Trojan.MulDrop24.52199

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\AudioConverterRipper v6.6] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\AudioConverterRipper v6.6] 'ImagePath' = '%ALLUSERSPROFILE%\AudioConverterRipper v6.6\AudioConverterRipper v6.6.exe'

Creates the following services

'AudioConverterRipper v6.6' %ALLUSERSPROFILE%\AudioConverterRipper v6.6\AudioConverterRipper v6.6.exe

Modifies file system

Creates the following files

%TEMP%\is-v99dm.tmp\<File name>.tmp
%LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\is-v8ine.tmp
%LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\is-l6p34.tmp
%LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\is-grato.tmp
%LOCALAPPDATA%\et audio converter\pf\common audio\is-mu648.tmp
%LOCALAPPDATA%\et audio converter\pf\common audio\is-o20b0.tmp
%LOCALAPPDATA%\et audio converter\pf\common audio\is-7f6bv.tmp
%LOCALAPPDATA%\et audio converter\pf\common audio\is-rqrd0.tmp
%LOCALAPPDATA%\et audio converter\pf\common audio\is-t9uve.tmp
%LOCALAPPDATA%\et audio converter\pf\common audio\is-aistr.tmp
%LOCALAPPDATA%\et audio converter\pf\common audio\is-ssn14.tmp
%LOCALAPPDATA%\et audio converter\pf\common audio\is-bin9s.tmp
%LOCALAPPDATA%\et audio converter\pf\common audio\is-epleq.tmp
%LOCALAPPDATA%\et audio converter\pf\common audio\is-9q45m.tmp
%LOCALAPPDATA%\et audio converter\lang\is-8vv0e.tmp
%LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\is-ktgii.tmp
%LOCALAPPDATA%\et audio converter\pf\common audio\is-1ndfc.tmp
%LOCALAPPDATA%\et audio converter\pf\common audio\is-og2k4.tmp
%LOCALAPPDATA%\et audio converter\unins000.dat
%LOCALAPPDATA%\et audio converter\jramsoft.url
%LOCALAPPDATA%\et audio converter\is-07jsp.tmp
%LOCALAPPDATA%\et audio converter\lang\is-040s4.tmp
%LOCALAPPDATA%\et audio converter\lang\is-ancgr.tmp
%LOCALAPPDATA%\et audio converter\is-1ommk.tmp
%LOCALAPPDATA%\et audio converter\lang\is-gbudk.tmp
%LOCALAPPDATA%\et audio converter\lang\is-e1me4.tmp
%LOCALAPPDATA%\et audio converter\pf\common audio\is-rv7ve.tmp
%LOCALAPPDATA%\et audio converter\pf\common audio\is-4iip5.tmp
%LOCALAPPDATA%\et audio converter\pf\common audio\is-a0sfh.tmp
%LOCALAPPDATA%\et audio converter\pf\common audio\is-lt4nf.tmp
%LOCALAPPDATA%\et audio converter\pf\common audio\is-dd9sa.tmp
%LOCALAPPDATA%\et audio converter\pf\common audio\is-56lh4.tmp
%LOCALAPPDATA%\et audio converter\lang\is-mlvdr.tmp
%LOCALAPPDATA%\et audio converter\lang\is-9p2hc.tmp
%LOCALAPPDATA%\et audio converter\lang\is-ckvjh.tmp
%TEMP%\is-4man5.tmp\_isetup\_setup64.tmp
%TEMP%\is-4man5.tmp\_isetup\_shfoldr.dll
%TEMP%\is-4man5.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\et audio converter\is-mggme.tmp
%LOCALAPPDATA%\et audio converter\is-mhn65.tmp
%LOCALAPPDATA%\et audio converter\is-9aakv.tmp
%LOCALAPPDATA%\et audio converter\is-raj08.tmp
%LOCALAPPDATA%\et audio converter\is-mf7us.tmp
%LOCALAPPDATA%\et audio converter\is-p5gnc.tmp
%LOCALAPPDATA%\et audio converter\is-0n4e2.tmp
%LOCALAPPDATA%\et audio converter\is-gumcp.tmp
%LOCALAPPDATA%\et audio converter\is-7758j.tmp
%LOCALAPPDATA%\et audio converter\is-b90uu.tmp
%LOCALAPPDATA%\et audio converter\is-nra6q.tmp
%TEMP%\is-4man5.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\et audio converter\is-b3q7h.tmp
%LOCALAPPDATA%\et audio converter\lang\is-keft7.tmp
%LOCALAPPDATA%\et audio converter\is-0gr9a.tmp
%LOCALAPPDATA%\et audio converter\is-84t9i.tmp
%LOCALAPPDATA%\et audio converter\is-56uuv.tmp
%LOCALAPPDATA%\et audio converter\is-p25f7.tmp
%LOCALAPPDATA%\et audio converter\is-0c4qq.tmp
%LOCALAPPDATA%\et audio converter\is-ma3o0.tmp
%LOCALAPPDATA%\et audio converter\lang\is-1kt3r.tmp
%LOCALAPPDATA%\et audio converter\is-k7gq8.tmp
%LOCALAPPDATA%\et audio converter\etconverterripper.exe
%LOCALAPPDATA%\et audio converter\is-1a0v1.tmp
%LOCALAPPDATA%\et audio converter\is-c0n0d.tmp
%LOCALAPPDATA%\et audio converter\is-3pq4f.tmp
%LOCALAPPDATA%\et audio converter\is-c2qb3.tmp
%LOCALAPPDATA%\et audio converter\is-j3m7d.tmp
%LOCALAPPDATA%\et audio converter\is-6uiqq.tmp
%ALLUSERSPROFILE%\audioconverterripper v6.6\audioconverterripper v6.6.exe

Deletes the following files

%LOCALAPPDATA%\et audio converter\lang\audioconverterripper.dat
%LOCALAPPDATA%\et audio converter\lang\audioconverterripper.txt
%LOCALAPPDATA%\et audio converter\lang\feedback.dat
%LOCALAPPDATA%\et audio converter\lang\musictype.txt
%LOCALAPPDATA%\et audio converter\lang\update.log

Moves the following files

from %LOCALAPPDATA%\et audio converter\is-mggme.tmp to %LOCALAPPDATA%\et audio converter\unins000.exe
from %LOCALAPPDATA%\et audio converter\lang\is-8vv0e.tmp to %LOCALAPPDATA%\et audio converter\lang\update.log
from %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\is-ktgii.tmp to %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\microsoft.vc90.crt.manifest
from %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\is-v8ine.tmp to %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\msvcm90.dll
from %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\is-l6p34.tmp to %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\msvcp90.dll
from %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\is-grato.tmp to %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\msvcr90.dll
from %LOCALAPPDATA%\et audio converter\pf\common audio\is-mu648.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\aac.pf
from %LOCALAPPDATA%\et audio converter\pf\common audio\is-o20b0.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\ac3.pf
from %LOCALAPPDATA%\et audio converter\pf\common audio\is-7f6bv.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\aiff.pf
from %LOCALAPPDATA%\et audio converter\pf\common audio\is-rqrd0.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\amr.pf
from %LOCALAPPDATA%\et audio converter\pf\common audio\is-t9uve.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\ape.pf
from %LOCALAPPDATA%\et audio converter\is-84t9i.tmp to %LOCALAPPDATA%\et audio converter\realquickjoin.dll
from %LOCALAPPDATA%\et audio converter\pf\common audio\is-aistr.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\au.pf
from %LOCALAPPDATA%\et audio converter\pf\common audio\is-bin9s.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\m4a.pf
from %LOCALAPPDATA%\et audio converter\pf\common audio\is-epleq.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\m4b.pf
from %LOCALAPPDATA%\et audio converter\pf\common audio\is-9q45m.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\m4r.pf
from %LOCALAPPDATA%\et audio converter\pf\common audio\is-1ndfc.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\mka.pf
from %LOCALAPPDATA%\et audio converter\pf\common audio\is-og2k4.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\mp2.pf
from %LOCALAPPDATA%\et audio converter\pf\common audio\is-56lh4.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\mp3.pf
from %LOCALAPPDATA%\et audio converter\pf\common audio\is-dd9sa.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\ogg.pf
from %LOCALAPPDATA%\et audio converter\pf\common audio\is-lt4nf.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\ra.pf
from %LOCALAPPDATA%\et audio converter\pf\common audio\is-a0sfh.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\voc.pf
from %LOCALAPPDATA%\et audio converter\pf\common audio\is-4iip5.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\wav.pf
from %LOCALAPPDATA%\et audio converter\lang\is-9p2hc.tmp to %LOCALAPPDATA%\et audio converter\lang\feedback.dat
from %LOCALAPPDATA%\et audio converter\lang\is-mlvdr.tmp to %LOCALAPPDATA%\et audio converter\lang\musictype.txt
from %LOCALAPPDATA%\et audio converter\lang\is-ckvjh.tmp to %LOCALAPPDATA%\et audio converter\lang\audioconverterripper.txt
from %LOCALAPPDATA%\et audio converter\lang\is-keft7.tmp to %LOCALAPPDATA%\et audio converter\lang\audioconverterripper.dat
from %LOCALAPPDATA%\et audio converter\is-j3m7d.tmp to %LOCALAPPDATA%\et audio converter\wmadecode.dll
from %LOCALAPPDATA%\et audio converter\is-9aakv.tmp to %LOCALAPPDATA%\et audio converter\msvcr71.dll
from %LOCALAPPDATA%\et audio converter\is-raj08.tmp to %LOCALAPPDATA%\et audio converter\musiccd.exe
from %LOCALAPPDATA%\et audio converter\is-mf7us.tmp to %LOCALAPPDATA%\et audio converter\nvencoderkernel.dll
from %LOCALAPPDATA%\et audio converter\is-p5gnc.tmp to %LOCALAPPDATA%\et audio converter\ocxhelper.exe
from %LOCALAPPDATA%\et audio converter\is-0n4e2.tmp to %LOCALAPPDATA%\et audio converter\pic2m2v.dll
from %LOCALAPPDATA%\et audio converter\is-gumcp.tmp to %LOCALAPPDATA%\et audio converter\popcorn.dll
from %LOCALAPPDATA%\et audio converter\is-7758j.tmp to %LOCALAPPDATA%\et audio converter\popcorn.dll.intermediate.manifest
from %LOCALAPPDATA%\et audio converter\is-b90uu.tmp to %LOCALAPPDATA%\et audio converter\postproc-52.dll
from %LOCALAPPDATA%\et audio converter\is-nra6q.tmp to %LOCALAPPDATA%\et audio converter\productcontrol.dll
from %LOCALAPPDATA%\et audio converter\is-b3q7h.tmp to %LOCALAPPDATA%\et audio converter\pthreadgc2.dll
from %LOCALAPPDATA%\et audio converter\pf\common audio\is-rv7ve.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\wma.pf
from %LOCALAPPDATA%\et audio converter\pf\common audio\is-ssn14.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\flac.pf
from %LOCALAPPDATA%\et audio converter\is-0gr9a.tmp to %LOCALAPPDATA%\et audio converter\pthreadvc2.dll
from %LOCALAPPDATA%\et audio converter\is-p25f7.tmp to %LOCALAPPDATA%\et audio converter\rmvbencodesync.dll
from %LOCALAPPDATA%\et audio converter\is-0c4qq.tmp to %LOCALAPPDATA%\et audio converter\simage.dll
from %LOCALAPPDATA%\et audio converter\is-ma3o0.tmp to %LOCALAPPDATA%\et audio converter\soundtouch.dll
from %LOCALAPPDATA%\et audio converter\is-k7gq8.tmp to %LOCALAPPDATA%\et audio converter\ssleay32.dll
from %LOCALAPPDATA%\et audio converter\is-1ommk.tmp to %LOCALAPPDATA%\et audio converter\swresample-0.dll
from %LOCALAPPDATA%\et audio converter\is-6uiqq.tmp to %LOCALAPPDATA%\et audio converter\uitoolkit.dll.intermediate.manifest
from %LOCALAPPDATA%\et audio converter\is-1a0v1.tmp to %LOCALAPPDATA%\et audio converter\ve32.dll
from %LOCALAPPDATA%\et audio converter\is-c0n0d.tmp to %LOCALAPPDATA%\et audio converter\ve64.dll
from %LOCALAPPDATA%\et audio converter\is-3pq4f.tmp to %LOCALAPPDATA%\et audio converter\wait.gif
from %LOCALAPPDATA%\et audio converter\is-c2qb3.tmp to %LOCALAPPDATA%\et audio converter\webrtc.dll
from %LOCALAPPDATA%\et audio converter\is-mhn65.tmp to %LOCALAPPDATA%\et audio converter\msvcp60.dll
from %LOCALAPPDATA%\et audio converter\is-56uuv.tmp to %LOCALAPPDATA%\et audio converter\rmvbencode.dll
from %LOCALAPPDATA%\et audio converter\is-07jsp.tmp to %LOCALAPPDATA%\et audio converter\etconverterripper.exe

Substitutes the following files

%LOCALAPPDATA%\et audio converter\lang\audioconverterripper.dat
%LOCALAPPDATA%\et audio converter\lang\audioconverterripper.txt
%LOCALAPPDATA%\et audio converter\lang\feedback.dat
%LOCALAPPDATA%\et audio converter\lang\musictype.txt
%LOCALAPPDATA%\et audio converter\lang\update.log

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'f4c079_ETAC1181FlashFixClass_f4c079'

Creates and executes the following

'%TEMP%\is-v99dm.tmp\<File name>.tmp' /SL5="$60238,3428006,54272,<Full path to file>"
'%LOCALAPPDATA%\et audio converter\etconverterripper.exe' -i
'%LOCALAPPDATA%\et audio converter\etconverterripper.exe' -s

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней