Trojan.MulDrop11.24191

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\extef2a.tmp
%WINDIR%\twain_32\arkcam\twar35d.rra
%ProgramFiles(x86)%\installshield installation information\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\setu33e.rra
%ProgramFiles(x86)%\installshield installation information\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\setu32e.rra
%ProgramFiles(x86)%\installshield installation information\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\data31f.rra
%ProgramFiles(x86)%\installshield installation information\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\data30f.rra
%ProgramFiles(x86)%\installshield installation information\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\layo30f.rra
%TEMP%\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\_isrffe2.rra
%TEMP%\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\defaffc3.rra
%TEMP%\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\isrtffa4.rra
%TEMP%\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\valuff94.rra
%TEMP%\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\setuff56.rra
%CommonProgramFiles(x86)%\installshield\iscript\iscrfd33.rra
%CommonProgramFiles(x86)%\installshield\engine\6\intel 32\iusefc87.rra
%CommonProgramFiles(x86)%\installshield\engine\6\intel 32\objefc77.rra
%CommonProgramFiles(x86)%\installshield\engine\6\intel 32\ctorfc0a.rra
%CommonProgramFiles(x86)%\installshield\engine\6\intel 32\corefbeb.rra
%TEMP%\fae1.rra
%CommonProgramFiles(x86)%\installshield\engine\6\intel 32\temp.000
%TEMP%\iecf2d3.tmp
%TEMP%\pftef99.tmp\disk1\setup.ini
%TEMP%\pftef99.tmp\disk1\data1.cab
%TEMP%\pftef99.tmp\disk1\data1.hdr
%TEMP%\pftef99.tmp\disk1\layout.bin
%TEMP%\pftef99.tmp\disk1\data2.cab
%TEMP%\pftef99.tmp\disk1\setup.inx
%TEMP%\pftef99.tmp\disk1\ikernel.ex_
%TEMP%\pftef99.tmp\disk1\setup.exe
%TEMP%\pftef99.tmp\pftw1.pkg
%TEMP%\plfef29.tmp
%WINDIR%\arks36d.rra
%WINDIR%\diba37c.rra

Удаляет следующие файлы

%TEMP%\extef2a.tmp
%TEMP%\pftef99.tmp\pftw1.pkg
%TEMP%\iecf2d3.tmp

Перемещает следующие файлы

%CommonProgramFiles(x86)%\installshield\engine\6\intel 32\temp.000 в %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\ikernel.exe
%WINDIR%\twain_32\arkcam\twar35d.rra в %WINDIR%\twain_32\arkcam\twark_32.ds
%ProgramFiles(x86)%\installshield installation information\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\setu33e.rra в %ProgramFiles(x86)%\installshield installation information\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\setup.inx
%ProgramFiles(x86)%\installshield installation information\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\setu32e.rra в %ProgramFiles(x86)%\installshield installation information\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\setup.ini
%ProgramFiles(x86)%\installshield installation information\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\setu32e.rra в %ProgramFiles(x86)%\installshield installation information\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\setup.exe
%ProgramFiles(x86)%\installshield installation information\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\data31f.rra в %ProgramFiles(x86)%\installshield installation information\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\data1.cab
%ProgramFiles(x86)%\installshield installation information\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\data30f.rra в %ProgramFiles(x86)%\installshield installation information\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\data1.hdr
%ProgramFiles(x86)%\installshield installation information\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\layo30f.rra в %ProgramFiles(x86)%\installshield installation information\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\layout.bin
%TEMP%\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\_isrffe2.rra в %TEMP%\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\_isres.dll
%TEMP%\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\defaffc3.rra в %TEMP%\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\default.pal
%TEMP%\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\isrtffa4.rra в %TEMP%\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\isrt.dll
%TEMP%\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\valuff94.rra в %TEMP%\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\value.shl
%TEMP%\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\setuff56.rra в %TEMP%\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\setup.inx
%CommonProgramFiles(x86)%\installshield\iscript\iscrfd33.rra в %CommonProgramFiles(x86)%\installshield\iscript\iscript.dll
%CommonProgramFiles(x86)%\installshield\engine\6\intel 32\iusefc87.rra в %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\iuser.dll
%CommonProgramFiles(x86)%\installshield\engine\6\intel 32\objefc77.rra в %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\objectps.dll
%CommonProgramFiles(x86)%\installshield\engine\6\intel 32\ctorfc0a.rra в %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\ctor.dll
%CommonProgramFiles(x86)%\installshield\engine\6\intel 32\corefbeb.rra в %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\corecomp.ini
%WINDIR%\arks36d.rra в %WINDIR%\arksti.exe
%WINDIR%\diba37c.rra в %WINDIR%\dibapi32.dll

Подменяет следующие файлы

%ProgramFiles(x86)%\installshield installation information\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\setu32e.rra
%ProgramFiles(x86)%\installshield installation information\{4616c3de-a3d0-4bdb-9bd2-fa4e4084c247}\setup.ini

Другое

Создает и запускает на исполнение

'%TEMP%\pftef99.tmp\disk1\setup.exe'
'%CommonProgramFiles(x86)%\installshield\engine\6\intel 32\ikernel.exe' -RegServer
'%CommonProgramFiles(x86)%\installshield\engine\6\intel 32\ikernel.exe' /REGSERVER