Technical Information
Modifies file system
Creates the following files
- D:\windows\appcompat\programs\recentfilecache.bcf
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab
- D:\users\user\appdata\local\temp\cabb530.tmp
- D:\users\user\appdata\local\temp\tarb531.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\35ddedf268117918d1d277a171d8df7b_b62be9e15baa1f2ccb69d8874cc15e6b
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\35ddedf268117918d1d277a171d8df7b_b62be9e15baa1f2ccb69d8874cc15e6b
- D:\users\user\appdata\local\temp\cabb6c8.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\gg1y0syc7my[1].js
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab
- D:\users\user\appdata\local\temp\tarb4c2.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\likebox[1].php
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\0ehcezowezf[1].css
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\gyofulenjhm[1].css
- D:\users\user\appdata\local\temp\cabb92c.tmp
- D:\users\user\appdata\local\temp\tarb92d.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\zr1oxyrgoni[1].js
- D:\users\user\appdata\local\temp\tarb6c9.tmp
- D:\users\user\appdata\local\temp\tarb728.tmp
- D:\users\user\appdata\local\temp\tarae69.tmp
- D:\users\user\appdata\local\temp\cabb727.tmp
- D:\users\user\appdata\local\temp\cabb0b1.tmp
- D:\windows\system32\winevt\logs\application.evtx
- D:\users\user\appdata\local\temp\cabafe1.tmp
- D:\users\user\appdata\local\temp\tarafe2.tmp
- D:\users\user\appdata\local\temp\cabb002.tmp
- D:\users\user\appdata\local\temp\tarb003.tmp
- D:\users\user\appdata\local\temp\cabb061.tmp
- D:\users\user\appdata\local\temp\cabb329.tmp
- D:\users\user\appdata\local\temp\cabb4c1.tmp
- D:\users\user\appdata\local\temp\tarb32a.tmp
- D:\users\user\appdata\local\temp\cabb21a.tmp
- D:\users\user\appdata\local\temp\tarb21b.tmp
- D:\users\user\appdata\local\temp\cabb24b.tmp
- D:\users\user\appdata\local\temp\tarb24c.tmp
- D:\users\user\appdata\local\temp\cabb2ca.tmp
- D:\users\user\appdata\local\temp\tarb2cb.tmp
- D:\users\user\appdata\local\temp\tarb062.tmp
- D:\users\user\appdata\local\temp\tarb0b2.tmp
- D:\users\user\appdata\local\temp\tarae38.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\error[1]
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\644b8874112055b5e195ecb0e8f243a4
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\103621de9cd5414cc2538780b4b75751
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\103621de9cd5414cc2538780b4b75751
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\831caad91f10dac37d98ad552b2c1716
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\831caad91f10dac37d98ad552b2c1716
- D:\users\user\appdata\local\temp\cabc3b3.tmp
- D:\users\user\appdata\local\temp\tarbee2.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\644b8874112055b5e195ecb0e8f243a4
- D:\users\user\appdata\local\temp\tarc3b4.tmp
- D:\users\user\appdata\local\temp\cabc4ef.tmp
- D:\users\user\appdata\local\temp\tarc4f0.tmp
- D:\users\user\appdata\local\temp\cabc5db.tmp
- D:\users\user\appdata\local\temp\tarc5ec.tmp
- D:\users\user\appdata\local\temp\cabc62b.tmp
- D:\users\user\appdata\local\temp\tarc62c.tmp
- D:\users\user\appdata\local\temp\cabc4af.tmp
- D:\users\user\appdata\local\temp\tarc4b0.tmp
- D:\users\user\appdata\local\temp\cabbb21.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\tsydvhj-hr3[1].js
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\warning[1]
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive0.dat
- D:\users\user\appdata\local\temp\cabbbcf.tmp
- D:\users\user\appdata\local\temp\tarbbd0.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\txms_hrzwkp[1].js
- D:\users\user\appdata\local\temp\tarbb22.tmp
- D:\users\user\appdata\local\temp\cabbee1.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\pv0ik0zpy4o[1].js
- D:\users\user\appdata\local\temp\cabbd86.tmp
- D:\users\user\appdata\local\temp\tarbd87.tmp
- D:\users\user\appdata\local\temp\cabbdd6.tmp
- D:\users\user\appdata\local\temp\tarbdd7.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\ea618097e393409afa316f0f87e2c202_1e65fd33f74047223af4d58cbfd34bce
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\ea618097e393409afa316f0f87e2c202_1e65fd33f74047223af4d58cbfd34bce
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\p55hfxw__mm[1].js
- D:\users\user\appdata\local\temp\cabae68.tmp
- D:\users\user\appdata\local\temp\cabae37.tmp
- D:\users\user\appdata\local\temp\tarae17.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\24bd96d5497f70b3f510a6b53cd43f3e_3a89246fb90c5ee6620004f1ae0eb0ea
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\caf4703619713e3f18d8a9d5d88d6288_a7725538c46de2d0088ee44974e2ceba
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\caf4703619713e3f18d8a9d5d88d6288_a7725538c46de2d0088ee44974e2ceba
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\f2ddcd2b5f37625b82e81f4976cee400_252e1be0796779bb20491d3fe9412cbb
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\f2ddcd2b5f37625b82e81f4976cee400_252e1be0796779bb20491d3fe9412cbb
- D:\users\user\appdata\local\temp\cab412c.tmp
- D:\users\user\appdata\local\temp\tar3af4.tmp
- D:\windows\system32\winevt\logs\system.evtx
- D:\users\user\appdata\local\temp\tar3ae3.tmp
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\users\user\ntuser.dat.log1
- D:\users\user\ntuser.dat
- D:\system volume information\syscache.hve.log1
- D:\system volume information\syscache.hve
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\3566091532-css_bundle_v2[1].css
- D:\users\user\appdata\local\temp\tar412d.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\authorization[1].css
- D:\users\user\appdata\local\temp\cab3ae2.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\4a9377e7e528f7e56b69a81c500abc24
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\39d80535a21e286b3c662765c5f09aceb927e77d
- D:\windows\system32\config\software.log1
- D:\windows\system32\config\software
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\jquery.min[1].js
- D:\windows\system32\config\system.log1
- D:\users\user\appdata\local\temp\cab3af3.tmp
- D:\windows\system32\winevt\logs\security.evtx
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\4a9377e7e528f7e56b69a81c500abc24
- D:\users\user\appdata\local\temp\cab37c2.tmp
- D:\users\user\appdata\local\temp\cab37f3.tmp
- D:\users\user\appdata\local\temp\tar37c3.tmp
- D:\users\user\appdata\local\temp\tar37f4.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015
- D:\windows\system32\config\system
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\dfdc36497a0baee2972009ee6deccc06c2e352c6
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\24bd96d5497f70b3f510a6b53cd43f3e_3a89246fb90c5ee6620004f1ae0eb0ea
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\bannerfans_9030239[1].jpg
- D:\users\user\appdata\local\temp\taraa80.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\e0f5c59f9fa661f6f4c50b87fef3a15a
- D:\users\user\appdata\local\temp\cabaab0.tmp
- D:\users\user\appdata\local\temp\taraab1.tmp
- D:\users\user\appdata\local\temp\cabacf3.tmp
- D:\users\user\appdata\local\temp\taracf4.tmp
- D:\users\user\appdata\local\temp\cabaa7f.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\error[1]
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e0f5c59f9fa661f6f4c50b87fef3a15a
- D:\users\user\appdata\local\temp\cabad34.tmp
- D:\users\user\appdata\local\temp\cabadc4.tmp
- D:\users\user\appdata\local\temp\taradc5.tmp
- D:\users\user\appdata\local\temp\cabade5.tmp
- D:\users\user\appdata\local\temp\tarade6.tmp
- D:\users\user\appdata\local\temp\cabae07.tmp
- D:\users\user\appdata\local\temp\tarad35.tmp
- D:\users\user\appdata\local\temp\cabad84.tmp
- D:\users\user\appdata\local\temp\tarad85.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\warning[1]
- D:\users\user\appdata\local\temp\tara9c3.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\film2gratis[1].png
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\johnny-english-reborn-2011[1].jpg
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\we-are-family-2010[1].jpg
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\mausam (2011)[1].jpg
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\icon18_edit_allbkg[1].gif
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\js15_as[1].js
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e87ce99f124623f95572a696c80efcaf_0e8a7a41d96b0fa577b95c0e6640147d
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\zindagi-na-milegi-dobara-2011[1].jpg
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\e87ce99f124623f95572a696c80efcaf_0e8a7a41d96b0fa577b95c0e6640147d
- D:\users\user\appdata\roaming\microsoft\windows\cookies\user@~~local~~[1].txt
- D:\users\user\appdata\roaming\microsoft\windows\cookies\user@~~local~~[2].txt
- D:\users\user\appdata\local\temp\caba628.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\pop[1].js
- D:\users\user\appdata\local\temp\tara629.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\error[1]
- D:\users\user\appdata\local\temp\caba9c2.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\w2b_facebookbadge[1].png
- D:\users\user\appdata\local\temp\cabc737.tmp
- D:\users\user\appdata\local\temp\tarc738.tmp
Deletes the following files
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
- D:\users\user\appdata\local\temp\tarb92d.tmp
- D:\users\user\appdata\local\temp\cabb92c.tmp
- D:\users\user\appdata\local\temp\tarb728.tmp
- D:\users\user\appdata\local\temp\cabb727.tmp
- D:\users\user\appdata\local\temp\tarb6c9.tmp
- D:\users\user\appdata\local\temp\cabb6c8.tmp
- D:\users\user\appdata\local\temp\tarb531.tmp
- D:\users\user\appdata\local\temp\cabb530.tmp
- D:\users\user\appdata\local\temp\cabbb21.tmp
- D:\users\user\appdata\local\temp\tarb4c2.tmp
- D:\users\user\appdata\local\temp\tarb32a.tmp
- D:\users\user\appdata\local\temp\cabb329.tmp
- D:\users\user\appdata\local\temp\tarb2cb.tmp
- D:\users\user\appdata\local\temp\cabb2ca.tmp
- D:\users\user\appdata\local\temp\tarb24c.tmp
- D:\users\user\appdata\local\temp\cabb24b.tmp
- D:\users\user\appdata\local\temp\tarb21b.tmp
- D:\users\user\appdata\local\temp\cabb21a.tmp
- D:\users\user\appdata\local\temp\cabb4c1.tmp
- D:\users\user\appdata\local\temp\tarbb22.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\error[1]
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\error[1]
- D:\users\user\appdata\local\temp\tarc62c.tmp
- D:\users\user\appdata\local\temp\cabc62b.tmp
- D:\users\user\appdata\local\temp\tarc5ec.tmp
- D:\users\user\appdata\local\temp\cabc5db.tmp
- D:\users\user\appdata\local\temp\tarc4f0.tmp
- D:\users\user\appdata\local\temp\cabc4ef.tmp
- D:\users\user\appdata\local\temp\tarc4b0.tmp
- D:\users\user\appdata\local\temp\cabc4af.tmp
- D:\users\user\appdata\local\temp\tarc3b4.tmp
- D:\users\user\appdata\local\temp\cabc3b3.tmp
- D:\users\user\appdata\local\temp\tarbee2.tmp
- D:\users\user\appdata\local\temp\cabbee1.tmp
- D:\users\user\appdata\local\temp\tarbdd7.tmp
- D:\users\user\appdata\local\temp\cabbdd6.tmp
- D:\users\user\appdata\local\temp\tarbd87.tmp
- D:\users\user\appdata\local\temp\cabbd86.tmp
- D:\users\user\appdata\local\temp\tarbbd0.tmp
- D:\users\user\appdata\local\temp\cabbbcf.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\warning[1]
- D:\users\user\appdata\local\temp\tarb0b2.tmp
- D:\users\user\appdata\local\temp\cabc737.tmp
- D:\users\user\appdata\local\temp\cabb0b1.tmp
- D:\users\user\appdata\local\temp\cabb061.tmp
- D:\users\user\appdata\local\temp\cabaa7f.tmp
- D:\users\user\appdata\local\temp\tara9c3.tmp
- D:\users\user\appdata\local\temp\caba9c2.tmp
- D:\users\user\appdata\local\temp\tara629.tmp
- D:\users\user\appdata\local\temp\caba628.tmp
- D:\users\user\appdata\roaming\microsoft\windows\cookies\user@~~local~~[2].txt
- D:\users\user\appdata\roaming\microsoft\windows\cookies\user@~~local~~[1].txt
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\authorization[1].css
- D:\users\user\appdata\local\temp\taraa80.tmp
- D:\users\user\appdata\local\temp\tar412d.tmp
- D:\users\user\appdata\local\temp\tar3af4.tmp
- D:\users\user\appdata\local\temp\cab3af3.tmp
- D:\users\user\appdata\local\temp\tar3ae3.tmp
- D:\users\user\appdata\local\temp\cab3ae2.tmp
- D:\users\user\appdata\local\temp\tar37f4.tmp
- D:\users\user\appdata\local\temp\cab37f3.tmp
- D:\users\user\appdata\local\temp\tar37c3.tmp
- D:\users\user\appdata\local\temp\cab37c2.tmp
- D:\users\user\appdata\local\temp\cab412c.tmp
- D:\users\user\appdata\local\temp\cabaab0.tmp
- D:\users\user\appdata\local\temp\taraab1.tmp
- D:\users\user\appdata\local\temp\cabacf3.tmp
- D:\users\user\appdata\local\temp\tarb003.tmp
- D:\users\user\appdata\local\temp\cabb002.tmp
- D:\users\user\appdata\local\temp\tarafe2.tmp
- D:\users\user\appdata\local\temp\cabafe1.tmp
- D:\users\user\appdata\local\temp\tarae38.tmp
- D:\users\user\appdata\local\temp\cabae37.tmp
- D:\users\user\appdata\local\temp\tarae69.tmp
- D:\users\user\appdata\local\temp\cabae68.tmp
- D:\users\user\appdata\local\temp\tarae17.tmp
- D:\users\user\appdata\local\temp\cabae07.tmp
- D:\users\user\appdata\local\temp\tarade6.tmp
- D:\users\user\appdata\local\temp\cabade5.tmp
- D:\users\user\appdata\local\temp\taradc5.tmp
- D:\users\user\appdata\local\temp\cabadc4.tmp
- D:\users\user\appdata\local\temp\tarad85.tmp
- D:\users\user\appdata\local\temp\cabad84.tmp
- D:\users\user\appdata\local\temp\tarad35.tmp
- D:\users\user\appdata\local\temp\cabad34.tmp
- D:\users\user\appdata\local\temp\taracf4.tmp
- D:\users\user\appdata\local\temp\tarb062.tmp
- D:\users\user\appdata\local\temp\tarc738.tmp
Substitutes the following files
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\prefs-1.js
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\prefs.js
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\authorization[1].css
- D:\users\user\appdata\roaming\microsoft\windows\cookies\user@~~local~~[1].txt
- D:\users\user\appdata\roaming\microsoft\windows\cookies\user@~~local~~[2].txt
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\error[1]
Network activity
Connects to
- 'aj##.#oogleapis.com':80
- 'st####.xx.fbcdn.net':443
- 's4.##stats.com':443
- 'cd#.#opcash.net':80
- 'fa###ook.com':443
- 'fa###ook.com':80
- 's1#.#istats.com':80
- '1.##.#logspot.com':80
- 'lh#.####leusercontent.com':443
- 're#####es.blogblog.com':443
- '4.##.#logspot.com':80
- 'c1.##pads.net':445
- 'pk#.goog':80
- 'w.###rethis.com':443
- 'w.###rethis.com':80
- 'bl##ger.com':443
- 'x1.#.lencr.org':80
- 'r3.#.lencr.org':80
TCP
HTTP GET requests
- http://aj##.#oogleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js
- http://cd#.#opcash.net/pop.js
- http://1.##.#logspot.com/--tscpVzcBjo/TdUarKtcAlI/AAAAAAAAA3I/qVkypiYO9rc/s150/w2b_facebookbadge.pn
- http://www.fa###ook.com/plugins/likebox.php?hr#######################################################################################################################################
- http://s1#.#istats.com/js15_as.js
- http://2.##.#logspot.com/-AwclzD4oh2k/TZva4oMQMyI/AAAAAAAAAW4/BpDFJfnJ8_M/s320/jddxr5pjs6puyhbz4q10.jpg
- http://3.##.#logspot.com/-JmjPi8o4RSU/TY_Vll55PrI/AAAAAAAAAN8/15hR9Al7BvA/s1600/0019115c_medium.jpeg
- http://2.##.#logspot.com/-ZJyN0Qr_1K4/TY_Vmqlxx7I/AAAAAAAAAOA/DwLNPnG8AU4/s1600/00191166_medium.jpeg
- http://2.##.#logspot.com/-hRu1qAFAXKo/TZvYdVur7BI/AAAAAAAAAWw/4D8Yu5GZTUo/s320/Tsubomi+Zanmaken+-+Shukumei+no+Kimusume+Kenshi.jpeg
- http://4.##.#logspot.com/-zXgw4hgN2pQ/TY_Vk7c250I/AAAAAAAAAN4/777c0qjbj1Y/s1600/0019115b_medium.jpeg
- http://1.##.#logspot.com/-8wdBsnESSDs/TZvayjtLR8I/AAAAAAAAAW0/kqcPtTtQDHI/s320/63opqi7ln1y00k9630pj.jpg
- http://1.##.#logspot.com/-O2Q3py-KEeY/TZvYZtxk1JI/AAAAAAAAAWs/9knIybDzFQM/s320/Sword+of+Tsubomi+%25282010%2529+Screen.jpg
- http://x1.#.lencr.org/
- http://3.##.#logspot.com/-jGb8z9uI4BE/TY_cCpBwPlI/AAAAAAAAAO8/lsTTs2qqqqU/s1600/1288203782_0017db8bmediumb.jpg
- http://2.##.#logspot.com/-iUeTw0x64xw/TY_bi9Zdv_I/AAAAAAAAAO0/RJn58LEJTpU/s1600/65368079.jpg
- http://2.##.#logspot.com/-VpByv9O4dlc/TY_cfoHxtNI/AAAAAAAAAPE/w0wv3tkzxw4/s1600/wall-lover-2009.jpg
- http://4.##.#logspot.com/-X9RIGr4P2s0/TY_baN2WzyI/AAAAAAAAAOw/vo610b8OU6M/s1600/00164176medium.jpg
- http://2.##.#logspot.com/--Cikq5puhTs/TtDMWoyV0PI/AAAAAAAAAVI/l2FAFp87RoI/s400/MAUSAM%2B%25282011%2529.jpg
- http://4.##.#logspot.com/-_Hk-AJnlp4s/TtDM0xgOaFI/AAAAAAAAAVU/pkNp5CngmVU/s400/We-Are-Family-2010.jpg
- http://4.##.#logspot.com/-FhiVJzlMaao/TtDTAxV6fNI/AAAAAAAAAXY/6yRWiTAsNk8/s400/Zindagi-Na-Milegi-Dobara-2011.jpg
- http://2.##.#logspot.com/-UgAuE5Os7Rs/TtEF5kBMZfI/AAAAAAAAAbU/NRiDuZ5aKts/s400/Johnny-English-Reborn-2011.jpg
- http://4.##.#logspot.com/-jfV7qIzrPyA/TtC_3TAs8DI/AAAAAAAAAU8/HUl6OaoGhcc/s1600/film2gratis.png
- http://2.##.#logspot.com/-oCgnKOV0JPc/Ukvjxe3PRtI/AAAAAAAAAN0/tuPvcA__41g/s1600/bannerfans_9030239.jpg
- http://pk#.goog/gsr1/gsr1.crt
- http://w.###rethis.com/button/buttons.js
- http://3.##.#logspot.com/-NjnjpJMOknM/TY_cB7r-MaI/AAAAAAAAAO4/CdoEUWc9WTQ/s1600/0017db8d_medium.jpeg
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgPLbh5fX7X1PBoqaMGeyi6Hkw%3D%3D
Other
- 'localhost':49158
- 'fi#####.###tings.services.mozilla.com':443
- 'bl##ger.com':443
- 'w.###rethis.com':443
- 'lh#.####leusercontent.com':443
- 'fa###ook.com':443
- 's4.##stats.com':443
- 'st####.xx.fbcdn.net':443
- '34.##0.144.191':443
UDP
- DNS ASK bl##ger.com
- DNS ASK st####.xx.fbcdn.net
- DNS ASK s4.##stats.com
- DNS ASK cd#.#opcash.net
- DNS ASK fa###ook.com
- DNS ASK s1#.#istats.com
- DNS ASK 1.##.#logspot.com
- DNS ASK 3.##.#logspot.com
- DNS ASK lh#.####leusercontent.com
- DNS ASK re#####es.blogblog.com
- DNS ASK 4.##.#logspot.com
- DNS ASK 2.##.#logspot.com
- DNS ASK c1.##pads.net
- DNS ASK pk#.goog
- DNS ASK w.###rethis.com
- DNS ASK aj##.#oogleapis.com
- DNS ASK x1.#.lencr.org
- DNS ASK r3.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
