrotator/thumbs/Ue/306470.jpg
- http://i.###day.biz/streamrotator/thumbs/Ii/502517.jpg
- http://i.###day.biz/streamrotator/thumbs/yj/544541.jpg
- http://i.###day.biz/streamrotator/thumbs/mj/532675.jpg
- http://i.###day.biz/streamrotator/thumbs/ki/478049.jpg
- http://i.###day.biz/streamrotator/thumbs/Gk/604205.jpg
- http://i.###day.biz/streamrotator/thumbs/ki/478955.jpg
- http://i.###day.biz/streamrotator/thumbs/jh/425804.jpg
- http://i.###day.biz/streamrotator/thumbs/Yg/414789.jpg
- http://i.###day.biz/streamrotator/thumbs/ah/416277.jpg
- http://i.###day.biz/streamrotator/thumbs/Ii/502236.jpg
- http://i.###day.biz/streamrotator/thumbs/sk/590142.jpg
- http://i.###day.biz/streamrotator/thumbs/Qh/458051.jpg
- http://i.###day.biz/streamrotator/thumbs/Uj/566015.jpg
- http://i.###day.biz/streamrotator/thumbs/Rk/615197.jpg
- http://i.###day.biz/streamrotator/thumbs/Me/298963.jpg
- http://i.###day.biz/streamrotator/thumbs/Bi/495869.jpg
- http://i.###day.biz/streamrotator/thumbs/kh/426594.jpg
- http://i.###day.biz/streamrotator/thumbs/tj/539914.jpg
- http://i.###day.biz/streamrotator/thumbs/ci/470936.jpg
- http://i.###day.biz/streamrotator/thumbs/Hj/553070.jpg
- http://i.###day.biz/streamrotator/thumbs/Rf/355039.jpg
- http://i.###day.biz/streamrotator/thumbs/Xh/465989.jpg
- http://i.###day.biz/streamrotator/thumbs/zj/545498.jpg
- http://i.###day.biz/streamrotator/thumbs/bf/313818.jpg
- http://i.###day.biz/streamrotator/thumbs/Oh/456205.jpg
- http://i.###day.biz/streamrotator/thumbs/fh/421501.jpg
- http://i.###day.biz/streamrotator/thumbs/ak/572175.jpg
- http://i.###day.biz/streamrotator/thumbs/Yd/258585.jpg
- http://i.###day.biz/streamrotator/thumbs/Kj/556927.jpg
- http://i.###day.biz/streamrotator/thumbs/Se/304216.jpg
- http://i.###day.biz/streamrotator/thumbs/Gh/448484.jpg
- http://i.###day.biz/streamrotator/thumbs/Fb/135930.jpg
- http://i.###day.biz/streamrotator/thumbs/Lh/453315.jpg
- http://i.###day.biz/streamrotator/thumbs/ck/574174.jpg
- http://i.###day.biz/streamrotator/thumbs/tk/591535.jpg
- http://i.###day.biz/streamrotator/thumbs/Qk/614961.jpg
- http://i.###day.biz/streamrotator/thumbs/Pi/509383.jpg
- http://i.###day.biz/streamrotator/thumbs/Hk/605024.jpg
- http://i.###day.biz/streamrotator/thumbs/dk/575153.jpg
- http://i.###day.biz/streamrotator/thumbs/uj/540210.jpg
- http://i.###day.biz/streamrotator/thumbs/Kh/452640.jpg
- http://i.###day.biz/streamrotator/thumbs/Fk/603235.jpg
- http://i.###day.biz/streamrotator/thumbs/Vh/463912.jpg
- http://i.###day.biz/streamrotator/thumbs/wb/126875.jpg
- http://i.###day.biz/streamrotator/thumbs/yk/596877.jpg
- http://i.###day.biz/streamrotator/thumbs/Qj/562729.jpg
- http://i.###day.biz/streamrotator/thumbs/Wg/412526.jpg
- http://i.###day.biz/streamrotator/thumbs/ji/477506.jpg
- http://i.###day.biz/streamrotator/thumbs/if/320001.jpg
- http://i.###day.biz/streamrotator/thumbs/Pi/509086.jpg
- http://i.###day.biz/streamrotator/thumbs/fk/577288.jpg
- http://i.###day.biz/streamrotator/thumbs/ij/528941.jpg
- http://i.###day.biz/streamrotator/thumbs/Fh/447062.jpg
- http://i.###day.biz/streamrotator/thumbs/Gk/604492.jpg
- http://i.###day.biz/streamrotator/thumbs/Ck/600024.jpg
- http://i.###day.biz/streamrotator/thumbs/Sh/460700.jpg
- http://i.###day.biz/streamrotator/thumbs/vg/385561.jpg
- http://i.###day.biz/streamrotator/thumbs/Qe/302232.jpg
- http://i.###day.biz/streamrotator/thumbs/Oh/456927.jpg
- http://i.###day.biz/streamrotator/thumbs/Wg/412339.jpg
- http://i.###day.biz/streamrotator/thumbs/cg/366778.jpg
- http://i.###day.biz/streamrotator/thumbs/zj/545422.jpg
- http://i.###day.biz/streamrotator/thumbs/Ik/606352.jpg
- http://i.###day.biz/streamrotator/thumbs/Bj/547977.jpg
- http://i.###day.biz/streamrotator/thumbs/Og/404895.jpg
- http://i.###day.biz/streamrotator/thumbs/Nk/611575.jpg
- http://i.###day.biz/streamrotator/thumbs/Bf/339311.jpg
- http://i.###day.biz/streamrotator/thumbs/Te/305954.jpg
- http://i.###day.biz/streamrotator/thumbs/oj/534687.jpg
- http://i.###day.biz/streamrotator/thumbs/Aj/546765.jpg
- http://i.###day.biz/streamrotator/thumbs/Th/461786.jpg
- http://i.###day.biz/streamrotator/thumbs/Lk/609972.jpg
- http://i.###day.biz/streamrotator/thumbs/Oh/456019.jpg
- http://i.###day.biz/streamrotator/thumbs/yk/596763.jpg
- http://i.###day.biz/streamrotator/thumbs/Bj/547423.jpg
- http://i.###day.biz/streamrotator/thumbs/bf/313531.jpg
- http://i.###day.biz/streamrotator/thumbs/Mi/506764.jpg
- http://i.###day.biz/streamrotator/thumbs/Rk/615574.jpg
- http://i.###day.biz/streamrotator/thumbs/Sj/564178.jpg
- http://tu###ideo.eu/iwysakhmr.cgi?2&###############################
- http://tu###ideo.eu/jry.cgi?3
- http://po##otop.eu/favicon.ico
- http://tu###ideo.eu/2.html
- http://tu###ideo.eu/bduuntea.cgi?2&###################################################
- http://nu###mphoto.top/
- http://po##otop.eu/go.php?u=############################################
- http://nu###mphoto.top/ftt2/cron.php
- http://nu###mphoto.top/ftt2/o.php
- http://nu###mphoto.top/ftt2/check.php?t=#############################################################
- http://ho##ay.biz/
- http://ho##ay.biz/hotsex.png
- http://ho##ay.biz/f/check.php?t=############################################################
- http://i.###day.biz/streamrotator/thumbs/lh/427755.jpg
- http://sh###per.org/ajn.cgi?14###########
- http://i.###day.biz/streamrotator/thumbs/ak/572555.jpg
- http://i.###day.biz/streamrotator/thumbs/qj/536027.jpg
- http://i.###day.biz/streamrotator/thumbs/si/486041.jpg
- http://i.###day.biz/streamrotator/thumbs/gi/474943.jpg
- http://i.###day.biz/streamrotator/thumbs/mj/532385.jpg
- http://i.###day.biz/streamrotator/thumbs/Qi/510539.jpg
- http://i.###day.biz/streamrotator/thumbs/hj/527566.jpg
- http://i.###day.biz/streamrotator/thumbs/Sk/616663.jpg
- http://i.###day.biz/streamrotator/thumbs/tk/591245.jpg
- http://i.###day.biz/streamrotator/thumbs/Kj/556755.jpg
- http://i.###day.biz/streamrotator/thumbs/di/471858.jpg
- http://i.###day.biz/streamrotator/thumbs/Sk/616035.jpg
- http://i.###day.biz/streamrotator/thumbs/tj/539617.jpg
- http://i.###day.biz/streamrotator/thumbs/wk/594793.jpg
- http://i.###day.biz/streamrotator/thumbs/ih/424794.jpg
- http://i.###day.biz/streamrotator/thumbs/Sj/564939.jpg
- http://i.###day.biz/streamrotator/thumbs/Kk/608478.jpg
- http://i.###day.biz/streamrotator/thumbs/zk/597248.jpg
- http://i.###day.biz/streamrotator/thumbs/eh/420346.jpg
- http://i.###day.biz/streamrotator/thumbs/rk/589436.jpg
- http://i.###day.biz/streamrotator/thumbs/Fj/551098.jpg
- http://i.###day.biz/streamrotator/thumbs/vi/489812.jpg
- http://i.###day.biz/streamrotator/thumbs/Bg/391255.jpg
- http://i.###day.biz/streamrotator/thumbs/Dj/549657.jpg
- http://i.###day.biz/streamrotator/thumbs/Pe/301036.jpg
- http://i.###day.biz/streamrotator/thumbs/Ik/606903.jpg
- http://i.###day.biz/streamrotator/thumbs/Re/303656.jpg
- http://i.###day.biz/streamrotator/thumbs/Jh/451815.jpg
- http://i.###day.biz/streamrotator/thumbs/qh/432345.jpg
- http://i.###day.biz/streamrotator/thumbs/fi/473487.jpg
- http://i.###day.biz/streamrotator/thumbs/lh/427213.jpg
- http://i.###day.biz/streamrotator/thumbs/ei/472270.jpg
- http://i.###day.biz/streamrotator/thumbs/bk/573290.jpg
- http://i.###day.biz/streamrotator/thumbs/fk/577291.jpg
- http://i.###day.biz/streamrotator/thumbs/Me/298207.jpg
- http://i.###day.biz/streamrotator/thumbs/lg/375236.jpg
- http://i.###day.biz/streamrotator/thumbs/hj/527071.jpg
- http://i.###day.biz/streamrotator/thumbs/af/312099.jpg
- http://ho##ay.biz/favicon.ico
UDP
- DNS ASK tu###ideo.eu
- DNS ASK po##otop.eu
- DNS ASK nu###mphoto.top
- DNS ASK sh###per.org
- DNS ASK ho##ay.biz
- DNS ASK i.###day.biz
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
