Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\n64mkart\Project64.exe' super.z64
- '%TEMP%\n64mkart\Game.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\n64mkart\Launch.bat" "
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %TEMP%\n64mkart\Save\AIR BOARDER 64.eep
- %TEMP%\n64mkart\Save\Banjo-Kazooie.eep
- %TEMP%\n64mkart\Save\AERO FIGHTERS ASSAUL.eep
- %TEMP%\n64mkart\Save\AERO FIGHTERS ASSAUL.mpk
- %TEMP%\n64mkart\Save\Banjo-Kazooie.mpk
- %TEMP%\n64mkart\d3dx9_26.dll
- %TEMP%\n64mkart\evoodoo.cpl
- %TEMP%\n64mkart\Save\SMASH BROTHERS.sra
- %TEMP%\n64mkart\d3d syslog.txt
- %TEMP%\n64mkart\Plugin\RSP\RSP.dll
- %TEMP%\n64mkart\Plugin\GFX\RiceVideoDevelopment.dll
- %TEMP%\n64mkart\Plugin\GFX\RiceVideoStable.dll
- %TEMP%\n64mkart\Plugin\GFX\LemD3D8.dll
- %TEMP%\n64mkart\Plugin\GFX\RiceVideo6.1.0.ini
- %TEMP%\n64mkart\Plugin\Input\Adaptoid_v1_0.dll
- %TEMP%\n64mkart\Plugin\Input\NRage.ini
- %TEMP%\n64mkart\Plugin\RSP\RSP 1.7.dll
- %TEMP%\n64mkart\Plugin\Input\Jabo_DInput.dll
- %TEMP%\n64mkart\Plugin\Input\NRage DInput8 V2.2.dll
- %TEMP%\n64mkart\Project64.rdx
- %TEMP%\n64mkart\Project64.sc2
- %TEMP%\n64mkart\Project64.exe
- %TEMP%\n64mkart\Project64.rdb
- %TEMP%\n64mkart\Super.z64
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\searchplugins\google.xml
- <SYSTEM32>\d3dx9_26.dll
- %TEMP%\n64mkart\zlib1.dll
- <SYSTEM32>\d3d8caps.dat
- %TEMP%\n64mkart\Project64.cht
- %TEMP%\n64mkart\msvcr70.dll
- %TEMP%\n64mkart\pif2.dat
- %TEMP%\n64mkart\glide3x.dll
- %TEMP%\n64mkart\Launch.bat
- %TEMP%\n64mkart\PJgameFAQ.chm
- %TEMP%\n64mkart\Project64.cfg
- %TEMP%\n64mkart\Project64.chm
- %TEMP%\n64mkart\Project64.cache
- %TEMP%\n64mkart\Project64.cache3
- %TEMP%\n64mkart\Plugin\GFX\Jabo_OpenGL.dll
- %TEMP%\n64mkart\Docs\Plugin Specs\Gfx #1.3.h
- %TEMP%\n64mkart\Docs\Plugin Specs\Makefile.win32
- %TEMP%\n64mkart\Docs\Plugin Specs\Audio #1.1.h
- %TEMP%\n64mkart\Docs\Plugin Specs\Controller #1.1.h
- %TEMP%\n64mkart\Docs\Plugin Specs\Plugin Spec history.txt
- %TEMP%\n64mkart\Docs\RDB - WhatsNew.txt
- %TEMP%\n64mkart\Docs\RDX - ReadMe (Unofficial).txt
- %TEMP%\n64mkart\Docs\Plugin Specs\Rsp #1.1.h
- %TEMP%\n64mkart\Docs\Plugin Specs\TextureFilters.cpp
- %TEMP%\n64mkart\Docs\GameFAQ - WhatsNew.txt
- %TEMP%\n64mkart\Docs\3rd Party Plugins\Adaptoid.txt
- %TEMP%\n64mkart\Docs\3rd Party Plugins\Direct64.txt
- %TEMP%\n64mkart\Game.exe
- %TEMP%\n64mkart\n64.ico
- %TEMP%\n64mkart\Docs\3rd Party Plugins\Glide Wonder Plus HQ.txt
- %TEMP%\n64mkart\Docs\Cheat - Changes.txt
- %TEMP%\n64mkart\Docs\Cheat - Readme.txt
- %TEMP%\n64mkart\Docs\3rd Party Plugins\N-Rage - Readme.txt
- %TEMP%\n64mkart\Docs\3rd Party Plugins\RiceVideoDocs.chm
- %TEMP%\n64mkart\Plugin\GFX\dxtn.dll
- %TEMP%\n64mkart\Plugin\GFX\Glide64.dll
- %TEMP%\n64mkart\Plugin\Audio\Zilmar_Audio.dll
- %TEMP%\n64mkart\Plugin\GFX\Direct64 v0.5.03.25.dll
- %TEMP%\n64mkart\Plugin\GFX\Glide64.ini
- %TEMP%\n64mkart\Plugin\GFX\Jabo_Direct3D8.dll
- %TEMP%\n64mkart\Plugin\GFX\Jabo_Direct3D8_1.6.dll
- %TEMP%\n64mkart\Plugin\GFX\GlideHQ.dll
- %TEMP%\n64mkart\Plugin\GFX\Jabo_Direct3D6.dll
- %TEMP%\n64mkart\Plugin\Audio\No Sound.dll
- %TEMP%\n64mkart\Lang\English.pj.Lang
- %TEMP%\n64mkart\Lang\English_alternative.pj.Lang
- %TEMP%\n64mkart\Docs\Readme.txt
- %TEMP%\n64mkart\Docs\Whatsnew.txt
- %TEMP%\n64mkart\Lang\Spanish (South America).pj.Lang
- %TEMP%\n64mkart\Plugin\Audio\Jabo_Dsound.dll
- %TEMP%\n64mkart\Plugin\Audio\Jabo_Dsound_1.6.dll
- %TEMP%\n64mkart\Lang\Spanish (Spain).pj.Lang
- %TEMP%\n64mkart\Plugin\Audio\AziAudio.dll
Deletes the following files:
- %TEMP%\n64mkart\d3d syslog.txt.bak
Moves the following files:
- from %TEMP%\n64mkart\d3d syslog.txt to %TEMP%\n64mkart\d3d syslog.txt.bak
Miscellaneous:
Searches for the following windows:
- ClassName: 'SysListView32' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'