Trojan.Siggen24.12114

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\AudioConverterRipper v6.1] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\AudioConverterRipper v6.1] 'ImagePath' = '%ALLUSERSPROFILE%\AudioConverterRipper v6.1\AudioConverterRipper v6.1.exe'

Creates the following services

'AudioConverterRipper v6.1' %ALLUSERSPROFILE%\AudioConverterRipper v6.1\AudioConverterRipper v6.1.exe

Modifies file system

Creates the following files

%TEMP%\is-3t43i.tmp\<File name>.tmp
%LOCALAPPDATA%\es audio converter\lang\is-l6suu.tmp
%LOCALAPPDATA%\es audio converter\microsoft.vc90.crt\is-rns4c.tmp
%LOCALAPPDATA%\es audio converter\microsoft.vc90.crt\is-l41er.tmp
%LOCALAPPDATA%\es audio converter\microsoft.vc90.crt\is-scjff.tmp
%LOCALAPPDATA%\es audio converter\microsoft.vc90.crt\is-i6afp.tmp
%LOCALAPPDATA%\es audio converter\pf\common audio\is-4mm3l.tmp
%LOCALAPPDATA%\es audio converter\pf\common audio\is-bhj27.tmp
%LOCALAPPDATA%\es audio converter\pf\common audio\is-j8q39.tmp
%LOCALAPPDATA%\es audio converter\pf\common audio\is-o0khr.tmp
%LOCALAPPDATA%\es audio converter\pf\common audio\is-qrl8u.tmp
%LOCALAPPDATA%\es audio converter\pf\common audio\is-fcf3l.tmp
%LOCALAPPDATA%\es audio converter\pf\common audio\is-707dg.tmp
%LOCALAPPDATA%\es audio converter\pf\common audio\is-hdsjs.tmp
%LOCALAPPDATA%\es audio converter\pf\common audio\is-g5ou0.tmp
%LOCALAPPDATA%\es audio converter\pf\common audio\is-vha3u.tmp
%LOCALAPPDATA%\es audio converter\pf\common audio\is-3aq1q.tmp
%LOCALAPPDATA%\es audio converter\pf\common audio\is-7hjoi.tmp
%LOCALAPPDATA%\es audio converter\unins000.dat
%LOCALAPPDATA%\es audio converter\iramsoft.url
%LOCALAPPDATA%\es audio converter\is-2smue.tmp
%LOCALAPPDATA%\es audio converter\lang\is-hi8t6.tmp
%LOCALAPPDATA%\es audio converter\lang\is-ki9h6.tmp
%LOCALAPPDATA%\es audio converter\lang\is-onvp8.tmp
%LOCALAPPDATA%\es audio converter\lang\is-9ndbu.tmp
%LOCALAPPDATA%\es audio converter\lang\is-ul5p4.tmp
%LOCALAPPDATA%\es audio converter\pf\common audio\is-5gm7u.tmp
%LOCALAPPDATA%\es audio converter\pf\common audio\is-5rvid.tmp
%LOCALAPPDATA%\es audio converter\pf\common audio\is-mbgmo.tmp
%LOCALAPPDATA%\es audio converter\pf\common audio\is-moho2.tmp
%LOCALAPPDATA%\es audio converter\pf\common audio\is-m3v7p.tmp
%LOCALAPPDATA%\es audio converter\pf\common audio\is-i1egi.tmp
%LOCALAPPDATA%\es audio converter\esconverterripper.exe
%LOCALAPPDATA%\es audio converter\lang\is-eeo2a.tmp
%LOCALAPPDATA%\es audio converter\lang\is-126cq.tmp
%LOCALAPPDATA%\es audio converter\lang\is-4b85c.tmp
%TEMP%\is-nuvop.tmp\_isetup\_regdll.tmp
%TEMP%\is-nuvop.tmp\_isetup\_setup64.tmp
%TEMP%\is-nuvop.tmp\_isetup\_shfoldr.dll
%TEMP%\is-nuvop.tmp\_isetup\_isdecmp.dll
%TEMP%\is-nuvop.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\es audio converter\is-0c7sp.tmp
%LOCALAPPDATA%\es audio converter\is-7kot1.tmp
%LOCALAPPDATA%\es audio converter\is-mivrl.tmp
%LOCALAPPDATA%\es audio converter\is-ph46t.tmp
%LOCALAPPDATA%\es audio converter\is-p59qg.tmp
%LOCALAPPDATA%\es audio converter\is-b0t4n.tmp
%LOCALAPPDATA%\es audio converter\is-acq12.tmp
%LOCALAPPDATA%\es audio converter\is-v2vt2.tmp
%LOCALAPPDATA%\es audio converter\is-5dgga.tmp
%LOCALAPPDATA%\es audio converter\is-drbkq.tmp
%LOCALAPPDATA%\es audio converter\is-kb40f.tmp
%LOCALAPPDATA%\es audio converter\is-sbp50.tmp
%LOCALAPPDATA%\es audio converter\is-79hg1.tmp
%LOCALAPPDATA%\es audio converter\is-4u8jc.tmp
%LOCALAPPDATA%\es audio converter\is-o6d4s.tmp
%LOCALAPPDATA%\es audio converter\is-h8rpr.tmp
%LOCALAPPDATA%\es audio converter\is-ljggs.tmp
%LOCALAPPDATA%\es audio converter\is-uc3do.tmp
%LOCALAPPDATA%\es audio converter\is-pjdc3.tmp
%LOCALAPPDATA%\es audio converter\is-to255.tmp
%LOCALAPPDATA%\es audio converter\is-5tf14.tmp
%LOCALAPPDATA%\es audio converter\is-3k0r6.tmp
%LOCALAPPDATA%\es audio converter\is-kokce.tmp
%LOCALAPPDATA%\es audio converter\is-64psi.tmp
%LOCALAPPDATA%\es audio converter\is-dpi11.tmp
%LOCALAPPDATA%\es audio converter\is-jqjev.tmp
%LOCALAPPDATA%\es audio converter\lang\is-o244h.tmp
%ALLUSERSPROFILE%\audioconverterripper v6.1\audioconverterripper v6.1.exe

Deletes the following files

%LOCALAPPDATA%\es audio converter\lang\audioconverterripper.dat
%LOCALAPPDATA%\es audio converter\lang\audioconverterripper.txt
%LOCALAPPDATA%\es audio converter\lang\feedback.dat
%LOCALAPPDATA%\es audio converter\lang\musictype.txt
%LOCALAPPDATA%\es audio converter\lang\update.log

Moves the following files

from %LOCALAPPDATA%\es audio converter\is-0c7sp.tmp to %LOCALAPPDATA%\es audio converter\unins000.exe
from %LOCALAPPDATA%\es audio converter\lang\is-l6suu.tmp to %LOCALAPPDATA%\es audio converter\lang\update.log
from %LOCALAPPDATA%\es audio converter\microsoft.vc90.crt\is-rns4c.tmp to %LOCALAPPDATA%\es audio converter\microsoft.vc90.crt\microsoft.vc90.crt.manifest
from %LOCALAPPDATA%\es audio converter\microsoft.vc90.crt\is-l41er.tmp to %LOCALAPPDATA%\es audio converter\microsoft.vc90.crt\msvcm90.dll
from %LOCALAPPDATA%\es audio converter\microsoft.vc90.crt\is-scjff.tmp to %LOCALAPPDATA%\es audio converter\microsoft.vc90.crt\msvcp90.dll
from %LOCALAPPDATA%\es audio converter\microsoft.vc90.crt\is-i6afp.tmp to %LOCALAPPDATA%\es audio converter\microsoft.vc90.crt\msvcr90.dll
from %LOCALAPPDATA%\es audio converter\pf\common audio\is-4mm3l.tmp to %LOCALAPPDATA%\es audio converter\pf\common audio\aac.pf
from %LOCALAPPDATA%\es audio converter\pf\common audio\is-bhj27.tmp to %LOCALAPPDATA%\es audio converter\pf\common audio\ac3.pf
from %LOCALAPPDATA%\es audio converter\pf\common audio\is-j8q39.tmp to %LOCALAPPDATA%\es audio converter\pf\common audio\aiff.pf
from %LOCALAPPDATA%\es audio converter\pf\common audio\is-o0khr.tmp to %LOCALAPPDATA%\es audio converter\pf\common audio\amr.pf
from %LOCALAPPDATA%\es audio converter\pf\common audio\is-qrl8u.tmp to %LOCALAPPDATA%\es audio converter\pf\common audio\ape.pf
from %LOCALAPPDATA%\es audio converter\is-dpi11.tmp to %LOCALAPPDATA%\es audio converter\realquickjoin.dll
from %LOCALAPPDATA%\es audio converter\pf\common audio\is-fcf3l.tmp to %LOCALAPPDATA%\es audio converter\pf\common audio\au.pf
from %LOCALAPPDATA%\es audio converter\pf\common audio\is-hdsjs.tmp to %LOCALAPPDATA%\es audio converter\pf\common audio\m4a.pf
from %LOCALAPPDATA%\es audio converter\pf\common audio\is-g5ou0.tmp to %LOCALAPPDATA%\es audio converter\pf\common audio\m4b.pf
from %LOCALAPPDATA%\es audio converter\pf\common audio\is-vha3u.tmp to %LOCALAPPDATA%\es audio converter\pf\common audio\m4r.pf
from %LOCALAPPDATA%\es audio converter\pf\common audio\is-3aq1q.tmp to %LOCALAPPDATA%\es audio converter\pf\common audio\mka.pf
from %LOCALAPPDATA%\es audio converter\pf\common audio\is-7hjoi.tmp to %LOCALAPPDATA%\es audio converter\pf\common audio\mp2.pf
from %LOCALAPPDATA%\es audio converter\pf\common audio\is-i1egi.tmp to %LOCALAPPDATA%\es audio converter\pf\common audio\mp3.pf
from %LOCALAPPDATA%\es audio converter\pf\common audio\is-m3v7p.tmp to %LOCALAPPDATA%\es audio converter\pf\common audio\ogg.pf
from %LOCALAPPDATA%\es audio converter\pf\common audio\is-moho2.tmp to %LOCALAPPDATA%\es audio converter\pf\common audio\ra.pf
from %LOCALAPPDATA%\es audio converter\pf\common audio\is-mbgmo.tmp to %LOCALAPPDATA%\es audio converter\pf\common audio\voc.pf
from %LOCALAPPDATA%\es audio converter\pf\common audio\is-5rvid.tmp to %LOCALAPPDATA%\es audio converter\pf\common audio\wav.pf
from %LOCALAPPDATA%\es audio converter\lang\is-126cq.tmp to %LOCALAPPDATA%\es audio converter\lang\feedback.dat
from %LOCALAPPDATA%\es audio converter\lang\is-eeo2a.tmp to %LOCALAPPDATA%\es audio converter\lang\musictype.txt
from %LOCALAPPDATA%\es audio converter\lang\is-4b85c.tmp to %LOCALAPPDATA%\es audio converter\lang\audioconverterripper.txt
from %LOCALAPPDATA%\es audio converter\lang\is-o244h.tmp to %LOCALAPPDATA%\es audio converter\lang\audioconverterripper.dat
from %LOCALAPPDATA%\es audio converter\is-79hg1.tmp to %LOCALAPPDATA%\es audio converter\wmadecode.dll
from %LOCALAPPDATA%\es audio converter\is-mivrl.tmp to %LOCALAPPDATA%\es audio converter\msvcr71.dll
from %LOCALAPPDATA%\es audio converter\is-ph46t.tmp to %LOCALAPPDATA%\es audio converter\musiccd.exe
from %LOCALAPPDATA%\es audio converter\is-p59qg.tmp to %LOCALAPPDATA%\es audio converter\nvencoderkernel.dll
from %LOCALAPPDATA%\es audio converter\is-b0t4n.tmp to %LOCALAPPDATA%\es audio converter\ocxhelper.exe
from %LOCALAPPDATA%\es audio converter\is-acq12.tmp to %LOCALAPPDATA%\es audio converter\pic2m2v.dll
from %LOCALAPPDATA%\es audio converter\is-v2vt2.tmp to %LOCALAPPDATA%\es audio converter\popcorn.dll
from %LOCALAPPDATA%\es audio converter\is-5dgga.tmp to %LOCALAPPDATA%\es audio converter\popcorn.dll.intermediate.manifest
from %LOCALAPPDATA%\es audio converter\is-drbkq.tmp to %LOCALAPPDATA%\es audio converter\postproc-52.dll
from %LOCALAPPDATA%\es audio converter\is-kb40f.tmp to %LOCALAPPDATA%\es audio converter\productcontrol.dll
from %LOCALAPPDATA%\es audio converter\is-sbp50.tmp to %LOCALAPPDATA%\es audio converter\pthreadgc2.dll
from %LOCALAPPDATA%\es audio converter\pf\common audio\is-5gm7u.tmp to %LOCALAPPDATA%\es audio converter\pf\common audio\wma.pf
from %LOCALAPPDATA%\es audio converter\pf\common audio\is-707dg.tmp to %LOCALAPPDATA%\es audio converter\pf\common audio\flac.pf
from %LOCALAPPDATA%\es audio converter\is-jqjev.tmp to %LOCALAPPDATA%\es audio converter\pthreadvc2.dll
from %LOCALAPPDATA%\es audio converter\is-kokce.tmp to %LOCALAPPDATA%\es audio converter\rmvbencodesync.dll
from %LOCALAPPDATA%\es audio converter\is-3k0r6.tmp to %LOCALAPPDATA%\es audio converter\simage.dll
from %LOCALAPPDATA%\es audio converter\is-5tf14.tmp to %LOCALAPPDATA%\es audio converter\soundtouch.dll
from %LOCALAPPDATA%\es audio converter\is-pjdc3.tmp to %LOCALAPPDATA%\es audio converter\ssleay32.dll
from %LOCALAPPDATA%\es audio converter\is-to255.tmp to %LOCALAPPDATA%\es audio converter\swresample-0.dll
from %LOCALAPPDATA%\es audio converter\is-uc3do.tmp to %LOCALAPPDATA%\es audio converter\uitoolkit.dll.intermediate.manifest
from %LOCALAPPDATA%\es audio converter\is-ljggs.tmp to %LOCALAPPDATA%\es audio converter\ve32.dll
from %LOCALAPPDATA%\es audio converter\is-h8rpr.tmp to %LOCALAPPDATA%\es audio converter\ve64.dll
from %LOCALAPPDATA%\es audio converter\is-o6d4s.tmp to %LOCALAPPDATA%\es audio converter\wait.gif
from %LOCALAPPDATA%\es audio converter\is-4u8jc.tmp to %LOCALAPPDATA%\es audio converter\webrtc.dll
from %LOCALAPPDATA%\es audio converter\is-7kot1.tmp to %LOCALAPPDATA%\es audio converter\msvcp60.dll
from %LOCALAPPDATA%\es audio converter\is-64psi.tmp to %LOCALAPPDATA%\es audio converter\rmvbencode.dll
from %LOCALAPPDATA%\es audio converter\is-2smue.tmp to %LOCALAPPDATA%\es audio converter\esconverterripper.exe

Substitutes the following files

%LOCALAPPDATA%\es audio converter\lang\audioconverterripper.dat
%LOCALAPPDATA%\es audio converter\lang\audioconverterripper.txt
%LOCALAPPDATA%\es audio converter\lang\feedback.dat
%LOCALAPPDATA%\es audio converter\lang\musictype.txt
%LOCALAPPDATA%\es audio converter\lang\update.log

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'Lc865_ESAC1174FlashFixClass_Lc865'

Creates and executes the following

'%TEMP%\is-3t43i.tmp\<File name>.tmp' /SL5="$50234,4339664,54272,<Full path to file>"
'%LOCALAPPDATA%\es audio converter\esconverterripper.exe' -i
'%LOCALAPPDATA%\es audio converter\esconverterripper.exe' -s

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "ESCR1174"

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial