Trojan.MulDrop28.35363

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\DW Edit Control 10.30.46] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\DW Edit Control 10.30.46] 'ImagePath' = '%ALLUSERSPROFILE%\DW Edit Control 10.30.46\DW Edit Control 10.30.46.exe'

Создает следующие сервисы

'DW Edit Control 10.30.46' %ALLUSERSPROFILE%\DW Edit Control 10.30.46\DW Edit Control 10.30.46.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-o1577.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\ascreenrecorder\is-itv0t.tmp
%LOCALAPPDATA%\ascreenrecorder\is-6m5qu.tmp
%LOCALAPPDATA%\ascreenrecorder\is-jn6va.tmp
%LOCALAPPDATA%\ascreenrecorder\is-deg0e.tmp
%LOCALAPPDATA%\ascreenrecorder\is-bglud.tmp
%LOCALAPPDATA%\ascreenrecorder\is-a0ndd.tmp
%LOCALAPPDATA%\ascreenrecorder\is-mfjsq.tmp
%LOCALAPPDATA%\ascreenrecorder\ascreenrecorder3264.exe
%LOCALAPPDATA%\ascreenrecorder\is-b08f9.tmp
%LOCALAPPDATA%\ascreenrecorder\is-l3fgs.tmp
%LOCALAPPDATA%\ascreenrecorder\is-igrj1.tmp
%LOCALAPPDATA%\ascreenrecorder\is-38c11.tmp
%LOCALAPPDATA%\ascreenrecorder\is-mgana.tmp
%LOCALAPPDATA%\ascreenrecorder\unins000.dat
%LOCALAPPDATA%\ascreenrecorder\is-ifkb5.tmp
%LOCALAPPDATA%\ascreenrecorder\is-sbpmp.tmp
%LOCALAPPDATA%\ascreenrecorder\is-f5iir.tmp
%LOCALAPPDATA%\ascreenrecorder\is-ar9j8.tmp
%TEMP%\is-htkdq.tmp\_isetup\_setup64.tmp
%TEMP%\is-htkdq.tmp\_isetup\_shfoldr.dll
%TEMP%\is-htkdq.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\ascreenrecorder\is-2ghvf.tmp
%LOCALAPPDATA%\ascreenrecorder\is-8b9a2.tmp
%LOCALAPPDATA%\ascreenrecorder\is-tnnq7.tmp
%LOCALAPPDATA%\ascreenrecorder\is-cnopl.tmp
%LOCALAPPDATA%\ascreenrecorder\is-o6qn1.tmp
%LOCALAPPDATA%\ascreenrecorder\is-bcs7v.tmp
%LOCALAPPDATA%\ascreenrecorder\is-oeamp.tmp
%LOCALAPPDATA%\ascreenrecorder\is-ksd52.tmp
%LOCALAPPDATA%\ascreenrecorder\is-dh41p.tmp
%LOCALAPPDATA%\ascreenrecorder\is-gtjrl.tmp
%LOCALAPPDATA%\ascreenrecorder\is-m6tg5.tmp
%LOCALAPPDATA%\ascreenrecorder\is-p5lqk.tmp
%ALLUSERSPROFILE%\dw edit control 10.30.46\dw edit control 10.30.46.exe

Перемещает следующие файлы

%LOCALAPPDATA%\ascreenrecorder\is-2ghvf.tmp в %LOCALAPPDATA%\ascreenrecorder\unins000.exe
%LOCALAPPDATA%\ascreenrecorder\is-igrj1.tmp в %LOCALAPPDATA%\ascreenrecorder\libtiff-5.dll
%LOCALAPPDATA%\ascreenrecorder\is-l3fgs.tmp в %LOCALAPPDATA%\ascreenrecorder\libsigc-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-b08f9.tmp в %LOCALAPPDATA%\ascreenrecorder\librsvg-2-2.dll
%LOCALAPPDATA%\ascreenrecorder\is-mfjsq.tmp в %LOCALAPPDATA%\ascreenrecorder\libpng16-16.dll
%LOCALAPPDATA%\ascreenrecorder\is-sbpmp.tmp в %LOCALAPPDATA%\ascreenrecorder\libpixman-1-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-a0ndd.tmp в %LOCALAPPDATA%\ascreenrecorder\libpcre-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-bglud.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangowin32-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-deg0e.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangomm-1.4-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-jn6va.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangoft2-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-6m5qu.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangocairo-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-itv0t.tmp в %LOCALAPPDATA%\ascreenrecorder\libpango-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-ifkb5.tmp в %LOCALAPPDATA%\ascreenrecorder\liblzma-5.dll
%LOCALAPPDATA%\ascreenrecorder\is-f5iir.tmp в %LOCALAPPDATA%\ascreenrecorder\liblcms2-2.dll
%LOCALAPPDATA%\ascreenrecorder\is-p5lqk.tmp в %LOCALAPPDATA%\ascreenrecorder\libjpeg-8.dll
%LOCALAPPDATA%\ascreenrecorder\is-o6qn1.tmp в %LOCALAPPDATA%\ascreenrecorder\libintl-8.dll
%LOCALAPPDATA%\ascreenrecorder\is-m6tg5.tmp в %LOCALAPPDATA%\ascreenrecorder\libharfbuzz-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-gtjrl.tmp в %LOCALAPPDATA%\ascreenrecorder\libgraphite2.dll
%LOCALAPPDATA%\ascreenrecorder\is-dh41p.tmp в %LOCALAPPDATA%\ascreenrecorder\libgomp-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-ksd52.tmp в %LOCALAPPDATA%\ascreenrecorder\libgobject-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-oeamp.tmp в %LOCALAPPDATA%\ascreenrecorder\libgmodule-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-bcs7v.tmp в %LOCALAPPDATA%\ascreenrecorder\libglibmm-2.4-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-cnopl.tmp в %LOCALAPPDATA%\ascreenrecorder\libgdk_pixbuf-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-ar9j8.tmp в %LOCALAPPDATA%\ascreenrecorder\libgdkmm-2.4-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-tnnq7.tmp в %LOCALAPPDATA%\ascreenrecorder\libgdk-win32-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-8b9a2.tmp в %LOCALAPPDATA%\ascreenrecorder\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-38c11.tmp в %LOCALAPPDATA%\ascreenrecorder\libwinpthread-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-mgana.tmp в %LOCALAPPDATA%\ascreenrecorder\ascreenrecorder3264.exe