Trojan.MulDrop28.31122

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\DDE Area Viewer 10.16.47] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\DDE Area Viewer 10.16.47] 'ImagePath' = '%ALLUSERSPROFILE%\DDE Area Viewer 10.16.47\DDE Area Viewer 10.16.47.exe'

Создает следующие сервисы

'DDE Area Viewer 10.16.47' %ALLUSERSPROFILE%\DDE Area Viewer 10.16.47\DDE Area Viewer 10.16.47.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-a50tr.tmp\is-svj0n.tmp
%LOCALAPPDATA%\sdkplayer\is-s6r85.tmp
%LOCALAPPDATA%\sdkplayer\is-iec8l.tmp
%LOCALAPPDATA%\sdkplayer\is-s4ljd.tmp
%LOCALAPPDATA%\sdkplayer\is-hnhid.tmp
%LOCALAPPDATA%\sdkplayer\is-1o7rm.tmp
%LOCALAPPDATA%\sdkplayer\is-2tjhb.tmp
%LOCALAPPDATA%\sdkplayer\is-jpvnb.tmp
%LOCALAPPDATA%\sdkplayer\is-p4j73.tmp
%LOCALAPPDATA%\sdkplayer\is-lh31r.tmp
%LOCALAPPDATA%\sdkplayer\is-2qn4r.tmp
%LOCALAPPDATA%\sdkplayer\is-gg8me.tmp
%LOCALAPPDATA%\sdkplayer\uninstall\unins000.dat
%LOCALAPPDATA%\sdkplayer\sdkplayer32_64.exe
%ALLUSERSPROFILE%\dde area viewer 10.16.47\dde area viewer 10.16.47.exe
%ALLUSERSPROFILE%\dd1016it47.dat
%LOCALAPPDATA%\sdkplayer\is-fq29l.tmp
%LOCALAPPDATA%\sdkplayer\is-09uqv.tmp
%LOCALAPPDATA%\sdkplayer\is-9uiq1.tmp
%LOCALAPPDATA%\sdkplayer\is-vj7mk.tmp
%LOCALAPPDATA%\sdkplayer\is-aerp0.tmp
%TEMP%\is-nnchc.tmp\_isetup\_setup64.tmp
%TEMP%\is-nnchc.tmp\_isetup\_shfoldr.dll
%TEMP%\is-nnchc.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\sdkplayer\uninstall\is-f1v00.tmp
%LOCALAPPDATA%\sdkplayer\is-3s8md.tmp
%LOCALAPPDATA%\sdkplayer\is-rg48l.tmp
%LOCALAPPDATA%\sdkplayer\is-gfdf5.tmp
%TEMP%\is-nnchc.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\sdkplayer\is-ib080.tmp
%LOCALAPPDATA%\sdkplayer\is-vrp6k.tmp
%LOCALAPPDATA%\sdkplayer\is-kqcc1.tmp
%LOCALAPPDATA%\sdkplayer\is-ts9rc.tmp
%LOCALAPPDATA%\sdkplayer\is-2epdb.tmp
%LOCALAPPDATA%\sdkplayer\is-34s1c.tmp
%LOCALAPPDATA%\sdkplayer\is-alp8o.tmp
%LOCALAPPDATA%\sdkplayer\is-c23tt.tmp
%LOCALAPPDATA%\sdkplayer\is-pgttc.tmp
%ALLUSERSPROFILE%\dd1016resa.dat
%ALLUSERSPROFILE%\dd1016resb.dat

Перемещает следующие файлы

%LOCALAPPDATA%\sdkplayer\uninstall\is-f1v00.tmp в %LOCALAPPDATA%\sdkplayer\uninstall\unins000.exe
%LOCALAPPDATA%\sdkplayer\is-09uqv.tmp в %LOCALAPPDATA%\sdkplayer\libwinpthread-1.dll
%LOCALAPPDATA%\sdkplayer\is-fq29l.tmp в %LOCALAPPDATA%\sdkplayer\libtiff-5.dll
%LOCALAPPDATA%\sdkplayer\is-lh31r.tmp в %LOCALAPPDATA%\sdkplayer\libsigc-2.0-0.dll
%LOCALAPPDATA%\sdkplayer\is-2tjhb.tmp в %LOCALAPPDATA%\sdkplayer\librsvg-2-2.dll
%LOCALAPPDATA%\sdkplayer\is-1o7rm.tmp в %LOCALAPPDATA%\sdkplayer\libpng16-16.dll
%LOCALAPPDATA%\sdkplayer\is-hnhid.tmp в %LOCALAPPDATA%\sdkplayer\libpixman-1-0.dll
%LOCALAPPDATA%\sdkplayer\is-s4ljd.tmp в %LOCALAPPDATA%\sdkplayer\libpcre-1.dll
%LOCALAPPDATA%\sdkplayer\is-iec8l.tmp в %LOCALAPPDATA%\sdkplayer\libpangowin32-1.0-0.dll
%LOCALAPPDATA%\sdkplayer\is-s6r85.tmp в %LOCALAPPDATA%\sdkplayer\libpangomm-1.4-1.dll
%LOCALAPPDATA%\sdkplayer\is-p4j73.tmp в %LOCALAPPDATA%\sdkplayer\libpangoft2-1.0-0.dll
%LOCALAPPDATA%\sdkplayer\is-jpvnb.tmp в %LOCALAPPDATA%\sdkplayer\libpangocairo-1.0-0.dll
%LOCALAPPDATA%\sdkplayer\is-9uiq1.tmp в %LOCALAPPDATA%\sdkplayer\libpango-1.0-0.dll
%LOCALAPPDATA%\sdkplayer\is-2qn4r.tmp в %LOCALAPPDATA%\sdkplayer\zlib1.dll
%LOCALAPPDATA%\sdkplayer\is-vj7mk.tmp в %LOCALAPPDATA%\sdkplayer\liblzma-5.dll
%LOCALAPPDATA%\sdkplayer\is-c23tt.tmp в %LOCALAPPDATA%\sdkplayer\libjpeg-8.dll
%LOCALAPPDATA%\sdkplayer\is-alp8o.tmp в %LOCALAPPDATA%\sdkplayer\libintl-8.dll
%LOCALAPPDATA%\sdkplayer\is-34s1c.tmp в %LOCALAPPDATA%\sdkplayer\libharfbuzz-0.dll
%LOCALAPPDATA%\sdkplayer\is-2epdb.tmp в %LOCALAPPDATA%\sdkplayer\libgraphite2.dll
%LOCALAPPDATA%\sdkplayer\is-ts9rc.tmp в %LOCALAPPDATA%\sdkplayer\libgomp-1.dll
%LOCALAPPDATA%\sdkplayer\is-kqcc1.tmp в %LOCALAPPDATA%\sdkplayer\libgobject-2.0-0.dll
%LOCALAPPDATA%\sdkplayer\is-vrp6k.tmp в %LOCALAPPDATA%\sdkplayer\libgmodule-2.0-0.dll
%LOCALAPPDATA%\sdkplayer\is-pgttc.tmp в %LOCALAPPDATA%\sdkplayer\libglibmm-2.4-1.dll
%LOCALAPPDATA%\sdkplayer\is-ib080.tmp в %LOCALAPPDATA%\sdkplayer\libgdk_pixbuf-2.0-0.dll
%LOCALAPPDATA%\sdkplayer\is-gfdf5.tmp в %LOCALAPPDATA%\sdkplayer\libgdkmm-2.4-1.dll
%LOCALAPPDATA%\sdkplayer\is-rg48l.tmp в %LOCALAPPDATA%\sdkplayer\libgdk-win32-2.0-0.dll
%LOCALAPPDATA%\sdkplayer\is-3s8md.tmp в %LOCALAPPDATA%\sdkplayer\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\sdkplayer\is-aerp0.tmp в %LOCALAPPDATA%\sdkplayer\liblcms2-2.dll
%LOCALAPPDATA%\sdkplayer\is-gg8me.tmp в %LOCALAPPDATA%\sdkplayer\sdkplayer32_64.exe