Trojan.MulDrop11.33783

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

%WINDIR%\tasks\c__users_user_desktop_hotspotshield-8.7.1-plain-773-preactive.exe.job
<SYSTEM32>\tasks\c__users_user_desktop_hotspotshield-8.7.1-plain-773-preactive.exe

Изменения в файловой системе

Создает следующие файлы

%LOCALAPPDATA%\turbo.net\sandbox\hotspot shield 8.7.1 pre-active\8.7.1.11380\xsandbox.bin.__tmp__
%TEMP%\nsec1eb.tmp\modern-wizard.bmp
%TEMP%\nsec1eb.tmp\iospecial.ini
%TEMP%\nsec1eb.tmp\system.dll
%TEMP%\nsec1eb.tmp\userinfo.dll
%LOCALAPPDATA%\turbo.net\sandbox\hotspot shield 8.7.1 pre-active\8.7.1.11380\local\stubexe\0xa8ff7c0bf91278b9\tap-windows-9.21.2.exe.manifest.__tmp__
%LOCALAPPDATA%\turbo.net\sandbox\hotspot shield 8.7.1 pre-active\8.7.1.11380\local\stubexe\0xa8ff7c0bf91278b9\tap-windows-9.21.2.exe.__tmp__
%APPDATA%\hss721.blogspot.com\hotspot shield 8.7.1 pre-active\prerequisites\tap-windows-9.21.2.exe
%TEMP%\msib548.tmp
%APPDATA%\hss721.blogspot.com\hotspot shield 8.7.1 pre-active 8.7.1.11380\install\lockhotspot shield 8.7.1_new.x64.msi
%APPDATA%\hss721.blogspot.com\hotspot shield 8.7.1 pre-active 8.7.1.11380\install\lockhotspot shield 8.7.1_new.msi
%APPDATA%\hss721.blogspot.com\hotspot shield 8.7.1 pre-active 8.7.1.11380\install\lockhotspot shield 8.7.1_new.aiui
%LOCALAPPDATA%\turbo.net\sandbox\hotspot shield 8.7.1 pre-active\8.7.1.11380\local\stubexe\0x730c41fed62ae5cd\hotspotshield-8.7.1-plain-773-preactive.exe.manifest.__tmp__
%LOCALAPPDATA%\turbo.net\sandbox\hotspot shield 8.7.1 pre-active\8.7.1.11380\local\stubexe\0x730c41fed62ae5cd\hotspotshield-8.7.1-plain-773-preactive.exe.__tmp__
%TEMP%\spoon\cache\0xf5599628de6d9377\sxs\manifests\hotspotshield-8.7.1-plain-773-preactive.exe_0xeae4ad94a7faa3d85f34ee156803bcff.1.manifest.__tmp__
%TEMP%\spoon\cache\0xf5599628de6d9377\sxs\hotspotshield-8.7.1-plain-773-preactive.exe\hotspotshield-8.7.1-plain-773-preactive.exe.manifest.__tmp__
%TEMP%\nsec1eb.tmp\modern-header.bmp
%TEMP%\nsec1eb.tmp\installoptions.dll

Удаляет следующие файлы

%TEMP%\msib548.tmp

Перемещает следующие файлы

%LOCALAPPDATA%\turbo.net\sandbox\hotspot shield 8.7.1 pre-active\8.7.1.11380\xsandbox.bin.__tmp__ в %LOCALAPPDATA%\turbo.net\sandbox\hotspot shield 8.7.1 pre-active\8.7.1.11380\xsandbox.bin
%TEMP%\spoon\cache\0xf5599628de6d9377\sxs\hotspotshield-8.7.1-plain-773-preactive.exe\hotspotshield-8.7.1-plain-773-preactive.exe.manifest.__tmp__ в %TEMP%\spoon\cache\0xf5599628de6d9377\sxs\hotspotshield-8.7.1-plain-773-preactive.exe\hotspotshield-8.7.1-plain-773-preactive.exe.manifest
%TEMP%\spoon\cache\0xf5599628de6d9377\sxs\manifests\hotspotshield-8.7.1-plain-773-preactive.exe_0xeae4ad94a7faa3d85f34ee156803bcff.1.manifest.__tmp__ в %TEMP%\spoon\cache\0xf5599628de6d9377\sxs\manifests\hotspotshield-8.7.1-plain-773-preactive.exe_0xeae4ad94a7faa3d85f34ee156803bcff.1.manifest
%LOCALAPPDATA%\turbo.net\sandbox\hotspot shield 8.7.1 pre-active\8.7.1.11380\local\stubexe\0x730c41fed62ae5cd\hotspotshield-8.7.1-plain-773-preactive.exe.__tmp__ в %LOCALAPPDATA%\turbo.net\sandbox\hotspot shield 8.7.1 pre-active\8.7.1.11380\local\stubexe\0x730c41fed62ae5cd\hotspotshield-8.7.1-plain-773-preactive.exe
%LOCALAPPDATA%\turbo.net\sandbox\hotspot shield 8.7.1 pre-active\8.7.1.11380\local\stubexe\0x730c41fed62ae5cd\hotspotshield-8.7.1-plain-773-preactive.exe.manifest.__tmp__ в %LOCALAPPDATA%\turbo.net\sandbox\hotspot shield 8.7.1 pre-active\8.7.1.11380\local\stubexe\0x730c41fed62ae5cd\hotspotshield-8.7.1-plain-773-preactive.exe.manifest
%LOCALAPPDATA%\turbo.net\sandbox\hotspot shield 8.7.1 pre-active\8.7.1.11380\local\stubexe\0xa8ff7c0bf91278b9\tap-windows-9.21.2.exe.__tmp__ в %LOCALAPPDATA%\turbo.net\sandbox\hotspot shield 8.7.1 pre-active\8.7.1.11380\local\stubexe\0xa8ff7c0bf91278b9\tap-windows-9.21.2.exe
%LOCALAPPDATA%\turbo.net\sandbox\hotspot shield 8.7.1 pre-active\8.7.1.11380\local\stubexe\0xa8ff7c0bf91278b9\tap-windows-9.21.2.exe.manifest.__tmp__ в %LOCALAPPDATA%\turbo.net\sandbox\hotspot shield 8.7.1 pre-active\8.7.1.11380\local\stubexe\0xa8ff7c0bf91278b9\tap-windows-9.21.2.exe.manifest

Другое

Создает и запускает на исполнение

'%LOCALAPPDATA%\turbo.net\sandbox\hotspot shield 8.7.1 pre-active\8.7.1.11380\local\stubexe\0x730c41fed62ae5cd\hotspotshield-8.7.1-plain-773-preactive.exe' /864A627C-C6B2-464A-AA13-25D62F282BD8
'%LOCALAPPDATA%\turbo.net\sandbox\hotspot shield 8.7.1 pre-active\8.7.1.11380\local\stubexe\0xa8ff7c0bf91278b9\tap-windows-9.21.2.exe' /864A627C-C6B2-464A-AA13-25D62F282BD8