Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\install_helper.exe' /browser=IE /guid={3EEF222A-E2BD-4650-A1B9-A1C2EF0B700A}
- '%APPDATA%\freegames115\install_helper.exe' /browser=CH /path="%APPDATA%\freegames115\freegames115.crx" /id=abckmpjbfjfoabjhefcbpdckdfikghpp
- '%TEMP%\freegames115.exe' /S
- '%PROGRAM_FILES%\Free Games 115\BackgroundHost.exe' /RegServer
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Free Games 115\ScriptHost.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Free Games 115\ButtonSite.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Free Games 115\AddonsFramework.Typelib.dll"
- '<SYSTEM32>\taskkill.exe' /F /IM PropertySync.exe
- '<SYSTEM32>\taskkill.exe' /F /IM BackgroundHost.exe
- '<SYSTEM32>\taskkill.exe' /F /IM BackgroundHost64.exe
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\che5.tmp\background.html
- %TEMP%\che5.tmp\button.js
- %TEMP%\che4.tmp
- %PROGRAM_FILES%\Free Games 115\uninst.exe
- %TEMP%\che5.tmp\ci.content.pack.js
- %TEMP%\che5.tmp\content.js
- %TEMP%\che5.tmp\ci.bg.pack.js
- %TEMP%\che5.tmp\ci.browser.helper.js
- %APPDATA%\freegames115\freegames115.xpi
- %PROGRAM_FILES%\Free Games 115\uninstall.exe
- %TEMP%\nse3.tmp\System.dll
- %PROGRAM_FILES%\Free Games 115\updater.js
- %PROGRAM_FILES%\Free Games 115\updaterWrapper.js
- %APPDATA%\freegames115\install_helper.exe
- %TEMP%\freegames115.xpi
- %TEMP%\install_helper.exe
- %APPDATA%\freegames115\freegames115.crx
- %TEMP%\che5.tmp\icon128.ico
- %TEMP%\che5.tmp\jquery-1.9.1.min.js
- %TEMP%\che5.tmp\jquery.uuid.js
- %TEMP%\che5.tmp\icon48.ico
- %TEMP%\che5.tmp\icon48.png
- %TEMP%\che5.tmp\rjs.js
- %TEMP%\che5.tmp\settings.json
- %TEMP%\che5.tmp\manifest.json
- %TEMP%\che5.tmp\popup.js
- %TEMP%\che5.tmp\icon32.png
- %TEMP%\che5.tmp\icon16.png
- %TEMP%\che5.tmp\icon18.ico
- %TEMP%\che5.tmp\icon128.png
- %TEMP%\che5.tmp\icon16.ico
- %TEMP%\che5.tmp\icon24.png
- %TEMP%\che5.tmp\icon32.ico
- %TEMP%\che5.tmp\icon18.png
- %TEMP%\che5.tmp\icon24.ico
- %PROGRAM_FILES%\Free Games 115\ButtonSite.dll
- %PROGRAM_FILES%\Free Games 115\ButtonSite64.dll
- %PROGRAM_FILES%\Free Games 115\BackgroundHost.exe
- %PROGRAM_FILES%\Free Games 115\BackgroundHost64.exe
- %PROGRAM_FILES%\Free Games 115\background.html
- %PROGRAM_FILES%\Free Games 115\button.js
- %PROGRAM_FILES%\Free Games 115\ScriptHost.dll
- %PROGRAM_FILES%\Free Games 115\ScriptHost64.dll
- %PROGRAM_FILES%\Free Games 115\AddonsFramework.Typelib64.dll
- %HOMEPATH%\Desktop\Free Games.lnk
- %TEMP%\freegames115.exe
- %TEMP%\DeskTopIcon.ico
- %APPDATA%\freegames115\DeskTopIcon.ico
- %TEMP%\nse3.tmp\UAC.dll
- %PROGRAM_FILES%\Free Games 115\AddonsFramework.Typelib.dll
- %TEMP%\nse3.tmp\help_page.ini
- %TEMP%\nse3.tmp\ie9install.bmp
- %PROGRAM_FILES%\Free Games 115\config.xml
- %PROGRAM_FILES%\Free Games 115\icon48.ico
- %PROGRAM_FILES%\Free Games 115\icon48.png
- %PROGRAM_FILES%\Free Games 115\icon32.ico
- %PROGRAM_FILES%\Free Games 115\icon32.png
- %PROGRAM_FILES%\Free Games 115\options.htm
- %PROGRAM_FILES%\Free Games 115\rjs.js
- %PROGRAM_FILES%\Free Games 115\jquery-1.9.1.min.js
- %PROGRAM_FILES%\Free Games 115\json2.min.js
- %PROGRAM_FILES%\Free Games 115\icon24.png
- %PROGRAM_FILES%\Free Games 115\icon128.png
- %PROGRAM_FILES%\Free Games 115\icon16.ico
- %PROGRAM_FILES%\Free Games 115\content.js
- %PROGRAM_FILES%\Free Games 115\icon128.ico
- %PROGRAM_FILES%\Free Games 115\icon18.png
- %PROGRAM_FILES%\Free Games 115\icon24.ico
- %PROGRAM_FILES%\Free Games 115\icon16.png
- %PROGRAM_FILES%\Free Games 115\icon18.ico
Удаляет следующие файлы:
- %TEMP%\freegames115.exe
- %TEMP%\install_helper.exe
- %TEMP%\freegames115.xpi
- %APPDATA%\freegames115\install_helper.exe
- %TEMP%\nse3.tmp\ie9install.bmp
- %TEMP%\nse3.tmp\help_page.ini
- %TEMP%\nse3.tmp\UAC.dll
- %TEMP%\nse3.tmp\System.dll
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: '(null)'
