Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022060820220609\index.dat
Modifies the following files
Network activity
Connects to
- 'ba###osnet.net':80
- 'z.###.adtarget.me':443
- 'u-####.onetouch11.info':80
- 'xm#.###eridianads.com':80
- 'st####.a-ads.com':80
- 'ad.##ads.com':80
- 'gr##.info':80
- 'fv##be.net':80
- 'microsoft.com':80
- 'co##.jquery.com':443
- 'po##ash.net':80
- 'cp###liv.com':80
- 'yo##ube.com':443
- 'dl#.##intara.com':1080
- 'yo##ube.com':80
- 'ic###.#conarchive.com':80
- 'ww##.##etasgroup.com':80
- 'ne###tc.space':80
- 'oc##.#tartssl.com':80
TCP
HTTP GET requests
- http://ba###osnet.net/style.css
- http://ps.##pcash.net/ad/ad?p=###################################################################################################################################################################...
- http://ne###tc.space/
- http://ne###tc.space/index.htm
- http://fv##be.net/index1.php
- http://gr##.info/
- http://gr##.info/img/style_002.css
- http://gr##.info/img/jquery-migrate.js
- http://gr##.info/img/blocks.css
- http://gr##.info/img/wme_rfsr.css
- http://gr##.info/img/app.js
- http://ad.##ads.com/1303536?si##########
- http://gr##.info/img/integrator.js
- http://gr##.info/img/jquery-ui.css
- http://po##ash.net/world/go/78036/145866/
- http://ps.##pcash.net/go/78036/145866/
- http://st####.a-ads.com/a-ads-banners/392928/320x100?re#################
- http://gr##.info/img/jquery-ui.js
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://u-####.onetouch11.info/favicon.ico
- http://u-####.onetouch11.info/api/rtb-pops/go?id#################################################################################################################################################...
- http://xm#.###eridianads.com/click?i=#############
- http://gr##.info/img/integrator_002.js
- http://ba###osnet.net/images/body_br.gif
- http://gr##.info/img/poker.css
- http://gr##.info/img/poker_util.js
- http://gr##.info/img/poker.js
- http://gr##.info/img/wme_rfsr.js
- http://gr##.info/img/showcase.js
- http://gr##.info/img/jquery_002.js
- http://gr##.info/img/messagebox.css
- http://gr##.info/img/font-awesome.css
- http://cp###liv.com/p.php?ci#####################################################################################################################################################################...
- http://cp###liv.com/p.php?id################################################
- http://ba###osnet.net/images/divider_h.gif
- http://ba###osnet.net/images/left_photo.jpg
- http://ic###.#conarchive.com/icons/hopstarter/social-networking/256/Twitter-icon.png
- http://ic###.#conarchive.com/icons/hopstarter/social-networking/256/Facebook-icon.png
- http://www.yo##ube.com/embed/kfZ7B3dcRyM
- http://ba###osnet.net/images/divider_cut.gif
- http://ww##.##etasgroup.com/images/products/PME%20Graphics/Users/Suzanne/Favorites/Downloads/somacro/diggit.png
- http://ww##.##etasgroup.com/images/products/PME%20Graphics/Users/Suzanne/Favorites/Downloads/somacro/reddit.png
- http://dl#.###ntara.com:1080/dln.js?se###################################################################################################################################### via dl#.##intara.com
- http://ba###osnet.net/images/black_man.gif
- http://ic###.#conarchive.com/icons/designbolts/3d-social/256/Google-plus-icon.png
- http://ww##.##etasgroup.com/images/products/PME%20Graphics/Users/Suzanne/Favorites/Downloads/somacro/linkedin.png
- http://ba###osnet.net/images/menu_b_bg.gif
- http://ww##.##etasgroup.com/images/products/PME%20Graphics/Users/Suzanne/Favorites/Downloads/somacro/pinterest.png
- http://ba###osnet.net/images/menu_a_bg.gif
- http://ba###osnet.net/images/logo.gif
- http://ww##.##etasgroup.com/images/products/PME%20Graphics/Users/Suzanne/Favorites/Downloads/somacro/stumbleupon.png
- http://ba###osnet.net/images/box_b.gif
- http://ba###osnet.net/images/menu_d_bg.gif
- http://ww##.##etasgroup.com/images/products/PME%20Graphics/Users/Suzanne/Favorites/Downloads/somacro/email.png
- http://ba###osnet.net/images/menu_c_bg.gif
- http://ba###osnet.net/images/body_bg.gif
- http://ba###osnet.net/images/body_tl.gif
- http://ba###osnet.net/images/body_tr.gif
- http://gr##.info/img/messagebox.js
- http://ba###osnet.net/images/body_bl.gif
- http://ne###tc.space/bc-game.jpg
- http://ba###osnet.net/images/menu_d_r.gif
- http://ba###osnet.net/images/menu_c_r.gif
- http://ba###osnet.net/images/menu_b_r.gif
- http://ba###osnet.net/images/box_bg.gif
- http://ba###osnet.net/images/box_t.gif
- http://ba###osnet.net/images/menu_a_r.gif
- http://oc##.#tartssl.com/sub/class2/code/ca/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBQSOgrhRCSnWfKxoWTjWxhk8hga9AQU0E4PQJlsuEsZbzsouODjiAc0qrcCAhAV
Other
- 'yo##ube.com':443
- 'co##.jquery.com':443
- 'z.###.adtarget.me':443
UDP
- DNS ASK ba###osnet.net
- DNS ASK microsoft.com
- DNS ASK z.###.adtarget.me
- DNS ASK u-####.onetouch11.info
- DNS ASK xm#.###eridianads.com
- DNS ASK st####.a-ads.com
- DNS ASK ad.##ads.com
- DNS ASK gr##.info
- DNS ASK fv##be.net
- DNS ASK co##.jquery.com
- DNS ASK ne###tc.space
- DNS ASK ps.##pcash.net
- DNS ASK po##ash.net
- DNS ASK cp###liv.com
- DNS ASK yo##ube.com
- DNS ASK ic###.#conarchive.com
- DNS ASK ww##.##etasgroup.com
- DNS ASK dl#.##intara.com
- DNS ASK public-trust.com
- DNS ASK oc##.#tartssl.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
