Trojan.MulDrop28.30849

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\DAC Converter Plugin 10.13.41] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\DAC Converter Plugin 10.13.41] 'ImagePath' = '%ALLUSERSPROFILE%\DAC Converter Plugin 10.13.41\DAC Converter Plugin 10.13.41.exe'

Создает следующие сервисы

'DAC Converter Plugin 10.13.41' %ALLUSERSPROFILE%\DAC Converter Plugin 10.13.41\DAC Converter Plugin 10.13.41.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-8du8a.tmp\is-obla7.tmp
%LOCALAPPDATA%\jennysoft video editor\is-oeur3.tmp
%LOCALAPPDATA%\jennysoft video editor\is-6ggvl.tmp
%LOCALAPPDATA%\jennysoft video editor\is-hfivn.tmp
%LOCALAPPDATA%\jennysoft video editor\is-4g9ea.tmp
%LOCALAPPDATA%\jennysoft video editor\is-f4vuh.tmp
%LOCALAPPDATA%\jennysoft video editor\is-vhnjs.tmp
%LOCALAPPDATA%\jennysoft video editor\is-8npjo.tmp
%LOCALAPPDATA%\jennysoft video editor\is-vj5tc.tmp
%LOCALAPPDATA%\jennysoft video editor\is-evn0q.tmp
%LOCALAPPDATA%\jennysoft video editor\is-8bmi6.tmp
%LOCALAPPDATA%\jennysoft video editor\is-jieae.tmp
%LOCALAPPDATA%\jennysoft video editor\is-ojf9u.tmp
%LOCALAPPDATA%\jennysoft video editor\is-73f6l.tmp
%LOCALAPPDATA%\jennysoft video editor\is-8gtie.tmp
%LOCALAPPDATA%\jennysoft video editor\uninstall\unins000.dat
%LOCALAPPDATA%\jennysoft video editor\is-5nsf1.tmp
%LOCALAPPDATA%\jennysoft video editor\jennysoftvideoeditor.exe
%LOCALAPPDATA%\jennysoft video editor\is-n1pbl.tmp
%LOCALAPPDATA%\jennysoft video editor\is-cof5n.tmp
%TEMP%\is-160uk.tmp\_isetup\_regdll.tmp
%TEMP%\is-160uk.tmp\_isetup\_setup64.tmp
%TEMP%\is-160uk.tmp\_isetup\_shfoldr.dll
%TEMP%\is-160uk.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\jennysoft video editor\uninstall\is-02058.tmp
%LOCALAPPDATA%\jennysoft video editor\is-fhlvn.tmp
%LOCALAPPDATA%\jennysoft video editor\is-dkc28.tmp
%LOCALAPPDATA%\jennysoft video editor\is-2df68.tmp
%LOCALAPPDATA%\jennysoft video editor\is-24eed.tmp
%LOCALAPPDATA%\jennysoft video editor\is-vj0sd.tmp
%LOCALAPPDATA%\jennysoft video editor\is-sjjso.tmp
%LOCALAPPDATA%\jennysoft video editor\is-jfd1m.tmp
%LOCALAPPDATA%\jennysoft video editor\is-k1lam.tmp
%LOCALAPPDATA%\jennysoft video editor\is-spr8q.tmp
%LOCALAPPDATA%\jennysoft video editor\is-7sflo.tmp
%LOCALAPPDATA%\jennysoft video editor\is-55k1r.tmp
%ALLUSERSPROFILE%\dac converter plugin 10.13.41\dac converter plugin 10.13.41.exe

Перемещает следующие файлы

%LOCALAPPDATA%\jennysoft video editor\uninstall\is-02058.tmp в %LOCALAPPDATA%\jennysoft video editor\uninstall\unins000.exe
%LOCALAPPDATA%\jennysoft video editor\is-ojf9u.tmp в %LOCALAPPDATA%\jennysoft video editor\libwinpthread-1.dll
%LOCALAPPDATA%\jennysoft video editor\is-jieae.tmp в %LOCALAPPDATA%\jennysoft video editor\libtiff-5.dll
%LOCALAPPDATA%\jennysoft video editor\is-8bmi6.tmp в %LOCALAPPDATA%\jennysoft video editor\libsigc-2.0-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-evn0q.tmp в %LOCALAPPDATA%\jennysoft video editor\librsvg-2-2.dll
%LOCALAPPDATA%\jennysoft video editor\is-vj5tc.tmp в %LOCALAPPDATA%\jennysoft video editor\libpng16-16.dll
%LOCALAPPDATA%\jennysoft video editor\is-8npjo.tmp в %LOCALAPPDATA%\jennysoft video editor\libpixman-1-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-vhnjs.tmp в %LOCALAPPDATA%\jennysoft video editor\libpcre-1.dll
%LOCALAPPDATA%\jennysoft video editor\is-f4vuh.tmp в %LOCALAPPDATA%\jennysoft video editor\libpangowin32-1.0-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-4g9ea.tmp в %LOCALAPPDATA%\jennysoft video editor\libpangomm-1.4-1.dll
%LOCALAPPDATA%\jennysoft video editor\is-hfivn.tmp в %LOCALAPPDATA%\jennysoft video editor\libpangoft2-1.0-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-6ggvl.tmp в %LOCALAPPDATA%\jennysoft video editor\libpangocairo-1.0-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-oeur3.tmp в %LOCALAPPDATA%\jennysoft video editor\libpango-1.0-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-73f6l.tmp в %LOCALAPPDATA%\jennysoft video editor\zlib1.dll
%LOCALAPPDATA%\jennysoft video editor\is-5nsf1.tmp в %LOCALAPPDATA%\jennysoft video editor\liblzma-5.dll
%LOCALAPPDATA%\jennysoft video editor\is-55k1r.tmp в %LOCALAPPDATA%\jennysoft video editor\libjpeg-8.dll
%LOCALAPPDATA%\jennysoft video editor\is-cof5n.tmp в %LOCALAPPDATA%\jennysoft video editor\libintl-8.dll
%LOCALAPPDATA%\jennysoft video editor\is-7sflo.tmp в %LOCALAPPDATA%\jennysoft video editor\libharfbuzz-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-spr8q.tmp в %LOCALAPPDATA%\jennysoft video editor\libgraphite2.dll
%LOCALAPPDATA%\jennysoft video editor\is-k1lam.tmp в %LOCALAPPDATA%\jennysoft video editor\libgomp-1.dll
%LOCALAPPDATA%\jennysoft video editor\is-jfd1m.tmp в %LOCALAPPDATA%\jennysoft video editor\libgobject-2.0-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-sjjso.tmp в %LOCALAPPDATA%\jennysoft video editor\libgmodule-2.0-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-vj0sd.tmp в %LOCALAPPDATA%\jennysoft video editor\libglibmm-2.4-1.dll
%LOCALAPPDATA%\jennysoft video editor\is-24eed.tmp в %LOCALAPPDATA%\jennysoft video editor\libgdk_pixbuf-2.0-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-2df68.tmp в %LOCALAPPDATA%\jennysoft video editor\libgdkmm-2.4-1.dll
%LOCALAPPDATA%\jennysoft video editor\is-dkc28.tmp в %LOCALAPPDATA%\jennysoft video editor\libgdk-win32-2.0-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-fhlvn.tmp в %LOCALAPPDATA%\jennysoft video editor\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\jennysoft video editor\is-n1pbl.tmp в %LOCALAPPDATA%\jennysoft video editor\liblcms2-2.dll
%LOCALAPPDATA%\jennysoft video editor\is-8gtie.tmp в %LOCALAPPDATA%\jennysoft video editor\jennysoftvideoeditor.exe

Другое

Ищет следующие окна

ClassName: 'L7ffe5_dacPlugin10131_L7ffe5' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-8du8a.tmp\is-obla7.tmp' /SL4 $6024A "<Полный путь к файлу>" 7988647 52224
'%LOCALAPPDATA%\jennysoft video editor\jennysoftvideoeditor.exe' -i