Technical Information
Modifies file system
Creates the following files
- %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#videobug.se\settings.sxx
- %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sxx
- %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\videobug.se\com.longtailvideo.jwplayer.sxx
Deletes the following files
- %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#videobug.se\settings.sol
- %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\videobug.se\com.longtailvideo.jwplayer.sxx
Moves the following files
- from %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#videobug.se\settings.sxx to %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#videobug.se\settings.sol
Substitutes the following files
- %APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
- %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#videobug.se\settings.sxx
- %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#videobug.se\settings.sol
Network activity
Connects to
- 'aj##.#oogleapis.com':80
- 'vi##obug.se':80
- 'go.##clasrv.com':445
- 'p.###cdn.com':80
- 'go#####analytics.com':445
- 'go#####analytics.com':139
- 'wi####s.amung.us':80
- 's1#.#istats.com':80
- 't.###cout.com':443
- 'fp######ad2.macromedia.com':80
- 'wh##.amung.us':445
- 'lh#.####leusercontent.com':443
- 'microsoft.com':80
- 'go#####analytics.com':80
- 'oc##.#ectigo.com':80
TCP
HTTP GET requests
- http://aj##.#oogleapis.com/ajax/libs/jquery/1.6/jquery.min.js
- http://vi##obug.se/jw6.8/jwplayer.js
- http://p.###cdn.com/6/8/vast.js
- http://p.###cdn.com/6/8/jwpsrv.js
- http://p.###cdn.com/6/8/sharing.js
- http://vi##obug.se/jw6.8/jwplayer.flash.swf
- http://wi####s.amung.us/small.js
- http://s1#.#istats.com/js15.js
- http://fp######ad2.macromedia.com/get/flashplayer/update/current/install/version.xml19.0.0.207~installVector=2&lang=en&cpuWordLength=64&playerType=ax&os=win&osVer=13
- http://p.###cdn.com/crossdomain.xml
- http://p.###cdn.com/6/8/skins/five.xml
- http://p.###cdn.com/6/8/vast.swf
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://oc##.#ectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQDpASB%2FFNyCJWUCDnOkaDrt
Other
- 't.###cout.com':443
- 'lh#.####leusercontent.com':443
UDP
- DNS ASK aj##.#oogleapis.com
- DNS ASK vi##obug.se
- DNS ASK go.##clasrv.com
- DNS ASK p.###cdn.com
- DNS ASK go#####analytics.com
- DNS ASK s1#.#istats.com
- DNS ASK wi####s.amung.us
- DNS ASK t.###cout.com
- DNS ASK fp######ad2.macromedia.com
- DNS ASK wh##.amung.us
- DNS ASK lh#.####leusercontent.com
- DNS ASK microsoft.com
- DNS ASK oc##.#ectigo.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
