Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WildTangent CDA' = '"%PROGRAM_FILES%\WildTangent\Apps\CDA\GameDrvr.exe" /startup "%PROGRAM_FILES%\WildTangent\Apps\CDA\cdaEngine0500.dll"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls] 'wtControlPanel' = ''
Вредоносные функции:
Создает и запускает на исполнение:
- %PROGRAM_FILES%\WildTangent\Apps\CDA\GameDrvr.exe cdaEngine0500.dll
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\Checkin\install_complete.html
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\Checkin\install.html
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\Checkin\install_progress.html
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\Checkin\install_nofiles.html
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\Checkin\download.html
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\UrlUpdate.cdaet
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\UpdateApplicationTrigger.cdaet
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\Checkin\icon.ico
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\WeeklyCDA.cdaet
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\Checkin\inuse.html
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\CDAOnlyScreen\uninstall_prompt.html
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\Checkin\installTrayIconData.cdas
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\CDAWithDependantsScreen\items.html
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\CDAOnlyScreen\style.css
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\Checkin\downloadTrayIconData.cdas
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\Checkin\items.html
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\Checkin\inuseitems.html
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\Checkin\style.css
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\Checkin\wt.gif
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\UpdateApplicationRestart.cdaet
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\Bandwidth.cdaet
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\WeeklyCDA.cdaes
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\GameData.cdaet
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\CreateAppConfig.cdaet
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\UrlUpdate.cdaes
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\SystemConfiguration.cdaes
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\ShutdownTest.cdaes
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\UpdateApplicationTrigger.cdaes
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\UpdateApplicationRestart.cdaes
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\GameDataTriggered.cdaet
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\PersistentUpdateRestart.cdaet
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\PersistentUpdateQuick.cdaet
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\SystemConfiguration.cdaet
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\ShutdownTest.cdaet
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\PersistentUpdateNormal.cdaet
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\ManualUpdate.cdaet
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\Maint.cdaet
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\NewUser.cdaet
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\MigrateDpid.cdaet
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\Images\retry-over.gif
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\Images\re.gif
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\Images\header.jpg
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\Images\retry.gif
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\Images\next.gif
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\Images\mb.gif
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\Images\le.gif
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\Images\next-over.gif
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\Images\next-disabled.gif
- %PROGRAM_FILES%\WildTangent\Apps\CDA\GameDrvr.exe
- <LS_APPDATA>\Wildtangent\Cdacache\cdacache.odds
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\UpdateApplicationRestart.cdaed
- %TEMP%\00000000.tmp
- %PROGRAM_FILES%\WildTangent\LFS\Cache\00000001.Cache
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\MigrateDpid.cdaed
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\CreateAppConfig.cdaed
- %PROGRAM_FILES%\WildTangent\LFS\Cache\Cache.dat
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\Maint.cdaed
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\GameData.cdaed
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\Images\finish.gif
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\InUseScreen\style.css
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\InUseScreen\items.html
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\ProgressScreen\style.css
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\ProgressScreen\uninstall_progress.html
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\InUseScreen\inuse.html
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\CDAWithDependantsScreen\style.css
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\CDAWithDependantsScreen\uninstall_promptdependant.html
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\ErrorScreen\style.css
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\ErrorScreen\uninstall_error.html
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\FinishedScreen\uninstallpackage_complete.html
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\Images\cancel-over.gif
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\Images\btm.gif
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\Images\finish-over.gif
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\Images\cancel.gif
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\Images\br.gif
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\FinishedScreen\style.css
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\FinishedScreen\uninstall_complete.html
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\Images\bl.gif
- %PROGRAM_FILES%\WildTangent\LFS\CDAData\UninstallerUI\Images\bc.gif
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\PersistentUpdateRestart.cdaes
- %PROGRAM_FILES%\WildTangent\Components\wtLua0300.dll
- %PROGRAM_FILES%\WildTangent\Components\wtKernel0300.dll
- %PROGRAM_FILES%\WildTangent\Components\wtScript0300.dll
- %PROGRAM_FILES%\WildTangent\Components\wtPropertyBag0300.dll
- %PROGRAM_FILES%\WildTangent\Components\wtIO0300.dll
- %PROGRAM_FILES%\WildTangent\Components\wtApplicationUpdateManager0500.dll
- %PROGRAM_FILES%\WildTangent\Components\wtUserSupport0500.dll
- %PROGRAM_FILES%\WildTangent\Components\wtDownloader0300.dll
- %PROGRAM_FILES%\WildTangent\Components\wtCache0300.dll
- %PROGRAM_FILES%\WildTangent\Components\wtSerialization0300.dll
- %PROGRAM_FILES%\WildTangent\Components\wtIO0200.dll
- %PROGRAM_FILES%\WildTangent\Components\wtDownloader0200.dll
- %PROGRAM_FILES%\WildTangent\Components\wtLua0200.dll
- %PROGRAM_FILES%\WildTangent\Components\wtKernel0200.dll
- %PROGRAM_FILES%\WildTangent\Components\wtCache0200.dll
- %PROGRAM_FILES%\WildTangent\Components\wtSystem0300.dll
- %PROGRAM_FILES%\WildTangent\Components\wtStreamProcessing0300.dll
- %PROGRAM_FILES%\WildTangent\Components\wtXml0300.dll
- %PROGRAM_FILES%\WildTangent\Components\wtSystemConfig0300.dll
- %PROGRAM_FILES%\WildTangent\Components\wtGUI0500.dll
- %PROGRAM_FILES%\WildTangent\Apps\CDA\CDAEngine0500.dll
- %PROGRAM_FILES%\WildTangent\Apps\CDA\CDALogger0401.dll
- %PROGRAM_FILES%\WildTangent\Apps\CDA\wtControlPanel.cpl
- %PROGRAM_FILES%\WildTangent\Apps\CDA\CDAEngine0400.dll
- %PROGRAM_FILES%\WildTangent\Apps\CDA\wt.ico
- %TEMP%\nsb3.tmp\wtInstallerPlugin.dll
- %TEMP%\nsv2.tmp
- %PROGRAM_FILES%\WildTangent\Apps\CDA\OtherLicenses.txt
- %TEMP%\nsb3.tmp\System.dll
- %PROGRAM_FILES%\WildTangent\Apps\CDA\CDAUninstall.exe
- %PROGRAM_FILES%\WildTangent\Components\wtAppConfig0500.dll
- %PROGRAM_FILES%\WildTangent\Apps\CDA\ControlPanel\CDA\updates.html
- %PROGRAM_FILES%\WildTangent\Components\wtGameData0500.dll
- %PROGRAM_FILES%\WildTangent\Components\wtCookie0500.dll
- %PROGRAM_FILES%\WildTangent\Apps\CDA\ControlPanel\CDA\cache.html
- %PROGRAM_FILES%\WildTangent\Apps\CDA\ControlPanel\nav.html
- %PROGRAM_FILES%\WildTangent\Apps\CDA\ControlPanel\index.html
- %PROGRAM_FILES%\WildTangent\Apps\CDA\ControlPanel\CDA\about.html
- %PROGRAM_FILES%\WildTangent\Apps\CDA\ControlPanel\wt.gif
- %PROGRAM_FILES%\WildTangent\LFS\Scripts\Uninstall\Uninstaller.cdas
- %PROGRAM_FILES%\WildTangent\LFS\Scripts\Install\CPL_uninstall.cdas
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\UpdateApplicationLibrary01.cdas
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\PersistentUpdateLibrary01.cdas
- %PROGRAM_FILES%\WildTangent\LFS\Scripts\Install\CPL_fileList.cdas
- %PROGRAM_FILES%\WildTangent\LFS\Scripts\Common\MasterUpdateLibrary_01.cdas
- %PROGRAM_FILES%\WildTangent\LFS\Scripts\Common\GameDataImmediate.cdas
- %PROGRAM_FILES%\WildTangent\LFS\Scripts\Common\UrlUpdateList.cdas
- %PROGRAM_FILES%\WildTangent\LFS\Scripts\Common\UI_Stub.cdas
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\Bandwidth.cdaes
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\NewUser.cdaes
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\MigrateDpid.cdaes
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\PersistentUpdateQuick.cdaes
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\PersistentUpdateNormal.cdaes
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\ManualUpdate.cdaes
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\GameData.cdaes
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\CreateAppConfig.cdaes
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\Maint.cdaes
- %PROGRAM_FILES%\WildTangent\LFS\TaskStore\GameDataTriggered.cdaes
- %PROGRAM_FILES%\WildTangent\LFS\Scripts\Common\DpidLibrary_01.cdas
- %PROGRAM_FILES%\WildTangent\Components\wtXml0200.dll
- %PROGRAM_FILES%\WildTangent\Components\wtSystem0200.dll
- %PROGRAM_FILES%\WildTangent\LFS\System\wt.sto
- %PROGRAM_FILES%\WildTangent\LFS\AppConfig\CDA.wtcfg
- %PROGRAM_FILES%\WildTangent\Components\wtStreamProcessing0200.dll
- %PROGRAM_FILES%\WildTangent\Components\wtPropertyBag0200.dll
- %PROGRAM_FILES%\WildTangent\Components\wtNetworking0200.dll
- %PROGRAM_FILES%\WildTangent\Components\wtSerialization0200.dll
- %PROGRAM_FILES%\WildTangent\Components\wtScript0200.dll
- %PROGRAM_FILES%\WildTangent\LFS\Scripts\Common\AUML01.cdas
- %PROGRAM_FILES%\WildTangent\LFS\Scripts\Common\CL01_Scheduler.cdas
- %PROGRAM_FILES%\WildTangent\LFS\Scripts\Common\CL01_Registry.cdas
- %PROGRAM_FILES%\WildTangent\LFS\Scripts\Common\CL01_User.cdas
- %PROGRAM_FILES%\WildTangent\LFS\Scripts\Common\CL01_String.cdas
- %PROGRAM_FILES%\WildTangent\LFS\Scripts\Common\CL01_LFSInit.cdas
- %PROGRAM_FILES%\WildTangent\LFS\Scripts\Common\CL01_Files.cdas
- %PROGRAM_FILES%\WildTangent\LFS\Scripts\Common\CL01.cdas
- %PROGRAM_FILES%\WildTangent\LFS\Scripts\Common\CL01_InstallConditions.cdas
- %PROGRAM_FILES%\WildTangent\LFS\Scripts\Common\CL01_Install.cdas
Удаляет следующие файлы:
- %PROGRAM_FILES%\WildTangent\LFS\Cache\00000001.Cache
- %TEMP%\nsb3.tmp\wtInstallerPlugin.dll
- %TEMP%\nsb3.tmp\System.dll
Сетевая активность:
Подключается к:
- 're######.cda.wildtangent.com':80
TCP:
Запросы HTTP GET:
- re######.cda.wildtangent.com/Recovery/Checkin.aspx?ve##########################################################################################################################
UDP:
- DNS ASK re######.cda.wildtangent.com
