Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012023022620230227\index.dat
Modifies the following files
Network activity
Connects to
- 'sh###per.org':80
- 'nu####african.eu':80
- 'to###udism.eu':80
- 'cd#.#opcash.net':80
- 'ma##s.xyz':80
- 'a.###srv.com':443
- 'pi###eens.club':80
- 'te###vporn.com':80
TCP
HTTP GET requests
- http://sh###per.org/vjpyh.cgi?2&###############################
- http://pi###eens.club/18virginxxx_files/clock.js
- http://pi###eens.club/18virginxxx_files/navbits_start.gif
- http://pi###eens.club/18virginxxx_files/navbits_finallink_ltr.gif
- http://pi###eens.club/images/magicalworld/magicalworld_alt1.gif
- http://pi###eens.club/18virginxxx_files/vbulletin_md5.js
- http://pi###eens.club/18virginxxx_files/newthread.gif
- http://pi###eens.club/images/magicalworld/magicalworld_catbg.gif
- http://pi###eens.club/18virginxxx_files/sortasc.gif
- http://pi###eens.club/18virginxxx_files/thread_hot.gif
- http://pi###eens.club/18virginxxx_files/icon1.gif
- http://pi###eens.club/18virginxxx_files/tag.png
- http://ma##s.xyz/csspfvbb/index.css?cr###########
- http://pi###eens.club/18virginxxx_files/multipage.gif
- http://pi###eens.club/18virginxxx_files/8_hot1.gif
- http://pi###eens.club/18virginxxx_files/rating_5.gif
- http://pi###eens.club/18virginxxx_files/update.gif
- http://pi###eens.club/18virginxxx_files/vbulletin_read_marker.js
- http://pi###eens.club/18virginxxx_files/keep2.png
- http://pi###eens.club/18virginxxx_files/thread_new.gif
- http://pi###eens.club/18virginxxx_files/thread_hot_new.gif
- http://pi###eens.club/18virginxxx_files/thread.gif
- http://pi###eens.club/18virginxxx_files/thread_lock.gif
- http://pi###eens.club/18virginxxx_files/collapse_thead.gif
- http://pi###eens.club/images/magicalworld/magicalworld_footL.gif
- http://pi###eens.club/images/magicalworld/magicalworld_headerR.gif
- http://pi###eens.club/images/magicalworld/magicalworld_headbg.gif
- http://pi###eens.club/images/magicalworld/magicalworld_headerL.gif
- http://pi###eens.club/images/magicalworld/magicalworld_navbg.gif
- http://pi###eens.club/images/magicalworld/misc/menu_open.gif
- http://nu####african.eu/
- http://sh###per.org/ajn.cgi?14###########
- http://nu####african.eu/dencasgj.js
- http://nu####african.eu/ftt2/check.php?t=#############################################################
- http://nu####african.eu/ftt2/o.php
- http://to###udism.eu/
- http://to###udism.eu/ftt2/check.php?t=#############################################################
- http://cd#.#opcash.net/pop.js
- http://to###udism.eu/ftt2/o.php
- http://ma##s.xyz/
- http://ma##s.xyz/csspfvbb/site_global.css?cr############
- http://pi###eens.club/images/magicalworld/magicalworld_footR.gif
- http://pi###eens.club/18virginxxx_files/lastpost.gif
- http://ma##s.xyz/dencasgj.js
- http://ma##s.xyz/ftt2/o.php
- http://pi###eens.club/
- http://te###vporn.com/ps/count.js
- http://pi###eens.club/18virginxxx_files/vbulletin_important.css
- http://pi###eens.club/18virginxxx_files/yahoo-dom-event.js
- http://pi###eens.club/images/magicalworld/magicalworld_bg.gif
- http://pi###eens.club/18virginxxx_files/connection-min.js
- http://pi###eens.club/18virginxxx_files/saved_resource.html
- http://pi###eens.club/18virginxxx_files/vbulletin_global.js
- http://pi###eens.club/18virginxxx_files/vbulletin_menu.js
- http://pi###eens.club/18virginxxx_files/menu_open.gif
- http://sh###per.org/dvh.cgi?4
- http://ma##s.xyz/ftt2/check.php?t=#############################################################
- http://pi###eens.club/favicon.ico
Other
- 'a.###srv.com':443
UDP
- DNS ASK sh###per.org
- DNS ASK nu####african.eu
- DNS ASK to###udism.eu
- DNS ASK cd#.#opcash.net
- DNS ASK ma##s.xyz
- DNS ASK a.###srv.com
- DNS ASK pi###eens.club
- DNS ASK te###vporn.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
