Trojan.MulDrop22.43147

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\Software\Classes\Stereoscopic Metafile\shell\open\command] '' = '"%ProgramFiles(x86)%\Stereoscopic Player\StereoPlayer.exe" "%1"'
[HKLM\Software\Classes\Stereoscopic Player Command\shell\open\command] '' = '"%ProgramFiles(x86)%\Stereoscopic Player\StereoPlayer.exe" -cmd:"%1"'
[HKLM\Software\Classes\Playlist\shell\open\command] '' = '"%ProgramFiles(x86)%\Stereoscopic Player\StereoPlayer.exe" "%1"'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\_ir_sf_temp_0\irsetup.exe
%ProgramFiles(x86)%\stereoscopic player\coreavcdecoder.dll
%ProgramFiles(x86)%\stereoscopic player\streamcontrol.dll
%ProgramFiles(x86)%\stereoscopic player\greek.lng
%ProgramFiles(x86)%\stereoscopic player\dutch.lng
%ProgramFiles(x86)%\stereoscopic player\eula.rtf
%ProgramFiles(x86)%\stereoscopic player\chinesetaiwan.lng
%ProgramFiles(x86)%\stereoscopic player\hungarian.lng
%ProgramFiles(x86)%\stereoscopic player\mlmxfsplitter.lic
%ProgramFiles(x86)%\stereoscopic player\wms.dll
%ProgramFiles(x86)%\stereoscopic player\flvsplitter.dll
%ProgramFiles(x86)%\stereoscopic player\portuguese.lng
%ProgramFiles(x86)%\stereoscopic player\j2kdecoder.dll
%WINDIR%\unattended soft setup log.txt
%ProgramFiles(x86)%\stereoscopic player\readme.txt
%ProgramFiles(x86)%\stereoscopic player\finnish.lng
%ProgramFiles(x86)%\stereoscopic player\italian.lng
%ProgramFiles(x86)%\stereoscopic player\sis.dll
%ProgramFiles(x86)%\stereoscopic player\serbian.lng
%ProgramFiles(x86)%\stereoscopic player\matroskasplitter.dll
%WINDIR%\installer\{c5e45bc3-a477-43a9-9f14-f6b82013daea}\_853f67d554f05449430e7e.exe
%WINDIR%\installer\{c5e45bc3-a477-43a9-9f14-f6b82013daea}\_8b3566eb3edda1fe1eca0b.exe
%WINDIR%\installer\{c5e45bc3-a477-43a9-9f14-f6b82013daea}\_256656cf86f0d26ccffe06.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\3dtv.at stereoscopic player\stereoscopic player.lnk
C:\users\public\desktop\stereoscopic player.lnk
%ProgramFiles(x86)%\stereoscopic player\spanish.lng
%ProgramFiles(x86)%\stereoscopic player\english.lng
%ProgramFiles(x86)%\stereoscopic player\srd.dll
%ProgramFiles(x86)%\stereoscopic player\japanese.lng
%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\_ir_sf_temp_0\irimg1.jpg
%TEMP%\_ir_sf_temp_0\irimg2.jpg
%TEMP%\_ir_sf_temp_0\stereoscopic.player.1.7.3.exe
%TEMP%\7zipsfx.000\stereoscopicplayer173_en.msi
%TEMP%\7zipsfx.000\regfile.reg
%ProgramFiles(x86)%\stereoscopic player\stereoplayer.dll
%ProgramFiles(x86)%\stereoscopic player\mlproxy.dll
%ProgramFiles(x86)%\stereoscopic player\qtsource.dll
%ProgramFiles(x86)%\stereoscopic player\stereoplayer.exe
%ProgramFiles(x86)%\stereoscopic player\stf.dll
%ProgramFiles(x86)%\stereoscopic player\mp4splitter.dll
%ProgramFiles(x86)%\stereoscopic player\french.lng
%ProgramFiles(x86)%\stereoscopic player\fxc.dll
%ProgramFiles(x86)%\stereoscopic player\german.lng
%ProgramFiles(x86)%\stereoscopic player\stereoplayer.cst
%ProgramFiles(x86)%\stereoscopic player\mpegsplitter.dll
%ProgramFiles(x86)%\stereoscopic player\qtsource.lic
%ProgramFiles(x86)%\stereoscopic player\russian.lng
%ProgramFiles(x86)%\stereoscopic player\mlmxfsplitter.dll
%ProgramFiles(x86)%\stereoscopic player\slovenian.lng
%ProgramFiles(x86)%\stereoscopic player\swedish.lng
%ProgramFiles(x86)%\stereoscopic player\turkish.lng
%ProgramFiles(x86)%\stereoscopic player\library.dat
%ProgramFiles(x86)%\stereoscopic player\polish.lng
C:\users\public\desktop\u-soft.org.url

Удаляет следующие файлы

%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\7zipsfx.000\regfile.reg
%TEMP%\7zipsfx.000\stereoscopicplayer173_en.msi
%TEMP%\_ir_sf_temp_0\irimg1.jpg
%TEMP%\_ir_sf_temp_0\irimg2.jpg
%TEMP%\_ir_sf_temp_0\stereoscopic.player.1.7.3.exe
%TEMP%\_ir_sf_temp_0\irsetup.exe

Другое

Ищет следующие окна

ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: 'MS_WINHELP' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:652322 "__IRAFN:<Полный путь к файлу>" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-1238866942-1249195528-555854008-1000"
'%TEMP%\_ir_sf_temp_0\stereoscopic.player.1.7.3.exe'
'%ProgramFiles(x86)%\stereoscopic player\stereoplayer.exe' /REGSERVER

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\7ZipSfx.000\StereoscopicPlayer173_en.msi" /qn
'%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles(x86)%\Stereoscopic Player\StereoPlayer.dll"
'%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles(x86)%\Stereoscopic Player\MLProxy.dll"
'%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles(x86)%\Stereoscopic Player\Stf.dll"
'%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles(x86)%\Stereoscopic Player\Fxc.dll"
'%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles(x86)%\Stereoscopic Player\Srd.dll"
'%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles(x86)%\Stereoscopic Player\StreamControl.dll"
'%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles(x86)%\Stereoscopic Player\Wms.dll"
'%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles(x86)%\Stereoscopic Player\J2KDecoder.dll"
'%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles(x86)%\Stereoscopic Player\Sis.dll"
'%WINDIR%\syswow64\regedit.exe' /S regfile.reg