Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Power Mixer' = '"%ProgramFiles%\Power Mixer\pwmixer.exe" /m'
Изменения в файловой системе:
Создает следующие файлы:
- C:\ProgramData\PowerMixer\Powermixer.exe
- %ProgramFiles%\Power Mixer\Res\Tray Icon\Digits (Multicolor).bmp
- %ProgramFiles%\Power Mixer\Res\Tray Icon\Default.bmp
- %ProgramFiles%\Power Mixer\Res\Tray Icon\Default (Low Color).bmp
- %ProgramFiles%\Power Mixer\Res\Tray Icon\Default (Light Text).bmp
- %ProgramFiles%\Power Mixer\Res\Tray Icon\Chameleon.bmp
- %ProgramFiles%\Power Mixer\Res\Tray Icon\Chameleon (Light Text).bmp
- %ProgramFiles%\Power Mixer\Res\Tray Icon\Basic.bmp
- %ProgramFiles%\Power Mixer\Res\Sounds\osd.wav
- %ProgramFiles%\Power Mixer\Res\Tray Icon\LouderIT.bmp
- %ProgramFiles%\Power Mixer\Res\Tray Icon\Horizontal Bar.bmp
- %ProgramFiles%\Power Mixer\Lang\Swedish.lng
- %ProgramFiles%\Power Mixer\Lang\Spanish.lng
- %ProgramFiles%\Power Mixer\Lang\Serbian (Latin).lng
- %ProgramFiles%\Power Mixer\Lang\Serbian (Cyrillic).lng
- %ProgramFiles%\Power Mixer\Lang\Russian.lng
- %ProgramFiles%\Power Mixer\Lang\Romanian.lng
- %ProgramFiles%\Power Mixer\Lang\Portuguese (Brazil).lng
- %ProgramFiles%\Power Mixer\Lang\Polish.lng
- %ProgramFiles%\Power Mixer\Lang\Ukrainian.lng
- %ProgramFiles%\Power Mixer\srvman.cfg
- %ProgramFiles%\Power Mixer\Res\Tray Icon\Rainbow.bmp
- %TEMP%\nsk3.tmp\SetupCfg.dll
- %APPDATA%\Power Mixer\pwmixer.cfg
- %APPDATA%\Power Mixer\session.cfg
- %APPDATA%\Power Mixer\theme.cfg
- %APPDATA%\Power Mixer\desk.cfg
- %APPDATA%\Power Mixer\hotkey.cfg
- %APPDATA%\Power Mixer\schedule.cfg
- %APPDATA%\Power Mixer\preset.cfg
- %HOMEPATH%\Start Menu\Programs\Power Mixer\Uninstall Power Mixer.lnk
- %HOMEPATH%\Start Menu\Programs\Power Mixer\Online Registration.lnk
- %HOMEPATH%\Start Menu\Programs\Power Mixer\Home Page.lnk
- %HOMEPATH%\Start Menu\Programs\Power Mixer\Power Mixer Help.lnk
- %HOMEPATH%\Start Menu\Programs\Power Mixer\Mini Mixer.lnk
- %HOMEPATH%\Start Menu\Programs\Power Mixer\Power Mixer.lnk
- %HOMEPATH%\Start Menu\Programs\Power Mixer\Tools\Audio Taper Editor.lnk
- %ProgramFiles%\Power Mixer\Uninst.exe
- %TEMP%\nsk3.tmp\System.dll
- %ProgramFiles%\Power Mixer\Res\Tray Icon\Vertical Bar.bmp
- %ProgramFiles%\Power Mixer\Res\Tray Icon\Vertical Bar (Multicolor).bmp
- %ProgramFiles%\Power Mixer\Lang\Norwegian.lng
- %ProgramFiles%\Power Mixer\Lang\Turkish.lng
- %ProgramFiles%\Power Mixer\Lang\Magyar.lng
- %ProgramFiles%\Power Mixer\Lang\Korean.lng
- %ProgramFiles%\Power Mixer\Lang\Italian.lng
- %ProgramFiles%\Power Mixer\pwmixer.dat
- %ProgramFiles%\Power Mixer\srvman.dat
- %ProgramFiles%\Power Mixer\license.txt
- %ProgramFiles%\Power Mixer\help.chm
- %ProgramFiles%\Power Mixer\history.txt
- %ProgramFiles%\Power Mixer\readme.txt
- %ProgramFiles%\Power Mixer\wheel.dll
- %ProgramFiles%\Power Mixer\pwmixer.exe
- %TEMP%\nsk3.tmp\Service.dll
- %TEMP%\nsk3.tmp\UserInfo.dll
- %ProgramFiles%\Power Mixer\srvhelp.dat
- %TEMP%\nsk3.tmp\GetVersion.dll
- %TEMP%\nse2.tmp
- %TEMP%\5252681.tmp
- C:\ProgramData\ActualSoftware\logs.bat
- C:\ProgramData\ActualSoftware\cert.vbs
- C:\ProgramData\ActualSoftware\update.exe
- C:\ProgramData\PowerMixer\logs.exe
- C:\ProgramData\PowerMixer\report.vbs
- %ProgramFiles%\Power Mixer\Homepage.htm
- %ProgramFiles%\Power Mixer\Res\Tray Icon\readme.txt
- %ProgramFiles%\Power Mixer\srvhelp.exe
- %ProgramFiles%\Power Mixer\Tools\atedit.exe
- %ProgramFiles%\Power Mixer\srvman.exe
- %ProgramFiles%\Power Mixer\Lang\Hebrew.lng
- %ProgramFiles%\Power Mixer\Lang\Greek.lng
- %ProgramFiles%\Power Mixer\Lang\German.lng
- %ProgramFiles%\Power Mixer\Lang\French.lng
- %ProgramFiles%\Power Mixer\Lang\Finnish.lng
- %ProgramFiles%\Power Mixer\Lang\Estonian.lng
- %ProgramFiles%\Power Mixer\Lang\English.lng
- %ProgramFiles%\Power Mixer\Lang\Dutch.lng
- %ProgramFiles%\Power Mixer\Lang\Danish.lng
- %ProgramFiles%\Power Mixer\Lang\Czech.lng
- %ProgramFiles%\Power Mixer\Lang\Croatian.lng
- %ProgramFiles%\Power Mixer\Lang\Chinese (Traditional).lng
- %ProgramFiles%\Power Mixer\Lang\Chinese (Simplified).lng
- %ProgramFiles%\Power Mixer\Lang\Catalan.lng
- %ProgramFiles%\Power Mixer\Lang\Bulgarian.lng
- %ProgramFiles%\Power Mixer\Lang\Arabic.lng
- %ProgramFiles%\Power Mixer\Lang\Afrikaans.lng
- %ProgramFiles%\Power Mixer\Tools\Default.csv
- %ProgramFiles%\Power Mixer\Tools\atedit.dat
- %ProgramFiles%\Power Mixer\Register.htm
Удаляет следующие файлы:
- %ProgramFiles%\Power Mixer\pwmixer.dat
- %ProgramFiles%\Power Mixer\srvman.dat
- %ProgramFiles%\Power Mixer\srvhelp.dat
- %ProgramFiles%\Power Mixer\Tools\atedit.dat
Сетевая активность:
Подключается к:
- 'ip###ger.org':443
UDP:
- DNS ASK ip###ger.org
Другое:
Ищет следующие окна:
- ClassName: 'EDIT' WindowName: ''
- ClassName: '#32770' WindowName: 'Power Mixer'
- ClassName: '#32770' WindowName: 'Mini Mixer'
Создает и запускает на исполнение:
- '<SYSTEM32>\wscript.exe' "C:\ProgramData\PowerMixer\report.vbs"
- 'C:\ProgramData\PowerMixer\logs.exe'
- 'C:\ProgramData\PowerMixer\Powermixer.exe'
- '<SYSTEM32>\wscript.exe' "C:\ProgramData\ActualSoftware\cert.vbs"
- 'C:\ProgramData\ActualSoftware\update.exe' /S
- '%ProgramFiles%\Power Mixer\srvman.exe' -u
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c ""C:\ProgramData\ActualSoftware\logs.bat" "
