Technical Information
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\privacie\index.dat
Network activity
Connects to
- 'tu###ideo.eu':80
- 'i.##b.co':443
- 'google.com':443
- 'ad#####tetoplist.com':80
- 'st.##atango.com':80
- 'ho###cret.top':80
- 'go#####agmanager.com':443
- 'i.##gur.com':443
- 'id##.imgdew.com':443
- '18##p.link':80
- 'bl#####st.rkn.gov.ru':80
- 'pk#.goog':80
- 'x1.#.lencr.org':80
- 't1.##tatic.com':443
- 't2.##tatic.com':443
- 't0.##tatic.com':443
- 'to###ist.xyz':80
- 'bl#####le.beeline.ru':80
- 'im####2.imgbox.com':443
- 'ho###cret.top':443
- 'ca###p###y.top':443
- 'sh###per.org':80
- 'cd#.#opcash.net':80
- 'a.###lsrv.com':443
- 'nu###tsmall.eu':80
- 'ga###ry###e.eu':80
- 'eb##o.xyz':80
- 'nu####-movies.top':80
- 'nu###tup.com':80
- 'to###udism.eu':80
- 'nu####collection.eu':80
- 'yo###nudism.eu':80
- 'nu###mtown.eu':80
- 'ca###p###y.top':80
- 'd.##opy.com':80
- 'cd#.##becorp.com':443
- 'sw###body.top':443
- 'eb##o.pw':80
- 't3.##tatic.com':443
- 'oc##.#ectigo.com':80
TCP
HTTP GET requests
- http://tu###ideo.eu/ezzgz.cgi?2&##################################################
- http://sh###per.org/tzh.cgi?9&##########
- http://nu####collection.eu/ftt2/o.php
- http://yo###nudism.eu/
- http://yo###nudism.eu/a###iz.js
- http://yo###nudism.eu/ftt2/check.php?t=#############################################################
- http://yo###nudism.eu/ftt2/o.php
- http://nu###mtown.eu/
- http://nu###mtown.eu/ftt2/check.php?t=#############################################################
- http://nu###mtown.eu/ftt2/o.php
- http://ca###p###y.top/
- http://ca###p###y.top/aeszoinypy.php
- http://ca###p###y.top/templatemo_style.css
- http://d.##opy.com/d/?re############
- http://ad#####tetoplist.com/button.php?u=##########
- http://18##p.link/button.php?u=#########
- http://to###ist.xyz/button.php?u=#########
- http://ca###p###y.top/images/templatemo_menu.jpg
- http://ca###p###y.top/images/templatemo_content.jpg
- http://st.##atango.com/js/gz/emb.js
- http://ca###p###y.top/images/templatemo_list.png
- http://ca###p###y.top/images/templatemo_body.jpg
- http://bl#####le.beeline.ru/
- http://ca###p###y.top/images/templatemo_main.jpg
- http://bl#####st.rkn.gov.ru/
- http://ca###p###y.top/images/templatemo_header.jpg
- http://ca###p###y.top/images/templatemo_main_bottom.jpg
- http://pk#.goog/gsr1/gsr1.crt
- http://nu####collection.eu/ftt2/check.php?t=#############################################################
- http://x1.#.lencr.org/
- http://nu####collection.eu/
- http://eb##o.pw/ftt2/check.php?t=#############################################################
- http://tu###ideo.eu/jry.cgi?3
- http://nu###tup.com/
- http://tu###ideo.eu/ezzgz.cgi?2&###############################
- http://sh###per.org/ajn.cgi?14###########
- http://cd#.#opcash.net/pop.js
- http://nu###tup.com/ftt2/check.php?t=#############################################################
- http://nu###tup.com/ftt2/o.php
- http://nu###tsmall.eu/
- http://nu###tsmall.eu/a###izpor.js
- http://nu###tsmall.eu/ftt2/check.php?t=#############################################################
- http://ga###ry###e.eu/
- http://nu###tsmall.eu/ftt2/o.php
- http://ga###ry###e.eu/ftt2/check.php?t=#############################################################
- http://eb##o.xyz/
- http://eb##o.xyz/paxota/normalize.css
- http://eb##o.xyz/paxota/styles.css
- http://eb##o.xyz/ftt2/check.php?t=############################################################
- http://eb##o.xyz/ftt2/cron.php
- http://eb##o.xyz/ftt2/o.php
- http://nu####-movies.top/
- http://nu####-movies.top/ftt2/check.php?t=#############################################################
- http://nu####-movies.top/ftt2/o.php
- http://to###udism.eu/
- http://to###udism.eu/ftt2/check.php?t=###########################################################
- http://to###udism.eu/ftt2/o.php
- http://eb##o.pw/
- http://eb##o.pw/imeqazoca/stil.css
- http://eb##o.pw/ftt2/o.php
- http://oc##.#ectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEDL0swXMjI37UOnO6kG2YJc%3D
Other
- 'a.###lsrv.com':443
- 'cd#.##becorp.com':443
- 'sw###body.top':443
- 'i.##gur.com':443
- 'google.com':443
- 'id##.imgdew.com':443
- 'im####2.imgbox.com':443
- 'ca###p###y.top':443
- 'i.##b.co':443
- 'go#####agmanager.com':443
- 't1.##tatic.com':443
- 't2.##tatic.com':443
- 't0.##tatic.com':443
- 't3.##tatic.com':443
UDP
- DNS ASK tu###ideo.eu
- DNS ASK i.##gur.com
- DNS ASK i.##b.co
- DNS ASK id##.imgdew.com
- DNS ASK ad#####tetoplist.com
- DNS ASK google.com
- DNS ASK st.##atango.com
- DNS ASK go#####agmanager.com
- DNS ASK 18##p.link
- DNS ASK t3.##tatic.com
- DNS ASK bl#####le.beeline.ru
- DNS ASK bl#####st.rkn.gov.ru
- DNS ASK pk#.goog
- DNS ASK x1.#.lencr.org
- DNS ASK t1.##tatic.com
- DNS ASK t2.##tatic.com
- DNS ASK t0.##tatic.com
- DNS ASK im####2.imgbox.com
- DNS ASK to###ist.xyz
- DNS ASK bo##xxx.top
- DNS ASK nu####-movies.top
- DNS ASK nu###tup.com
- DNS ASK sh###per.org
- DNS ASK cd#.#opcash.net
- DNS ASK a.###lsrv.com
- DNS ASK ga###ry###e.eu
- DNS ASK nu###tsmall.eu
- DNS ASK eb##o.xyz
- DNS ASK to###udism.eu
- DNS ASK sw###body.top
- DNS ASK eb##o.pw
- DNS ASK nu####collection.eu
- DNS ASK yo###nudism.eu
- DNS ASK nu###mtown.eu
- DNS ASK ca###p###y.top
- DNS ASK d.##opy.com
- DNS ASK cd#.##becorp.com
- DNS ASK ho###cret.top
- DNS ASK oc##.#ectigo.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
