landing at: -http://tmserver-1.com/197ktl61js0t9ycw3y8c0qx61qwuo9y0j7mxdu9
probably detected Webzilla abuse as DrWeb flags: https://www.virustotal.com/nl/url/a38b4c5a4c6bc902e4528f8ba6bae4807b27ae07d053a6a58175bf7122a188be/analysis/
then redirecting here: https://www.virustotal.com/nl/url/0fa852f6953f2e7f16c6ffeee70e2cde83ba261da9ca59fa937c4d55dff6ca86/analysis/1445029305/ (detected via Malzilla scan) malicious: https://www.virustotal.com/nl/url/0fa852f6953f2e7f16c6ffeee70e2cde83ba261da9ca59fa937c4d55dff6ca86/analysis/1445029305/
malware confirmed here: http://urlquery.net/report.php?id=1445029498326 continued Webzilla abuse!
-http://darangi.ru/8xtl1k5coxs5svcdqvoa2s8gz3n9mo9hy7ek0kkpq78b88qjd4evexo38zt2 is present in the Dr.Web database of unwanted sites!
-http://tmserver-1.com/197ktl61js0t9ycw3y8c0qx61qwuo9y0j7mxdu9 is present in the Dr.Web database of unwanted sites!
polonus