Trojan.MulDrop28.28237

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\ET Ammeter Side 10.7.46] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\ET Ammeter Side 10.7.46] 'ImagePath' = '%ALLUSERSPROFILE%\ET Ammeter Side 10.7.46\ET Ammeter Side 10.7.46.exe'

Создает следующие сервисы

'ET Ammeter Side 10.7.46' %ALLUSERSPROFILE%\ET Ammeter Side 10.7.46\ET Ammeter Side 10.7.46.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-94njv.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\jenny video converter\is-jjf13.tmp
%LOCALAPPDATA%\jenny video converter\is-ce3vl.tmp
%LOCALAPPDATA%\jenny video converter\is-a8s9p.tmp
%LOCALAPPDATA%\jenny video converter\is-sjbii.tmp
%LOCALAPPDATA%\jenny video converter\is-ptcdo.tmp
%LOCALAPPDATA%\jenny video converter\is-civ1v.tmp
%LOCALAPPDATA%\jenny video converter\is-k2vro.tmp
%LOCALAPPDATA%\jenny video converter\is-mphhe.tmp
%LOCALAPPDATA%\jenny video converter\is-94c48.tmp
%LOCALAPPDATA%\jenny video converter\is-mi18t.tmp
%LOCALAPPDATA%\jenny video converter\is-f445u.tmp
%LOCALAPPDATA%\jenny video converter\uninstall\unins000.dat
%LOCALAPPDATA%\jenny video converter\jennyvideoconverter32_64.exe
%ALLUSERSPROFILE%\et ammeter side 10.7.46\et ammeter side 10.7.46.exe
%ALLUSERSPROFILE%\et107it46.dat
%LOCALAPPDATA%\jenny video converter\is-ks51v.tmp
%LOCALAPPDATA%\jenny video converter\is-egvho.tmp
%LOCALAPPDATA%\jenny video converter\is-4kgm8.tmp
%LOCALAPPDATA%\jenny video converter\is-omp30.tmp
%LOCALAPPDATA%\jenny video converter\is-l7osq.tmp
%TEMP%\is-33hai.tmp\_isetup\_setup64.tmp
%TEMP%\is-33hai.tmp\_isetup\_shfoldr.dll
%TEMP%\is-33hai.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\jenny video converter\uninstall\is-ltg56.tmp
%LOCALAPPDATA%\jenny video converter\is-0f4ki.tmp
%LOCALAPPDATA%\jenny video converter\is-s8mko.tmp
%LOCALAPPDATA%\jenny video converter\is-tails.tmp
%TEMP%\is-33hai.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\jenny video converter\is-n6gss.tmp
%LOCALAPPDATA%\jenny video converter\is-7trjj.tmp
%LOCALAPPDATA%\jenny video converter\is-kvpj4.tmp
%LOCALAPPDATA%\jenny video converter\is-1cpu2.tmp
%LOCALAPPDATA%\jenny video converter\is-2jnmv.tmp
%LOCALAPPDATA%\jenny video converter\is-qu0uo.tmp
%LOCALAPPDATA%\jenny video converter\is-3asu0.tmp
%LOCALAPPDATA%\jenny video converter\is-1alje.tmp
%LOCALAPPDATA%\jenny video converter\is-6oa64.tmp
%ALLUSERSPROFILE%\et107resa.dat
%ALLUSERSPROFILE%\et107resb.dat

Перемещает следующие файлы

%LOCALAPPDATA%\jenny video converter\uninstall\is-ltg56.tmp в %LOCALAPPDATA%\jenny video converter\uninstall\unins000.exe
%LOCALAPPDATA%\jenny video converter\is-egvho.tmp в %LOCALAPPDATA%\jenny video converter\libwinpthread-1.dll
%LOCALAPPDATA%\jenny video converter\is-ks51v.tmp в %LOCALAPPDATA%\jenny video converter\libtiff-5.dll
%LOCALAPPDATA%\jenny video converter\is-94c48.tmp в %LOCALAPPDATA%\jenny video converter\libsigc-2.0-0.dll
%LOCALAPPDATA%\jenny video converter\is-civ1v.tmp в %LOCALAPPDATA%\jenny video converter\librsvg-2-2.dll
%LOCALAPPDATA%\jenny video converter\is-ptcdo.tmp в %LOCALAPPDATA%\jenny video converter\libpng16-16.dll
%LOCALAPPDATA%\jenny video converter\is-sjbii.tmp в %LOCALAPPDATA%\jenny video converter\libpixman-1-0.dll
%LOCALAPPDATA%\jenny video converter\is-a8s9p.tmp в %LOCALAPPDATA%\jenny video converter\libpcre-1.dll
%LOCALAPPDATA%\jenny video converter\is-ce3vl.tmp в %LOCALAPPDATA%\jenny video converter\libpangowin32-1.0-0.dll
%LOCALAPPDATA%\jenny video converter\is-jjf13.tmp в %LOCALAPPDATA%\jenny video converter\libpangomm-1.4-1.dll
%LOCALAPPDATA%\jenny video converter\is-mphhe.tmp в %LOCALAPPDATA%\jenny video converter\libpangoft2-1.0-0.dll
%LOCALAPPDATA%\jenny video converter\is-k2vro.tmp в %LOCALAPPDATA%\jenny video converter\libpangocairo-1.0-0.dll
%LOCALAPPDATA%\jenny video converter\is-4kgm8.tmp в %LOCALAPPDATA%\jenny video converter\libpango-1.0-0.dll
%LOCALAPPDATA%\jenny video converter\is-mi18t.tmp в %LOCALAPPDATA%\jenny video converter\zlib1.dll
%LOCALAPPDATA%\jenny video converter\is-omp30.tmp в %LOCALAPPDATA%\jenny video converter\liblzma-5.dll
%LOCALAPPDATA%\jenny video converter\is-1alje.tmp в %LOCALAPPDATA%\jenny video converter\libjpeg-8.dll
%LOCALAPPDATA%\jenny video converter\is-3asu0.tmp в %LOCALAPPDATA%\jenny video converter\libintl-8.dll
%LOCALAPPDATA%\jenny video converter\is-qu0uo.tmp в %LOCALAPPDATA%\jenny video converter\libharfbuzz-0.dll
%LOCALAPPDATA%\jenny video converter\is-2jnmv.tmp в %LOCALAPPDATA%\jenny video converter\libgraphite2.dll
%LOCALAPPDATA%\jenny video converter\is-1cpu2.tmp в %LOCALAPPDATA%\jenny video converter\libgomp-1.dll
%LOCALAPPDATA%\jenny video converter\is-kvpj4.tmp в %LOCALAPPDATA%\jenny video converter\libgobject-2.0-0.dll
%LOCALAPPDATA%\jenny video converter\is-7trjj.tmp в %LOCALAPPDATA%\jenny video converter\libgmodule-2.0-0.dll
%LOCALAPPDATA%\jenny video converter\is-6oa64.tmp в %LOCALAPPDATA%\jenny video converter\libglibmm-2.4-1.dll
%LOCALAPPDATA%\jenny video converter\is-n6gss.tmp в %LOCALAPPDATA%\jenny video converter\libgdk_pixbuf-2.0-0.dll
%LOCALAPPDATA%\jenny video converter\is-tails.tmp в %LOCALAPPDATA%\jenny video converter\libgdkmm-2.4-1.dll
%LOCALAPPDATA%\jenny video converter\is-s8mko.tmp в %LOCALAPPDATA%\jenny video converter\libgdk-win32-2.0-0.dll
%LOCALAPPDATA%\jenny video converter\is-0f4ki.tmp в %LOCALAPPDATA%\jenny video converter\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\jenny video converter\is-l7osq.tmp в %LOCALAPPDATA%\jenny video converter\liblcms2-2.dll
%LOCALAPPDATA%\jenny video converter\is-f445u.tmp в %LOCALAPPDATA%\jenny video converter\jennyvideoconverter32_64.exe

Другое

Ищет следующие окна

ClassName: 'fff6f9_etBox1073_fff6f9' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-94njv.tmp\<Имя файла>.tmp' /SL5="$6024E,4217740,54272,<Полный путь к файлу>"
'%LOCALAPPDATA%\jenny video converter\jennyvideoconverter32_64.exe' -i