Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '%WINDIR%\svchost.exe'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
Создает и запускает на исполнение:
- %TEMP%\svchost.exe
- %WINDIR%\svchost.exe
- %PROGRAM_FILES%\Company\LMPK-13-3\Plugin-Setup.exe
- %TEMP%\svchost.exe (загружен из сети Интернет)
Запускает на исполнение:
- <SYSTEM32>\netsh.exe firewall set opmode Disable
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\CollectItem.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\BuffHoTro.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\confirm.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\GetIdNpc.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\GetIDItemInBag.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\autotreasure.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ThuTrangBi\previewmgr.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ThuTrangBi\preview.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\activeaward.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\autopath.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\auctionroom.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\playerpray.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\nomessage.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\skilltree.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\skillprogress.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\namext.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\guttalk.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\gutmodel.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\healthy.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\mgr.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\helpsprite.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ThuTrangBi\preview.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TeamControl\TeamControl.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TeamControl\SprNN.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TeamControl\TeamControl.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TheoSauHoTong\follow.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TeamControl\vCTTK.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TeamControl\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TeamControl\AutoMau.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TeamControl\AutoLakTDLT.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TeamControl\AutoMaXuyenSon.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TeamControl\member.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TeamControl\AutoMongTay.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ThuongHoi\MuaVatPhamDauGia.txt
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ThuongHoi\AutoMerchant.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ThuongHoi\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ThuTrangBi\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ThuTrangBi\base.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ThuCuongHoa\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TheoSauHoTong\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TheoSauHoTong\main.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TheoSauHoTong\selecttnpc.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ThuCuongHoa\enhanceitem_setting.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ThuCuongHoa\enhanceitem.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\setting\talk\hanhua3.txt
- %PROGRAM_FILES%\Company\LMPK-13-3\setting\talk\hanhua2.txt
- %PROGRAM_FILES%\Company\LMPK-13-3\setting\talk\hanhua4.txt
- %PROGRAM_FILES%\Company\LMPK-13-3\setting\talk\reply.txt
- %PROGRAM_FILES%\Company\LMPK-13-3\setting\talk\hanhua5.txt
- %PROGRAM_FILES%\Company\LMPK-13-3\setting\talk\hanhua1.txt
- %PROGRAM_FILES%\Company\LMPK-13-3\setting\item\001\other\xuanjing_lv4.spr
- %PROGRAM_FILES%\Company\LMPK-13-3\setting\item\001\other\xuanjing_002_s.spr
- %PROGRAM_FILES%\Company\LMPK-13-3\setting\map\worldmap.txt
- %PROGRAM_FILES%\Company\LMPK-13-3\setting\talk\hanhua.txt
- %PROGRAM_FILES%\Company\LMPK-13-3\setting\misc\daytip.ini
- %TEMP%\aut2.tmp
- <SYSTEM32>\autoexec1.bat
- <SYSTEM32>\config1.sys
- %TEMP%\svchost.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\svchost[1].a3x
- %TEMP%\aut1.tmp
- %PROGRAM_FILES%\Company\LMPK-13-3\ui\002a\wndconfig.ini
- %WINDIR%\svchost.exe
- %PROGRAM_FILES%\Company\LMPK-13-3\ui\002b\wndconfig.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\Uninstall.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\Uninstall.exe
- %PROGRAM_FILES%\Company\LMPK-13-3\setting\item\001\other\version.cfg
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ToDoiNangCao\teamportrait.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ToDoiNangCao\teamportrait.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ToDoiNangCao\team_modify.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ToolTuDong\autosupport.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ToolTuDong\aliasdefine.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ToDoiNangCao\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\tools.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\TheTL.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\tools.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\worldmap.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\trade.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\XemSkill\viewfightskill.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\XemSkill\viewfightskill.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\Plugin-Setup.exe
- %PROGRAM_FILES%\Company\LMPK-13-3\setting\item\001\other\scriptitem.txt
- %PROGRAM_FILES%\Company\LMPK-13-3\setting\chat\chataction.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\XemSkill\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ToolTuDong\Nang_Dong.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ToolTuDong\autosupport.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ToolTuDong\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ToolTuDong\UiCallback.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ToolTuDong\ScriptLoad.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TaiPhuDanhVong\viewwealthvalue.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\Compose\Compose.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\Compose\compose.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\Compose\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\Detector\enemy.wav
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\Detector\Detector.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ChiTietVatPham\zhenyuan.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ChiTietVatPham\itemequip.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ChiTietVatPham\itemenhance.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ChiTietVatPham\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ChiTietVatPham\zhanhunbag.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ChiTietVatPham\zhanhunbag.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\HeThong\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\HeThong\jinghuofuliex.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\HeThong\tasktips.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\HoiSinhDongKhoa\renascencepanel.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\HoiSinhDongKhoa\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\HeThong\cover.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\Detector\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\Detector\jingying.wav
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\Event_tool\HoaRuou.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\HeThong\buffbar.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\Event_tool\pluginCfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ChiTietVatPham\itemdetail.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\AutoHP_MP\image\life_green.spr
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\AutoHP_MP\fightsprite.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\AutoHP_MP\image\life_red.spr
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\AutoHP_MP\image\mana.spr
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\AutoHP_MP\image\life_yellow.spr
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\AutoHP_MP\fightsprite.ini
- %TEMP%\$inst\4.tmp
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\5.tmp
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\AutoHP_MP\autoMedicine.lua
- %TEMP%\$inst\temp_0.tmp
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\CauCa\diaoyu1.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\CauCa\diaoyu.txt
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\CauCa\diaoyu1.txt
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ChiTietVatPham\itemcompare.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\CauCa\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\CauCa\diaoyu.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\AutoHP_MP\pluginCfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\AutoHP_MP\peresplus_setting.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\CauCa\AutoJiaoYu.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\CauCa\diaoyu.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\CauCa\CauCa.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\RuongNangCao\ThrowAway..lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\RuongNangCao\repository.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\sprBao\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\sprBao\SprBao_setting.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\sprBao\Remote.dll
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\RuongNangCao\repository.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\RuongNangCao\OrderBag.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\RuongNangCao\itembox.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\RuongNangCao\OrderBag_Compare.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\RuongNangCao\PluginCfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\RuongNangCao\OrderBag_Logic.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TaiPhuDanhVong\playerpanel.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TaiPhuDanhVong\playerhonor_wealth.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TaiPhuDanhVong\playerpanel.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TaiPhuDanhVong\viewwealthvalue.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TaiPhuDanhVong\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\supermaplink\supermaplink.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\supermaplink\maplink_ui.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\sprBao\SprBao_setting.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\supermaplink\maplink_ui.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\supermaplink\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\supermaplink\myui.dll
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\RuongNangCao\itembox.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\QuanDoanh\AutoQuanDoanh.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\QuanDoanh\AutoChiLing.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\QuanDoanh\AutoQuanDoanh.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\QuanDoanh\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\QuanDoanh\Input0.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\MiniClock\sidesysbar.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\interfacemanagercfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\HoiSinhDongKhoa\renascencepanel.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\MiniClock\miniclock.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\MiniClock\plugincfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\MiniClock\miniclock.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\RaoTraLoi\AutoSay.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\QuanDoanh\VuotRao.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\RaoTraLoi\AutoSay.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\RaoTraLoi\ReplyData.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\RaoTraLoi\PluginCfg.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\QuanDoanh\tool.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\QuanDoanh\Supercall.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\QuanDoanh\RungGai.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\QuanDoanh\Thuthapgo.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\QuanDoanh\tool.ini
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\QuanDoanh\Thuthapthaoduoc.lua
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\svchost.exe
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\ToolTuDong\aliasdefine.lua
- %PROGRAM_FILES%\Company\LMPK-13-3\interface2\TienIch\mgr.lua
Удаляет следующие файлы:
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\svchost[1].a3x
- %TEMP%\$inst\5.tmp
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\4.tmp
Сетевая активность:
Подключается к:
- 'au####meviet.com':80
TCP:
Запросы HTTP GET:
- au####meviet.com/files/svchost.a3x
UDP:
- DNS ASK au####meviet.com
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'GINA Logon'
- ClassName: 'Shell_TrayWnd' WindowName: ''
