Trojan.MulDrop28.35331

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\DW Edit Control 10.30.46] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\DW Edit Control 10.30.46] 'ImagePath' = '%ALLUSERSPROFILE%\DW Edit Control 10.30.46\DW Edit Control 10.30.46.exe'

Создает следующие сервисы

'DW Edit Control 10.30.46' %ALLUSERSPROFILE%\DW Edit Control 10.30.46\DW Edit Control 10.30.46.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-pljos.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\ascreenrecorder\is-fvmfh.tmp
%LOCALAPPDATA%\ascreenrecorder\is-71arp.tmp
%LOCALAPPDATA%\ascreenrecorder\is-4b6qd.tmp
%LOCALAPPDATA%\ascreenrecorder\is-ke8pp.tmp
%LOCALAPPDATA%\ascreenrecorder\is-p49ls.tmp
%LOCALAPPDATA%\ascreenrecorder\is-vr8uh.tmp
%LOCALAPPDATA%\ascreenrecorder\is-bmpk4.tmp
%LOCALAPPDATA%\ascreenrecorder\ascreenrecorder32.exe
%LOCALAPPDATA%\ascreenrecorder\is-pvfgh.tmp
%LOCALAPPDATA%\ascreenrecorder\is-rcumt.tmp
%LOCALAPPDATA%\ascreenrecorder\is-2qrfv.tmp
%LOCALAPPDATA%\ascreenrecorder\is-7m7bf.tmp
%LOCALAPPDATA%\ascreenrecorder\is-simc9.tmp
%LOCALAPPDATA%\ascreenrecorder\unins000.dat
%LOCALAPPDATA%\ascreenrecorder\is-rbt6n.tmp
%LOCALAPPDATA%\ascreenrecorder\is-8ujn3.tmp
%LOCALAPPDATA%\ascreenrecorder\is-cnef7.tmp
%LOCALAPPDATA%\ascreenrecorder\is-fvg2u.tmp
%TEMP%\is-djhud.tmp\_isetup\_setup64.tmp
%TEMP%\is-djhud.tmp\_isetup\_shfoldr.dll
%TEMP%\is-djhud.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\ascreenrecorder\is-3q4q9.tmp
%LOCALAPPDATA%\ascreenrecorder\is-46rmp.tmp
%LOCALAPPDATA%\ascreenrecorder\is-qqgrj.tmp
%LOCALAPPDATA%\ascreenrecorder\is-6svju.tmp
%LOCALAPPDATA%\ascreenrecorder\is-l4q4o.tmp
%LOCALAPPDATA%\ascreenrecorder\is-urm64.tmp
%LOCALAPPDATA%\ascreenrecorder\is-birjc.tmp
%LOCALAPPDATA%\ascreenrecorder\is-ul5gq.tmp
%LOCALAPPDATA%\ascreenrecorder\is-tc9c8.tmp
%LOCALAPPDATA%\ascreenrecorder\is-i9vum.tmp
%LOCALAPPDATA%\ascreenrecorder\is-42995.tmp
%LOCALAPPDATA%\ascreenrecorder\is-1e1iv.tmp
%ALLUSERSPROFILE%\dw edit control 10.30.46\dw edit control 10.30.46.exe

Перемещает следующие файлы

%LOCALAPPDATA%\ascreenrecorder\is-3q4q9.tmp в %LOCALAPPDATA%\ascreenrecorder\unins000.exe
%LOCALAPPDATA%\ascreenrecorder\is-2qrfv.tmp в %LOCALAPPDATA%\ascreenrecorder\libtiff-5.dll
%LOCALAPPDATA%\ascreenrecorder\is-rcumt.tmp в %LOCALAPPDATA%\ascreenrecorder\libsigc-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-pvfgh.tmp в %LOCALAPPDATA%\ascreenrecorder\librsvg-2-2.dll
%LOCALAPPDATA%\ascreenrecorder\is-bmpk4.tmp в %LOCALAPPDATA%\ascreenrecorder\libpng16-16.dll
%LOCALAPPDATA%\ascreenrecorder\is-8ujn3.tmp в %LOCALAPPDATA%\ascreenrecorder\libpixman-1-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-vr8uh.tmp в %LOCALAPPDATA%\ascreenrecorder\libpcre-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-p49ls.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangowin32-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-ke8pp.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangomm-1.4-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-4b6qd.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangoft2-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-71arp.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangocairo-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-fvmfh.tmp в %LOCALAPPDATA%\ascreenrecorder\libpango-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-rbt6n.tmp в %LOCALAPPDATA%\ascreenrecorder\liblzma-5.dll
%LOCALAPPDATA%\ascreenrecorder\is-cnef7.tmp в %LOCALAPPDATA%\ascreenrecorder\liblcms2-2.dll
%LOCALAPPDATA%\ascreenrecorder\is-1e1iv.tmp в %LOCALAPPDATA%\ascreenrecorder\libjpeg-8.dll
%LOCALAPPDATA%\ascreenrecorder\is-l4q4o.tmp в %LOCALAPPDATA%\ascreenrecorder\libintl-8.dll
%LOCALAPPDATA%\ascreenrecorder\is-42995.tmp в %LOCALAPPDATA%\ascreenrecorder\libharfbuzz-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-i9vum.tmp в %LOCALAPPDATA%\ascreenrecorder\libgraphite2.dll
%LOCALAPPDATA%\ascreenrecorder\is-tc9c8.tmp в %LOCALAPPDATA%\ascreenrecorder\libgomp-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-ul5gq.tmp в %LOCALAPPDATA%\ascreenrecorder\libgobject-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-birjc.tmp в %LOCALAPPDATA%\ascreenrecorder\libgmodule-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-urm64.tmp в %LOCALAPPDATA%\ascreenrecorder\libglibmm-2.4-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-6svju.tmp в %LOCALAPPDATA%\ascreenrecorder\libgdk_pixbuf-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-fvg2u.tmp в %LOCALAPPDATA%\ascreenrecorder\libgdkmm-2.4-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-qqgrj.tmp в %LOCALAPPDATA%\ascreenrecorder\libgdk-win32-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-46rmp.tmp в %LOCALAPPDATA%\ascreenrecorder\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-7m7bf.tmp в %LOCALAPPDATA%\ascreenrecorder\libwinpthread-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-simc9.tmp в %LOCALAPPDATA%\ascreenrecorder\ascreenrecorder32.exe