Technical Information
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\privacie\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012023120720231208\index.dat
Network activity
Connects to
- 'sh###per.org':80
- 'po##i.pw':80
- 'mi###udist.eu':80
- 'nu####sfamilys.eu':80
- 'ma###exxx.cyou':80
- 'nu##vidi.eu':80
- 'yo###nudism.eu':80
- 'hd###deo.top':80
- 'an##iud.pw':80
- 'a.###srv.com':443
- 'te####bes.online':80
- 'go#####a###ytics.com':80
TCP
HTTP GET requests
- http://sh###per.org/yngcpk.cgi?2&###################################################
- http://www.go#####a###ytics.com/ga.js
- http://te####bes.online/Teen###nBoard_files/quick_lock.gif
- http://te####bes.online/Teen###nBoard_files/avatar_247.png
- http://te####bes.online/Teen###nBoard_files/show_sticky.gif
- http://te####bes.online/Teen###nBoard_files/normal_post.gif
- http://te####bes.online/Teen###nBoard_files/sort_down.gif
- http://te####bes.online/Teen###nBoard_files/xx.gif
- http://te####bes.online/Teen###nBoard_files/linktree_main.gif
- http://te####bes.online/Teen###nBoard_files/normal_poll.gif
- http://te####bes.online/Teen###nBoard_files/lamp.gif
- http://te####bes.online/Teen###nBoard_files/folder_open.gif
- http://te####bes.online/Teen###nBoard_files/images/catbg.jpg
- http://te####bes.online/Teen###nBoard_files/linktree_side.gif
- http://te####bes.online/Teen###nBoard_files/filter.gif
- http://te####bes.online/Teen###nBoard_files/upshrink.gif
- http://te####bes.online/Teen###nBoard_files/exclamation.gif
- http://hd###deo.top/cssmil/styles.css
- http://te####bes.online/Teen###nBoard_files/xml_board.js
- http://te####bes.online/Teen###nBoard_files/thumbup.gif
- http://te####bes.online/Teen###nBoard_files/my_normal_post.gif
- http://te####bes.online/Teen###nBoard_files/hot_post.gif
- http://te####bes.online/Teen###nBoard_files/images/maintab_last.gif
- http://te####bes.online/Teen###nBoard_files/images/maintab_back.gif
- http://te####bes.online/Teen###nBoard_files/images/maintab_active_last.gif
- http://te####bes.online/Teen###nBoard_files/images/maintab_active_back.gif
- http://te####bes.online/Teen###nBoard_files/xxxbbslogo.jpg
- http://te####bes.online/Teen###nBoard_files/quick_sticky.gif
- http://te####bes.online/Teen###nBoard_files/David_Boreanaz.jpg
- http://te####bes.online/Teen###nBoard_files/question1.gif
- http://te####bes.online/Teen###nBoard_files/Avril_Lavigne.jpg
- http://te####bes.online/Teen###nBoard_files/noavatar.gif
- http://te####bes.online/Teen###nBoard_files/images/maintab_first.gif
- http://te####bes.online/Teen###nBoard_files/veryhot_post.gif
- http://te####bes.online/Teen###nBoard_files/last_post.gif
- http://te####bes.online/Teen###nBoard_files/CYdoK60WAAA09aq.jpg
- http://te####bes.online/Teen###nBoard_files/images/titlebg.jpg
- http://te####bes.online/Teen###nBoard_files/saved_resource.html
- http://te####bes.online/Teen###nBoard_files/sha1.js
- http://te####bes.online/Teen###nBoard_files/print.css
- http://po##i.pw/ftt2/o.php
- http://ma###exxx.cyou/
- http://nu####sfamilys.eu/ftt2/o.php
- http://nu####sfamilys.eu/ftt2/check.php?t=#############################################################
- http://nu####sfamilys.eu/dencasgj.js
- http://nu####sfamilys.eu/
- http://mi###udist.eu/ftt2/o.php
- http://www.go#####a###ytics.com/r/__utm.gif?ut###################################################################################################################################################...
- http://ma###exxx.cyou/ftt2/cron.php
- http://po##i.pw/ftt2/check.php?t=#############################################################
- http://sh###per.org/tzh.cgi?9&##########
- http://po##i.pw/dencasgj.js
- http://sh###per.org/ajn.cgi?14###########
- http://po##i.pw/
- http://sh###per.org/yngcpk.cgi?2&###############################
- http://sh###per.org/dvh.cgi?4
- http://mi###udist.eu/
- http://te####bes.online/Teen###nBoard_files/images/maintab_active_first.gif
- http://ma###exxx.cyou/ftt2/o.php
- http://nu##vidi.eu/ftt2/o.php
- http://nu##vidi.eu/
- http://te####bes.online/Teen###nBoard_files/style.css
- http://te####bes.online/Teen###nBoard_files/script.js
- http://te####bes.online/
- http://an##iud.pw/ftt2/o.php
- http://an##iud.pw/diissaik/sch18.css
- http://an##iud.pw/
- http://nu##vidi.eu/ftt2/check.php?t=#############################################################
- http://hd###deo.top/ftt2/o.php
- http://ma###exxx.cyou/ftt2/check.php?t=#############################################################
- http://hd###deo.top/ftt2/check.php?t=#############################################################
- http://hd###deo.top/
- http://yo###nudism.eu/ftt2/o.php
- http://yo###nudism.eu/ftt2/check.php?t=#############################################################
- http://yo###nudism.eu/a###iz.js
- http://yo###nudism.eu/
- http://hd###deo.top/a###iz.js
- http://te####bes.online/favicon.ico
Other
- 'a.###srv.com':443
UDP
- DNS ASK sh###per.org
- DNS ASK po##i.pw
- DNS ASK mi###udist.eu
- DNS ASK nu####sfamilys.eu
- DNS ASK ma###exxx.cyou
- DNS ASK nu##vidi.eu
- DNS ASK yo###nudism.eu
- DNS ASK hd###deo.top
- DNS ASK an##iud.pw
- DNS ASK a.###srv.com
- DNS ASK te####bes.online
- DNS ASK ad#.#dbrite.com
- DNS ASK go#####a###ytics.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
