Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012023022620230227\index.dat
Modifies the following files
Network activity
Connects to
- 'sh###per.org':80
- 'ma##s.pw':80
- 'a.###srv.com':443
- 'ma###tube.eu':80
- 'nu##vidi.eu':80
- 'po###ubmilf.icu':80
- 'yo###nudism.eu':80
- 'to###lpuss.in':80
- 'se###hxt.com':443
- 'x1.#.lencr.org':80
- 'r3.#.lencr.org':80
TCP
HTTP GET requests
- http://sh###per.org/ojmkxmt.cgi?2&###################################################
- http://to###lpuss.in/assets/img/bg.gif
- http://to###lpuss.in/imgi.jpg
- http://to###lpuss.in/jquery.js
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgQP0f%2FosFEDGkWJBdBmPvhIdA%3D%3D
- http://x1.#.lencr.org/
- http://to###lpuss.in/gallrs/u.php?id#######################################
- http://to###lpuss.in/
- http://nu##vidi.eu/ftt2/o.php
- http://nu##vidi.eu/ftt2/check.php?t=#############################################################
- http://nu##vidi.eu/
- http://yo###nudism.eu/ftt2/o.php
- http://yo###nudism.eu/ftt2/check.php?t=#############################################################
- http://yo###nudism.eu/analiz.js
- http://to###lpuss.in/include/loader.gif
- http://yo###nudism.eu/
- http://po###ubmilf.icu/ftt2/check.php?t=############################################################
- http://po###ubmilf.icu/
- http://ma###tube.eu/ftt2/o.php
- http://ma###tube.eu/ftt2/check.php?t=#############################################################
- http://ma###tube.eu/
- http://ma##s.pw/ftt2/o.php
- http://ma##s.pw/diznovua/font-awesome.min.css
- http://ma##s.pw/ftt2/check.php?t=############################################################
- http://sh###per.org/ojmkxmt.cgi?2&###############################
- http://ma##s.pw/diznovua/stylesheet.min.css
- http://sh###per.org/ajn.cgi?14###########
- http://ma##s.pw/
- http://sh###per.org/dvh.cgi?4
- http://po###ubmilf.icu/ftt2/o.php
- http://to###lpuss.in/favicon.ico
Other
- 'a.###srv.com':443
- 'se###hxt.com':443
UDP
- DNS ASK sh###per.org
- DNS ASK ma##s.pw
- DNS ASK a.###srv.com
- DNS ASK nu##vidi.eu
- DNS ASK ma###tube.eu
- DNS ASK po###ubmilf.icu
- DNS ASK yo###nudism.eu
- DNS ASK to###lpuss.in
- DNS ASK se###hxt.com
- DNS ASK microsoft.com
- DNS ASK x1.#.lencr.org
- DNS ASK r3.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
