Technical Information
Malicious functions:
Executes the following:
- <SYSTEM32>\wbem\wmiadap.exe /F /T
Modifies file system :
Creates the following files:
- C:\aim
- <Current directory>\mlang.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\c.aimbotcf[1]
- %WINDIR%\ads.exe
- %WINDIR%\ads2.exe
Network activity:
Connects to:
- 'c.###botcf.net':80
- 'localhost':1036
TCP:
HTTP GET requests:
- c.###botcf.net/
UDP:
- DNS ASK c.###botcf.net
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'Aimbot CF Download - Windows Internet Explorer'
- ClassName: '' WindowName: 'Aimbot CF Download - Mozilla Firefox'
- ClassName: '' WindowName: 'Aimbot CF Download - Google Chrome'
- ClassName: '' WindowName: 'Download Modz CF - dot kich: Kich hoat Aimbot moi phien ban | AdminGame.Net - Windows Internet Explorer'
- ClassName: '' WindowName: 'Download Modz CF - dot kich: Kich hoat Aimbot moi phien ban | AdminGame.Net - Mozilla Firefox'
- ClassName: '' WindowName: 'Aimbot CF Download - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'Aimbot CrossFire License - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'DinhGame aimbot successfully | DinhGame.Com - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'DinhGame aimbot successfully | DinhGame.Com - Windows Internet Explorer'
- ClassName: '' WindowName: 'DinhGame aimbot successfully | DinhGame.Com - Mozilla Firefox'
- ClassName: '' WindowName: 'Aimbot CrossFire License - Windows Internet Explorer'
- ClassName: '' WindowName: 'Aimbot CrossFire License - Mozilla Firefox'
- ClassName: '' WindowName: 'Aimbot CrossFire License - Google Chrome'
- ClassName: '' WindowName: 'Download Modz CF - dot kich: Kich hoat Aimbot moi phien ban | AdminGame.Net - Microsoft Internet Explorer'
- ClassName: '' WindowName: '[HACK CF] Kich hoat full chuc nang cho aimbot | CongDongGameVN.Com - Mozilla Firefox'
- ClassName: '' WindowName: 'Huong dan kich hoat aimbot full | Lanh Dia Cong Dong Game Online Viet Nam - LanhDiaGame.Com - Google Chrome'
- ClassName: '' WindowName: 'Huong dan kich hoat aimbot full | Lanh Dia Cong Dong Game Online Viet Nam - LanhDiaGame.Com - Microsoft Internet Explorer'
- ClassName: '' WindowName: '[HACK CF] Kich hoat full chuc nang cho aimbot | CongDongGameVN.Com - Google Chrome'
- ClassName: '' WindowName: '[HACK CF] Kich hoat full chuc nang cho aimbot | CongDongGameVN.Com - Microsoft Internet Explorer'
- ClassName: '' WindowName: '[HACK CF] Kich hoat full chuc nang cho aimbot | CongDongGameVN.Com - Windows Internet Explorer'
- ClassName: '' WindowName: 'Huong dan kich hoat aimbot full | Lanh Dia Cong Dong Game Online Viet Nam - LanhDiaGame.Com - Windows Internet Explorer'
- ClassName: '' WindowName: 'Kich hoat AimbotCF - AdminGame.Net - Mozilla Firefox'
- ClassName: '' WindowName: 'Kich hoat AimbotCF - AdminGame.Net - Google Chrome'
- ClassName: '' WindowName: 'Download Modz CF - dot kich: Kich hoat Aimbot moi phien ban | AdminGame.Net - Google Chrome'
- ClassName: '' WindowName: 'Huong dan kich hoat aimbot full | Lanh Dia Cong Dong Game Online Viet Nam - LanhDiaGame.Com - Mozilla Firefox'
- ClassName: '' WindowName: 'Kich hoat AimbotCF - AdminGame.Net - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'Kich hoat AimbotCF - AdminGame.Net - Windows Internet Explorer'
- ClassName: '' WindowName: 'DinhGame aimbot successfully | DinhGame.Com - Google Chrome'
- ClassName: '' WindowName: 'Download license is starting... | Fan CrossFire CF FPS Gaming - Windows Internet Explorer'
- ClassName: '' WindowName: 'Download license is starting... | Fan CrossFire CF FPS Gaming - Mozilla Firefox'
- ClassName: '' WindowName: 'Download license is starting... | Fan CrossFire CF FPS Gaming - Google Chrome'
- ClassName: '' WindowName: 'License for aimbot crossfire game - SieuNhanGame.Com - Mozilla Firefox'
- ClassName: '' WindowName: 'License for aimbot crossfire game - SieuNhanGame.Com - Google Chrome'
- ClassName: '' WindowName: 'Download license is starting... | Fan CrossFire CF FPS Gaming - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'Free Key for Aimbot Modz Download - FPS Modz Game | FPS Game - Online FPS Gameing - Microsoft Internet Explorer'
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'Free Key for Aimbot Modz Download - FPS Modz Game | FPS Game - Online FPS Gameing - Windows Internet Explorer'
- ClassName: '' WindowName: 'Free Key for Aimbot Modz Download - FPS Modz Game | FPS Game - Online FPS Gameing - Mozilla Firefox'
- ClassName: '' WindowName: 'Free Key for Aimbot Modz Download - FPS Modz Game | FPS Game - Online FPS Gameing - Google Chrome'
- ClassName: '' WindowName: 'License for aimbot crossfire game - SieuNhanGame.Com - Windows Internet Explorer'
- ClassName: '' WindowName: 'DinhGame license for Aimbot Crossfire | DinhGame.Com - Google Chrome'
- ClassName: '' WindowName: 'Download cf key aimbot successully | SieuChoiGame.Com - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'Download cf key aimbot successully | SieuChoiGame.Com - Windows Internet Explorer'
- ClassName: '' WindowName: 'DinhGame license for Aimbot Crossfire | DinhGame.Com - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'DinhGame license for Aimbot Crossfire | DinhGame.Com - Windows Internet Explorer'
- ClassName: '' WindowName: 'DinhGame license for Aimbot Crossfire | DinhGame.Com - Mozilla Firefox'
- ClassName: '' WindowName: 'Download cf key aimbot successully | SieuChoiGame.Com - Mozilla Firefox'
- ClassName: '' WindowName: 'CF Key Aimbot - Sieu choi Game | Sieu Auto Game - Sieu Hack Game - Mozilla Firefox'
- ClassName: '' WindowName: 'CF Key Aimbot - Sieu choi Game | Sieu Auto Game - Sieu Hack Game - Google Chrome'
- ClassName: '' WindowName: 'License for aimbot crossfire game - SieuNhanGame.Com - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'Download cf key aimbot successully | SieuChoiGame.Com - Google Chrome'
- ClassName: '' WindowName: 'CF Key Aimbot - Sieu choi Game | Sieu Auto Game - Sieu Hack Game - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'CF Key Aimbot - Sieu choi Game | Sieu Auto Game - Sieu Hack Game - Windows Internet Explorer'
