Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\Software\Classes\GTarcade\shell\open\command] '' = '"%LOCALAPPDATA%\Gtarcade\app\GTarcade.exe" "%1"'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'gtarcade' = '"%LOCALAPPDATA%\Gtarcade\app\gtarcade.exe" /auto_start=1 '
Вредоносные функции
Внедряет код в
следующие пользовательские процессы:
- gtarexternal.exe
Изменения в файловой системе
Создает следующие файлы
- %LOCALAPPDATA%\gtarcade\config.ini
- %LOCALAPPDATA%\gtarcade\app\gtarcadehelper.exe
- %LOCALAPPDATA%\gtarcade\app\gtarcadeemulatorhandler.exe
- %LOCALAPPDATA%\gtarcade\app\gtarcade.exe
- %LOCALAPPDATA%\gtarcade\app\gtarbugreport.exe
- %LOCALAPPDATA%\gtarcade\app\gtarbind.dll
- %LOCALAPPDATA%\gtarcade\app\gtagame.exe
- %LOCALAPPDATA%\gtarcade\app\gtacrashhandler.exe
- %LOCALAPPDATA%\gtarcade\app\gamserver.exe
- %LOCALAPPDATA%\gtarcade\app\gamehall\v8_context_snapshot.bin
- %LOCALAPPDATA%\gtarcade\app\gamehall\swiftshader\libglesv2.dll
- %LOCALAPPDATA%\gtarcade\app\gamehall\swiftshader\libegl.dll
- %LOCALAPPDATA%\gtarcade\app\gamehall\snapshot_blob.bin
- %LOCALAPPDATA%\gtarcade\app\gamehall\pepflashplayer.dll
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\zh-tw.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\zh-cn.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\vi.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\uk.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\tr.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\th.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\te.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\ta.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\sw.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\sv.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\sr.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\sl.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\sk.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\ru.pak
- %LOCALAPPDATA%\gtarcade\app\gtarepair.exe
- %LOCALAPPDATA%\gtarcade\app\gtarhelper.exe
- %LOCALAPPDATA%\gtarcade\cache\game\cache\data_2
- %LOCALAPPDATA%\gtarcade\app\gtarucore.exe
- %LOCALAPPDATA%\gtarcade\cache\game\cache\data_1
- %LOCALAPPDATA%\gtarcade\cache\game\cache\data_0
- %LOCALAPPDATA%\gtarcade\cache\game\cache\index
- %LOCALAPPDATA%\gtarcade\cache\game\code cache\js\index
- %LOCALAPPDATA%\gtarcade\cache\game\code cache\wasm\index
- %LOCALAPPDATA%\gtarcade\app\upload.log
- %LOCALAPPDATA%\gtarcade\app\log\tmp.dat
- %LOCALAPPDATA%\gtarcade\cache\game\visited links
- %LOCALAPPDATA%\gtarcade\app\log\20240421153530997\gtarcade.log0
- %LOCALAPPDATA%\gtarcade\app\log\20240421153530997\gtarcade.log4cplus0
- %APPDATA%\microsoft\windows\start menu\programs\gtarcade\gtarcade.lnk
- %HOMEPATH%\desktop\gtarcade.lnk
- %LOCALAPPDATA%\gtarcade\app\gtarcade.ini
- %LOCALAPPDATA%\gtarcade\app\gtarcade.xml
- %LOCALAPPDATA%\gtarcade\app\uninstall.exe
- %LOCALAPPDATA%\gtarcade\app\sim_preinstallchecker_native.exe
- %LOCALAPPDATA%\gtarcade\app\resource\images\unlock_skin_346.gif
- %LOCALAPPDATA%\gtarcade\app\resource\images\unlock_skin_312.gif
- %LOCALAPPDATA%\gtarcade\app\resource\images\secure-gif.gif
- %LOCALAPPDATA%\gtarcade\app\resource\audio\camera_shutter.wav
- %LOCALAPPDATA%\gtarcade\app\repairwnd.exe
- %LOCALAPPDATA%\gtarcade\app\pepflashplayer.dll
- %LOCALAPPDATA%\gtarcade\app\manifest.json
- %LOCALAPPDATA%\gtarcade\app\log4cplus.dll
- %LOCALAPPDATA%\gtarcade\app\libssl-1_1.dll
- %LOCALAPPDATA%\gtarcade\app\libcrypto-1_1.dll
- %LOCALAPPDATA%\gtarcade\app\ipc.dll
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\ro.pak
- %LOCALAPPDATA%\gtarcade\app\gtarhandler.exe
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\pt-pt.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\cs.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\bn.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\bg.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\ar.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\am.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\libglesv2.dll
- %LOCALAPPDATA%\gtarcade\app\gamehall\libegl.dll
- %LOCALAPPDATA%\gtarcade\app\gamehall\libcef.dll
- %LOCALAPPDATA%\gtarcade\app\gamehall\ipc.dll
- %LOCALAPPDATA%\gtarcade\app\gamehall\icudtl.dat
- %LOCALAPPDATA%\gtarcade\app\gamehall\gtarhelper.dll
- %LOCALAPPDATA%\gtarcade\app\gamehall\gtarexternal.exe
- %LOCALAPPDATA%\gtarcade\app\gamehall\devtools_resources.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\d3dcompiler_47.dll
- %LOCALAPPDATA%\gtarcade\app\gamehall\chrome_elf.dll
- %LOCALAPPDATA%\gtarcade\app\gamehall\cef_extensions.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\cef_200_percent.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\cef_100_percent.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\cef.pak
- %LOCALAPPDATA%\gtarcade\app\gamedata\inputmapper\com.gtarcade.lod.cfg
- %LOCALAPPDATA%\gtarcade\app\gamedata\inputmapper\com.gtarcade.eoa.cfg
- %LOCALAPPDATA%\gtarcade\app\gamedata\game.json
- %LOCALAPPDATA%\gtarcade\app\duilib.dll
- %LOCALAPPDATA%\gtarcade\app\adbkits\adbwinusbapi.dll
- %LOCALAPPDATA%\gtarcade\app\adbkits\adbwinapi.dll
- %LOCALAPPDATA%\gtarcade\app\adbkits\adb.exe
- %LOCALAPPDATA%\gtarcade\app\adbkits\aapt.exe
- %TEMP%\gtarinstall_1034941.tmp
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\ca.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\da.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\pl.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\de.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\nl.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\nb.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\ms.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\mr.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\ml.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\lv.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\lt.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\ko.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\kn.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\ja.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\it.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\id.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\hu.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\hr.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\hi.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\he.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\gu.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\fr.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\fil.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\fi.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\fa.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\et.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\es.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\es-419.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\en-us.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\en-gb.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\el.pak
- %LOCALAPPDATA%\gtarcade\app\gamehall\locales\pt-br.pak
- %LOCALAPPDATA%\gtarcade\cache\game\cache\data_3
Удаляет следующие файлы
- %TEMP%\gtarinstall_1034941.tmp
- %LOCALAPPDATA%\gtarcade\app\upload.log
Сетевая активность
Подключается к
- 'co#####.gtarcade.com':443
- 'mi#####pi.gtarcade.com':443
- 'st#####cdn.gtarcade.com':443
- 'localhost':49197
- 'localhost':49199
- 'localhost':49201
- 'localhost':49203
- 'localhost':49206
TCP
Другие
- 'co#####.gtarcade.com':443
- 'st#####cdn.gtarcade.com':443
- 'localhost':49197
- 'localhost':49199
- 'localhost':49201
- 'localhost':49203
- 'localhost':49204
- 'localhost':49202
UDP
- DNS ASK co#####.gtarcade.com
- DNS ASK mi#####pi.gtarcade.com
- DNS ASK st#####cdn.gtarcade.com
Другое
Создает и запускает на исполнение
- '%LOCALAPPDATA%\gtarcade\app\gtarcade.exe' /flag=<Имя файла> /user_frome=0 /start_from=1
- '%LOCALAPPDATA%\gtarcade\app\gtacrashhandler.exe' /log_path="%LOCALAPPDATA%\Gtarcade\app\log\20240421153530997\ "
- '%LOCALAPPDATA%\gtarcade\app\gamehall\gtarexternal.exe' --start-from-gtarapp=3.1.13.4009
- '%LOCALAPPDATA%\gtarcade\app\gtarcadehelper.exe' /action=start-from-gtar
- '%LOCALAPPDATA%\gtarcade\app\gtarbugreport.exe' /prod=gtar_report
- '%LOCALAPPDATA%\gtarcade\app\gamehall\gtarexternal.exe' --type=gpu-process --field-trial-handle=1104,16317714419700550957,15193435477306201400,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --log-file="%LOCALAPPDAT...
- '%LOCALAPPDATA%\gtarcade\app\gamehall\gtarexternal.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1104,16317714419700550957,15193435477306201400,131072 --enable-features=CastMediaRouteProvider --disable-feat...
- '%LOCALAPPDATA%\gtarcade\app\gamehall\gtarexternal.exe' --type=renderer --js-flags=--expose-wasm --log-file="%LOCALAPPDATA%\Gtarcade\app\gamehall\debug.log" --field-trial-handle=1104,16317714419700550957,15193435477306201400,131072 --enable-features...
- '%LOCALAPPDATA%\gtarcade\app\gtarcade.exe' /flag=<Имя файла> /user_frome=0 /start_from=1' (со скрытым окном)
- '%LOCALAPPDATA%\gtarcade\app\gtacrashhandler.exe' /log_path="%LOCALAPPDATA%\Gtarcade\app\log\20240421153530997\ "' (со скрытым окном)
- '%LOCALAPPDATA%\gtarcade\app\gamehall\gtarexternal.exe' --start-from-gtarapp=3.1.13.4009' (со скрытым окном)
- '%LOCALAPPDATA%\gtarcade\app\gtarcadehelper.exe' /action=start-from-gtar' (со скрытым окном)
- '%LOCALAPPDATA%\gtarcade\app\gtarbugreport.exe' /prod=gtar_report' (со скрытым окном)
