Trojan.Siggen24.43047

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\TVTunerClassic61] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\TVTunerClassic61] 'ImagePath' = '%ALLUSERSPROFILE%\TVTunerClassic61\TVTunerClassic61.exe'

Creates the following services

'TVTunerClassic61' %ALLUSERSPROFILE%\TVTunerClassic61\TVTunerClassic61.exe

Modifies file system

Creates the following files

%TEMP%\is-c1v22.tmp\<File name>.tmp
%LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\is-8t33c.tmp
%LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\is-ildb9.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-t9c54.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-lb81h.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-de4nq.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-2cigf.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-l5mq1.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-muhh3.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-jhp8k.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-fhijj.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-obmkn.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-88ddf.tmp
%LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\is-svqc7.tmp
%LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\is-uqbe1.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-klk9j.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-nvnrf.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-78qif.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-ig1io.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-vabmc.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-k79jo.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-f9vuv.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-ghrg7.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-gu84r.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-qru34.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-me5er.tmp
%LOCALAPPDATA%\xplay standard library\is-3qiem.tmp
%LOCALAPPDATA%\xplay standard library\unins000.dat
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-sk7ne.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-s562t.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-df8la.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-hdjri.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-l66ps.tmp
%TEMP%\is-rt3m4.tmp\_isetup\_setup64.tmp
%TEMP%\is-rt3m4.tmp\_isetup\_shfoldr.dll
%TEMP%\is-rt3m4.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\xplay standard library\is-q9v3c.tmp
%LOCALAPPDATA%\xplay standard library\is-ron0q.tmp
%LOCALAPPDATA%\xplay standard library\is-ge0s8.tmp
%LOCALAPPDATA%\xplay standard library\is-p2lem.tmp
%LOCALAPPDATA%\xplay standard library\is-bdkp5.tmp
%LOCALAPPDATA%\xplay standard library\is-ldjko.tmp
%LOCALAPPDATA%\xplay standard library\is-ca12v.tmp
%LOCALAPPDATA%\xplay standard library\is-ijbv7.tmp
%LOCALAPPDATA%\xplay standard library\is-67gmn.tmp
%LOCALAPPDATA%\xplay standard library\is-9pnvh.tmp
%TEMP%\is-rt3m4.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\xplay standard library\is-pjibp.tmp
%LOCALAPPDATA%\xplay standard library\is-fm49p.tmp
%LOCALAPPDATA%\xplay standard library\is-crj5s.tmp
%LOCALAPPDATA%\xplay standard library\is-rvoeh.tmp
%LOCALAPPDATA%\xplay standard library\is-l5173.tmp
%LOCALAPPDATA%\xplay standard library\is-66t44.tmp
%LOCALAPPDATA%\xplay standard library\is-i010h.tmp
%LOCALAPPDATA%\xplay standard library\is-kvm6t.tmp
%LOCALAPPDATA%\xplay standard library\is-a8gvv.tmp
%LOCALAPPDATA%\xplay standard library\is-iairf.tmp
%LOCALAPPDATA%\xplay standard library\is-d8fs9.tmp
%LOCALAPPDATA%\xplay standard library\is-fvbkl.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-ckjjp.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-tql9j.tmp
%LOCALAPPDATA%\xplay standard library\is-omcad.tmp
%LOCALAPPDATA%\xplay standard library\xplaystdlib.exe
%ALLUSERSPROFILE%\tvtunerclassic61\tvtunerclassic61.exe

Deletes the following files

%LOCALAPPDATA%\xplay standard library\lang\audioconverterripper.dat
%LOCALAPPDATA%\xplay standard library\lang\audioconverterripper.txt
%LOCALAPPDATA%\xplay standard library\lang\feedback.dat
%LOCALAPPDATA%\xplay standard library\lang\musictype.txt
%LOCALAPPDATA%\xplay standard library\lang\update.log

Moves the following files

from %LOCALAPPDATA%\xplay standard library\is-q9v3c.tmp to %LOCALAPPDATA%\xplay standard library\unins000.exe
from %LOCALAPPDATA%\xplay standard library\lang\is-df8la.tmp to %LOCALAPPDATA%\xplay standard library\lang\update.log
from %LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\is-svqc7.tmp to %LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\microsoft.vc90.crt.manifest
from %LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\is-uqbe1.tmp to %LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\msvcm90.dll
from %LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\is-8t33c.tmp to %LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\msvcp90.dll
from %LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\is-ildb9.tmp to %LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\msvcr90.dll
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-t9c54.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\aac.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-lb81h.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\ac3.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-de4nq.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\aiff.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-2cigf.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\amr.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-l5mq1.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\ape.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-jhp8k.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\flac.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-k79jo.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\wma.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-fhijj.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\m4a.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-obmkn.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\m4b.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-88ddf.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\m4r.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-klk9j.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\mka.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-sk7ne.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\mp2.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-s562t.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\mp3.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-nvnrf.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\ogg.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-78qif.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\ra.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-ig1io.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\voc.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-vabmc.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\wav.pf
from %LOCALAPPDATA%\xplay standard library\lang\is-hdjri.tmp to %LOCALAPPDATA%\xplay standard library\lang\musictype.txt
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-muhh3.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\au.pf
from %LOCALAPPDATA%\xplay standard library\lang\is-l66ps.tmp to %LOCALAPPDATA%\xplay standard library\lang\feedback.dat
from %LOCALAPPDATA%\xplay standard library\is-omcad.tmp to %LOCALAPPDATA%\xplay standard library\rmvbencode.dll
from %LOCALAPPDATA%\xplay standard library\is-ron0q.tmp to %LOCALAPPDATA%\xplay standard library\msvcp60.dll
from %LOCALAPPDATA%\xplay standard library\is-ge0s8.tmp to %LOCALAPPDATA%\xplay standard library\msvcr71.dll
from %LOCALAPPDATA%\xplay standard library\is-p2lem.tmp to %LOCALAPPDATA%\xplay standard library\musiccd.exe
from %LOCALAPPDATA%\xplay standard library\is-bdkp5.tmp to %LOCALAPPDATA%\xplay standard library\nvencoderkernel.dll
from %LOCALAPPDATA%\xplay standard library\is-ldjko.tmp to %LOCALAPPDATA%\xplay standard library\ocxhelper.exe
from %LOCALAPPDATA%\xplay standard library\is-ca12v.tmp to %LOCALAPPDATA%\xplay standard library\postproc-52.dll
from %LOCALAPPDATA%\xplay standard library\is-ijbv7.tmp to %LOCALAPPDATA%\xplay standard library\productcontrol.dll
from %LOCALAPPDATA%\xplay standard library\is-67gmn.tmp to %LOCALAPPDATA%\xplay standard library\pthreadgc2.dll
from %LOCALAPPDATA%\xplay standard library\is-9pnvh.tmp to %LOCALAPPDATA%\xplay standard library\pthreadvc2.dll
from %LOCALAPPDATA%\xplay standard library\is-pjibp.tmp to %LOCALAPPDATA%\xplay standard library\realquickjoin.dll
from %LOCALAPPDATA%\xplay standard library\is-fm49p.tmp to %LOCALAPPDATA%\xplay standard library\rmvbencodesync.dll
from %LOCALAPPDATA%\xplay standard library\lang\is-ckjjp.tmp to %LOCALAPPDATA%\xplay standard library\lang\audioconverterripper.dat
from %LOCALAPPDATA%\xplay standard library\is-crj5s.tmp to %LOCALAPPDATA%\xplay standard library\simage.dll
from %LOCALAPPDATA%\xplay standard library\is-rvoeh.tmp to %LOCALAPPDATA%\xplay standard library\soundtouch.dll
from %LOCALAPPDATA%\xplay standard library\is-l5173.tmp to %LOCALAPPDATA%\xplay standard library\ssleay32.dll
from %LOCALAPPDATA%\xplay standard library\is-66t44.tmp to %LOCALAPPDATA%\xplay standard library\swresample-0.dll
from %LOCALAPPDATA%\xplay standard library\is-i010h.tmp to %LOCALAPPDATA%\xplay standard library\uitoolkit.dll.intermediate.manifest
from %LOCALAPPDATA%\xplay standard library\is-kvm6t.tmp to %LOCALAPPDATA%\xplay standard library\ve32.dll
from %LOCALAPPDATA%\xplay standard library\is-a8gvv.tmp to %LOCALAPPDATA%\xplay standard library\ve64.dll
from %LOCALAPPDATA%\xplay standard library\is-iairf.tmp to %LOCALAPPDATA%\xplay standard library\wait.gif
from %LOCALAPPDATA%\xplay standard library\is-d8fs9.tmp to %LOCALAPPDATA%\xplay standard library\webrtc.dll
from %LOCALAPPDATA%\xplay standard library\is-fvbkl.tmp to %LOCALAPPDATA%\xplay standard library\wmadecode.dll
from %LOCALAPPDATA%\xplay standard library\lang\is-tql9j.tmp to %LOCALAPPDATA%\xplay standard library\lang\audioconverterripper.txt
from %LOCALAPPDATA%\xplay standard library\is-3qiem.tmp to %LOCALAPPDATA%\xplay standard library\xplaystdlib.exe

Substitutes the following files

%LOCALAPPDATA%\xplay standard library\lang\audioconverterripper.dat
%LOCALAPPDATA%\xplay standard library\lang\audioconverterripper.txt
%LOCALAPPDATA%\xplay standard library\lang\feedback.dat
%LOCALAPPDATA%\xplay standard library\lang\musictype.txt
%LOCALAPPDATA%\xplay standard library\lang\update.log

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'j2e149_XPSL1223FlashFixClass_j2e149'

Creates and executes the following

'%TEMP%\is-c1v22.tmp\<File name>.tmp' /SL5="$B023A,3805633,598528,<Full path to file>"
'%LOCALAPPDATA%\xplay standard library\xplaystdlib.exe' -i
'%LOCALAPPDATA%\xplay standard library\xplaystdlib.exe' -s

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "XPSL1223"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней