Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\澳门在线轮盘\RotGame.exe'
Запускает на исполнение:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\澳门在线轮盘\firwork.wav
- %PROGRAM_FILES%\澳门在线轮盘\help.jpg
- %PROGRAM_FILES%\澳门在线轮盘\HistoryNumber.bmp
- %PROGRAM_FILES%\澳门在线轮盘\Even.wav
- %PROGRAM_FILES%\澳门在线轮盘\down.jpg
- %PROGRAM_FILES%\澳门在线轮盘\Downbet.bmp
- %PROGRAM_FILES%\澳门在线轮盘\edge.JPG
- %PROGRAM_FILES%\澳门在线轮盘\info.cfg
- %PROGRAM_FILES%\澳门在线轮盘\num32x48.bmp
- %PROGRAM_FILES%\澳门在线轮盘\num36x46.bmp
- %PROGRAM_FILES%\澳门在线轮盘\Odd.wav
- %PROGRAM_FILES%\澳门在线轮盘\num12x20x3.bmp
- %PROGRAM_FILES%\澳门在线轮盘\metal.bmp
- %PROGRAM_FILES%\澳门在线轮盘\midi.wav
- %PROGRAM_FILES%\澳门在线轮盘\Music1.mid
- %PROGRAM_FILES%\澳门在线轮盘\coin1000.x
- %PROGRAM_FILES%\澳门在线轮盘\coin2000.bmp
- %PROGRAM_FILES%\澳门在线轮盘\coin2000.x
- %PROGRAM_FILES%\澳门在线轮盘\coin1000.bmp
- %PROGRAM_FILES%\澳门在线轮盘\coin200.x
- %PROGRAM_FILES%\澳门在线轮盘\coin500.bmp
- %PROGRAM_FILES%\澳门在线轮盘\coin500.x
- %PROGRAM_FILES%\澳门在线轮盘\coin5000.bmp
- %PROGRAM_FILES%\澳门在线轮盘\desknum.x
- %PROGRAM_FILES%\澳门在线轮盘\desktop.jpg
- %PROGRAM_FILES%\澳门在线轮盘\down.bmp
- %PROGRAM_FILES%\澳门在线轮盘\DeskNum.jpg
- %PROGRAM_FILES%\澳门在线轮盘\coin5000.x
- %PROGRAM_FILES%\澳门在线轮盘\coins.bmp
- %PROGRAM_FILES%\澳门在线轮盘\Demo.bmp
- %PROGRAM_FILES%\澳门在线轮盘\TAB-EDGE.jpg
- %PROGRAM_FILES%\澳门在线轮盘\TableNo.cfg
- %PROGRAM_FILES%\澳门在线轮盘\TimeBar.bmp
- %PROGRAM_FILES%\澳门在线轮盘\StopPush.wav
- %PROGRAM_FILES%\澳门在线轮盘\SelectCoin.bmp
- %PROGRAM_FILES%\澳门在线轮盘\star.x
- %PROGRAM_FILES%\澳门在线轮盘\startpush.wav
- %PROGRAM_FILES%\澳门在线轮盘\titleball.x
- %PROGRAM_FILES%\澳门在线轮盘\04.wav
- %PROGRAM_FILES%\澳门在线轮盘\05.wav
- %HOMEPATH%\Desktop\澳门在线轮盘.lnk
- %PROGRAM_FILES%\澳门在线轮盘\03.wav
- %PROGRAM_FILES%\澳门在线轮盘\00.wav
- %PROGRAM_FILES%\澳门在线轮盘\01.wav
- %PROGRAM_FILES%\澳门在线轮盘\02.wav
- %PROGRAM_FILES%\澳门在线轮盘\Poo.wav
- %PROGRAM_FILES%\澳门在线轮盘\Push.wav
- %PROGRAM_FILES%\澳门在线轮盘\raise.cfg
- %PROGRAM_FILES%\澳门在线轮盘\Po.wav
- %PROGRAM_FILES%\澳门在线轮盘\online.cfg
- %PROGRAM_FILES%\澳门在线轮盘\Particle.bmp
- %PROGRAM_FILES%\澳门在线轮盘\PlayWin.wav
- %PROGRAM_FILES%\澳门在线轮盘\Red.wav
- %PROGRAM_FILES%\澳门在线轮盘\RotGame.exe
- %PROGRAM_FILES%\澳门在线轮盘\round512.jpg
- %PROGRAM_FILES%\澳门在线轮盘\SelCoin.wav
- %PROGRAM_FILES%\澳门在线轮盘\RotDllf.dll
- %PROGRAM_FILES%\澳门在线轮盘\roll.wav
- %PROGRAM_FILES%\澳门在线轮盘\Rot.cfg
- %PROGRAM_FILES%\澳门在线轮盘\RotDef.cfg
- %PROGRAM_FILES%\澳门在线轮盘\25.wav
- %PROGRAM_FILES%\澳门在线轮盘\26.wav
- %PROGRAM_FILES%\澳门在线轮盘\27.wav
- %PROGRAM_FILES%\澳门在线轮盘\24.wav
- %PROGRAM_FILES%\澳门在线轮盘\21.wav
- %PROGRAM_FILES%\澳门在线轮盘\22.wav
- %PROGRAM_FILES%\澳门在线轮盘\23.wav
- %PROGRAM_FILES%\澳门在线轮盘\28.wav
- %PROGRAM_FILES%\澳门在线轮盘\33.wav
- %PROGRAM_FILES%\澳门在线轮盘\34.wav
- %PROGRAM_FILES%\澳门在线轮盘\35.wav
- %PROGRAM_FILES%\澳门在线轮盘\32.wav
- %PROGRAM_FILES%\澳门在线轮盘\29.wav
- %PROGRAM_FILES%\澳门在线轮盘\30.wav
- %PROGRAM_FILES%\澳门在线轮盘\31.wav
- %PROGRAM_FILES%\澳门在线轮盘\10.wav
- %PROGRAM_FILES%\澳门在线轮盘\11.wav
- %PROGRAM_FILES%\澳门在线轮盘\12.wav
- %PROGRAM_FILES%\澳门在线轮盘\09.wav
- %PROGRAM_FILES%\澳门在线轮盘\06.wav
- %PROGRAM_FILES%\澳门在线轮盘\07.wav
- %PROGRAM_FILES%\澳门在线轮盘\08.wav
- %PROGRAM_FILES%\澳门在线轮盘\13.wav
- %PROGRAM_FILES%\澳门在线轮盘\18.wav
- %PROGRAM_FILES%\澳门在线轮盘\19.wav
- %PROGRAM_FILES%\澳门在线轮盘\20.wav
- %PROGRAM_FILES%\澳门在线轮盘\17.wav
- %PROGRAM_FILES%\澳门在线轮盘\14.wav
- %PROGRAM_FILES%\澳门在线轮盘\15.wav
- %PROGRAM_FILES%\澳门在线轮盘\16.wav
- %PROGRAM_FILES%\澳门在线轮盘\coin20t.bmp
- %PROGRAM_FILES%\澳门在线轮盘\coin20t.x
- %PROGRAM_FILES%\澳门在线轮盘\coin50.bmp
- %PROGRAM_FILES%\澳门在线轮盘\coin20.x
- %PROGRAM_FILES%\澳门在线轮盘\coin10t.bmp
- %PROGRAM_FILES%\澳门在线轮盘\coin10t.x
- %PROGRAM_FILES%\澳门在线轮盘\coin20.bmp
- %PROGRAM_FILES%\澳门在线轮盘\coin50.x
- %PROGRAM_FILES%\澳门在线轮盘\coin100t.bmp
- %PROGRAM_FILES%\澳门在线轮盘\coin100t.x
- %PROGRAM_FILES%\澳门在线轮盘\coin200.bmp
- %PROGRAM_FILES%\澳门在线轮盘\coin100.x
- %PROGRAM_FILES%\澳门在线轮盘\coin50t.bmp
- %PROGRAM_FILES%\澳门在线轮盘\coin50t.x
- %PROGRAM_FILES%\澳门在线轮盘\coin100.bmp
- %PROGRAM_FILES%\澳门在线轮盘\Button.bmp
- %PROGRAM_FILES%\澳门在线轮盘\Cancel.wav
- %PROGRAM_FILES%\澳门在线轮盘\clock.wav
- %PROGRAM_FILES%\澳门在线轮盘\Black.wav
- %PROGRAM_FILES%\澳门在线轮盘\36.wav
- %PROGRAM_FILES%\澳门在线轮盘\all.x
- %PROGRAM_FILES%\澳门在线轮盘\bingo.x
- %PROGRAM_FILES%\澳门在线轮盘\coin1.bmp
- %PROGRAM_FILES%\澳门在线轮盘\coin5.x
- %PROGRAM_FILES%\澳门在线轮盘\coin10.bmp
- %PROGRAM_FILES%\澳门在线轮盘\coin10.x
- %PROGRAM_FILES%\澳门在线轮盘\coin5.bmp
- %PROGRAM_FILES%\澳门在线轮盘\coin1.x
- %PROGRAM_FILES%\澳门在线轮盘\coin2.bmp
- %PROGRAM_FILES%\澳门在线轮盘\coin2.x
Другое:
Ищет следующие окна:
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
