Trojan.MulDrop28.31123

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\DDE Area Viewer 10.16.46] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\DDE Area Viewer 10.16.46] 'ImagePath' = '%ALLUSERSPROFILE%\DDE Area Viewer 10.16.46\DDE Area Viewer 10.16.46.exe'

Создает следующие сервисы

'DDE Area Viewer 10.16.46' %ALLUSERSPROFILE%\DDE Area Viewer 10.16.46\DDE Area Viewer 10.16.46.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-ojb0j.tmp\is-5un8e.tmp
%LOCALAPPDATA%\sdkplayer\is-nkv7f.tmp
%LOCALAPPDATA%\sdkplayer\is-913if.tmp
%LOCALAPPDATA%\sdkplayer\is-kk36r.tmp
%LOCALAPPDATA%\sdkplayer\is-h7qur.tmp
%LOCALAPPDATA%\sdkplayer\is-tcpi6.tmp
%LOCALAPPDATA%\sdkplayer\is-2k1r5.tmp
%LOCALAPPDATA%\sdkplayer\is-2gvh8.tmp
%LOCALAPPDATA%\sdkplayer\is-ge1e0.tmp
%LOCALAPPDATA%\sdkplayer\is-tjm50.tmp
%LOCALAPPDATA%\sdkplayer\is-c4ts8.tmp
%LOCALAPPDATA%\sdkplayer\is-sgd5l.tmp
%LOCALAPPDATA%\sdkplayer\is-6hcuu.tmp
%LOCALAPPDATA%\sdkplayer\is-jekgl.tmp
%LOCALAPPDATA%\sdkplayer\is-9ld9f.tmp
%LOCALAPPDATA%\sdkplayer\uninstall\unins000.dat
%LOCALAPPDATA%\sdkplayer\is-7hb7n.tmp
%LOCALAPPDATA%\sdkplayer\sdkplayer32_64.exe
%LOCALAPPDATA%\sdkplayer\is-ibjnj.tmp
%LOCALAPPDATA%\sdkplayer\is-10o82.tmp
%TEMP%\is-uptq9.tmp\_isetup\_regdll.tmp
%TEMP%\is-uptq9.tmp\_isetup\_setup64.tmp
%TEMP%\is-uptq9.tmp\_isetup\_shfoldr.dll
%TEMP%\is-uptq9.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\sdkplayer\uninstall\is-rhb4k.tmp
%LOCALAPPDATA%\sdkplayer\is-tei5k.tmp
%LOCALAPPDATA%\sdkplayer\is-7ujcr.tmp
%LOCALAPPDATA%\sdkplayer\is-5ens7.tmp
%LOCALAPPDATA%\sdkplayer\is-3ie18.tmp
%LOCALAPPDATA%\sdkplayer\is-b43jo.tmp
%LOCALAPPDATA%\sdkplayer\is-pppef.tmp
%LOCALAPPDATA%\sdkplayer\is-rv0b7.tmp
%LOCALAPPDATA%\sdkplayer\is-7kbf9.tmp
%LOCALAPPDATA%\sdkplayer\is-73m8q.tmp
%LOCALAPPDATA%\sdkplayer\is-akk2q.tmp
%LOCALAPPDATA%\sdkplayer\is-eu0ie.tmp
%ALLUSERSPROFILE%\dde area viewer 10.16.46\dde area viewer 10.16.46.exe

Перемещает следующие файлы

%LOCALAPPDATA%\sdkplayer\uninstall\is-rhb4k.tmp в %LOCALAPPDATA%\sdkplayer\uninstall\unins000.exe
%LOCALAPPDATA%\sdkplayer\is-6hcuu.tmp в %LOCALAPPDATA%\sdkplayer\libwinpthread-1.dll
%LOCALAPPDATA%\sdkplayer\is-sgd5l.tmp в %LOCALAPPDATA%\sdkplayer\libtiff-5.dll
%LOCALAPPDATA%\sdkplayer\is-c4ts8.tmp в %LOCALAPPDATA%\sdkplayer\libsigc-2.0-0.dll
%LOCALAPPDATA%\sdkplayer\is-tjm50.tmp в %LOCALAPPDATA%\sdkplayer\librsvg-2-2.dll
%LOCALAPPDATA%\sdkplayer\is-ge1e0.tmp в %LOCALAPPDATA%\sdkplayer\libpng16-16.dll
%LOCALAPPDATA%\sdkplayer\is-2gvh8.tmp в %LOCALAPPDATA%\sdkplayer\libpixman-1-0.dll
%LOCALAPPDATA%\sdkplayer\is-2k1r5.tmp в %LOCALAPPDATA%\sdkplayer\libpcre-1.dll
%LOCALAPPDATA%\sdkplayer\is-tcpi6.tmp в %LOCALAPPDATA%\sdkplayer\libpangowin32-1.0-0.dll
%LOCALAPPDATA%\sdkplayer\is-h7qur.tmp в %LOCALAPPDATA%\sdkplayer\libpangomm-1.4-1.dll
%LOCALAPPDATA%\sdkplayer\is-kk36r.tmp в %LOCALAPPDATA%\sdkplayer\libpangoft2-1.0-0.dll
%LOCALAPPDATA%\sdkplayer\is-913if.tmp в %LOCALAPPDATA%\sdkplayer\libpangocairo-1.0-0.dll
%LOCALAPPDATA%\sdkplayer\is-nkv7f.tmp в %LOCALAPPDATA%\sdkplayer\libpango-1.0-0.dll
%LOCALAPPDATA%\sdkplayer\is-jekgl.tmp в %LOCALAPPDATA%\sdkplayer\zlib1.dll
%LOCALAPPDATA%\sdkplayer\is-7hb7n.tmp в %LOCALAPPDATA%\sdkplayer\liblzma-5.dll
%LOCALAPPDATA%\sdkplayer\is-eu0ie.tmp в %LOCALAPPDATA%\sdkplayer\libjpeg-8.dll
%LOCALAPPDATA%\sdkplayer\is-10o82.tmp в %LOCALAPPDATA%\sdkplayer\libintl-8.dll
%LOCALAPPDATA%\sdkplayer\is-akk2q.tmp в %LOCALAPPDATA%\sdkplayer\libharfbuzz-0.dll
%LOCALAPPDATA%\sdkplayer\is-73m8q.tmp в %LOCALAPPDATA%\sdkplayer\libgraphite2.dll
%LOCALAPPDATA%\sdkplayer\is-7kbf9.tmp в %LOCALAPPDATA%\sdkplayer\libgomp-1.dll
%LOCALAPPDATA%\sdkplayer\is-rv0b7.tmp в %LOCALAPPDATA%\sdkplayer\libgobject-2.0-0.dll
%LOCALAPPDATA%\sdkplayer\is-pppef.tmp в %LOCALAPPDATA%\sdkplayer\libgmodule-2.0-0.dll
%LOCALAPPDATA%\sdkplayer\is-b43jo.tmp в %LOCALAPPDATA%\sdkplayer\libglibmm-2.4-1.dll
%LOCALAPPDATA%\sdkplayer\is-3ie18.tmp в %LOCALAPPDATA%\sdkplayer\libgdk_pixbuf-2.0-0.dll
%LOCALAPPDATA%\sdkplayer\is-5ens7.tmp в %LOCALAPPDATA%\sdkplayer\libgdkmm-2.4-1.dll
%LOCALAPPDATA%\sdkplayer\is-7ujcr.tmp в %LOCALAPPDATA%\sdkplayer\libgdk-win32-2.0-0.dll
%LOCALAPPDATA%\sdkplayer\is-tei5k.tmp в %LOCALAPPDATA%\sdkplayer\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\sdkplayer\is-ibjnj.tmp в %LOCALAPPDATA%\sdkplayer\liblcms2-2.dll
%LOCALAPPDATA%\sdkplayer\is-9ld9f.tmp в %LOCALAPPDATA%\sdkplayer\sdkplayer32_64.exe