Trojan.MulDrop28.30855

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\DAC Converter Plugin 10.13.41] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\DAC Converter Plugin 10.13.41] 'ImagePath' = '%ALLUSERSPROFILE%\DAC Converter Plugin 10.13.41\DAC Converter Plugin 10.13.41.exe'

Создает следующие сервисы

'DAC Converter Plugin 10.13.41' %ALLUSERSPROFILE%\DAC Converter Plugin 10.13.41\DAC Converter Plugin 10.13.41.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-p6l2m.tmp\is-gnr9e.tmp
%LOCALAPPDATA%\jennysoft video editor\is-4nv6p.tmp
%LOCALAPPDATA%\jennysoft video editor\is-dvlir.tmp
%LOCALAPPDATA%\jennysoft video editor\is-gmfre.tmp
%LOCALAPPDATA%\jennysoft video editor\is-vef3j.tmp
%LOCALAPPDATA%\jennysoft video editor\is-s8uum.tmp
%LOCALAPPDATA%\jennysoft video editor\is-lko1b.tmp
%LOCALAPPDATA%\jennysoft video editor\is-rnems.tmp
%LOCALAPPDATA%\jennysoft video editor\is-3s6bp.tmp
%LOCALAPPDATA%\jennysoft video editor\is-0p42j.tmp
%LOCALAPPDATA%\jennysoft video editor\is-fq5rt.tmp
%LOCALAPPDATA%\jennysoft video editor\is-s0oum.tmp
%LOCALAPPDATA%\jennysoft video editor\is-gkj1t.tmp
%LOCALAPPDATA%\jennysoft video editor\is-hj2s9.tmp
%LOCALAPPDATA%\jennysoft video editor\is-j6sj9.tmp
%LOCALAPPDATA%\jennysoft video editor\uninstall\unins000.dat
%LOCALAPPDATA%\jennysoft video editor\is-itqqk.tmp
%LOCALAPPDATA%\jennysoft video editor\jennysoftvideoeditor32.exe
%LOCALAPPDATA%\jennysoft video editor\is-i33sk.tmp
%LOCALAPPDATA%\jennysoft video editor\is-b80l5.tmp
%TEMP%\is-fde8b.tmp\_isetup\_regdll.tmp
%TEMP%\is-fde8b.tmp\_isetup\_setup64.tmp
%TEMP%\is-fde8b.tmp\_isetup\_shfoldr.dll
%TEMP%\is-fde8b.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\jennysoft video editor\uninstall\is-t0mum.tmp
%LOCALAPPDATA%\jennysoft video editor\is-mc5aj.tmp
%LOCALAPPDATA%\jennysoft video editor\is-313jd.tmp
%LOCALAPPDATA%\jennysoft video editor\is-v9j1m.tmp
%LOCALAPPDATA%\jennysoft video editor\is-rt0kb.tmp
%LOCALAPPDATA%\jennysoft video editor\is-mue9v.tmp
%LOCALAPPDATA%\jennysoft video editor\is-07bf9.tmp
%LOCALAPPDATA%\jennysoft video editor\is-uu181.tmp
%LOCALAPPDATA%\jennysoft video editor\is-g89r3.tmp
%LOCALAPPDATA%\jennysoft video editor\is-4n7en.tmp
%LOCALAPPDATA%\jennysoft video editor\is-b80m3.tmp
%LOCALAPPDATA%\jennysoft video editor\is-86hjm.tmp
%ALLUSERSPROFILE%\dac converter plugin 10.13.41\dac converter plugin 10.13.41.exe

Перемещает следующие файлы

%LOCALAPPDATA%\jennysoft video editor\uninstall\is-t0mum.tmp в %LOCALAPPDATA%\jennysoft video editor\uninstall\unins000.exe
%LOCALAPPDATA%\jennysoft video editor\is-gkj1t.tmp в %LOCALAPPDATA%\jennysoft video editor\libwinpthread-1.dll
%LOCALAPPDATA%\jennysoft video editor\is-s0oum.tmp в %LOCALAPPDATA%\jennysoft video editor\libtiff-5.dll
%LOCALAPPDATA%\jennysoft video editor\is-fq5rt.tmp в %LOCALAPPDATA%\jennysoft video editor\libsigc-2.0-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-0p42j.tmp в %LOCALAPPDATA%\jennysoft video editor\librsvg-2-2.dll
%LOCALAPPDATA%\jennysoft video editor\is-3s6bp.tmp в %LOCALAPPDATA%\jennysoft video editor\libpng16-16.dll
%LOCALAPPDATA%\jennysoft video editor\is-rnems.tmp в %LOCALAPPDATA%\jennysoft video editor\libpixman-1-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-lko1b.tmp в %LOCALAPPDATA%\jennysoft video editor\libpcre-1.dll
%LOCALAPPDATA%\jennysoft video editor\is-s8uum.tmp в %LOCALAPPDATA%\jennysoft video editor\libpangowin32-1.0-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-vef3j.tmp в %LOCALAPPDATA%\jennysoft video editor\libpangomm-1.4-1.dll
%LOCALAPPDATA%\jennysoft video editor\is-gmfre.tmp в %LOCALAPPDATA%\jennysoft video editor\libpangoft2-1.0-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-dvlir.tmp в %LOCALAPPDATA%\jennysoft video editor\libpangocairo-1.0-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-4nv6p.tmp в %LOCALAPPDATA%\jennysoft video editor\libpango-1.0-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-hj2s9.tmp в %LOCALAPPDATA%\jennysoft video editor\zlib1.dll
%LOCALAPPDATA%\jennysoft video editor\is-itqqk.tmp в %LOCALAPPDATA%\jennysoft video editor\liblzma-5.dll
%LOCALAPPDATA%\jennysoft video editor\is-86hjm.tmp в %LOCALAPPDATA%\jennysoft video editor\libjpeg-8.dll
%LOCALAPPDATA%\jennysoft video editor\is-b80l5.tmp в %LOCALAPPDATA%\jennysoft video editor\libintl-8.dll
%LOCALAPPDATA%\jennysoft video editor\is-b80m3.tmp в %LOCALAPPDATA%\jennysoft video editor\libharfbuzz-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-4n7en.tmp в %LOCALAPPDATA%\jennysoft video editor\libgraphite2.dll
%LOCALAPPDATA%\jennysoft video editor\is-g89r3.tmp в %LOCALAPPDATA%\jennysoft video editor\libgomp-1.dll
%LOCALAPPDATA%\jennysoft video editor\is-uu181.tmp в %LOCALAPPDATA%\jennysoft video editor\libgobject-2.0-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-07bf9.tmp в %LOCALAPPDATA%\jennysoft video editor\libgmodule-2.0-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-mue9v.tmp в %LOCALAPPDATA%\jennysoft video editor\libglibmm-2.4-1.dll
%LOCALAPPDATA%\jennysoft video editor\is-rt0kb.tmp в %LOCALAPPDATA%\jennysoft video editor\libgdk_pixbuf-2.0-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-v9j1m.tmp в %LOCALAPPDATA%\jennysoft video editor\libgdkmm-2.4-1.dll
%LOCALAPPDATA%\jennysoft video editor\is-313jd.tmp в %LOCALAPPDATA%\jennysoft video editor\libgdk-win32-2.0-0.dll
%LOCALAPPDATA%\jennysoft video editor\is-mc5aj.tmp в %LOCALAPPDATA%\jennysoft video editor\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\jennysoft video editor\is-i33sk.tmp в %LOCALAPPDATA%\jennysoft video editor\liblcms2-2.dll
%LOCALAPPDATA%\jennysoft video editor\is-j6sj9.tmp в %LOCALAPPDATA%\jennysoft video editor\jennysoftvideoeditor32.exe

Другое

Ищет следующие окна

ClassName: 'n297cd_dacPlugin10132_n297cd' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-p6l2m.tmp\is-gnr9e.tmp' /SL4 $120172 "<Полный путь к файлу>" 7626141 52224
'%LOCALAPPDATA%\jennysoft video editor\jennysoftvideoeditor32.exe' -i