Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021072420210725\index.dat
Network activity
Connects to
- 'st###ounter.com':443
- 'my####htyporn.com':80
- 'cd######st.streamable.com':443
- 'im###.isu.pub':443
- 'i.###img.com':443
- '41##################-931851ca4d0d7cdafe33022cf8264a37.ssl.cf1.rackcdn.com':443
- 'im####.xvideos-cdn.com':443
- 'ma#########mocracy.files.wordpress.com':443
- 'oh##n.top':80
- 'i.##img.com':443
- 'vi######psimage.agaclip.com':80
- 'na#########losopher.files.wordpress.com':443
- 'b8.##.icdn.ru':80
- 'th###dism.biz':80
- 'im##y.org':443
- 'vi######psimage.agaclip.com':443
- '7f##################-5fa18836a2ae6b5e7c49abcc89b20237.ssl.cf1.rackcdn.com':443
- 'r3.#.lencr.org':80
- 'x.##2.us':80
- 'ar##ive.fo':443
- 'me###.30seconds.com':443
- 'sa##asm.cc':80
- '4.##.#logspot.com':80
- 'yt###.##ogleusercontent.com':80
- 'il###4ulih.com':445
- 'aj##.#oogleapis.com':80
- 'ht######v.googlecode.com':445
- 'ht######v.googlecode.com':139
- 'm.####access.mobi':443
- 'sw###mining.win':80
- 'google.com':80
- 'x1.#.lencr.org':80
- 'microsoft.com':80
- '2.##.#logspot.com':80
- 'pp.##erapi.com':443
- 'st#######ivery.nexusmods.com':443
- 's.##nux.com':443
- 'ft##ews.com':443
- 'im#####.xvideos-cdn.com':80
- 'im#####.xnxx-cdn.com':443
- 'da###motion.com':443
- 'im##y.org':80
- 'i2#####.mirror.co.uk':443
- 'sw###mining.win':443
- 'di.##ncdn.com':443
- 'o.##2.us':80
TCP
HTTP GET requests
- http://sw###mining.win/px.gif?ch#######################
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgO%2FsNzz%2FthsqYbhYb%2B1IJTwMg%3D%3D
- http://x.##2.us/x.cer
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://o.##2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
Other
- 'st###ounter.com':443
- 'na#########losopher.files.wordpress.com':443
- 'cd######st.streamable.com':443
- 'ma#########mocracy.files.wordpress.com':443
- 'im####.xnxx-cdn.com':443
- '41##################-931851ca4d0d7cdafe33022cf8264a37.ssl.cf1.rackcdn.com':443
- 'im###.isu.pub':443
- 'i.###img.com':443
- 'me###.30seconds.com':443
- 'ar##ive.fo':443
- 'im##y.org':443
- 'i2#####.mirror.co.uk':443
- 'im#####.xnxx-cdn.com':443
- 'ft##ews.com':443
- 'st#######ivery.nexusmods.com':443
- 's.##nux.com':443
- 'di.##ncdn.com':443
- 'pp.##erapi.com':443
- 'i.##img.com':443
- 'm.####access.mobi':443
- 'sw###mining.win':443
- 'da###motion.com':443
- 'vi######psimage.agaclip.com':443
UDP
- DNS ASK st###ounter.com
- DNS ASK ar##ive.fo
- DNS ASK oh##n.top
- DNS ASK me###.30seconds.com
- DNS ASK my####htyporn.com
- DNS ASK cd######st.streamable.com
- DNS ASK 41##################-931851ca4d0d7cdafe33022cf8264a37.ssl.cf1.rackcdn.com
- DNS ASK i.###img.com
- DNS ASK im###.isu.pub
- DNS ASK ma#########mocracy.files.wordpress.com
- DNS ASK im####.xvideos-cdn.com
- DNS ASK microsoft.com
- DNS ASK vi######psimage.agaclip.com
- DNS ASK 83##########n-0-95.pagely.netdna-cdn.com
- DNS ASK 2.##.#logspot.com
- DNS ASK na#########losopher.files.wordpress.com
- DNS ASK b8.##.icdn.ru
- DNS ASK th###dism.biz
- DNS ASK 7f##################-5fa18836a2ae6b5e7c49abcc89b20237.ssl.cf1.rackcdn.com
- DNS ASK r3.#.lencr.org
- DNS ASK x.##2.us
- DNS ASK 4.##.#logspot.com
- DNS ASK im####.xnxx-cdn.com
- DNS ASK sa##asm.cc
- DNS ASK pp.##erapi.com
- DNS ASK sw###mining.win
- DNS ASK il###4ulih.com
- DNS ASK aj##.#oogleapis.com
- DNS ASK ht######v.googlecode.com
- DNS ASK m.####access.mobi
- DNS ASK google.com
- DNS ASK x1.#.lencr.org
- DNS ASK d1#######h6vq5.cloudfront.net
- DNS ASK im##y.org
- DNS ASK i.##img.com
- DNS ASK yt###.##ogleusercontent.com
- DNS ASK di.##ncdn.com
- DNS ASK st#######ivery.nexusmods.com
- DNS ASK s.##nux.com
- DNS ASK ft##ews.com
- DNS ASK p.###moms.info
- DNS ASK im#####.xvideos-cdn.com
- DNS ASK im#####.xnxx-cdn.com
- DNS ASK da###motion.com
- DNS ASK i2#####.mirror.co.uk
- DNS ASK pa###.paheal.net
- DNS ASK o.##2.us
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
