Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = '<Full path to virus>'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'FlashPlayerUpdate' = '<Full path to virus>'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '<Full path to virus>'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'userinit' = '<SYSTEM32>\userinit.exe,<Full path to virus>,'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'System' = '<Full path to virus>'
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\cscript.exe
a large number of user processes.
Modifies file system :
Creates the following files:
- %TEMP%\3D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[16].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[16].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[16].php
- %TEMP%\3E.tmp
- %TEMP%\3C.tmp
- %TEMP%\3A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[15].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[15].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[15].php
- %TEMP%\3B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[17].php
- %TEMP%\42.tmp
- %TEMP%\43.tmp
- %TEMP%\44.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[17].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[17].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[16].php
- %TEMP%\3F.tmp
- %TEMP%\40.tmp
- %TEMP%\41.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[17].php
- %TEMP%\39.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[13].php
- %TEMP%\31.tmp
- %TEMP%\32.tmp
- %TEMP%\33.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[13].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[13].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[12].php
- %TEMP%\2E.tmp
- %TEMP%\2F.tmp
- %TEMP%\30.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[12].php
- %TEMP%\37.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[14].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[14].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[15].php
- %TEMP%\38.tmp
- %TEMP%\36.tmp
- %TEMP%\34.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[13].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[14].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[14].php
- %TEMP%\35.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[18].php
- %TEMP%\54.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[21].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[22].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[22].php
- %TEMP%\55.tmp
- %TEMP%\53.tmp
- %TEMP%\51.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[21].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[21].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[21].php
- %TEMP%\52.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[23].php
- %TEMP%\59.tmp
- %TEMP%\5A.tmp
- %TEMP%\5B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[23].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[23].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[22].php
- %TEMP%\56.tmp
- %TEMP%\57.tmp
- %TEMP%\58.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[22].php
- %TEMP%\50.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[19].php
- %TEMP%\48.tmp
- %TEMP%\49.tmp
- %TEMP%\4A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[19].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[18].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[18].php
- %TEMP%\45.tmp
- %TEMP%\46.tmp
- %TEMP%\47.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[18].php
- %TEMP%\4E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[20].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[20].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[20].php
- %TEMP%\4F.tmp
- %TEMP%\4D.tmp
- %TEMP%\4B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[19].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[19].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[20].php
- %TEMP%\4C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[12].php
- %TEMP%\F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[5].php
- %TEMP%\10.tmp
- %TEMP%\E.tmp
- %TEMP%\C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[3].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[4].php
- %TEMP%\D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[6].php
- %TEMP%\14.tmp
- %TEMP%\15.tmp
- %TEMP%\16.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[6].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[5].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[5].php
- %TEMP%\11.tmp
- %TEMP%\12.tmp
- %TEMP%\13.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[5].php
- %TEMP%\B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[1].php
- %TEMP%\3.tmp
- %TEMP%\4.tmp
- %TEMP%\5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[1].php
- %APPDATA%\579f766\cmdline.txt
- %TEMP%\1.tmp
- %TEMP%\2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[1].php
- %TEMP%\9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[3].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[3].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[3].php
- %TEMP%\A.tmp
- %TEMP%\8.tmp
- %TEMP%\6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[2].php
- %TEMP%\7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[6].php
- %TEMP%\26.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[10].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[10].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[10].php
- %TEMP%\27.tmp
- %TEMP%\25.tmp
- %TEMP%\23.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[9].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[9].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[10].php
- %TEMP%\24.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[11].php
- %TEMP%\2B.tmp
- %TEMP%\2C.tmp
- %TEMP%\2D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[12].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[11].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[11].php
- %TEMP%\28.tmp
- %TEMP%\29.tmp
- %TEMP%\2A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[11].php
- %TEMP%\22.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[7].php
- %TEMP%\1A.tmp
- %TEMP%\1B.tmp
- %TEMP%\1C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[7].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[7].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[6].php
- %TEMP%\17.tmp
- %TEMP%\18.tmp
- %TEMP%\19.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[7].php
- %TEMP%\20.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\posting[8].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[9].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[9].php
- %TEMP%\21.tmp
- %TEMP%\1F.tmp
- %TEMP%\1D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\posting[8].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\posting[8].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\posting[8].php
- %TEMP%\1E.tmp
Sets the 'hidden' attribute to the following files:
- <Full path to virus>
Deletes the following files:
- %TEMP%\3D.tmp
- %TEMP%\3E.tmp
- %TEMP%\3C.tmp
- %TEMP%\3A.tmp
- %TEMP%\3B.tmp
- %TEMP%\3F.tmp
- %TEMP%\43.tmp
- %TEMP%\44.tmp
- %TEMP%\42.tmp
- %TEMP%\40.tmp
- %TEMP%\41.tmp
- %TEMP%\32.tmp
- %TEMP%\33.tmp
- %TEMP%\31.tmp
- %TEMP%\2F.tmp
- %TEMP%\30.tmp
- %TEMP%\34.tmp
- %TEMP%\38.tmp
- %TEMP%\39.tmp
- %TEMP%\37.tmp
- %TEMP%\35.tmp
- %TEMP%\36.tmp
- %TEMP%\45.tmp
- %TEMP%\54.tmp
- %TEMP%\55.tmp
- %TEMP%\53.tmp
- %TEMP%\51.tmp
- %TEMP%\52.tmp
- %TEMP%\56.tmp
- %TEMP%\5A.tmp
- %TEMP%\5B.tmp
- %TEMP%\59.tmp
- %TEMP%\57.tmp
- %TEMP%\58.tmp
- %TEMP%\49.tmp
- %TEMP%\4A.tmp
- %TEMP%\48.tmp
- %TEMP%\46.tmp
- %TEMP%\47.tmp
- %TEMP%\4B.tmp
- %TEMP%\4F.tmp
- %TEMP%\50.tmp
- %TEMP%\4E.tmp
- %TEMP%\4C.tmp
- %TEMP%\4D.tmp
- %TEMP%\2E.tmp
- %TEMP%\F.tmp
- %TEMP%\10.tmp
- %TEMP%\E.tmp
- %TEMP%\C.tmp
- %TEMP%\D.tmp
- %TEMP%\11.tmp
- %TEMP%\15.tmp
- %TEMP%\16.tmp
- %TEMP%\14.tmp
- %TEMP%\12.tmp
- %TEMP%\13.tmp
- %TEMP%\4.tmp
- %TEMP%\5.tmp
- %TEMP%\3.tmp
- %TEMP%\1.tmp
- %TEMP%\2.tmp
- %TEMP%\6.tmp
- %TEMP%\A.tmp
- %TEMP%\B.tmp
- %TEMP%\9.tmp
- %TEMP%\7.tmp
- %TEMP%\8.tmp
- %TEMP%\17.tmp
- %TEMP%\26.tmp
- %TEMP%\27.tmp
- %TEMP%\25.tmp
- %TEMP%\23.tmp
- %TEMP%\24.tmp
- %TEMP%\28.tmp
- %TEMP%\2C.tmp
- %TEMP%\2D.tmp
- %TEMP%\2B.tmp
- %TEMP%\29.tmp
- %TEMP%\2A.tmp
- %TEMP%\1B.tmp
- %TEMP%\1C.tmp
- %TEMP%\1A.tmp
- %TEMP%\18.tmp
- %TEMP%\19.tmp
- %TEMP%\1D.tmp
- %TEMP%\21.tmp
- %TEMP%\22.tmp
- %TEMP%\20.tmp
- %TEMP%\1E.tmp
- %TEMP%\1F.tmp
Network activity:
Connects to:
- 'fo###ih.info':80
- 'di###yb.info':80
- 'ga###aw.info':80
- 'ke###ud.info':80
- 'je###ex.info':80
- 'ci###yt.info':80
- 'vo###ic.info':80
- 'ma###em.info':80
- 'no###af.info':80
- 'ly###on.info':80
- 'xu###ej.info':80
- 'vo###uk.info':80
- 'ci###em.info':80
- 'no###it.info':80
- 'ga###ib.info':80
- 'ly###ux.info':80
- 'xu###od.info':80
- 'ry###uq.info':80
- 'ma###ac.info':80
- 'tu###ol.info':80
- 'qe###yg.info':80
- 'pu###ep.info':80
- 'qe###ul.info':80
- 'ma###ut.info':80
- 'ry###ag.info':80
- 'qe###iv.info':80
- 'ci###if.info':80
- 'ly###ar.info':80
- 'tu###yq.info':80
- 'ga###uh.info':80
- 'ke###ax.info':80
- 'di###os.info':80
- 'fo###eb.info':80
- 'je###ir.info':80
- 'di###iw.info':80
- 'ke###oj.info':80
- 'pu###yg.info':80
- 'ry###op.info':80
- 'tu###av.info':80
- 'fo###oz.info':80
- 'xu###yx.info':80
- 'vo###om.info':80
- 'no###ek.info':80
- 'ga###es.info':80
- 'je###un.info':80
- 'ke###yr.info':80
- 'fo###ab.info':80
- 'ga###yh.info':80
- 'ke###ox.info':80
- 'pu###ul.info':80
- 'di###is.info':80
- 'je###ur.info':80
- 'ci###ik.info':80
- 'no###ec.info':80
- 'xu###yn.info':80
- 'vo###at.info':80
- 'ly###ed.info':80
- 'no###ak.info':80
- 'ly###or.info':80
- 'ci###uf.info':80
- 'www.bing.com':80
- 'di###uw.info':80
- 'xu###ex.info':80
- 'qe###uv.info':80
- 'tu###eq.info':80
- 'ry###og.info':80
- 'vo###im.info':80
- 'ma###yt.info':80
- 'ma###uf.info':80
- 'tu###ig.info':80
- 'ma###ok.info':80
- 'ly###yj.info':80
- 'vo###ef.info':80
- 'no###um.info':80
- 'pu###oq.info':80
- 'fo###us.info':80
- 'di###ez.info':80
- 'je###aj.info':80
- 'qe###ap.info':80
- 'ry###yv.info':80
- 'pu###iv.info':80
- 'di###ah.info':80
- 'ry###el.info':80
- 'qe###oq.info':80
- 'tu###yp.info':80
- 'fo###ew.info':80
- 'xu###ir.info':80
- 'ci###oc.info':80
- 'ke###an.info':80
- 'je###od.info':80
- 'ga###uz.info':80
TCP:
HTTP GET requests:
- fo###ih.info/posting.php
- di###yb.info/posting.php
- ga###aw.info/posting.php
- ke###ud.info/posting.php
- je###ex.info/posting.php
- ci###yt.info/posting.php
- vo###ic.info/posting.php
- ma###em.info/posting.php
- no###af.info/posting.php
- ly###on.info/posting.php
- xu###ej.info/posting.php
- vo###uk.info/posting.php
- ci###em.info/posting.php
- no###it.info/posting.php
- ga###ib.info/posting.php
- ly###ux.info/posting.php
- xu###od.info/posting.php
- ry###uq.info/posting.php
- ma###ac.info/posting.php
- tu###ol.info/posting.php
- qe###yg.info/posting.php
- pu###ep.info/posting.php
- qe###ul.info/posting.php
- ma###ut.info/posting.php
- ry###ag.info/posting.php
- qe###iv.info/posting.php
- ci###if.info/posting.php
- ly###ar.info/posting.php
- tu###yq.info/posting.php
- ga###uh.info/posting.php
- ke###ax.info/posting.php
- di###os.info/posting.php
- fo###eb.info/posting.php
- je###ir.info/posting.php
- di###iw.info/posting.php
- ke###oj.info/posting.php
- pu###yg.info/posting.php
- ry###op.info/posting.php
- tu###av.info/posting.php
- fo###oz.info/posting.php
- xu###yx.info/posting.php
- vo###om.info/posting.php
- no###ek.info/posting.php
- ga###es.info/posting.php
- je###un.info/posting.php
- ga###yh.info/posting.php
- je###ur.info/posting.php
- fo###ab.info/posting.php
- di###is.info/posting.php
- ke###ox.info/posting.php
- vo###at.info/posting.php
- no###ec.info/posting.php
- ma###uf.info/posting.php
- ci###ik.info/posting.php
- ly###ed.info/posting.php
- xu###yn.info/posting.php
- ly###or.info/posting.php
- xu###ex.info/posting.php
- no###ak.info/posting.php
- di###uw.info/posting.php
- ci###uf.info/posting.php
- vo###im.info/posting.php
- tu###eq.info/posting.php
- pu###ul.info/posting.php
- qe###uv.info/posting.php
- ma###yt.info/posting.php
- ry###og.info/posting.php
- qe###oq.info/posting.php
- ma###ok.info/posting.php
- pu###oq.info/posting.php
- tu###ig.info/posting.php
- no###um.info/posting.php
- ly###yj.info/posting.php
- qe###ap.info/posting.php
- di###ez.info/posting.php
- ke###yr.info/posting.php
- fo###us.info/posting.php
- ry###yv.info/posting.php
- je###aj.info/posting.php
- di###ah.info/posting.php
- fo###ew.info/posting.php
- pu###iv.info/posting.php
- tu###yp.info/posting.php
- ry###el.info/posting.php
- je###od.info/posting.php
- ci###oc.info/posting.php
- vo###ef.info/posting.php
- xu###ir.info/posting.php
- ga###uz.info/posting.php
- ke###an.info/posting.php
UDP:
- DNS ASK di###yb.info
- DNS ASK no###af.info
- DNS ASK ci###yt.info
- DNS ASK je###ex.info
- DNS ASK ga###aw.info
- DNS ASK fo###ih.info
- DNS ASK ma###em.info
- DNS ASK qe###ul.info
- DNS ASK ry###op.info
- DNS ASK ly###on.info
- DNS ASK xu###ej.info
- DNS ASK vo###ic.info
- DNS ASK vo###uk.info
- DNS ASK ci###em.info
- DNS ASK xu###od.info
- DNS ASK ga###ib.info
- DNS ASK ly###ux.info
- DNS ASK no###it.info
- DNS ASK ry###uq.info
- DNS ASK ma###ac.info
- DNS ASK ke###ud.info
- DNS ASK qe###yg.info
- DNS ASK tu###ol.info
- DNS ASK pu###ep.info
- DNS ASK tu###av.info
- DNS ASK je###ir.info
- DNS ASK di###os.info
- DNS ASK fo###eb.info
- DNS ASK ry###ag.info
- DNS ASK tu###yq.info
- DNS ASK ke###ax.info
- DNS ASK ci###ok.info
- DNS ASK xu###un.info
- DNS ASK ly###yd.info
- DNS ASK ga###uh.info
- DNS ASK no###yc.info
- DNS ASK vo###et.info
- DNS ASK ga###es.info
- DNS ASK je###un.info
- DNS ASK no###ek.info
- DNS ASK pu###yg.info
- DNS ASK di###iw.info
- DNS ASK ke###oj.info
- DNS ASK ly###ar.info
- DNS ASK qe###iv.info
- DNS ASK ma###ut.info
- DNS ASK xu###yx.info
- DNS ASK ci###if.info
- DNS ASK vo###om.info
- DNS ASK ke###yr.info
- DNS ASK pu###ul.info
- DNS ASK di###is.info
- DNS ASK ke###ox.info
- DNS ASK ma###yt.info
- DNS ASK ry###og.info
- DNS ASK qe###uv.info
- DNS ASK vo###at.info
- DNS ASK ly###ed.info
- DNS ASK xu###yn.info
- DNS ASK fo###ab.info
- DNS ASK ga###yh.info
- DNS ASK je###ur.info
- DNS ASK je###yn.info
- DNS ASK ga###as.info
- DNS ASK ke###ij.info
- DNS ASK www.bing.com
- DNS ASK di###uw.info
- DNS ASK fo###oz.info
- DNS ASK ly###or.info
- DNS ASK vo###im.info
- DNS ASK tu###eq.info
- DNS ASK no###ak.info
- DNS ASK ci###uf.info
- DNS ASK xu###ex.info
- DNS ASK ci###ik.info
- DNS ASK ly###yj.info
- DNS ASK tu###ig.info
- DNS ASK ma###ok.info
- DNS ASK vo###ef.info
- DNS ASK ci###oc.info
- DNS ASK no###um.info
- DNS ASK fo###us.info
- DNS ASK je###aj.info
- DNS ASK di###ez.info
- DNS ASK pu###oq.info
- DNS ASK qe###ap.info
- DNS ASK ry###yv.info
- DNS ASK tu###yp.info
- DNS ASK ry###el.info
- DNS ASK pu###iv.info
- DNS ASK no###ec.info
- DNS ASK qe###oq.info
- DNS ASK ma###uf.info
- DNS ASK ke###an.info
- DNS ASK je###od.info
- DNS ASK xu###ir.info
- DNS ASK di###ah.info
- DNS ASK fo###ew.info
- DNS ASK ga###uz.info
Miscellaneous:
Searches for the following windows:
- ClassName: 'javax.swing.JFrame' WindowName: 'Login Dispositivo'
- ClassName: 'javax.swing.JFrame' WindowName: 'Identificazione Utente'
- ClassName: 'javax.swing.JFrame' WindowName: 'Modifica del PIN'
- ClassName: 'SunAwtFrame' WindowName: 'Modifica del PIN'
- ClassName: 'SunAwtFrame' WindowName: 'Sblocco del PIN'
- ClassName: 'javax.swing.JFrame' WindowName: 'Scelta e Login dispositivo'
- ClassName: 'javax.swing.JFrame' WindowName: 'Sblocco del PIN'
- ClassName: 'SunAwtDialog' WindowName: 'Modifica del PIN'
- ClassName: 'SunAwtDialog' WindowName: 'Sblocco del PIN'
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'SunAwtDialog' WindowName: 'Scelta e Login dispositivo'
- ClassName: 'SunAwtDialog' WindowName: 'Login Dispositivo'
- ClassName: 'SunAwtDialog' WindowName: 'Identificazione Utente'
- ClassName: 'SunAwtFrame' WindowName: 'Identificazione Utente'
- ClassName: 'SunAwtFrame' WindowName: '??i? ? ???????'
- ClassName: 'javax.swing.JFrame' WindowName: '???? ? ???????'
- ClassName: 'javax.swing.JFrame' WindowName: 'Welcome'
- ClassName: 'SunAwtFrame' WindowName: '???? ? ???????'
- ClassName: 'SunAwtFrame' WindowName: 'Welcome'
- ClassName: 'SunAwtFrame' WindowName: '????????????? ? ??????'
- ClassName: 'javax.swing.JFrame' WindowName: '??i? ? ???????'
- ClassName: 'SunAwtDialog' WindowName: '??i? ? ???????'
- ClassName: 'SunAwtFrame' WindowName: 'Scelta e Login dispositivo'
- ClassName: 'SunAwtFrame' WindowName: 'Login Dispositivo'
- ClassName: 'SunAwtDialog' WindowName: 'Synchronization with bank'
- ClassName: 'SunAwtDialog' WindowName: '???? ? ???????'
- ClassName: 'SunAwtDialog' WindowName: '????????????? ? ??????'