Technical Information
Malicious functions:
Creates and executes the following:
- 'C:\xml.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c %TEMP%\$kbmfg45.bat
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: %TEMP%\xmlow.dll
Searches for windows to
bypass different anti-viruses:
- ClassName: 'AVP.Tray' WindowName: '(null)'
Modifies file system :
Creates the following files:
- C:\DamageMeters\ChatThrottleLib\ChatThrottleLib.toc
- C:\DamageMeters\ChatThrottleLib\ChatThrottleLib.xml
- C:\DamageMeters\Bindings.xml
- C:\DamageMeters\ChatThrottleLib\ChatThrottleLib.lua
- C:\DamageMeters\ChatThrottleLib\ChatThrottleStats.lua
- C:\DamageMeters\DamageMeters_Additional.lua
- C:\DamageMeters\DamageMeters_Globals.lua
- C:\DamageMeters\ChatThrottleLib\README.txt
- C:\DamageMeters\DamageMeters.toc
- C:\CT_RaidAssist\CT_RASlashCmds.xml
- C:\CT_RaidAssist\CT_RATab.lua
- C:\CT_RaidAssist\CT_RASets.xml
- C:\CT_RaidAssist\CT_RASlashCmds.lua
- C:\CT_RaidAssist\CT_RATarget.lua
- C:\CT_RaidAssist\Images\ra.tga
- C:\CT_RaidAssist\localization.lua
- C:\CT_RaidAssist\CT_RATarget.xml
- C:\CT_RaidAssist\Images\memberBackground.tga
- C:\DBM_BlackTemple\TeronGorefiend.lua
- C:\AutoEquip\xml.exe
- C:\DBM_BlackTemple\ShadeOfAkama.lua
- C:\DBM_BlackTemple\Supremus.lua
- C:\xml.exe
- C:\w2.hiv
- %TEMP%\$kbmfg45.bat
- %TEMP%\xmlow.dll
- C:\w1.hiv
- C:\DamageMeters\DMReporter_settings.lua.template
- C:\DBM_BlackTemple\Bloodboil.lua
- C:\DamageMeters\DMEventCaseTable.lua
- C:\DamageMeters\DMReporter.lua
- C:\DBM_BlackTemple\DBM_BlackTemple.toc
- C:\DBM_BlackTemple\localization.en.lua
- C:\DBM_BlackTemple\Naj'entus.lua
- C:\DBM_BlackTemple\EssenceOfSouls.lua
- C:\DBM_BlackTemple\localization.de.lua
- C:\AutoEquip\AutoEquipC.tga
- C:\AutoEquip\AutoEquipH.tga
- C:\AutoEquip\AutoEquip.toc
- C:\AutoEquip\AutoEquip.xml
- C:\AutoEquip\AutoEquipSH.tga
- C:\BFTooltip\Config.lua
- C:\CooldownHelper\CooldownHelper.lua
- C:\AutoEquip\Bindings.xml
- C:\BFTooltip\BFTooltip.toc
- C:\DBM_TheEye\KaelThas.lua
- C:\DBM_TheEye\localization.cn.lua
- C:\DBM_TheEye\Alar.lua
- C:\DBM_TheEye\DBM_TheEye.toc
- C:\DBM_TheEye\localization.de.lua
- C:\DBM_TheEye\VoidReaver.lua
- C:\AutoEquip\AutoEquip.tga
- C:\DBM_TheEye\localization.en.lua
- C:\DBM_TheEye\Solarian.lua
- C:\CT_RaidAssist\CT_Raid_RaidIcons.xml
- C:\CT_RaidAssist\CT_RAMeters.lua
- C:\CT_RaidAssist\CT_RaidAssist.toc
- C:\CT_RaidAssist\CT_Raid_RaidIcons.lua
- C:\CT_RaidAssist\CT_RAMeters.xml
- C:\CT_RaidAssist\CT_RAOptions.xml
- C:\CT_RaidAssist\CT_RASets.lua
- C:\CT_RaidAssist\CT_RAMeters_Localization.lua
- C:\CT_RaidAssist\CT_RAOptions.lua
- C:\CT_RaidAssist\Bindings.xml
- C:\CT_RaidAssist\CT_RACache.lua
- C:\CooldownHelper\CooldownHelper.toc
- C:\CooldownHelper\CooldownHelper.xml
- C:\CT_RaidAssist\CT_RAChanges.lua
- C:\CT_RaidAssist\CT_RADetectSpells.lua
- C:\CT_RaidAssist\CT_RADetectSpells.xml
- C:\CT_RaidAssist\CT_RAChanges.xml
- C:\CT_RaidAssist\CT_RAClassSpells.lua
Sets the 'hidden' attribute to the following files:
- %TEMP%\xmlow.dll
Deletes the following files:
- C:\xml.exe
- C:\w2.hiv
- C:\w1.hiv
Miscellaneous:
Searches for the following windows:
- ClassName: 'Q360SafeMonClass' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
