Trojan.MulDrop24.54745

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\TVTunerClassic66] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\TVTunerClassic66] 'ImagePath' = '%ALLUSERSPROFILE%\TVTunerClassic66\TVTunerClassic66.exe'

Creates the following services

'TVTunerClassic66' %ALLUSERSPROFILE%\TVTunerClassic66\TVTunerClassic66.exe

Modifies file system

Creates the following files

%TEMP%\is-38am7.tmp\<File name>.tmp
%LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\is-p8qab.tmp
%LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\is-992bt.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-0uhsv.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-20c0i.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-rfkpp.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-1a7s4.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-e2it0.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-gqcbk.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-tpv82.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-lu7me.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-grbvm.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-htbk6.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-g74pt.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-iuhim.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-743c1.tmp
%ALLUSERSPROFILE%\resource-a.dat
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-36t82.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-7akci.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-49ss8.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-16n8s.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-vviva.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-46s3q.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-3uavi.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-i034g.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-h990d.tmp
%LOCALAPPDATA%\xplay standard library\is-f4fs7.tmp
%LOCALAPPDATA%\xplay standard library\unins000.dat
%LOCALAPPDATA%\xplay standard library\xplaystdlib.exe
%ALLUSERSPROFILE%\tvtunerclassic66\tvtunerclassic66.exe
%ALLUSERSPROFILE%\ts66.dat
%LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\is-mtd59.tmp
%LOCALAPPDATA%\xplay standard library\pf\common audio\is-7o3rs.tmp
%LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\is-g47st.tmp
%LOCALAPPDATA%\xplay standard library\is-uruta.tmp
%TEMP%\is-v2ntb.tmp\_isetup\_regdll.tmp
%TEMP%\is-v2ntb.tmp\_isetup\_setup64.tmp
%TEMP%\is-v2ntb.tmp\_isetup\_shfoldr.dll
%TEMP%\is-v2ntb.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\xplay standard library\is-c2js6.tmp
%LOCALAPPDATA%\xplay standard library\is-ef54m.tmp
%LOCALAPPDATA%\xplay standard library\is-p5ume.tmp
%LOCALAPPDATA%\xplay standard library\is-6vmje.tmp
%LOCALAPPDATA%\xplay standard library\is-5jepj.tmp
%LOCALAPPDATA%\xplay standard library\is-8ij2k.tmp
%LOCALAPPDATA%\xplay standard library\is-2e933.tmp
%LOCALAPPDATA%\xplay standard library\is-2k25l.tmp
%LOCALAPPDATA%\xplay standard library\is-d1ujm.tmp
%LOCALAPPDATA%\xplay standard library\is-55g02.tmp
%LOCALAPPDATA%\xplay standard library\is-gb9bo.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-elb8v.tmp
%LOCALAPPDATA%\xplay standard library\is-sn517.tmp
%LOCALAPPDATA%\xplay standard library\is-c3sep.tmp
%LOCALAPPDATA%\xplay standard library\is-44qts.tmp
%LOCALAPPDATA%\xplay standard library\is-s3a1g.tmp
%LOCALAPPDATA%\xplay standard library\is-5sfcv.tmp
%LOCALAPPDATA%\xplay standard library\is-nvj4g.tmp
%LOCALAPPDATA%\xplay standard library\is-3fqhg.tmp
%LOCALAPPDATA%\xplay standard library\is-i3f6l.tmp
%LOCALAPPDATA%\xplay standard library\is-cecll.tmp
%LOCALAPPDATA%\xplay standard library\is-ltmr0.tmp
%LOCALAPPDATA%\xplay standard library\is-n83ou.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-8seuu.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-ms3e2.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-bl0g0.tmp
%LOCALAPPDATA%\xplay standard library\lang\is-218i3.tmp
%ALLUSERSPROFILE%\resource-b.dat

Deletes the following files

%LOCALAPPDATA%\xplay standard library\lang\audioconverterripper.dat
%LOCALAPPDATA%\xplay standard library\lang\audioconverterripper.txt
%LOCALAPPDATA%\xplay standard library\lang\feedback.dat
%LOCALAPPDATA%\xplay standard library\lang\musictype.txt
%LOCALAPPDATA%\xplay standard library\lang\update.log

Moves the following files

from %LOCALAPPDATA%\xplay standard library\is-c2js6.tmp to %LOCALAPPDATA%\xplay standard library\unins000.exe
from %LOCALAPPDATA%\xplay standard library\lang\is-218i3.tmp to %LOCALAPPDATA%\xplay standard library\lang\update.log
from %LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\is-g47st.tmp to %LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\microsoft.vc90.crt.manifest
from %LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\is-mtd59.tmp to %LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\msvcm90.dll
from %LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\is-p8qab.tmp to %LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\msvcp90.dll
from %LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\is-992bt.tmp to %LOCALAPPDATA%\xplay standard library\microsoft.vc90.crt\msvcr90.dll
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-0uhsv.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\aac.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-20c0i.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\ac3.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-rfkpp.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\aiff.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-1a7s4.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\amr.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-e2it0.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\ape.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-tpv82.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\flac.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-16n8s.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\wma.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-lu7me.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\m4a.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-grbvm.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\m4b.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-htbk6.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\m4r.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-g74pt.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\mka.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-iuhim.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\mp2.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-7o3rs.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\mp3.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-743c1.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\ogg.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-36t82.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\ra.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-7akci.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\voc.pf
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-49ss8.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\wav.pf
from %LOCALAPPDATA%\xplay standard library\lang\is-elb8v.tmp to %LOCALAPPDATA%\xplay standard library\lang\musictype.txt
from %LOCALAPPDATA%\xplay standard library\pf\common audio\is-gqcbk.tmp to %LOCALAPPDATA%\xplay standard library\pf\common audio\au.pf
from %LOCALAPPDATA%\xplay standard library\lang\is-bl0g0.tmp to %LOCALAPPDATA%\xplay standard library\lang\feedback.dat
from %LOCALAPPDATA%\xplay standard library\is-gb9bo.tmp to %LOCALAPPDATA%\xplay standard library\rmvbencode.dll
from %LOCALAPPDATA%\xplay standard library\is-ef54m.tmp to %LOCALAPPDATA%\xplay standard library\msvcp60.dll
from %LOCALAPPDATA%\xplay standard library\is-p5ume.tmp to %LOCALAPPDATA%\xplay standard library\msvcr71.dll
from %LOCALAPPDATA%\xplay standard library\is-6vmje.tmp to %LOCALAPPDATA%\xplay standard library\musiccd.exe
from %LOCALAPPDATA%\xplay standard library\is-5jepj.tmp to %LOCALAPPDATA%\xplay standard library\nvencoderkernel.dll
from %LOCALAPPDATA%\xplay standard library\is-8ij2k.tmp to %LOCALAPPDATA%\xplay standard library\ocxhelper.exe
from %LOCALAPPDATA%\xplay standard library\is-2e933.tmp to %LOCALAPPDATA%\xplay standard library\postproc-52.dll
from %LOCALAPPDATA%\xplay standard library\is-2k25l.tmp to %LOCALAPPDATA%\xplay standard library\productcontrol.dll
from %LOCALAPPDATA%\xplay standard library\is-d1ujm.tmp to %LOCALAPPDATA%\xplay standard library\pthreadgc2.dll
from %LOCALAPPDATA%\xplay standard library\is-55g02.tmp to %LOCALAPPDATA%\xplay standard library\pthreadvc2.dll
from %LOCALAPPDATA%\xplay standard library\is-uruta.tmp to %LOCALAPPDATA%\xplay standard library\realquickjoin.dll
from %LOCALAPPDATA%\xplay standard library\is-sn517.tmp to %LOCALAPPDATA%\xplay standard library\rmvbencodesync.dll
from %LOCALAPPDATA%\xplay standard library\lang\is-8seuu.tmp to %LOCALAPPDATA%\xplay standard library\lang\audioconverterripper.dat
from %LOCALAPPDATA%\xplay standard library\is-c3sep.tmp to %LOCALAPPDATA%\xplay standard library\simage.dll
from %LOCALAPPDATA%\xplay standard library\is-44qts.tmp to %LOCALAPPDATA%\xplay standard library\soundtouch.dll
from %LOCALAPPDATA%\xplay standard library\is-s3a1g.tmp to %LOCALAPPDATA%\xplay standard library\ssleay32.dll
from %LOCALAPPDATA%\xplay standard library\is-5sfcv.tmp to %LOCALAPPDATA%\xplay standard library\swresample-0.dll
from %LOCALAPPDATA%\xplay standard library\is-nvj4g.tmp to %LOCALAPPDATA%\xplay standard library\uitoolkit.dll.intermediate.manifest
from %LOCALAPPDATA%\xplay standard library\is-3fqhg.tmp to %LOCALAPPDATA%\xplay standard library\ve32.dll
from %LOCALAPPDATA%\xplay standard library\is-i3f6l.tmp to %LOCALAPPDATA%\xplay standard library\ve64.dll
from %LOCALAPPDATA%\xplay standard library\is-cecll.tmp to %LOCALAPPDATA%\xplay standard library\wait.gif
from %LOCALAPPDATA%\xplay standard library\is-ltmr0.tmp to %LOCALAPPDATA%\xplay standard library\webrtc.dll
from %LOCALAPPDATA%\xplay standard library\is-n83ou.tmp to %LOCALAPPDATA%\xplay standard library\wmadecode.dll
from %LOCALAPPDATA%\xplay standard library\lang\is-ms3e2.tmp to %LOCALAPPDATA%\xplay standard library\lang\audioconverterripper.txt
from %LOCALAPPDATA%\xplay standard library\is-f4fs7.tmp to %LOCALAPPDATA%\xplay standard library\xplaystdlib.exe

Substitutes the following files

%LOCALAPPDATA%\xplay standard library\lang\audioconverterripper.dat
%LOCALAPPDATA%\xplay standard library\lang\audioconverterripper.txt
%LOCALAPPDATA%\xplay standard library\lang\feedback.dat
%LOCALAPPDATA%\xplay standard library\lang\musictype.txt
%LOCALAPPDATA%\xplay standard library\lang\update.log

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'L63aa5_XPSL1223FlashFixClass_L63aa5'

Creates and executes the following

'%TEMP%\is-38am7.tmp\<File name>.tmp' /SL5="$90254,3831949,598528,<Full path to file>"
'%LOCALAPPDATA%\xplay standard library\xplaystdlib.exe' -i
'%LOCALAPPDATA%\xplay standard library\xplaystdlib.exe' -s

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней