Trojan.MulDrop7.65408

Техническая информация

Вредоносные функции:

Завершает или пытается завершить

следующие пользовательские процессы:

safari.exe
opera.exe
firefox.exe
iexplore.exe
chrome.exe

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-SJV5T.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-KA8LU.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-977PT.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-AAJ0H.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-DRVGB.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-J9D6H.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-J8JU9.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-IHU7M.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-MDUSK.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-GORQ1.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-1EB0K.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-0BR40.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-9HGFJ.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-MV89C.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-LH014.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-7H5Q7.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-A303A.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-8N6G4.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-MPKD8.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-QPJNH.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-ILHNT.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-AEHS0.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-SVRQN.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\TunesKit Spotify Converter\TunesKit Spotify Converter.lnk
%ProgramFiles%\TunesKit Spotify Converter\unins000.dat
%ProgramFiles%\TunesKit Spotify Converter\SpotifyConverter.exe
%ALLUSERSPROFILE%\Start Menu\Programs\TunesKit Spotify Converter\Uninstall TunesKit Spotify Converter.lnk
%HOMEPATH%\Desktop\TunesKit Spotify Converter.lnk
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-DP6R4.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-GKV2I.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-0L9LG.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-B0PKD.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-GDHV7.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-A9JVF.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-SDVBN.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-0LULJ.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-EVQ9F.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-S1VKQ.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-5EHTH.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-2M9JH.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-6VT3N.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-8QI4V.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-3J49P.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-OV4U7.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-G1M27.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-22729.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-MPFB2.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-SBJ2T.tmp
%TEMP%\is-S1PTA.tmp\~ntzhkvs.tmp
%ProgramFiles%\TunesKit Spotify Converter\is-51877.tmp
%TEMP%\aut1.tmp
%CommonProgramFiles%\~ntzhkvs.tmp
%ProgramFiles%\TunesKit Spotify Converter\is-MN22O.tmp
%ProgramFiles%\TunesKit Spotify Converter\is-ARJ4S.tmp
%ProgramFiles%\TunesKit Spotify Converter\is-2QOI0.tmp
%ProgramFiles%\TunesKit Spotify Converter\is-9U3FK.tmp
%ProgramFiles%\TunesKit Spotify Converter\is-7EJ09.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-RJ9EH.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-P9FKC.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-58C68.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-1DKJD.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-K0C8O.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-PI1E7.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-QS813.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-1PO2U.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-4NAB3.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-L91L8.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-PL3JN.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-BV30Q.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-DPDBH.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-14I4B.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-ADG3G.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-B5ST9.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-0J00T.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-MD9N6.tmp
%ProgramFiles%\TunesKit Spotify Converter\skin\is-NHAOQ.tmp

Присваивает атрибут 'скрытый' для следующих файлов:

%CommonProgramFiles%\~ntzhkvs.tmp

Удаляет следующие файлы:

%CommonProgramFiles%\~ntzhkvs.tmp
%TEMP%\is-S1PTA.tmp\~ntzhkvs.tmp
%TEMP%\aut1.tmp

Перемещает следующие файлы:

%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-977PT.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\de\preferences.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-AAJ0H.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\de\register.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-A303A.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\de\menu.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-GORQ1.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\de\messagebox.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-DRVGB.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\fr\history.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-IHU7M.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\fr\library.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-SJV5T.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\de\registerhint.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-KA8LU.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\fr\about.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-7H5Q7.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\de\main.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-MV89C.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\en\register.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-1EB0K.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\en\registerhint.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-QS813.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\en\messagebox.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-9HGFJ.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\en\preferences.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-8N6G4.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\de\library.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-MPKD8.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\de\loading.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-0BR40.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\de\about.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\de\is-LH014.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\de\history.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-0LULJ.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\ja\main.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-DP6R4.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\ja\menu.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-S1VKQ.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\ja\library.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-SDVBN.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\ja\loading.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-QPJNH.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\ja\register.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-ILHNT.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\ja\registerhint.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-AEHS0.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\ja\messagebox.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-SVRQN.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\ja\preferences.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-EVQ9F.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\ja\history.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-J8JU9.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\fr\menu.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-B0PKD.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\fr\messagebox.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-MDUSK.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\fr\loading.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-J9D6H.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\fr\main.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-0L9LG.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\fr\registerhint.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\ja\is-A9JVF.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\ja\about.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-GDHV7.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\fr\preferences.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\fr\is-GKV2I.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\fr\register.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\is-3J49P.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\list_header_hot.png
%ProgramFiles%\TunesKit Spotify Converter\skin\is-22729.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\list_header_pushed.png
%ProgramFiles%\TunesKit Spotify Converter\skin\is-5EHTH.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\icon_80.png
%ProgramFiles%\TunesKit Spotify Converter\skin\is-2M9JH.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\list_header_bg.png
%ProgramFiles%\TunesKit Spotify Converter\skin\is-G1M27.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\main.png
%ProgramFiles%\TunesKit Spotify Converter\skin\is-DPDBH.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\main_btn_convert.png
%ProgramFiles%\TunesKit Spotify Converter\skin\is-MPFB2.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\list_header_sep.png
%ProgramFiles%\TunesKit Spotify Converter\skin\is-OV4U7.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\logo.png
%ProgramFiles%\TunesKit Spotify Converter\skin\is-8QI4V.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\icon.png
%ProgramFiles%\TunesKit Spotify Converter\is-9U3FK.tmp в %ProgramFiles%\TunesKit Spotify Converter\ConvertLibrary.dll
%ProgramFiles%\TunesKit Spotify Converter\is-7EJ09.tmp в %ProgramFiles%\TunesKit Spotify Converter\DuiLib.dll
%ProgramFiles%\TunesKit Spotify Converter\is-51877.tmp в %ProgramFiles%\TunesKit Spotify Converter\unins000.exe
%ProgramFiles%\TunesKit Spotify Converter\is-MN22O.tmp в %ProgramFiles%\TunesKit Spotify Converter\SpotifyConverter.exe
%ProgramFiles%\TunesKit Spotify Converter\skin\is-SBJ2T.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\dialog.png
%ProgramFiles%\TunesKit Spotify Converter\skin\is-6VT3N.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\frame.png
%ProgramFiles%\TunesKit Spotify Converter\is-ARJ4S.tmp в %ProgramFiles%\TunesKit Spotify Converter\WinSparkle.dll
%ProgramFiles%\TunesKit Spotify Converter\is-2QOI0.tmp в %ProgramFiles%\TunesKit Spotify Converter\WebStream.dll
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-RJ9EH.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\en\about.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-P9FKC.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\en\history.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\is-58C68.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\menu.png
%ProgramFiles%\TunesKit Spotify Converter\skin\is-1DKJD.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\scrollbar.png
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-4NAB3.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\en\main.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-PI1E7.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\en\menu.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-K0C8O.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\en\library.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\en\is-1PO2U.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\en\loading.xml
%ProgramFiles%\TunesKit Spotify Converter\skin\is-L91L8.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\main_progress.png
%ProgramFiles%\TunesKit Spotify Converter\skin\is-BV30Q.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\main_com_icons.png
%ProgramFiles%\TunesKit Spotify Converter\skin\is-ADG3G.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\main_default_cover.png
%ProgramFiles%\TunesKit Spotify Converter\skin\is-14I4B.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\main_buttons.png
%ProgramFiles%\TunesKit Spotify Converter\skin\is-PL3JN.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\main_com_buttons.png
%ProgramFiles%\TunesKit Spotify Converter\skin\is-B5ST9.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\main_menu_check.png
%ProgramFiles%\TunesKit Spotify Converter\skin\is-0J00T.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\main_menu_line.png
%ProgramFiles%\TunesKit Spotify Converter\skin\is-MD9N6.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\main_dragfiles.png
%ProgramFiles%\TunesKit Spotify Converter\skin\is-NHAOQ.tmp в %ProgramFiles%\TunesKit Spotify Converter\skin\main_menu_bk.png

Сетевая активность:

Подключается к:

'tu###kit.com':80
'localhost':1040

TCP:

Запросы HTTP GET:

http://www.tu###kit.com/spotify-converter-for-win/user-guide.html via tu###kit.com

UDP:

DNS ASK www.tu###kit.com

Другое:

Ищет следующие окна:

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'IEFrame' WindowName: ''

Создает и запускает на исполнение:

'%TEMP%\is-S1PTA.tmp\~ntzhkvs.tmp' /SL5="$100E2,1619986,134144,%CommonProgramFiles%\~ntzhkvs.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%CommonProgramFiles%\~ntzhkvs.tmp' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Запускает на исполнение:

'%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -nohome

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней