Trojan.MulDrop28.28046

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\ET Ammeter Side 10.7.46] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\ET Ammeter Side 10.7.46] 'ImagePath' = '%ALLUSERSPROFILE%\ET Ammeter Side 10.7.46\ET Ammeter Side 10.7.46.exe'

Создает следующие сервисы

'ET Ammeter Side 10.7.46' %ALLUSERSPROFILE%\ET Ammeter Side 10.7.46\ET Ammeter Side 10.7.46.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-2k4of.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\jenny video converter\is-qip5p.tmp
%LOCALAPPDATA%\jenny video converter\is-nbgil.tmp
%LOCALAPPDATA%\jenny video converter\is-mbci8.tmp
%LOCALAPPDATA%\jenny video converter\is-n73cd.tmp
%LOCALAPPDATA%\jenny video converter\is-43jsf.tmp
%LOCALAPPDATA%\jenny video converter\is-f16f0.tmp
%LOCALAPPDATA%\jenny video converter\is-0abmt.tmp
%LOCALAPPDATA%\jenny video converter\is-3lnmp.tmp
%LOCALAPPDATA%\jenny video converter\is-32kfb.tmp
%LOCALAPPDATA%\jenny video converter\is-n8g8b.tmp
%LOCALAPPDATA%\jenny video converter\is-u6usl.tmp
%LOCALAPPDATA%\jenny video converter\is-q42mh.tmp
%LOCALAPPDATA%\jenny video converter\is-ma2t5.tmp
%LOCALAPPDATA%\jenny video converter\is-srdof.tmp
%LOCALAPPDATA%\jenny video converter\uninstall\unins000.dat
%LOCALAPPDATA%\jenny video converter\is-tnlnl.tmp
%LOCALAPPDATA%\jenny video converter\jennyvideoconverter32_64.exe
%LOCALAPPDATA%\jenny video converter\is-pu31t.tmp
%LOCALAPPDATA%\jenny video converter\is-4oe0j.tmp
%TEMP%\is-8k4q5.tmp\_isetup\_regdll.tmp
%TEMP%\is-8k4q5.tmp\_isetup\_setup64.tmp
%TEMP%\is-8k4q5.tmp\_isetup\_shfoldr.dll
%TEMP%\is-8k4q5.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\jenny video converter\uninstall\is-jcacf.tmp
%LOCALAPPDATA%\jenny video converter\is-35bna.tmp
%LOCALAPPDATA%\jenny video converter\is-sqlpq.tmp
%LOCALAPPDATA%\jenny video converter\is-6i13g.tmp
%LOCALAPPDATA%\jenny video converter\is-gbu68.tmp
%LOCALAPPDATA%\jenny video converter\is-q1ef6.tmp
%LOCALAPPDATA%\jenny video converter\is-jk244.tmp
%LOCALAPPDATA%\jenny video converter\is-g4nm2.tmp
%LOCALAPPDATA%\jenny video converter\is-ubbu1.tmp
%LOCALAPPDATA%\jenny video converter\is-u33d4.tmp
%LOCALAPPDATA%\jenny video converter\is-5prsr.tmp
%LOCALAPPDATA%\jenny video converter\is-qe6tj.tmp
%ALLUSERSPROFILE%\et ammeter side 10.7.46\et ammeter side 10.7.46.exe

Перемещает следующие файлы

%LOCALAPPDATA%\jenny video converter\uninstall\is-jcacf.tmp в %LOCALAPPDATA%\jenny video converter\uninstall\unins000.exe
%LOCALAPPDATA%\jenny video converter\is-q42mh.tmp в %LOCALAPPDATA%\jenny video converter\libwinpthread-1.dll
%LOCALAPPDATA%\jenny video converter\is-u6usl.tmp в %LOCALAPPDATA%\jenny video converter\libtiff-5.dll
%LOCALAPPDATA%\jenny video converter\is-n8g8b.tmp в %LOCALAPPDATA%\jenny video converter\libsigc-2.0-0.dll
%LOCALAPPDATA%\jenny video converter\is-32kfb.tmp в %LOCALAPPDATA%\jenny video converter\librsvg-2-2.dll
%LOCALAPPDATA%\jenny video converter\is-3lnmp.tmp в %LOCALAPPDATA%\jenny video converter\libpng16-16.dll
%LOCALAPPDATA%\jenny video converter\is-0abmt.tmp в %LOCALAPPDATA%\jenny video converter\libpixman-1-0.dll
%LOCALAPPDATA%\jenny video converter\is-f16f0.tmp в %LOCALAPPDATA%\jenny video converter\libpcre-1.dll
%LOCALAPPDATA%\jenny video converter\is-43jsf.tmp в %LOCALAPPDATA%\jenny video converter\libpangowin32-1.0-0.dll
%LOCALAPPDATA%\jenny video converter\is-n73cd.tmp в %LOCALAPPDATA%\jenny video converter\libpangomm-1.4-1.dll
%LOCALAPPDATA%\jenny video converter\is-mbci8.tmp в %LOCALAPPDATA%\jenny video converter\libpangoft2-1.0-0.dll
%LOCALAPPDATA%\jenny video converter\is-nbgil.tmp в %LOCALAPPDATA%\jenny video converter\libpangocairo-1.0-0.dll
%LOCALAPPDATA%\jenny video converter\is-qip5p.tmp в %LOCALAPPDATA%\jenny video converter\libpango-1.0-0.dll
%LOCALAPPDATA%\jenny video converter\is-ma2t5.tmp в %LOCALAPPDATA%\jenny video converter\zlib1.dll
%LOCALAPPDATA%\jenny video converter\is-tnlnl.tmp в %LOCALAPPDATA%\jenny video converter\liblzma-5.dll
%LOCALAPPDATA%\jenny video converter\is-qe6tj.tmp в %LOCALAPPDATA%\jenny video converter\libjpeg-8.dll
%LOCALAPPDATA%\jenny video converter\is-4oe0j.tmp в %LOCALAPPDATA%\jenny video converter\libintl-8.dll
%LOCALAPPDATA%\jenny video converter\is-5prsr.tmp в %LOCALAPPDATA%\jenny video converter\libharfbuzz-0.dll
%LOCALAPPDATA%\jenny video converter\is-u33d4.tmp в %LOCALAPPDATA%\jenny video converter\libgraphite2.dll
%LOCALAPPDATA%\jenny video converter\is-ubbu1.tmp в %LOCALAPPDATA%\jenny video converter\libgomp-1.dll
%LOCALAPPDATA%\jenny video converter\is-g4nm2.tmp в %LOCALAPPDATA%\jenny video converter\libgobject-2.0-0.dll
%LOCALAPPDATA%\jenny video converter\is-jk244.tmp в %LOCALAPPDATA%\jenny video converter\libgmodule-2.0-0.dll
%LOCALAPPDATA%\jenny video converter\is-q1ef6.tmp в %LOCALAPPDATA%\jenny video converter\libglibmm-2.4-1.dll
%LOCALAPPDATA%\jenny video converter\is-gbu68.tmp в %LOCALAPPDATA%\jenny video converter\libgdk_pixbuf-2.0-0.dll
%LOCALAPPDATA%\jenny video converter\is-6i13g.tmp в %LOCALAPPDATA%\jenny video converter\libgdkmm-2.4-1.dll
%LOCALAPPDATA%\jenny video converter\is-sqlpq.tmp в %LOCALAPPDATA%\jenny video converter\libgdk-win32-2.0-0.dll
%LOCALAPPDATA%\jenny video converter\is-35bna.tmp в %LOCALAPPDATA%\jenny video converter\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\jenny video converter\is-pu31t.tmp в %LOCALAPPDATA%\jenny video converter\liblcms2-2.dll
%LOCALAPPDATA%\jenny video converter\is-srdof.tmp в %LOCALAPPDATA%\jenny video converter\jennyvideoconverter32_64.exe

Другое

Ищет следующие окна

ClassName: 'n30fcd_etBox1073_n30fcd' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-2k4of.tmp\<Имя файла>.tmp' /SL5="$5024A,4188315,54272,<Полный путь к файлу>"
'%LOCALAPPDATA%\jenny video converter\jennyvideoconverter32_64.exe' -i