Technical Information
Modifies file system
Modifies the following files
Network activity
Connects to
- 'ic###.#conarchive.com':80
- 'x1.#.lencr.org':80
- 'go#####analytics.com':80
- 'cd#.##becorp.com':443
- 'aj##.#oogleapis.com':80
- 'wo#####.instantfap.com':443
- 'mo###echix.com':80
- 'microsoft.com':80
- 'p.##s17.top':443
- 'ct.##pcash.net':443
- 'ad##tie.com':80
- 'po##ash.net':80
- 'ad##3a.com':80
- 'dl#.##intara.com':1080
- 'yo##ube.com':443
- 'oh###kprod.com':80
- 'yo##ube.com':80
- 'ww##.##etasgroup.com':80
- 'r3.#.lencr.org':80
- 'oc##.#tartssl.com':80
TCP
HTTP GET requests
- http://ic###.#conarchive.com/icons/hopstarter/social-networking/256/Facebook-icon.png
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgN%2BnWrPEZIWs2y6az%2BjBG0Gjw%3D%3D
- http://x1.#.lencr.org/
- http://www.go#####analytics.com/r/__utm.gif?ut###################################################################################################################################################...
- http://www.go#####analytics.com/ga.js
- http://aj##.#oogleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
- http://mo###echix.com/glightbox.min.js
- http://mo###echix.com/logo.png
- http://mo###echix.com/glightbox.min.css
- http://mo###echix.com/?d
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgPGczcQhF7PJzod1w9BG8amag%3D%3D
- http://ad##tie.com/pop.php?id##########################
- http://ps.##pcash.net/go/78036/145869/
- http://po##ash.net/world/go/78036/145869/
- http://ad##3a.com/redirect?ci####################################################################################################################################################################...
- http://ad##3a.com/redirect?si######
- http://ic###.#conarchive.com/icons/hopstarter/social-networking/256/Twitter-icon.png
- http://oh###kprod.com/assets/images/autogen/clearpixel.gif
- http://oh###kprod.com/assets/images/background.gif
- http://dl#.###ntara.com:1080/dln.js?se############################################################################################################################### via dl#.##intara.com
- http://ic###.#conarchive.com/icons/designbolts/3d-social/256/Google-plus-icon.png
- http://www.yo##ube.com/embed/6cOfxzOpipI
- http://ps.##pcash.net/ad/ad?p=##############################################################################################################
- http://oc##.#tartssl.com/sub/class2/code/ca/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBQSOgrhRCSnWfKxoWTjWxhk8hga9AQU0E4PQJlsuEsZbzsouODjiAc0qrcCAhAV
Other
- 'yo##ube.com':443
- 'p.##s17.top':443
- 'wo#####.instantfap.com':443
- 'cd#.##becorp.com':443
UDP
- DNS ASK oh###kprod.com
- DNS ASK x1.#.lencr.org
- DNS ASK go#####analytics.com
- DNS ASK cd#.##becorp.com
- DNS ASK aj##.#oogleapis.com
- DNS ASK wo#####.instantfap.com
- DNS ASK mo###echix.com
- DNS ASK microsoft.com
- DNS ASK p.##s17.top
- DNS ASK ct.##pcash.net
- DNS ASK ad##tie.com
- DNS ASK ps.##pcash.net
- DNS ASK po##ash.net
- DNS ASK ad##3a.com
- DNS ASK yo##ube.com
- DNS ASK ww##.##etasgroup.com
- DNS ASK ic###.#conarchive.com
- DNS ASK dl#.##intara.com
- DNS ASK r3.#.lencr.org
- DNS ASK oc##.#tartssl.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Static' WindowName: ''
