Technical Information
Modifies file system
Creates the following files
- %TEMP%\9847849616421660.jpg
Network activity
TCP
HTTP GET requests
- http://ic###azip.com/
- http://92.##.197.190/xes/n.txt
- http://92.##.197.190/xes/855.txt
UDP
- DNS ASK ya##o.com
- DNS ASK 00##.com
- DNS ASK bi##ond.com
- DNS ASK ex####l.bigpond.com
- DNS ASK an####supply.com
- DNS ASK 65##.com
- DNS ASK us#######nbound-1.mimecast.com
- DNS ASK 75##.com
- DNS ASK 01##.com
- DNS ASK 06##.com
- DNS ASK 51##.com
- DNS ASK is####ahglass.com
- DNS ASK ma##.##tusnet.com.au
- DNS ASK op####ome.com.au
- DNS ASK ve##zon.net
- DNS ASK 67##.com
- DNS ASK 82##.com
- DNS ASK 40##.com
- DNS ASK ro##rs.com
- DNS ASK mx#######.mail.am0.yahoodns.net
- DNS ASK 23##.com
- DNS ASK 64##.com
- DNS ASK ya###.com.au
- DNS ASK 70##.com
- DNS ASK 96##.com
- DNS ASK 84##.com
- DNS ASK 36##.com
- DNS ASK 19##.com
- DNS ASK mx.##vemail.com
- DNS ASK 30##.com
- DNS ASK 78##.com
- DNS ASK de##llo.com
- DNS ASK ch##ter.net
- DNS ASK ic##ud.com
- DNS ASK 81##.com
- DNS ASK aspmx.l.google.com
- DNS ASK mx#.#harter.net
- DNS ASK te##s.net
- DNS ASK mx.##lus.net
- DNS ASK nc.#r.com
- DNS ASK ma##.#rotonmail.ch
- DNS ASK ga##.com
- DNS ASK 80##.com
- DNS ASK 25##.com
- DNS ASK 08##.com
- DNS ASK mo###dam.com
- DNS ASK 28##.com
- DNS ASK 53##.com
- DNS ASK 11##.com
- DNS ASK 52##.com
- DNS ASK be###outh.net
- DNS ASK al######x-vip1.prodigy.net
- DNS ASK wa###able.com
- DNS ASK ai#.com
- DNS ASK 61##.com
- DNS ASK fa######mx.spamexperts.eu
- DNS ASK bm#.net
- DNS ASK mx.###turylink.net
- DNS ASK in###rmserv.com
- DNS ASK d9#####.##s.barracudanetworks.com
- DNS ASK lu###mail.com
- DNS ASK wc#.com
- DNS ASK 09##.com
- DNS ASK wc#####.##il.protection.outlook.com
- DNS ASK 44##.com
- DNS ASK 50##.com
- DNS ASK ac#.com
- DNS ASK so###.rr.com
- DNS ASK q.#om
- DNS ASK ac#.###.2.arsmtp.com
- DNS ASK ne###ape.net
- DNS ASK bi###########-com.mail.protection.outlook.com
- DNS ASK ko###ice.com
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK pr##igy.net
- DNS ASK ff######x-vip1.prodigy.net
- DNS ASK wi###tream.net
- DNS ASK mx##.#indstream.net
- DNS ASK 21##.com
- DNS ASK tm#.##ackberry.net
- DNS ASK kc.#r.com
- DNS ASK bi####consult.com
- DNS ASK 87##.com
- DNS ASK ep##.net
- DNS ASK ya##o.ca
- DNS ASK ma##.#luetie.com
- DNS ASK ro####ter.rr.com
- DNS ASK sk#.com
- DNS ASK 48##.com
- DNS ASK ro###tmail.com
- DNS ASK au###n.rr.com
- DNS ASK 34##.com
- DNS ASK wi.#r.com
- DNS ASK 10##.com
- DNS ASK al###ndcpa.com
- DNS ASK mx.###ntiernet.net
- DNS ASK al##########om.mail.protection.outlook.com
- DNS ASK wo##ast.com
- DNS ASK cl###pot.net
- DNS ASK 91##.com
- DNS ASK bs##.nsoit.com
- DNS ASK wa####schools.net
- DNS ASK wa###########-net.mail.protection.outlook.com
- DNS ASK sh#w.ca
- DNS ASK id#######x2no.cg.shawcable.net
- DNS ASK 93##.com
- DNS ASK 59##.com
- DNS ASK in##.rr.com
- DNS ASK bt###ernet.com
- DNS ASK mx.##.#tinternet.com
- DNS ASK 39##.com
- DNS ASK 60##.com
- DNS ASK 29##.com
- DNS ASK 85##.com
- DNS ASK 95##.com
- DNS ASK 13##.com
- DNS ASK 57##.com
- DNS ASK 79##.com
- DNS ASK 26##.com
- DNS ASK 41##.com
- DNS ASK 47##.com
- DNS ASK au###id.com.au
- DNS ASK td#.net
- DNS ASK 12##.com
- DNS ASK 31##.com
- DNS ASK 02##.com
- DNS ASK ca###ina.rr.com
- DNS ASK ym##l.com
- DNS ASK ea##link.ca
- DNS ASK ma##.com
- DNS ASK sm####.eastlink.ca
- DNS ASK mx##.mail.com
- DNS ASK 42##.com
- DNS ASK 86##.com
- DNS ASK ro###unner.com
- DNS ASK gm##.com
- DNS ASK ho##il.com
- DNS ASK ma###.#usgrid.com.au
- DNS ASK mx.#ds.net
- DNS ASK 54##.com
- DNS ASK al######x-vip2.prodigy.net
- DNS ASK ic###azip.com
- DNS ASK co##ast.net
- DNS ASK mx#.#omcast.net
- DNS ASK ao#.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK go###email.com
- DNS ASK ta###alk.net
- DNS ASK alt2.gmail-smtp-in.l.google.com
- DNS ASK mx.##lktalk.net
- DNS ASK co#.net
- DNS ASK pk#####.#sg.pkvw.co.charter.net
- DNS ASK 72##.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK 32##.com
- DNS ASK 98##.com
- DNS ASK me.com
- DNS ASK ic##ail.com
- DNS ASK 46##.com
- DNS ASK mx#.##il.icloud.com
- DNS ASK em#.mail.ru
- DNS ASK 71##.com
- DNS ASK 33##.com
- DNS ASK cf#.rr.com
- DNS ASK cx#.##.#.cloudfilter.net
- DNS ASK at#.net
- DNS ASK 74##.com
- DNS ASK ma##.#-email.net
- DNS ASK 20##.com
- DNS ASK 55##.com
- DNS ASK op###line.net
- DNS ASK 99##.com
- DNS ASK mx.##timum.net
- DNS ASK 24##.com
- DNS ASK 45##.com
- DNS ASK 89##.com
- DNS ASK 37##.com
- DNS ASK 97##.com
- DNS ASK 83##.com
- DNS ASK 38##.com
- DNS ASK 16##.com
- DNS ASK 69##.com
- DNS ASK 92##.com
- DNS ASK 27##.com
- DNS ASK 88##.com
- DNS ASK 15##.com
- DNS ASK 22##.com
- DNS ASK 68##.com
- DNS ASK fi#####tionlonline.com
- DNS ASK 05##.com
- DNS ASK 63##.com
- DNS ASK 66##.com
- DNS ASK 03##.com
- DNS ASK 62##.com
- DNS ASK 58##.com
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK 76##.com
- DNS ASK sa###hool.com
- DNS ASK sa##########m.mail.protection.outlook.com
- DNS ASK 73##.com
- DNS ASK 94##.com
- DNS ASK 17##.com
- DNS ASK 56##.com
- DNS ASK 14##.com
- DNS ASK 49##.com
- DNS ASK 35##.com
- DNS ASK 07##.com
- DNS ASK 18##.com
- DNS ASK 90##.com
- DNS ASK 43##.com
- DNS ASK 77##.com
- DNS ASK gh####software.com
- DNS ASK mx##.1and1.com
- DNS ASK ma#.com
- DNS ASK ao#.co.uk
- DNS ASK es##lte.com
- DNS ASK sb###obal.net
- DNS ASK ff######x-vip2.prodigy.net
- DNS ASK mt###line.net
- DNS ASK ya##o.co.uk
- DNS ASK mt#######.#et.mx1.greymail.rcimx.net
- DNS ASK 04##.com
- DNS ASK mx##.###.us.blackberry.com
- DNS ASK wo#.rr.com
