Trojan.MulDrop28.35348

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\DW Edit Control 10.30.46] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\DW Edit Control 10.30.46] 'ImagePath' = '%ALLUSERSPROFILE%\DW Edit Control 10.30.46\DW Edit Control 10.30.46.exe'

Создает следующие сервисы

'DW Edit Control 10.30.46' %ALLUSERSPROFILE%\DW Edit Control 10.30.46\DW Edit Control 10.30.46.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-hmpvd.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\ascreenrecorder\is-oulhe.tmp
%LOCALAPPDATA%\ascreenrecorder\is-gj6sl.tmp
%LOCALAPPDATA%\ascreenrecorder\is-fmuiu.tmp
%LOCALAPPDATA%\ascreenrecorder\is-r11pm.tmp
%LOCALAPPDATA%\ascreenrecorder\is-q7pfj.tmp
%LOCALAPPDATA%\ascreenrecorder\is-nau2b.tmp
%LOCALAPPDATA%\ascreenrecorder\is-ocim4.tmp
%LOCALAPPDATA%\ascreenrecorder\ascreenrecorder3264.exe
%LOCALAPPDATA%\ascreenrecorder\is-dlvgs.tmp
%LOCALAPPDATA%\ascreenrecorder\is-gbk7o.tmp
%LOCALAPPDATA%\ascreenrecorder\is-giage.tmp
%LOCALAPPDATA%\ascreenrecorder\is-ombb5.tmp
%LOCALAPPDATA%\ascreenrecorder\is-peet1.tmp
%LOCALAPPDATA%\ascreenrecorder\unins000.dat
%LOCALAPPDATA%\ascreenrecorder\is-oes12.tmp
%LOCALAPPDATA%\ascreenrecorder\is-lf3qe.tmp
%LOCALAPPDATA%\ascreenrecorder\is-m6ps7.tmp
%LOCALAPPDATA%\ascreenrecorder\is-sn2oc.tmp
%TEMP%\is-orj99.tmp\_isetup\_setup64.tmp
%TEMP%\is-orj99.tmp\_isetup\_shfoldr.dll
%TEMP%\is-orj99.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\ascreenrecorder\is-j8qns.tmp
%LOCALAPPDATA%\ascreenrecorder\is-fvtf4.tmp
%LOCALAPPDATA%\ascreenrecorder\is-ai6ak.tmp
%LOCALAPPDATA%\ascreenrecorder\is-ib9i9.tmp
%LOCALAPPDATA%\ascreenrecorder\is-0jlim.tmp
%LOCALAPPDATA%\ascreenrecorder\is-6oeu2.tmp
%LOCALAPPDATA%\ascreenrecorder\is-7l2c9.tmp
%LOCALAPPDATA%\ascreenrecorder\is-i56jj.tmp
%LOCALAPPDATA%\ascreenrecorder\is-c3ipc.tmp
%LOCALAPPDATA%\ascreenrecorder\is-l9asg.tmp
%LOCALAPPDATA%\ascreenrecorder\is-dpjbg.tmp
%LOCALAPPDATA%\ascreenrecorder\is-g603t.tmp
%ALLUSERSPROFILE%\dw edit control 10.30.46\dw edit control 10.30.46.exe

Перемещает следующие файлы

%LOCALAPPDATA%\ascreenrecorder\is-j8qns.tmp в %LOCALAPPDATA%\ascreenrecorder\unins000.exe
%LOCALAPPDATA%\ascreenrecorder\is-giage.tmp в %LOCALAPPDATA%\ascreenrecorder\libtiff-5.dll
%LOCALAPPDATA%\ascreenrecorder\is-gbk7o.tmp в %LOCALAPPDATA%\ascreenrecorder\libsigc-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-dlvgs.tmp в %LOCALAPPDATA%\ascreenrecorder\librsvg-2-2.dll
%LOCALAPPDATA%\ascreenrecorder\is-ocim4.tmp в %LOCALAPPDATA%\ascreenrecorder\libpng16-16.dll
%LOCALAPPDATA%\ascreenrecorder\is-lf3qe.tmp в %LOCALAPPDATA%\ascreenrecorder\libpixman-1-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-nau2b.tmp в %LOCALAPPDATA%\ascreenrecorder\libpcre-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-q7pfj.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangowin32-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-r11pm.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangomm-1.4-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-fmuiu.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangoft2-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-gj6sl.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangocairo-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-oulhe.tmp в %LOCALAPPDATA%\ascreenrecorder\libpango-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-oes12.tmp в %LOCALAPPDATA%\ascreenrecorder\liblzma-5.dll
%LOCALAPPDATA%\ascreenrecorder\is-m6ps7.tmp в %LOCALAPPDATA%\ascreenrecorder\liblcms2-2.dll
%LOCALAPPDATA%\ascreenrecorder\is-g603t.tmp в %LOCALAPPDATA%\ascreenrecorder\libjpeg-8.dll
%LOCALAPPDATA%\ascreenrecorder\is-0jlim.tmp в %LOCALAPPDATA%\ascreenrecorder\libintl-8.dll
%LOCALAPPDATA%\ascreenrecorder\is-dpjbg.tmp в %LOCALAPPDATA%\ascreenrecorder\libharfbuzz-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-l9asg.tmp в %LOCALAPPDATA%\ascreenrecorder\libgraphite2.dll
%LOCALAPPDATA%\ascreenrecorder\is-c3ipc.tmp в %LOCALAPPDATA%\ascreenrecorder\libgomp-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-i56jj.tmp в %LOCALAPPDATA%\ascreenrecorder\libgobject-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-7l2c9.tmp в %LOCALAPPDATA%\ascreenrecorder\libgmodule-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-6oeu2.tmp в %LOCALAPPDATA%\ascreenrecorder\libglibmm-2.4-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-ib9i9.tmp в %LOCALAPPDATA%\ascreenrecorder\libgdk_pixbuf-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-sn2oc.tmp в %LOCALAPPDATA%\ascreenrecorder\libgdkmm-2.4-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-ai6ak.tmp в %LOCALAPPDATA%\ascreenrecorder\libgdk-win32-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-fvtf4.tmp в %LOCALAPPDATA%\ascreenrecorder\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-ombb5.tmp в %LOCALAPPDATA%\ascreenrecorder\libwinpthread-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-peet1.tmp в %LOCALAPPDATA%\ascreenrecorder\ascreenrecorder3264.exe