Trojan.MulDrop28.29289

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\EXXY Game Terminal 10.11.47] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\EXXY Game Terminal 10.11.47] 'ImagePath' = '%ALLUSERSPROFILE%\EXXY Game Terminal 10.11.47\EXXY Game Terminal 10.11.47.exe'

Создает следующие сервисы

'EXXY Game Terminal 10.11.47' %ALLUSERSPROFILE%\EXXY Game Terminal 10.11.47\EXXY Game Terminal 10.11.47.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-15s43.tmp\is-rek9e.tmp
%LOCALAPPDATA%\middle media player\is-iv6rh.tmp
%LOCALAPPDATA%\middle media player\is-0coba.tmp
%LOCALAPPDATA%\middle media player\is-ud49g.tmp
%LOCALAPPDATA%\middle media player\is-ilecn.tmp
%LOCALAPPDATA%\middle media player\is-djgq0.tmp
%LOCALAPPDATA%\middle media player\is-1lken.tmp
%LOCALAPPDATA%\middle media player\is-ml4hg.tmp
%LOCALAPPDATA%\middle media player\is-vui7l.tmp
%LOCALAPPDATA%\middle media player\is-ppgvm.tmp
%LOCALAPPDATA%\middle media player\is-bcm64.tmp
%LOCALAPPDATA%\middle media player\is-j0hdi.tmp
%LOCALAPPDATA%\middle media player\is-3n7mv.tmp
%LOCALAPPDATA%\middle media player\is-2m5ra.tmp
%LOCALAPPDATA%\middle media player\is-ehdra.tmp
%LOCALAPPDATA%\middle media player\uninstall\unins000.dat
%LOCALAPPDATA%\middle media player\is-j97md.tmp
%LOCALAPPDATA%\middle media player\middlemediaplayer.exe
%LOCALAPPDATA%\middle media player\is-llnor.tmp
%LOCALAPPDATA%\middle media player\is-osu9g.tmp
%TEMP%\is-aruuk.tmp\_isetup\_regdll.tmp
%TEMP%\is-aruuk.tmp\_isetup\_setup64.tmp
%TEMP%\is-aruuk.tmp\_isetup\_shfoldr.dll
%TEMP%\is-aruuk.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\middle media player\uninstall\is-kt8es.tmp
%LOCALAPPDATA%\middle media player\is-1navb.tmp
%LOCALAPPDATA%\middle media player\is-d2uds.tmp
%LOCALAPPDATA%\middle media player\is-5fa3q.tmp
%LOCALAPPDATA%\middle media player\is-8u0jn.tmp
%LOCALAPPDATA%\middle media player\is-c65eg.tmp
%LOCALAPPDATA%\middle media player\is-9rbco.tmp
%LOCALAPPDATA%\middle media player\is-b3lt6.tmp
%LOCALAPPDATA%\middle media player\is-c6idi.tmp
%LOCALAPPDATA%\middle media player\is-1pgmo.tmp
%LOCALAPPDATA%\middle media player\is-pdup0.tmp
%LOCALAPPDATA%\middle media player\is-n11m6.tmp
%ALLUSERSPROFILE%\exxy game terminal 10.11.47\exxy game terminal 10.11.47.exe

Перемещает следующие файлы

%LOCALAPPDATA%\middle media player\uninstall\is-kt8es.tmp в %LOCALAPPDATA%\middle media player\uninstall\unins000.exe
%LOCALAPPDATA%\middle media player\is-3n7mv.tmp в %LOCALAPPDATA%\middle media player\libwinpthread-1.dll
%LOCALAPPDATA%\middle media player\is-j0hdi.tmp в %LOCALAPPDATA%\middle media player\libtiff-5.dll
%LOCALAPPDATA%\middle media player\is-bcm64.tmp в %LOCALAPPDATA%\middle media player\libsigc-2.0-0.dll
%LOCALAPPDATA%\middle media player\is-ppgvm.tmp в %LOCALAPPDATA%\middle media player\librsvg-2-2.dll
%LOCALAPPDATA%\middle media player\is-vui7l.tmp в %LOCALAPPDATA%\middle media player\libpng16-16.dll
%LOCALAPPDATA%\middle media player\is-ml4hg.tmp в %LOCALAPPDATA%\middle media player\libpixman-1-0.dll
%LOCALAPPDATA%\middle media player\is-1lken.tmp в %LOCALAPPDATA%\middle media player\libpcre-1.dll
%LOCALAPPDATA%\middle media player\is-djgq0.tmp в %LOCALAPPDATA%\middle media player\libpangowin32-1.0-0.dll
%LOCALAPPDATA%\middle media player\is-ilecn.tmp в %LOCALAPPDATA%\middle media player\libpangomm-1.4-1.dll
%LOCALAPPDATA%\middle media player\is-ud49g.tmp в %LOCALAPPDATA%\middle media player\libpangoft2-1.0-0.dll
%LOCALAPPDATA%\middle media player\is-0coba.tmp в %LOCALAPPDATA%\middle media player\libpangocairo-1.0-0.dll
%LOCALAPPDATA%\middle media player\is-iv6rh.tmp в %LOCALAPPDATA%\middle media player\libpango-1.0-0.dll
%LOCALAPPDATA%\middle media player\is-2m5ra.tmp в %LOCALAPPDATA%\middle media player\zlib1.dll
%LOCALAPPDATA%\middle media player\is-j97md.tmp в %LOCALAPPDATA%\middle media player\liblzma-5.dll
%LOCALAPPDATA%\middle media player\is-n11m6.tmp в %LOCALAPPDATA%\middle media player\libjpeg-8.dll
%LOCALAPPDATA%\middle media player\is-osu9g.tmp в %LOCALAPPDATA%\middle media player\libintl-8.dll
%LOCALAPPDATA%\middle media player\is-pdup0.tmp в %LOCALAPPDATA%\middle media player\libharfbuzz-0.dll
%LOCALAPPDATA%\middle media player\is-1pgmo.tmp в %LOCALAPPDATA%\middle media player\libgraphite2.dll
%LOCALAPPDATA%\middle media player\is-c6idi.tmp в %LOCALAPPDATA%\middle media player\libgomp-1.dll
%LOCALAPPDATA%\middle media player\is-b3lt6.tmp в %LOCALAPPDATA%\middle media player\libgobject-2.0-0.dll
%LOCALAPPDATA%\middle media player\is-9rbco.tmp в %LOCALAPPDATA%\middle media player\libgmodule-2.0-0.dll
%LOCALAPPDATA%\middle media player\is-c65eg.tmp в %LOCALAPPDATA%\middle media player\libglibmm-2.4-1.dll
%LOCALAPPDATA%\middle media player\is-8u0jn.tmp в %LOCALAPPDATA%\middle media player\libgdk_pixbuf-2.0-0.dll
%LOCALAPPDATA%\middle media player\is-5fa3q.tmp в %LOCALAPPDATA%\middle media player\libgdkmm-2.4-1.dll
%LOCALAPPDATA%\middle media player\is-d2uds.tmp в %LOCALAPPDATA%\middle media player\libgdk-win32-2.0-0.dll
%LOCALAPPDATA%\middle media player\is-1navb.tmp в %LOCALAPPDATA%\middle media player\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\middle media player\is-llnor.tmp в %LOCALAPPDATA%\middle media player\liblcms2-2.dll
%LOCALAPPDATA%\middle media player\is-ehdra.tmp в %LOCALAPPDATA%\middle media player\middlemediaplayer.exe