Technical Information
Modifies file system
Creates the following files
- D:\users\user\appdata\local\temp\cab4a1.tmp
- D:\users\user\appdata\local\temp\tar2f95.tmp
- D:\users\user\appdata\local\temp\cab3032.tmp
- D:\users\user\appdata\local\temp\tar3033.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\644b8874112055b5e195ecb0e8f243a4
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\644b8874112055b5e195ecb0e8f243a4
- D:\system volume information\syscache.hve.log1
- D:\users\user\appdata\local\temp\cab316c.tmp
- D:\users\user\appdata\local\temp\tar317d.tmp
- D:\users\user\appdata\local\temp\cab321a.tmp
- D:\system volume information\syscache.hve
- D:\users\user\appdata\local\temp\tar357d.tmp
- D:\users\user\appdata\local\temp\cab3325.tmp
- D:\users\user\appdata\local\temp\tar3326.tmp
- D:\users\user\appdata\local\temp\cab33b4.tmp
- D:\users\user\appdata\local\temp\tar33b5.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\103621de9cd5414cc2538780b4b75751
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\103621de9cd5414cc2538780b4b75751
- D:\users\user\appdata\local\temp\cab34af.tmp
- D:\users\user\appdata\local\temp\tar34b0.tmp
- D:\users\user\appdata\local\temp\cab357c.tmp
- D:\users\user\appdata\local\temp\cab2f94.tmp
- D:\users\user\appdata\local\temp\tar321b.tmp
- D:\users\user\appdata\local\temp\tar2ed8.tmp
- D:\users\user\appdata\local\temp\cab2a87.tmp
- D:\users\user\appdata\local\temp\cab286d.tmp
- D:\users\user\appdata\local\temp\tar287d.tmp
- D:\users\user\appdata\local\temp\cab289e.tmp
- D:\users\user\appdata\local\temp\tar28ae.tmp
- D:\users\user\appdata\local\temp\cab28ee.tmp
- D:\users\user\appdata\local\temp\tar28ef.tmp
- D:\users\user\appdata\local\temp\cab298c.tmp
- D:\users\user\appdata\local\temp\tar298d.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\sdk[1].js
- D:\users\user\appdata\local\temp\tar2a98.tmp
- D:\users\user\appdata\local\temp\tar2d6f.tmp
- D:\users\user\appdata\local\temp\cab2b35.tmp
- D:\users\user\appdata\local\temp\tar2b36.tmp
- D:\users\user\appdata\local\temp\cab2bc3.tmp
- D:\users\user\appdata\local\temp\tar2bc4.tmp
- D:\users\user\appdata\local\temp\cab2caf.tmp
- D:\users\user\appdata\local\temp\tar2cb0.tmp
- D:\users\user\appdata\local\temp\cab2ce0.tmp
- D:\users\user\appdata\local\temp\tar2ce1.tmp
- D:\users\user\appdata\local\temp\cab2d6e.tmp
- D:\users\user\appdata\local\temp\cab2ed7.tmp
- D:\users\user\appdata\local\temp\tar39ec.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8
- D:\users\user\appdata\local\temp\cab367a.tmp
- D:\users\user\appdata\local\temp\tar3eab.tmp
- D:\users\user\appdata\local\temp\cab3f39.tmp
- D:\users\user\appdata\local\temp\tar3f3a.tmp
- D:\users\user\appdata\local\temp\cab3fc7.tmp
- D:\users\user\appdata\local\temp\tar3fc8.tmp
- D:\users\user\appdata\local\temp\cab40c3.tmp
- D:\users\user\appdata\local\temp\tar40c4.tmp
- D:\windows\system32\winevt\logs\system.evtx
- D:\windows\system32\winevt\logs\security.evtx
- D:\windows\system32\config\system.log1
- D:\users\user\appdata\local\temp\tar35bd.tmp
- D:\windows\system32\config\system
- D:\windows\system32\winevt\logs\application.evtx
- D:\windows\system32\config\software.log1
- D:\windows\system32\config\software
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive0.dat
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\ea618097e393409afa316f0f87e2c202_1e65fd33f74047223af4d58cbfd34bce
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\ea618097e393409afa316f0f87e2c202_1e65fd33f74047223af4d58cbfd34bce
- D:\users\user\appdata\local\temp\cab3eaa.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\35ddedf268117918d1d277a171d8df7b_b62be9e15baa1f2ccb69d8874cc15e6b
- D:\users\user\appdata\local\temp\tar3e2d.tmp
- D:\users\user\appdata\local\temp\cab39eb.tmp
- D:\users\user\appdata\local\temp\tar367b.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8da7f758568fbd48f22d63f2816d3340
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\8da7f758568fbd48f22d63f2816d3340
- D:\users\user\appdata\local\temp\cab37e2.tmp
- D:\users\user\appdata\local\temp\tar37e3.tmp
- D:\users\user\appdata\local\temp\cab38af.tmp
- D:\users\user\appdata\local\temp\tar38b0.tmp
- D:\users\user\appdata\local\temp\cab391e.tmp
- D:\users\user\appdata\local\temp\tar391f.tmp
- D:\users\user\appdata\local\temp\cab35bc.tmp
- D:\users\user\appdata\local\temp\tar3dae.tmp
- D:\users\user\appdata\local\temp\cab3b16.tmp
- D:\users\user\appdata\local\temp\tar3b17.tmp
- D:\users\user\appdata\local\temp\cab3b85.tmp
- D:\users\user\appdata\local\temp\tar3b95.tmp
- D:\users\user\appdata\local\temp\cab3bb6.tmp
- D:\users\user\appdata\local\temp\tar3bb7.tmp
- D:\users\user\appdata\local\temp\cab3c34.tmp
- D:\users\user\appdata\local\temp\tar3c35.tmp
- D:\users\user\appdata\local\temp\cab3dad.tmp
- D:\users\user\appdata\local\temp\cab3e2c.tmp
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\35ddedf268117918d1d277a171d8df7b_b62be9e15baa1f2ccb69d8874cc15e6b
- D:\users\user\appdata\local\temp\tar2315.tmp
- D:\users\user\appdata\local\temp\cab10e4.tmp
- D:\users\user\appdata\local\temp\tar10e5.tmp
- D:\users\user\appdata\local\temp\cab11b0.tmp
- D:\users\user\appdata\local\temp\tar11b1.tmp
- D:\users\user\appdata\local\temp\cab1210.tmp
- D:\users\user\appdata\local\temp\tar1221.tmp
- D:\users\user\appdata\local\temp\cab1250.tmp
- D:\users\user\appdata\local\temp\cab1291.tmp
- D:\users\user\appdata\local\temp\tar1251.tmp
- D:\users\user\appdata\local\temp\cab1476.tmp
- D:\users\user\appdata\local\temp\cab17da.tmp
- D:\users\user\appdata\local\temp\tar1487.tmp
- D:\users\user\appdata\local\temp\cab1582.tmp
- D:\users\user\appdata\local\temp\tar1583.tmp
- D:\users\user\appdata\local\temp\cab15e1.tmp
- D:\users\user\appdata\local\temp\tar15e2.tmp
- D:\users\user\appdata\local\temp\cab16ec.tmp
- D:\users\user\appdata\local\temp\tar16ed.tmp
- D:\users\user\appdata\local\temp\cab173c.tmp
- D:\users\user\appdata\local\temp\tar173d.tmp
- D:\users\user\appdata\local\temp\tar1027.tmp
- D:\users\user\appdata\local\temp\tar1292.tmp
- D:\users\user\appdata\local\temp\cab1026.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e0f5c59f9fa661f6f4c50b87fef3a15a
- D:\users\user\appdata\local\temp\tar4a2.tmp
- D:\users\user\ntuser.dat.log1
- D:\users\user\ntuser.dat
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\f59a01a8b782d93ea6991bc172ceffb1
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\f59a01a8b782d93ea6991bc172ceffb1
- D:\users\user\appdata\local\temp\cab983.tmp
- D:\users\user\appdata\local\temp\tar984.tmp
- D:\users\user\appdata\local\temp\cab9c4.tmp
- D:\users\user\appdata\local\temp\tar9d4.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\e0f5c59f9fa661f6f4c50b87fef3a15a
- D:\users\user\appdata\local\temp\cabf69.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015
- D:\users\user\appdata\local\temp\caba81.tmp
- D:\users\user\appdata\local\temp\tara82.tmp
- D:\users\user\appdata\local\temp\cabad1.tmp
- D:\users\user\appdata\local\temp\tarad2.tmp
- D:\users\user\appdata\local\temp\cabd72.tmp
- D:\users\user\appdata\local\temp\tard83.tmp
- D:\users\user\appdata\local\temp\cabebc.tmp
- D:\users\user\appdata\local\temp\tarebd.tmp
- D:\users\user\appdata\local\temp\tarf6a.tmp
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\appdata\local\temp\cab27bf.tmp
- D:\users\user\appdata\local\temp\tar18e7.tmp
- D:\users\user\appdata\local\temp\cab206d.tmp
- D:\users\user\appdata\local\temp\tar206e.tmp
- D:\users\user\appdata\local\temp\cab210b.tmp
- D:\users\user\appdata\local\temp\tar210c.tmp
- D:\users\user\appdata\local\temp\cab215b.tmp
- D:\users\user\appdata\local\temp\cab216c.tmp
- D:\users\user\appdata\local\temp\tar215c.tmp
- D:\users\user\appdata\local\temp\tar216d.tmp
- D:\users\user\appdata\local\temp\cab2314.tmp
- D:\users\user\appdata\local\temp\cab241f.tmp
- D:\users\user\appdata\local\temp\cab18e6.tmp
- D:\users\user\appdata\local\temp\tar2420.tmp
- D:\users\user\appdata\local\temp\cab24fb.tmp
- D:\users\user\appdata\local\temp\tar250c.tmp
- D:\users\user\appdata\local\temp\cab253c.tmp
- D:\users\user\appdata\local\temp\tar253d.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab
- D:\users\user\appdata\local\temp\cab25f9.tmp
- D:\users\user\appdata\local\temp\tar2609.tmp
- D:\users\user\appdata\local\temp\tar1fdf.tmp
- D:\users\user\appdata\local\temp\tar27c0.tmp
- D:\users\user\appdata\local\temp\cab1fcf.tmp
- D:\users\user\appdata\local\temp\tar1b8f.tmp
- D:\users\user\appdata\local\temp\cab19e1.tmp
- D:\users\user\appdata\local\temp\cab1a02.tmp
- D:\users\user\appdata\local\temp\tar19e2.tmp
- D:\users\user\appdata\local\temp\tar1a23.tmp
- D:\users\user\appdata\local\temp\cab1ab0.tmp
- D:\users\user\appdata\local\temp\tar1ab1.tmp
- D:\users\user\appdata\local\temp\cab1af0.tmp
- D:\users\user\appdata\local\temp\tar1af1.tmp
- D:\users\user\appdata\local\temp\cab1b8e.tmp
- D:\users\user\appdata\local\temp\tar17db.tmp
- D:\users\user\appdata\local\temp\cab1f6f.tmp
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\users\user\appdata\local\temp\cab1c7a.tmp
- D:\users\user\appdata\local\temp\tar1c7b.tmp
- D:\users\user\appdata\local\temp\cab1de3.tmp
- D:\users\user\appdata\local\temp\tar1df4.tmp
- D:\users\user\appdata\local\temp\cab1e24.tmp
- D:\users\user\appdata\local\temp\tar1e25.tmp
- D:\users\user\appdata\local\temp\cab1eb2.tmp
- D:\users\user\appdata\local\temp\tar1ec3.tmp
- D:\users\user\appdata\local\temp\tar1faf.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8
Deletes the following files
- D:\users\user\appdata\local\temp\cab4a1.tmp
- D:\users\user\appdata\local\temp\tar2cb0.tmp
- D:\users\user\appdata\local\temp\cab2ce0.tmp
- D:\users\user\appdata\local\temp\tar2ce1.tmp
- D:\users\user\appdata\local\temp\cab2d6e.tmp
- D:\users\user\appdata\local\temp\tar2d6f.tmp
- D:\users\user\appdata\local\temp\cab2ed7.tmp
- D:\users\user\appdata\local\temp\cab3325.tmp
- D:\users\user\appdata\local\temp\tar2ed8.tmp
- D:\users\user\appdata\local\temp\tar2f95.tmp
- D:\users\user\appdata\local\temp\cab3032.tmp
- D:\users\user\appdata\local\temp\tar3033.tmp
- D:\users\user\appdata\local\temp\cab316c.tmp
- D:\users\user\appdata\local\temp\tar317d.tmp
- D:\users\user\appdata\local\temp\cab321a.tmp
- D:\users\user\appdata\local\temp\tar2bc4.tmp
- D:\users\user\appdata\local\temp\cab2caf.tmp
- D:\users\user\appdata\local\temp\cab2f94.tmp
- D:\users\user\appdata\local\temp\tar321b.tmp
- D:\users\user\appdata\local\temp\cab2b35.tmp
- D:\users\user\appdata\local\temp\tar2609.tmp
- D:\users\user\appdata\local\temp\cab27bf.tmp
- D:\users\user\appdata\local\temp\tar27c0.tmp
- D:\users\user\appdata\local\temp\cab286d.tmp
- D:\users\user\appdata\local\temp\tar287d.tmp
- D:\users\user\appdata\local\temp\cab289e.tmp
- D:\users\user\appdata\local\temp\tar28ae.tmp
- D:\users\user\appdata\local\temp\cab28ee.tmp
- D:\users\user\appdata\local\temp\tar28ef.tmp
- D:\users\user\appdata\local\temp\cab298c.tmp
- D:\users\user\appdata\local\temp\tar298d.tmp
- D:\users\user\appdata\local\temp\cab2a87.tmp
- D:\users\user\appdata\local\temp\tar2a98.tmp
- D:\users\user\appdata\local\temp\tar2b36.tmp
- D:\users\user\appdata\local\temp\tar253d.tmp
- D:\users\user\appdata\local\temp\cab2bc3.tmp
- D:\users\user\appdata\local\temp\cab1af0.tmp
- D:\users\user\appdata\local\temp\tar3326.tmp
- D:\users\user\appdata\local\temp\tar3b95.tmp
- D:\users\user\appdata\local\temp\tar3bb7.tmp
- D:\users\user\appdata\local\temp\cab3c34.tmp
- D:\users\user\appdata\local\temp\tar3c35.tmp
- D:\users\user\appdata\local\temp\cab3dad.tmp
- D:\users\user\appdata\local\temp\tar3dae.tmp
- D:\users\user\appdata\local\temp\cab3e2c.tmp
- D:\users\user\appdata\local\temp\cab33b4.tmp
- D:\users\user\appdata\local\temp\tar3e2d.tmp
- D:\users\user\appdata\local\temp\tar3eab.tmp
- D:\users\user\appdata\local\temp\cab3f39.tmp
- D:\users\user\appdata\local\temp\tar3f3a.tmp
- D:\users\user\appdata\local\temp\cab3fc7.tmp
- D:\users\user\appdata\local\temp\tar3fc8.tmp
- D:\users\user\appdata\local\temp\cab3b85.tmp
- D:\users\user\appdata\local\temp\tar3b17.tmp
- D:\users\user\appdata\local\temp\cab3bb6.tmp
- D:\users\user\appdata\local\temp\cab3b16.tmp
- D:\users\user\appdata\local\temp\tar39ec.tmp
- D:\users\user\appdata\local\temp\tar33b5.tmp
- D:\users\user\appdata\local\temp\tar34b0.tmp
- D:\users\user\appdata\local\temp\cab357c.tmp
- D:\users\user\appdata\local\temp\tar357d.tmp
- D:\users\user\appdata\local\temp\cab35bc.tmp
- D:\users\user\appdata\local\temp\tar35bd.tmp
- D:\users\user\appdata\local\temp\cab253c.tmp
- D:\users\user\appdata\local\temp\cab367a.tmp
- D:\users\user\appdata\local\temp\cab25f9.tmp
- D:\users\user\appdata\local\temp\cab37e2.tmp
- D:\users\user\appdata\local\temp\cab38af.tmp
- D:\users\user\appdata\local\temp\tar38b0.tmp
- D:\users\user\appdata\local\temp\cab391e.tmp
- D:\users\user\appdata\local\temp\tar391f.tmp
- D:\users\user\appdata\local\temp\cab39eb.tmp
- D:\users\user\appdata\local\temp\tar367b.tmp
- D:\users\user\appdata\local\temp\cab34af.tmp
- D:\users\user\appdata\local\temp\tar37e3.tmp
- D:\users\user\appdata\local\temp\tar250c.tmp
- D:\users\user\appdata\local\temp\cab24fb.tmp
- D:\users\user\appdata\local\temp\tar2420.tmp
- D:\users\user\appdata\local\temp\tar1221.tmp
- D:\users\user\appdata\local\temp\cab1250.tmp
- D:\users\user\appdata\local\temp\tar1251.tmp
- D:\users\user\appdata\local\temp\cab1291.tmp
- D:\users\user\appdata\local\temp\tar1292.tmp
- D:\users\user\appdata\local\temp\cab1476.tmp
- D:\users\user\appdata\local\temp\tar1487.tmp
- D:\users\user\appdata\local\temp\cab1582.tmp
- D:\users\user\appdata\local\temp\tar1583.tmp
- D:\users\user\appdata\local\temp\cab15e1.tmp
- D:\users\user\appdata\local\temp\tar15e2.tmp
- D:\users\user\appdata\local\temp\cab16ec.tmp
- D:\users\user\appdata\local\temp\tar16ed.tmp
- D:\users\user\appdata\local\temp\cab11b0.tmp
- D:\users\user\appdata\local\temp\cab10e4.tmp
- D:\users\user\appdata\local\temp\cab1210.tmp
- D:\users\user\appdata\local\temp\tar10e5.tmp
- D:\users\user\appdata\local\temp\tar1027.tmp
- D:\users\user\appdata\local\temp\tarad2.tmp
- D:\users\user\appdata\local\temp\cab983.tmp
- D:\users\user\appdata\local\temp\tar984.tmp
- D:\users\user\appdata\local\temp\cab9c4.tmp
- D:\users\user\appdata\local\temp\tar9d4.tmp
- D:\users\user\appdata\local\temp\caba81.tmp
- D:\users\user\appdata\local\temp\tara82.tmp
- D:\users\user\appdata\local\temp\cab173c.tmp
- D:\users\user\appdata\local\temp\cab40c3.tmp
- D:\users\user\appdata\local\temp\cabad1.tmp
- D:\users\user\appdata\local\temp\tard83.tmp
- D:\users\user\appdata\local\temp\cabebc.tmp
- D:\users\user\appdata\local\temp\tarebd.tmp
- D:\users\user\appdata\local\temp\cabf69.tmp
- D:\users\user\appdata\local\temp\tarf6a.tmp
- D:\users\user\appdata\local\temp\cab1026.tmp
- D:\users\user\appdata\local\temp\tar4a2.tmp
- D:\users\user\appdata\local\temp\cabd72.tmp
- D:\users\user\appdata\local\temp\cab3eaa.tmp
- D:\users\user\appdata\local\temp\tar173d.tmp
- D:\users\user\appdata\local\temp\tar18e7.tmp
- D:\users\user\appdata\local\temp\cab1fcf.tmp
- D:\users\user\appdata\local\temp\tar1fdf.tmp
- D:\users\user\appdata\local\temp\cab206d.tmp
- D:\users\user\appdata\local\temp\tar206e.tmp
- D:\users\user\appdata\local\temp\cab210b.tmp
- D:\users\user\appdata\local\temp\tar11b1.tmp
- D:\users\user\appdata\local\temp\tar210c.tmp
- D:\users\user\appdata\local\temp\tar215c.tmp
- D:\users\user\appdata\local\temp\cab216c.tmp
- D:\users\user\appdata\local\temp\tar216d.tmp
- D:\users\user\appdata\local\temp\cab2314.tmp
- D:\users\user\appdata\local\temp\tar2315.tmp
- D:\users\user\appdata\local\temp\cab241f.tmp
- D:\users\user\appdata\local\temp\tar1ec3.tmp
- D:\users\user\appdata\local\temp\cab215b.tmp
- D:\users\user\appdata\local\temp\tar1faf.tmp
- D:\users\user\appdata\local\temp\cab1f6f.tmp
- D:\users\user\appdata\local\temp\cab1eb2.tmp
- D:\users\user\appdata\local\temp\tar1e25.tmp
- D:\users\user\appdata\local\temp\cab19e1.tmp
- D:\users\user\appdata\local\temp\tar19e2.tmp
- D:\users\user\appdata\local\temp\cab1a02.tmp
- D:\users\user\appdata\local\temp\tar1a23.tmp
- D:\users\user\appdata\local\temp\cab1ab0.tmp
- D:\users\user\appdata\local\temp\cab17da.tmp
- D:\users\user\appdata\local\temp\tar1ab1.tmp
- D:\users\user\appdata\local\temp\tar17db.tmp
- D:\users\user\appdata\local\temp\tar1af1.tmp
- D:\users\user\appdata\local\temp\tar1b8f.tmp
- D:\users\user\appdata\local\temp\cab1c7a.tmp
- D:\users\user\appdata\local\temp\tar1c7b.tmp
- D:\users\user\appdata\local\temp\cab1de3.tmp
- D:\users\user\appdata\local\temp\tar1df4.tmp
- D:\users\user\appdata\local\temp\cab18e6.tmp
- D:\users\user\appdata\local\temp\cab1e24.tmp
- D:\users\user\appdata\local\temp\cab1b8e.tmp
- D:\users\user\appdata\local\temp\tar40c4.tmp
Network activity
Connects to
- 'cd#.##delivr.net':443
- 'il#.lc':443
- 'co##.jquery.com':443
- 'pl#####m.twitter.com':443
- 'co#####.facebook.net':443
- 'x1.#.lencr.org':80
- 'r3.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgOzqCBHDetTNdHHVg0pmQsaqQ%3D%3D
Other
- 'il#.lc':443
- 'cd#.##delivr.net':443
- 'co##.jquery.com':443
- 'pl#####m.twitter.com':443
- 'co#####.facebook.net':443
- 'localhost':49158
- '34.##1.73.144':443
UDP
- DNS ASK il#.lc
- DNS ASK cd#.##delivr.net
- DNS ASK co##.jquery.com
- DNS ASK pl#####m.twitter.com
- DNS ASK co#####.facebook.net
- DNS ASK x1.#.lencr.org
- DNS ASK r3.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'SystemTray_Main' WindowName: ''
