Technical Information
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\privacie\index.dat
Network activity
Connects to
- 'sh###per.org':80
- 'am###ur###n.me':443
- 'me#a.nz':443
- 'fr#####itorcounters.com':443
- 'te###4s##.com':80
- 'vi###mature.eu':80
- 'to###udism.eu':80
- 'hd###dist.eu':80
- 'hd##lf.eu':80
- 'nu####russian.eu':80
- 'cl######rocurertightwad.com':443
- 'ea######atisfiedsplice.com':80
- 'cl######rocurertightwad.com':80
- 'po###picsx.com':80
- 'ki###udist.eu':80
- 'ma###es##x.eu':80
- 'nu###tvoyour.eu':80
- 'cd#.#opcash.net':80
- 'be###nudist.eu':80
- 'af####nnudist.eu':80
- 'mi###udist.eu':80
- 'nu####4colony.eu':80
- 'mi##hd.eu':80
- 'ma##s.pw':80
- 'pt##emd.com':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://sh###per.org/pxjvgejyt.cgi?2&###################################################
- http://nu####russian.eu/ftt2/o.php
- http://nu####russian.eu/ftt2/check.php?t=#############################################################
- http://nu####russian.eu/bonzai/style.css
- http://nu####russian.eu/dencasgj.js
- http://nu####russian.eu/
- http://po###picsx.com/pics/o.php?wr######
- http://po###picsx.com/pics/o.php
- http://hd##lf.eu/ftt2/check.php?t=#############################################################
- http://hd##lf.eu/
- http://po###picsx.com/
- http://ki###udist.eu/ftt2/o.php
- http://ki###udist.eu/ftt2/check.php?t=############################################################
- http://ki###udist.eu/a###izzpor.js
- http://ki###udist.eu/
- http://ma###es##x.eu/ftt2/o.php
- http://ma###es##x.eu/ftt2/check.php?t=#############################################################
- http://ea######atisfiedsplice.com/pn07uscr/f/tr/zavbn/2012866/lib.js
- http://af####nnudist.eu/ftt2/o.php
- http://hd##lf.eu/ftt2/o.php
- http://af####nnudist.eu/icons/ftv2pnode.gif
- http://af####nnudist.eu/icons/ftv2doc.gif
- http://mi##hd.eu/ftt2/check.php?t=#############################################################
- http://www.te###4s##.com/blueheavenstars.jpg
- http://www.te###4s##.com/logos/t46/gifs/t46_ab001b.gif
- http://www.te###4s##.com/87iuzphp/style.css
- http://www.te###4s##.com/w3.css
- http://www.te###4s##.com/
- http://vi###mature.eu/ftt2/o.php
- http://vi###mature.eu/ftt2/check.php?t=#############################################################
- http://vi###mature.eu/
- http://to###udism.eu/ftt2/o.php
- http://to###udism.eu/ftt2/check.php?t=#############################################################
- http://to###udism.eu/
- http://hd###dist.eu/ftt2/check.php?t=#############################################################
- http://hd###dist.eu/ftt2/o.php
- http://hd###dist.eu/ftt2/cron.php
- http://ma###es##x.eu/ftt2/cron.php
- http://cl######rocurertightwad.com/t/9/fret/meow4/1891556/6a453a94.js
- http://ma###es##x.eu/
- http://nu###tvoyour.eu/ftt2/o.php
- http://nu###tvoyour.eu/ftt2/check.php?t=#############################################################
- http://mi##hd.eu/
- http://mi###udist.eu/
- http://nu####4colony.eu/ftt2/o.php
- http://nu####4colony.eu/ftt2/check.php?t=#############################################################
- http://nu####4colony.eu/a###izzpor.js
- http://nu####4colony.eu/
- http://mi##hd.eu/ftt2/o.php
- http://mi##hd.eu/ftt2/cron.php
- http://ma##s.pw/ftt2/o.php
- http://af####nnudist.eu/ftt2/check.php?t=#############################################################
- http://ma##s.pw/ftt2/check.php?t=#############################################################
- http://sh###per.org/pxjvgejyt.cgi?2&###############################
- http://sh###per.org/ajn.cgi?14###########
- http://ma##s.pw/
- http://sh###per.org/uuj6.html
- http://sh###per.org/wnnbfb.cgi?5
- http://sh###per.org/dvh.cgi?4
- http://af####nnudist.eu/icons/ftv2plastnode.gif
- http://hd###dist.eu/
- http://af####nnudist.eu/j61_1_1.htm
- http://af####nnudist.eu/j61_1.js
- http://af####nnudist.eu/
- http://nu###tvoyour.eu/a###iz.js
- http://nu###tvoyour.eu/
- http://be###nudist.eu/ftt2/o.php
- http://be###nudist.eu/ftt2/check.php?t=#############################################################
- http://cd#.#opcash.net/pop.js
- http://be###nudist.eu/tanolsew.js
- http://sh###per.org/tzh.cgi?9&##########
- http://af####nnudist.eu/dencasgj.js
- http://af####nnudist.eu/icons/ftv2folderclosed.gif
- http://af####nnudist.eu/icons/ftv2mlastnode.gif
- http://be###nudist.eu/
- http://af####nnudist.eu/j61_1_2.htm
- http://af####nnudist.eu/icons/ftv2lastnode.gif
- http://af####nnudist.eu/icons/ftv2node.gif
- http://af####nnudist.eu/icons/ftv2vertline.gif
- http://af####nnudist.eu/icons/ftv2folderopen.gif
- http://af####nnudist.eu/j61.js
- http://x1.#.lencr.org/
Other
- 'cl######rocurertightwad.com':443
- 'fr#####itorcounters.com':443
- 'pt##emd.com':443
- 'me#a.nz':443
- 'am###ur###n.me':443
UDP
- DNS ASK sh###per.org
- DNS ASK me#a.nz
- DNS ASK am###ur###n.me
- DNS ASK fr#####itorcounters.com
- DNS ASK wm##em.com
- DNS ASK te###4s##.com
- DNS ASK vi###mature.eu
- DNS ASK to###udism.eu
- DNS ASK hd###dist.eu
- DNS ASK hd##lf.eu
- DNS ASK nu####russian.eu
- DNS ASK ea######atisfiedsplice.com
- DNS ASK pt##emd.com
- DNS ASK cl######rocurertightwad.com
- DNS ASK ki###udist.eu
- DNS ASK ma###es##x.eu
- DNS ASK nu###tvoyour.eu
- DNS ASK cd#.#opcash.net
- DNS ASK be###nudist.eu
- DNS ASK xm##ure.eu
- DNS ASK af####nnudist.eu
- DNS ASK mi###udist.eu
- DNS ASK nu####4colony.eu
- DNS ASK mi##hd.eu
- DNS ASK ma##s.pw
- DNS ASK po###picsx.com
- DNS ASK x1.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
