Trojan.MulDrop21.41369

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

%APPDATA%\microsoft\windows\start menu\programs\startup\winrar.lnk

Изменения в файловой системе

Создает следующие файлы

%HOMEPATH%\runtimesfx\cwjbin.jar
%HOMEPATH%\runtimesfx\jre\conf\net.properties
%HOMEPATH%\runtimesfx\jre\conf\logging.properties
%HOMEPATH%\runtimesfx\jre\bin\zip.dll
%HOMEPATH%\runtimesfx\jre\bin\verify.dll
%HOMEPATH%\runtimesfx\jre\bin\vcruntime140_1.dll
%HOMEPATH%\runtimesfx\jre\bin\vcruntime140.dll
%HOMEPATH%\runtimesfx\jre\bin\ucrtbase.dll
%HOMEPATH%\runtimesfx\jre\bin\splashscreen.dll
%HOMEPATH%\runtimesfx\jre\bin\server\jvm.dll
%HOMEPATH%\runtimesfx\jre\bin\javajpeg.dll
%HOMEPATH%\runtimesfx\jre\bin\prefs.dll
%HOMEPATH%\runtimesfx\jre\bin\net.dll
%HOMEPATH%\runtimesfx\jre\bin\msvcp140.dll
%HOMEPATH%\runtimesfx\jre\bin\mlib_image.dll
%HOMEPATH%\runtimesfx\jre\bin\lcms.dll
%HOMEPATH%\runtimesfx\jre\bin\keytool.exe
%HOMEPATH%\runtimesfx\jre\bin\jsound.dll
%HOMEPATH%\runtimesfx\jre\bin\jli.dll
%HOMEPATH%\runtimesfx\jre\bin\jimage.dll
%HOMEPATH%\runtimesfx\jre\bin\jawt.dll
%HOMEPATH%\runtimesfx\jre\bin\nio.dll
%HOMEPATH%\runtimesfx\jre\bin\javaw.exe
%HOMEPATH%\runtimesfx\jre\conf\security\java.policy
%HOMEPATH%\runtimesfx\jre\lib\jawt.lib
%HOMEPATH%\runtimesfx\jre\lib\security\public_suffix_list.dat
%HOMEPATH%\runtimesfx\jre\lib\security\default.policy
%HOMEPATH%\runtimesfx\jre\lib\security\cacerts
%HOMEPATH%\runtimesfx\jre\lib\security\blocked.certs
%HOMEPATH%\runtimesfx\jre\lib\psfontj2d.properties
%HOMEPATH%\runtimesfx\jre\lib\psfont.properties.ja
%HOMEPATH%\runtimesfx\jre\lib\modules
%HOMEPATH%\runtimesfx\jre\lib\jvm.lib
%HOMEPATH%\runtimesfx\jre\lib\jvm.cfg
%HOMEPATH%\runtimesfx\jre\conf\security\policy\limited\default_local.policy
%HOMEPATH%\runtimesfx\jre\conf\security\java.security
%HOMEPATH%\runtimesfx\jre\lib\fontconfig.properties.src
%HOMEPATH%\runtimesfx\jre\lib\fontconfig.bfc
%HOMEPATH%\runtimesfx\jre\lib\classlist
%HOMEPATH%\runtimesfx\jre\conf\sound.properties
%HOMEPATH%\runtimesfx\jre\conf\security\policy\unlimited\default_us_export.policy
%HOMEPATH%\runtimesfx\jre\conf\security\policy\unlimited\default_local.policy
%HOMEPATH%\runtimesfx\jre\conf\security\policy\readme.txt
%HOMEPATH%\runtimesfx\jre\conf\security\policy\limited\exempt_local.policy
%HOMEPATH%\runtimesfx\jre\conf\security\policy\limited\default_us_export.policy
%HOMEPATH%\runtimesfx\jre\lib\jrt-fs.jar
%HOMEPATH%\runtimesfx\jre\bin\java.exe
%HOMEPATH%\runtimesfx\jre\bin\java.dll
%HOMEPATH%\runtimesfx\jre\bin\freetype.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-memory-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-localization-l1-2-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-heap-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-profile-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-handle-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-file-l1-2-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-file-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-debug-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-datetime-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-console-l1-2-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-console-l1-1-0.dll
%HOMEPATH%\runtimesfx\winctl.json
%HOMEPATH%\runtimesfx\winctl.exe
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-file-l2-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-string-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\fontmanager.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-crt-math-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\awt.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-crt-utility-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-crt-time-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-crt-string-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-crt-process-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-crt-private-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-crt-locale-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-synch-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-crt-heap-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-crt-environment-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-crt-convert-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-crt-conio-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-util-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-timezone-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll
%HOMEPATH%\runtimesfx\jre\bin\api-ms-win-core-synch-l1-2-0.dll
%HOMEPATH%\runtimesfx\jre\lib\tzdb.dat
%HOMEPATH%\runtimesfx\jre\lib\tzmappings