Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обнаружения утилит для анализа:
- ClassName: 'Filemonclass', WindowName: ''
- ClassName: 'Regmonclass', WindowName: ''
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\oy_轮盘\3d_sound\16.wav
- %ProgramFiles%\oy_轮盘\3d_sound\15.wav
- %ProgramFiles%\oy_轮盘\3d_sound\18.wav
- %ProgramFiles%\oy_轮盘\3d_sound\17.wav
- %ProgramFiles%\oy_轮盘\3d_sound\12.wav
- %ProgramFiles%\oy_轮盘\3d_sound\11.wav
- %ProgramFiles%\oy_轮盘\3d_sound\14.wav
- %ProgramFiles%\oy_轮盘\3d_sound\13.wav
- %ProgramFiles%\oy_轮盘\3d_sound\24.wav
- %ProgramFiles%\oy_轮盘\3d_sound\23.wav
- %ProgramFiles%\oy_轮盘\3d_sound\26.wav
- %ProgramFiles%\oy_轮盘\3d_sound\25.wav
- %ProgramFiles%\oy_轮盘\3d_sound\20.wav
- %ProgramFiles%\oy_轮盘\3d_sound\19.wav
- %ProgramFiles%\oy_轮盘\3d_sound\22.wav
- %ProgramFiles%\oy_轮盘\3d_sound\21.wav
- %ProgramFiles%\oy_轮盘\3d_sound\10.wav
- %ProgramFiles%\oy_轮盘\3d_Graphic\titleball.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\TimeBar.bmp
- %ProgramFiles%\oy_轮盘\3d_sound\01.wav
- %ProgramFiles%\oy_轮盘\3d_sound\00.wav
- %ProgramFiles%\oy_轮盘\3d_Graphic\star.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\SelectCoin.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\Thumbs.db
- %ProgramFiles%\oy_轮盘\3d_Graphic\TAB-EDGE.JPG
- %ProgramFiles%\oy_轮盘\3d_sound\07.wav
- %ProgramFiles%\oy_轮盘\3d_sound\06.wav
- %ProgramFiles%\oy_轮盘\3d_sound\09.wav
- %ProgramFiles%\oy_轮盘\3d_sound\08.wav
- %ProgramFiles%\oy_轮盘\3d_sound\03.wav
- %ProgramFiles%\oy_轮盘\3d_sound\02.wav
- %ProgramFiles%\oy_轮盘\3d_sound\05.wav
- %ProgramFiles%\oy_轮盘\3d_sound\04.wav
- %ProgramFiles%\oy_轮盘\3d_sound\27.wav
- %ProgramFiles%\oy_轮盘\3d_sound\Red.wav
- %ProgramFiles%\oy_轮盘\3d_sound\Push.wav
- %ProgramFiles%\oy_轮盘\3d_sound\SelCoin.wav
- %ProgramFiles%\oy_轮盘\3d_sound\Roll.wav
- %ProgramFiles%\oy_轮盘\3d_sound\PlayWin.wav
- %ProgramFiles%\oy_轮盘\3d_sound\Odd.wav
- %ProgramFiles%\oy_轮盘\3d_sound\Poo.wav
- %ProgramFiles%\oy_轮盘\3d_sound\Po.wav
- %ProgramFiles%\oy_轮盘\RotDll.dll
- %ProgramFiles%\oy_轮盘\login.ini
- %HOMEPATH%\Desktop\轮盘.lnk
- %ProgramFiles%\oy_轮盘\RotGame.exe
- %ProgramFiles%\oy_轮盘\3d_sound\Stoppush.wav
- %ProgramFiles%\oy_轮盘\3d_sound\startpush.wav
- %ProgramFiles%\oy_轮盘\ip.Dat
- %ProgramFiles%\oy_轮盘\3d_sound\town.mid
- %ProgramFiles%\oy_轮盘\3d_sound\Music1.mid
- %ProgramFiles%\oy_轮盘\3d_sound\33.wav
- %ProgramFiles%\oy_轮盘\3d_sound\32.wav
- %ProgramFiles%\oy_轮盘\3d_sound\35.wav
- %ProgramFiles%\oy_轮盘\3d_sound\34.wav
- %ProgramFiles%\oy_轮盘\3d_sound\29.wav
- %ProgramFiles%\oy_轮盘\3d_sound\28.wav
- %ProgramFiles%\oy_轮盘\3d_sound\31.wav
- %ProgramFiles%\oy_轮盘\3d_sound\30.wav
- %ProgramFiles%\oy_轮盘\3d_sound\Even.wav
- %ProgramFiles%\oy_轮盘\3d_sound\Clock.wav
- %ProgramFiles%\oy_轮盘\3d_sound\midi.wav
- %ProgramFiles%\oy_轮盘\3d_sound\Firwork.wav
- %ProgramFiles%\oy_轮盘\3d_sound\BkSound.mid
- %ProgramFiles%\oy_轮盘\3d_sound\36.wav
- %ProgramFiles%\oy_轮盘\3d_sound\Cancel.wav
- %ProgramFiles%\oy_轮盘\3d_sound\Black.wav
- %ProgramFiles%\oy_轮盘\3d_Graphic\score.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin20.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin20.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin200.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin200.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin10t.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin10t.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin2.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin2.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin5.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin5.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin50.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin50.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin2000.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin2000.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin20t.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin20t.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin100t.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\Button03.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\Button02.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin1.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\Button04.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\ball.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\all.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\Button01.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\bingo.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin1000.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin100.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin100t.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin1000.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin10.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin1.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin100.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin10.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin500.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\edge.JPG
- %ProgramFiles%\oy_轮盘\3d_Graphic\downscore.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\help.jpg
- %ProgramFiles%\oy_轮盘\3d_Graphic\font.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\down.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\desktop.jpg
- %ProgramFiles%\oy_轮盘\3d_Graphic\Downbet.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\down.jpg
- %ProgramFiles%\oy_轮盘\3d_Graphic\Particle.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\num36x46.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\round512.jpg
- %ProgramFiles%\oy_轮盘\3d_Graphic\rect.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\metal.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\HistoryNumber.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\num32x48.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\num12x20x3.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\desknum.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\coins.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin50t.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\CoinTitle2.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\CoinTitle.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin5000.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin500.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin50t.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\coin5000.x
- %ProgramFiles%\oy_轮盘\3d_Graphic\Demo.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\d4.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\DeskNum.jpg
- %ProgramFiles%\oy_轮盘\3d_Graphic\DeskNum.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\d1.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\config.ini
- %ProgramFiles%\oy_轮盘\3d_Graphic\d3.bmp
- %ProgramFiles%\oy_轮盘\3d_Graphic\d2.bmp
Присваивает атрибут 'скрытый' для следующих файлов:
- %ProgramFiles%\oy_轮盘\3d_Graphic\Thumbs.db
Другое:
Ищет следующие окна:
- ClassName: '18467-41' WindowName: ''
- ClassName: '4823-00000029' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
Создает и запускает на исполнение:
- '%ProgramFiles%\oy_轮盘\RotGame.exe'
