Trojan.MulDrop8.24149

Техническая информация

Изменения в файловой системе:

Создает следующие файлы:

C:\Progressive\x64.msi
%ProgramFiles%\Defraggler\Lang\lang-1052.dll
%ProgramFiles%\Defraggler\Lang\lang-1051.dll
%ProgramFiles%\Defraggler\Lang\lang-1050.dll
%ProgramFiles%\Defraggler\Lang\lang-1049.dll
%ProgramFiles%\Defraggler\Lang\lang-1048.dll
%ProgramFiles%\Defraggler\Lang\lang-1046.dll
%ProgramFiles%\Defraggler\Lang\lang-1045.dll
%ProgramFiles%\Defraggler\Lang\lang-1044.dll
%ProgramFiles%\Defraggler\Lang\lang-1043.dll
%ProgramFiles%\Defraggler\Lang\lang-1041.dll
%ProgramFiles%\Defraggler\Lang\lang-1040.dll
%ProgramFiles%\Defraggler\Lang\lang-1055.dll
%ProgramFiles%\Defraggler\Lang\lang-1053.dll
%ProgramFiles%\Defraggler\Lang\lang-1036.dll
%ProgramFiles%\Defraggler\Lang\lang-1035.dll
%ProgramFiles%\Defraggler\Lang\lang-1034.dll
%ProgramFiles%\Defraggler\Lang\lang-1032.dll
%ProgramFiles%\Defraggler\Lang\lang-1031.dll
%ProgramFiles%\Defraggler\Lang\lang-1030.dll
%ProgramFiles%\Defraggler\Lang\lang-1029.dll
%ProgramFiles%\Defraggler\Lang\lang-1028.dll
%ProgramFiles%\Defraggler\Lang\lang-1027.dll
%ProgramFiles%\Defraggler\Lang\lang-1026.dll
%ProgramFiles%\Defraggler\Lang\lang-1025.dll
%ProgramFiles%\Defraggler\Lang\lang-1038.dll
C:\Progressive\Defraggler\Lang\lang-1048.dll
%ProgramFiles%\Defraggler\Lang\lang-1057.dll
%WINDIR%\Installer\2529e.msi
%ProgramFiles%\Defraggler\license.ini
%HOMEPATH%\Start Menu\Programs\Defraggler\Defraggler Homepage.url
%WINDIR%\Installer\MSI5.tmp
%HOMEPATH%\Desktop\Defraggler.lnk
%HOMEPATH%\Start Menu\Programs\Defraggler\Uninstall.lnk
%HOMEPATH%\Start Menu\Programs\Defraggler\Defraggler.lnk
%ProgramFiles%\Defraggler\Uninstall.lnk
%ProgramFiles%\Defraggler\DefragglerShell.dll
%ProgramFiles%\Defraggler\df.exe
%ProgramFiles%\Defraggler\defraggler.exe
%ProgramFiles%\Defraggler\Lang\lang-9999.dll
%ProgramFiles%\Defraggler\Lang\lang-5146.dll
%ProgramFiles%\Defraggler\Lang\lang-2070.dll
%ProgramFiles%\Defraggler\Lang\lang-2052.dll
%ProgramFiles%\Defraggler\Lang\lang-1079.dll
%ProgramFiles%\Defraggler\Lang\lang-1071.dll
%ProgramFiles%\Defraggler\Lang\lang-1067.dll
%ProgramFiles%\Defraggler\Lang\lang-1066.dll
%ProgramFiles%\Defraggler\Lang\lang-1065.dll
%ProgramFiles%\Defraggler\Lang\lang-1063.dll
%ProgramFiles%\Defraggler\Lang\lang-1062.dll
%ProgramFiles%\Defraggler\Lang\lang-1061.dll
%ProgramFiles%\Defraggler\Lang\lang-1060.dll
%ProgramFiles%\Defraggler\Lang\lang-1059.dll
%ProgramFiles%\Defraggler\branding.dll
%ProgramFiles%\Defraggler\Lang\lang-1037.dll
C:\Config.Msi\2529d.rbs
%WINDIR%\Installer\MSI3.tmp
%WINDIR%\Installer\MSI2.tmp
C:\Progressive\Defraggler\Lang\lang-1029.dll
C:\Progressive\Defraggler\Lang\lang-1043.dll
C:\Progressive\Defraggler\Lang\lang-1041.dll
C:\Progressive\Defraggler\Lang\lang-1040.dll
C:\Progressive\Defraggler\Lang\lang-1038.dll
C:\Progressive\Defraggler\Lang\lang-1037.dll
C:\Progressive\Defraggler\Lang\lang-1036.dll
C:\Progressive\Defraggler\Lang\lang-1035.dll
C:\Progressive\Defraggler\Lang\lang-1034.dll
C:\Progressive\Defraggler\Lang\lang-1032.dll
C:\Progressive\Defraggler\Lang\lang-1031.dll
C:\Progressive\Defraggler\Lang\lang-1030.dll
C:\Progressive\Defraggler\Lang\lang-1028.dll
C:\Progressive\Defraggler\Lang\lang-1045.dll
C:\Progressive\Defraggler\Lang\lang-1027.dll
C:\Progressive\Defraggler\Lang\lang-1026.dll
C:\Progressive\Defraggler\Lang\lang-1025.dll
C:\Progressive\Defraggler\df64.exe
C:\Progressive\Defraggler\df.exe
C:\Progressive\Defraggler\DefragglerShell64.dll
C:\Progressive\Defraggler\DefragglerShell.dll
C:\Progressive\Defraggler\defraggler64.exe
C:\Progressive\Defraggler\defraggler.exe
C:\Progressive\Defraggler\branding.dll
C:\Progressive\x86.msi
%APPDATA%\Microsoft\Installer\{6B186DC9-BADA-4A8E-A226-6384541E264E}\Product.ico
%ProgramFiles%\Defraggler\Lang\lang-1058.dll
C:\Progressive\Defraggler\Lang\lang-1046.dll
C:\Progressive\Defraggler\Lang\lang-1050.dll
C:\Progressive\Defraggler\Lang\lang-1044.dll
%WINDIR%\Installer\2529c.ipi
%WINDIR%\Installer\MSI1.tmp
%WINDIR%\Installer\2529a.msi
C:\Progressive\Kur.exe
C:\Progressive\Defraggler\Lang\lang-9999.dll
C:\Progressive\Defraggler\Lang\lang-5146.dll
C:\Progressive\Defraggler\Lang\lang-2070.dll
C:\Progressive\Defraggler\Lang\lang-2052.dll
C:\Progressive\Defraggler\Lang\lang-1079.dll
C:\Progressive\Defraggler\Lang\lang-1071.dll
C:\Progressive\Defraggler\Lang\lang-1067.dll
C:\Progressive\Defraggler\Lang\lang-1066.dll
C:\Progressive\Defraggler\Lang\lang-1065.dll
C:\Progressive\Defraggler\Lang\lang-1063.dll
C:\Progressive\Defraggler\Lang\lang-1062.dll
C:\Progressive\Defraggler\Lang\lang-1061.dll
C:\Progressive\Defraggler\Lang\lang-1060.dll
C:\Progressive\Defraggler\Lang\lang-1059.dll
C:\Progressive\Defraggler\Lang\lang-1058.dll
C:\Progressive\Defraggler\Lang\lang-1057.dll
C:\Progressive\Defraggler\Lang\lang-1055.dll
C:\Progressive\Defraggler\Lang\lang-1053.dll
C:\Progressive\Defraggler\Lang\lang-1052.dll
C:\Progressive\Defraggler\Lang\lang-1051.dll
C:\Progressive\Defraggler\Lang\lang-1049.dll
%WINDIR%\Installer\MSI7.tmp

Удаляет следующие файлы:

%WINDIR%\Installer\MSI1.tmp
%WINDIR%\Installer\MSI3.tmp
%WINDIR%\Installer\MSI5.tmp
%WINDIR%\Installer\MSI2.tmp
C:\Config.Msi\2529d.rbs
%WINDIR%\Installer\MSI7.tmp
%WINDIR%\Installer\2529a.msi
%WINDIR%\Installer\2529c.ipi

Другое:

Создает и запускает на исполнение:

'C:\Progressive\Kur.exe'

Запускает на исполнение:

'<SYSTEM32>\msiexec.exe' /i "C:\Progressive\X86.msi" AUTOUPDATECHECK=0 NAME=SolidShare.Net/Progressive KEY=DGN2-74GR-ZDZR-6WFG-NVFF /quiet /norestart
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' -Embedding 32CF9FADA4B7D0995C8117C227A322A7
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Defraggler\DefragglerShell.dll"