Technical Information
Modifies file system
Creates the following files
- %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#yandex.st\settings.sxx
- %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sxx
- %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\yandex.st\swf\videoplayer\13_102\videoplayer.swf\yalogger.sxx
- %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\yandex.st\swf\videoplayer\13_102\videoplayer.swf\videoplayer.sxx
Deletes the following files
- %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#yandex.st\settings.sol
Moves the following files
- from %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#yandex.st\settings.sxx to %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#yandex.st\settings.sol
- from %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\yandex.st\swf\videoplayer\13_102\videoplayer.swf\yalogger.sxx to %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\yandex.st\swf\videoplayer\13_102\videoplayer.swf\yalogger.sol
- from %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\yandex.st\swf\videoplayer\13_102\videoplayer.swf\videoplayer.sxx to %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\yandex.st\swf\videoplayer\13_102\videoplayer.swf\videoplayer.sol
Substitutes the following files
- %APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
- %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#yandex.st\settings.sxx
- %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#yandex.st\settings.sol
Network activity
Connects to
- 'co####r.yadro.ru':80
- 'clck.yandex.ru':445
- 'tn###ounter.ru':80
- 'co####r.24log.ru':443
- 'c.###mir.net':80
- 'co####r.24log.ru':80
- 'dm#.###italtarget.ru':443
- 'hi###.hotlog.ru':80
- 'go##ats.ru':80
- 'op###tat.net':80
- 'fp######ad2.macromedia.com':80
- 'ya##ex.st':80
- 'ki###oisk.ru':443
- 'static.video.yandex.ru':80
- 'ki###oisk.ru':80
- 'to######mages.rambler.ru':80
- 'kr####.rambler.ru':443
- 'st####.rapidssl.com':80
- 'co####r.rambler.ru':443
- 'co####r.rambler.ru':80
- 'microsoft.com':80
- 'co####r.yadro.ru':443
- 's3#.#coz.net':443
- 's3#.#coz.net':80
- 'tn###ounter.ru':443
- 'st####.video.yandex.net':80
TCP
HTTP GET requests
- http://fi####inema.ucoz.ru/_st/my.css
- http://st####.video.yandex.net/get/zalito1/8bz7xm4qg4.2004/0h.xml?nc####################
- http://co####r.24log.ru/counter?id############################################################################################
- http://co####r.24log.ru/buttons/24/bg24-7_2.gif
- http://co####r.24log.ru/buttons/24/bg24-7_1.gif
- http://ya##ex.st/swf/videoplayer/13_102/videoplayer.swf?ve############
- http://s3#.#coz.net/.s/img/icon/social/ya.svg
- http://hi###.hotlog.ru/cgi-bin/hotlog/count?0.####################################################################################################################
- http://s3#.#coz.net/.s/img/icon/social/tw.svg
- http://s3#.#coz.net/.s/img/icon/social/gp.svg
- http://s3#.#coz.net/.s/img/icon/social/fb.svg
- http://s3#.#coz.net/.s/img/icon/social/ok.svg
- http://s3#.#coz.net/.s/img/icon/social/vk.svg
- http://fi####inema.ucoz.ru/tags/swfobject.js
- http://op###tat.net/cnt?ci#######################################################################################################################################################################...
- http://fi####inema.ucoz.ru/secure/?k=##################################################
- http://fi####inema.ucoz.ru/flvplayer.swf
- http://fi####inema.ucoz.ru/rtr/1-1
- http://fi####inema.ucoz.ru/logo/new.gif
- http://s3#.#coz.net/src/social.css
- http://s3#.#coz.net/cgi/uutils.fcg?a=######################################
- http://s3#.#coz.net/src/socCom.js
- http://s3#.#coz.net/src/socCom.css
- http://s3#.#coz.net/src/uwnd.js?2
- http://s3#.#coz.net/src/ulightbox/ulightbox.css
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://s3#.#coz.net/src/jquery-1.7.2.js
- http://s3#.#coz.net/src/layer1.css
- http://co####r.yadro.ru/hit;ucoznet?r;##################################################################
- http://s3#.#coz.net/.s/img/fr/g.gif
- http://st####.video.yandex.net/get/zalito1/8bz7xm4qg4.2004/0h.xml?nc###################
UDP
- DNS ASK fi####inema.ucoz.ru
- DNS ASK clck.yandex.ru
- DNS ASK tn###ounter.ru
- DNS ASK mo##s.com
- DNS ASK jo#####s.okoshechka.net
- DNS ASK co####r.24log.ru
- DNS ASK c.###mir.net
- DNS ASK dm#.###italtarget.ru
- DNS ASK c4.##stats.ru
- DNS ASK hi###.hotlog.ru
- DNS ASK go##ats.ru
- DNS ASK p7####.adskape.ru
- DNS ASK op###tat.net
- DNS ASK ya##ex.st
- DNS ASK static.video.yandex.ru
- DNS ASK ki###oisk.ru
- DNS ASK to######mages.rambler.ru
- DNS ASK kr####.rambler.ru
- DNS ASK st####.rapidssl.com
- DNS ASK co####r.rambler.ru
- DNS ASK microsoft.com
- DNS ASK co####r.yadro.ru
- DNS ASK s3#.#coz.net
- DNS ASK fp######ad2.macromedia.com
- DNS ASK st####.video.yandex.net
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
