Technical Information
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\privacie\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012024072520240726\index.dat
Network activity
Connects to
- 'sh###per.org':80
- 'ic####lm.xhcdn.com':443
- 'cd#####5446.ahacdn.me':443
- 'fo###.gstatic.com':443
- 'pk#.goog':80
- 'fo###.#oogleapis.com':443
- 'be###reetube.eu':80
- 'nu###tgirls.eu':80
- 'nu####sfamilys.eu':80
- 'nu###mmovies.eu':80
- 'im#.#orntry.com':443
- 'hd###deo.top':80
- 'fa#####collection.eu':80
- 'po##i.pw':80
- 'hd###dist.eu':80
- 'a.###lsrv.com':443
- 'a.###srv.com':443
- 'cd#.#opcash.net':80
- 'ga####ynudist.eu':80
- 'an##iud.pw':80
- 'mi###udist.eu':80
- 'vi###mature.eu':80
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://sh###per.org/qmowew.cgi?2&###################################################
- http://hd###deo.top/ftt2/check.php?t=#############################################################
- http://hd###deo.top/ftt2/o.php
- http://nu###mmovies.eu/
- http://nu###mmovies.eu/ftt2/check.php?t=#############################################################
- http://nu###mmovies.eu/ftt2/o.php
- http://nu####sfamilys.eu/
- http://nu####sfamilys.eu/dencasgj.js
- http://nu####sfamilys.eu/ftt2/check.php?t=#############################################################
- http://nu####sfamilys.eu/ftt2/o.php
- http://nu###tgirls.eu/
- http://nu###tgirls.eu/ftt2/check.php?t=#############################################################
- http://hd###deo.top/
- http://hd###deo.top/cssmil/styles.css
- http://nu###tgirls.eu/ftt2/o.php
- http://be###reetube.eu/css/import.css
- http://be###reetube.eu/css/styles.css
- http://be###reetube.eu/t.png
- http://be###reetube.eu/font/css/line-awesome.min.css
- http://be###reetube.eu/font/fonts/la-brands-400.eot?
- http://be###reetube.eu/font/fonts/la-solid-900.eot?
- http://be###reetube.eu/font/fonts/la-regular-400.eot?
- http://pk#.goog/gsr1/gsr1.crt
- http://be###reetube.eu/js/jquery.min.js
- http://be###reetube.eu/js/main.js
- http://be###reetube.eu/favicon.ico
- http://be###reetube.eu/ru/
- http://sh###per.org/tzh.cgi?9&###############
- http://vi###mature.eu/ftt2/o.php
- http://vi###mature.eu/ftt2/check.php?t=############################################################
- http://vi###mature.eu/
- http://sh###per.org/wnnbfb.cgi?5
- http://sh###per.org/uuj6.html
- http://mi###udist.eu/
- http://sh###per.org/qmowew.cgi?2&###############################
- http://sh###per.org/ajn.cgi?14###########
- http://an##iud.pw/
- http://mi###udist.eu/ftt2/o.php
- http://ga####ynudist.eu/
- http://cd#.#opcash.net/pop.js
- http://an##iud.pw/diissaik/sch18.css
- http://ga####ynudist.eu/ftt2/check.php?t=#############################################################
- http://ga####ynudist.eu/ftt2/o.php
- http://sh###per.org/dvh.cgi?4
- http://hd###dist.eu/
- http://hd###dist.eu/ftt2/check.php?t=############################################################
- http://hd###dist.eu/ftt2/o.php
- http://po##i.pw/
- http://po##i.pw/dencasgj.js
- http://sh###per.org/tzh.cgi?9&##########
- http://po##i.pw/ftt2/check.php?t=#############################################################
- http://po##i.pw/ftt2/o.php
- http://fa#####collection.eu/
- http://fa#####collection.eu/disainovms/base38.min.css
- http://fa#####collection.eu/ftt2/cron.php
- http://fa#####collection.eu/ftt2/o.php
- http://fa#####collection.eu/ftt2/check.php?t=#############################################################
- http://hd###dist.eu/ftt2/cron.php
- http://be###reetube.eu/
- http://x1.#.lencr.org/
Other
- 'a.###lsrv.com':443
- 'a.###srv.com':443
- 'fo###.#oogleapis.com':443
- 'fo###.gstatic.com':443
- 'cd#####2858.ahacdn.me':443
- 'ic####lm.xhcdn.com':443
- 'im#.#orntry.com':443
UDP
- DNS ASK sh###per.org
- DNS ASK cd#####5446.ahacdn.me
- DNS ASK cd#####3788.ahacdn.me
- DNS ASK cd#####2858.ahacdn.me
- DNS ASK ic####lm.xhcdn.com
- DNS ASK fo###.gstatic.com
- DNS ASK pk#.goog
- DNS ASK fo###.#oogleapis.com
- DNS ASK be###reetube.eu
- DNS ASK nu###tgirls.eu
- DNS ASK nu####sfamilys.eu
- DNS ASK im#.#orntry.com
- DNS ASK nu###mmovies.eu
- DNS ASK vi###mature.eu
- DNS ASK fa#####collection.eu
- DNS ASK po##i.pw
- DNS ASK hd###dist.eu
- DNS ASK a.###lsrv.com
- DNS ASK a.###srv.com
- DNS ASK cd#.#opcash.net
- DNS ASK ga####ynudist.eu
- DNS ASK an##iud.pw
- DNS ASK mi###udist.eu
- DNS ASK hd###deo.top
- DNS ASK x1.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
