Trojan.MulDrop28.26969

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\Equal Math Calculator 10.5.46] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\Equal Math Calculator 10.5.46] 'ImagePath' = '%ALLUSERSPROFILE%\Equal Math Calculator 10.5.46\Equal Math Calculator 10.5.46.exe'

Создает следующие сервисы

'Equal Math Calculator 10.5.46' %ALLUSERSPROFILE%\Equal Math Calculator 10.5.46\Equal Math Calculator 10.5.46.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-jjc16.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\screen camera lite\is-c9o8h.tmp
%LOCALAPPDATA%\screen camera lite\is-oblv1.tmp
%LOCALAPPDATA%\screen camera lite\is-q5h9s.tmp
%LOCALAPPDATA%\screen camera lite\is-3q43a.tmp
%LOCALAPPDATA%\screen camera lite\is-ocsiq.tmp
%LOCALAPPDATA%\screen camera lite\is-3u3he.tmp
%LOCALAPPDATA%\screen camera lite\is-6ed0s.tmp
%LOCALAPPDATA%\screen camera lite\is-015tb.tmp
%LOCALAPPDATA%\screen camera lite\is-dspnv.tmp
%LOCALAPPDATA%\screen camera lite\is-0fpq9.tmp
%LOCALAPPDATA%\screen camera lite\is-e0io5.tmp
%LOCALAPPDATA%\screen camera lite\is-j7i8n.tmp
%LOCALAPPDATA%\screen camera lite\is-7d63p.tmp
%LOCALAPPDATA%\screen camera lite\is-h70kb.tmp
%LOCALAPPDATA%\screen camera lite\uninstall\unins000.dat
%LOCALAPPDATA%\screen camera lite\is-2ejhs.tmp
%LOCALAPPDATA%\screen camera lite\screencameralite32.exe
%LOCALAPPDATA%\screen camera lite\is-otihc.tmp
%LOCALAPPDATA%\screen camera lite\is-0rthc.tmp
%TEMP%\is-3l3da.tmp\_isetup\_regdll.tmp
%TEMP%\is-3l3da.tmp\_isetup\_setup64.tmp
%TEMP%\is-3l3da.tmp\_isetup\_shfoldr.dll
%TEMP%\is-3l3da.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\screen camera lite\uninstall\is-pkaqv.tmp
%LOCALAPPDATA%\screen camera lite\is-04b9g.tmp
%LOCALAPPDATA%\screen camera lite\is-59u5f.tmp
%LOCALAPPDATA%\screen camera lite\is-ecnhh.tmp
%LOCALAPPDATA%\screen camera lite\is-755f2.tmp
%LOCALAPPDATA%\screen camera lite\is-vsu8u.tmp
%LOCALAPPDATA%\screen camera lite\is-9m29m.tmp
%LOCALAPPDATA%\screen camera lite\is-s669k.tmp
%LOCALAPPDATA%\screen camera lite\is-gnhmj.tmp
%LOCALAPPDATA%\screen camera lite\is-877pl.tmp
%LOCALAPPDATA%\screen camera lite\is-ksfk8.tmp
%LOCALAPPDATA%\screen camera lite\is-v3csb.tmp
%ALLUSERSPROFILE%\equal math calculator 10.5.46\equal math calculator 10.5.46.exe

Перемещает следующие файлы

%LOCALAPPDATA%\screen camera lite\uninstall\is-pkaqv.tmp в %LOCALAPPDATA%\screen camera lite\uninstall\unins000.exe
%LOCALAPPDATA%\screen camera lite\is-j7i8n.tmp в %LOCALAPPDATA%\screen camera lite\libwinpthread-1.dll
%LOCALAPPDATA%\screen camera lite\is-e0io5.tmp в %LOCALAPPDATA%\screen camera lite\libtiff-5.dll
%LOCALAPPDATA%\screen camera lite\is-0fpq9.tmp в %LOCALAPPDATA%\screen camera lite\libsigc-2.0-0.dll
%LOCALAPPDATA%\screen camera lite\is-dspnv.tmp в %LOCALAPPDATA%\screen camera lite\librsvg-2-2.dll
%LOCALAPPDATA%\screen camera lite\is-015tb.tmp в %LOCALAPPDATA%\screen camera lite\libpng16-16.dll
%LOCALAPPDATA%\screen camera lite\is-6ed0s.tmp в %LOCALAPPDATA%\screen camera lite\libpixman-1-0.dll
%LOCALAPPDATA%\screen camera lite\is-3u3he.tmp в %LOCALAPPDATA%\screen camera lite\libpcre-1.dll
%LOCALAPPDATA%\screen camera lite\is-ocsiq.tmp в %LOCALAPPDATA%\screen camera lite\libpangowin32-1.0-0.dll
%LOCALAPPDATA%\screen camera lite\is-3q43a.tmp в %LOCALAPPDATA%\screen camera lite\libpangomm-1.4-1.dll
%LOCALAPPDATA%\screen camera lite\is-q5h9s.tmp в %LOCALAPPDATA%\screen camera lite\libpangoft2-1.0-0.dll
%LOCALAPPDATA%\screen camera lite\is-oblv1.tmp в %LOCALAPPDATA%\screen camera lite\libpangocairo-1.0-0.dll
%LOCALAPPDATA%\screen camera lite\is-c9o8h.tmp в %LOCALAPPDATA%\screen camera lite\libpango-1.0-0.dll
%LOCALAPPDATA%\screen camera lite\is-7d63p.tmp в %LOCALAPPDATA%\screen camera lite\zlib1.dll
%LOCALAPPDATA%\screen camera lite\is-2ejhs.tmp в %LOCALAPPDATA%\screen camera lite\liblzma-5.dll
%LOCALAPPDATA%\screen camera lite\is-v3csb.tmp в %LOCALAPPDATA%\screen camera lite\libjpeg-8.dll
%LOCALAPPDATA%\screen camera lite\is-0rthc.tmp в %LOCALAPPDATA%\screen camera lite\libintl-8.dll
%LOCALAPPDATA%\screen camera lite\is-ksfk8.tmp в %LOCALAPPDATA%\screen camera lite\libharfbuzz-0.dll
%LOCALAPPDATA%\screen camera lite\is-877pl.tmp в %LOCALAPPDATA%\screen camera lite\libgraphite2.dll
%LOCALAPPDATA%\screen camera lite\is-gnhmj.tmp в %LOCALAPPDATA%\screen camera lite\libgomp-1.dll
%LOCALAPPDATA%\screen camera lite\is-s669k.tmp в %LOCALAPPDATA%\screen camera lite\libgobject-2.0-0.dll
%LOCALAPPDATA%\screen camera lite\is-9m29m.tmp в %LOCALAPPDATA%\screen camera lite\libgmodule-2.0-0.dll
%LOCALAPPDATA%\screen camera lite\is-vsu8u.tmp в %LOCALAPPDATA%\screen camera lite\libglibmm-2.4-1.dll
%LOCALAPPDATA%\screen camera lite\is-755f2.tmp в %LOCALAPPDATA%\screen camera lite\libgdk_pixbuf-2.0-0.dll
%LOCALAPPDATA%\screen camera lite\is-ecnhh.tmp в %LOCALAPPDATA%\screen camera lite\libgdkmm-2.4-1.dll
%LOCALAPPDATA%\screen camera lite\is-59u5f.tmp в %LOCALAPPDATA%\screen camera lite\libgdk-win32-2.0-0.dll
%LOCALAPPDATA%\screen camera lite\is-04b9g.tmp в %LOCALAPPDATA%\screen camera lite\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\screen camera lite\is-otihc.tmp в %LOCALAPPDATA%\screen camera lite\liblcms2-2.dll
%LOCALAPPDATA%\screen camera lite\is-h70kb.tmp в %LOCALAPPDATA%\screen camera lite\screencameralite32.exe