Trojan.MulDrop28.35343

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\DW Edit Control 10.30.46] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\DW Edit Control 10.30.46] 'ImagePath' = '%ALLUSERSPROFILE%\DW Edit Control 10.30.46\DW Edit Control 10.30.46.exe'

Создает следующие сервисы

'DW Edit Control 10.30.46' %ALLUSERSPROFILE%\DW Edit Control 10.30.46\DW Edit Control 10.30.46.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-mfgro.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\ascreenrecorder\is-gjb2p.tmp
%LOCALAPPDATA%\ascreenrecorder\is-k0lfi.tmp
%LOCALAPPDATA%\ascreenrecorder\is-5stuo.tmp
%LOCALAPPDATA%\ascreenrecorder\is-r1mmv.tmp
%LOCALAPPDATA%\ascreenrecorder\is-e32d8.tmp
%LOCALAPPDATA%\ascreenrecorder\is-sukev.tmp
%LOCALAPPDATA%\ascreenrecorder\is-4lr84.tmp
%LOCALAPPDATA%\ascreenrecorder\is-3acio.tmp
%LOCALAPPDATA%\ascreenrecorder\is-399uu.tmp
%LOCALAPPDATA%\ascreenrecorder\is-72r2c.tmp
%LOCALAPPDATA%\ascreenrecorder\unins000.dat
%LOCALAPPDATA%\ascreenrecorder\ascreenrecorder32.exe
%ALLUSERSPROFILE%\dw edit control 10.30.46\dw edit control 10.30.46.exe
%ALLUSERSPROFILE%\dw1030it46.dat
%LOCALAPPDATA%\ascreenrecorder\is-65d23.tmp
%LOCALAPPDATA%\ascreenrecorder\is-o8q4l.tmp
%LOCALAPPDATA%\ascreenrecorder\is-v0tue.tmp
%LOCALAPPDATA%\ascreenrecorder\is-qff4o.tmp
%LOCALAPPDATA%\ascreenrecorder\is-icdb8.tmp
%TEMP%\is-d7b1i.tmp\_isetup\_shfoldr.dll
%TEMP%\is-d7b1i.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\ascreenrecorder\is-vemlo.tmp
%LOCALAPPDATA%\ascreenrecorder\is-u9iqs.tmp
%LOCALAPPDATA%\ascreenrecorder\is-h6hls.tmp
%LOCALAPPDATA%\ascreenrecorder\is-ihe34.tmp
%ALLUSERSPROFILE%\dw1030resa.dat
%LOCALAPPDATA%\ascreenrecorder\is-si2dt.tmp
%LOCALAPPDATA%\ascreenrecorder\is-jof4j.tmp
%LOCALAPPDATA%\ascreenrecorder\is-dd13v.tmp
%LOCALAPPDATA%\ascreenrecorder\is-n9fvo.tmp
%LOCALAPPDATA%\ascreenrecorder\is-h5830.tmp
%LOCALAPPDATA%\ascreenrecorder\is-6jdce.tmp
%LOCALAPPDATA%\ascreenrecorder\is-gcfpq.tmp
%LOCALAPPDATA%\ascreenrecorder\is-4bbk0.tmp
%TEMP%\is-d7b1i.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\ascreenrecorder\is-mg272.tmp
%ALLUSERSPROFILE%\dw1030resb.dat

Перемещает следующие файлы

%LOCALAPPDATA%\ascreenrecorder\is-vemlo.tmp в %LOCALAPPDATA%\ascreenrecorder\unins000.exe
%LOCALAPPDATA%\ascreenrecorder\is-si2dt.tmp в %LOCALAPPDATA%\ascreenrecorder\libtiff-5.dll
%LOCALAPPDATA%\ascreenrecorder\is-3acio.tmp в %LOCALAPPDATA%\ascreenrecorder\libsigc-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-sukev.tmp в %LOCALAPPDATA%\ascreenrecorder\librsvg-2-2.dll
%LOCALAPPDATA%\ascreenrecorder\is-e32d8.tmp в %LOCALAPPDATA%\ascreenrecorder\libpng16-16.dll
%LOCALAPPDATA%\ascreenrecorder\is-r1mmv.tmp в %LOCALAPPDATA%\ascreenrecorder\libpixman-1-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-5stuo.tmp в %LOCALAPPDATA%\ascreenrecorder\libpcre-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-k0lfi.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangowin32-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-gjb2p.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangomm-1.4-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-o8q4l.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangoft2-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-65d23.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangocairo-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-v0tue.tmp в %LOCALAPPDATA%\ascreenrecorder\libpango-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-qff4o.tmp в %LOCALAPPDATA%\ascreenrecorder\liblzma-5.dll
%LOCALAPPDATA%\ascreenrecorder\is-icdb8.tmp в %LOCALAPPDATA%\ascreenrecorder\liblcms2-2.dll
%LOCALAPPDATA%\ascreenrecorder\is-4bbk0.tmp в %LOCALAPPDATA%\ascreenrecorder\libjpeg-8.dll
%LOCALAPPDATA%\ascreenrecorder\is-gcfpq.tmp в %LOCALAPPDATA%\ascreenrecorder\libintl-8.dll
%LOCALAPPDATA%\ascreenrecorder\is-6jdce.tmp в %LOCALAPPDATA%\ascreenrecorder\libharfbuzz-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-h5830.tmp в %LOCALAPPDATA%\ascreenrecorder\libgraphite2.dll
%LOCALAPPDATA%\ascreenrecorder\is-n9fvo.tmp в %LOCALAPPDATA%\ascreenrecorder\libgomp-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-dd13v.tmp в %LOCALAPPDATA%\ascreenrecorder\libgobject-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-mg272.tmp в %LOCALAPPDATA%\ascreenrecorder\libgmodule-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-4lr84.tmp в %LOCALAPPDATA%\ascreenrecorder\libglibmm-2.4-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-jof4j.tmp в %LOCALAPPDATA%\ascreenrecorder\libgdk_pixbuf-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-ihe34.tmp в %LOCALAPPDATA%\ascreenrecorder\libgdkmm-2.4-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-h6hls.tmp в %LOCALAPPDATA%\ascreenrecorder\libgdk-win32-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-u9iqs.tmp в %LOCALAPPDATA%\ascreenrecorder\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-399uu.tmp в %LOCALAPPDATA%\ascreenrecorder\libwinpthread-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-72r2c.tmp в %LOCALAPPDATA%\ascreenrecorder\ascreenrecorder32.exe