Trojan.MulDrop28.30649

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\DC Converter Extension 10.15.47] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\DC Converter Extension 10.15.47] 'ImagePath' = '%ALLUSERSPROFILE%\DC Converter Extension 10.15.47\DC Converter Extension 10.15.47.exe'

Создает следующие сервисы

'DC Converter Extension 10.15.47' %ALLUSERSPROFILE%\DC Converter Extension 10.15.47\DC Converter Extension 10.15.47.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-0cgn7.tmp\is-nvcio.tmp
%LOCALAPPDATA%\vex video extensions\is-jvmr8.tmp
%LOCALAPPDATA%\vex video extensions\is-lv538.tmp
%LOCALAPPDATA%\vex video extensions\is-6prvd.tmp
%LOCALAPPDATA%\vex video extensions\is-5f4hd.tmp
%LOCALAPPDATA%\vex video extensions\is-2l65o.tmp
%LOCALAPPDATA%\vex video extensions\is-t08em.tmp
%LOCALAPPDATA%\vex video extensions\is-s2ubm.tmp
%LOCALAPPDATA%\vex video extensions\is-v18dq.tmp
%LOCALAPPDATA%\vex video extensions\is-l6heo.tmp
%LOCALAPPDATA%\vex video extensions\is-q3o2n.tmp
%LOCALAPPDATA%\vex video extensions\is-tr0ir.tmp
%LOCALAPPDATA%\vex video extensions\is-vto0l.tmp
%LOCALAPPDATA%\vex video extensions\is-lolo1.tmp
%LOCALAPPDATA%\vex video extensions\is-qrt83.tmp
%LOCALAPPDATA%\vex video extensions\uninstall\unins000.dat
%LOCALAPPDATA%\vex video extensions\is-ovo4n.tmp
%LOCALAPPDATA%\vex video extensions\vexvideoextensions32.exe
%LOCALAPPDATA%\vex video extensions\is-vnq68.tmp
%LOCALAPPDATA%\vex video extensions\is-ciahh.tmp
%TEMP%\is-gombe.tmp\_isetup\_regdll.tmp
%TEMP%\is-gombe.tmp\_isetup\_setup64.tmp
%TEMP%\is-gombe.tmp\_isetup\_shfoldr.dll
%TEMP%\is-gombe.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\vex video extensions\uninstall\is-8kco6.tmp
%LOCALAPPDATA%\vex video extensions\is-01ks6.tmp
%LOCALAPPDATA%\vex video extensions\is-ltu5b.tmp
%LOCALAPPDATA%\vex video extensions\is-hantc.tmp
%LOCALAPPDATA%\vex video extensions\is-ppp8r.tmp
%LOCALAPPDATA%\vex video extensions\is-9bb2d.tmp
%LOCALAPPDATA%\vex video extensions\is-0b33e.tmp
%LOCALAPPDATA%\vex video extensions\is-lqueq.tmp
%LOCALAPPDATA%\vex video extensions\is-rdv72.tmp
%LOCALAPPDATA%\vex video extensions\is-572sg.tmp
%LOCALAPPDATA%\vex video extensions\is-raskv.tmp
%LOCALAPPDATA%\vex video extensions\is-37pbk.tmp
%ALLUSERSPROFILE%\dc converter extension 10.15.47\dc converter extension 10.15.47.exe

Перемещает следующие файлы

%LOCALAPPDATA%\vex video extensions\uninstall\is-8kco6.tmp в %LOCALAPPDATA%\vex video extensions\uninstall\unins000.exe
%LOCALAPPDATA%\vex video extensions\is-vto0l.tmp в %LOCALAPPDATA%\vex video extensions\libwinpthread-1.dll
%LOCALAPPDATA%\vex video extensions\is-tr0ir.tmp в %LOCALAPPDATA%\vex video extensions\libtiff-5.dll
%LOCALAPPDATA%\vex video extensions\is-q3o2n.tmp в %LOCALAPPDATA%\vex video extensions\libsigc-2.0-0.dll
%LOCALAPPDATA%\vex video extensions\is-l6heo.tmp в %LOCALAPPDATA%\vex video extensions\librsvg-2-2.dll
%LOCALAPPDATA%\vex video extensions\is-v18dq.tmp в %LOCALAPPDATA%\vex video extensions\libpng16-16.dll
%LOCALAPPDATA%\vex video extensions\is-s2ubm.tmp в %LOCALAPPDATA%\vex video extensions\libpixman-1-0.dll
%LOCALAPPDATA%\vex video extensions\is-t08em.tmp в %LOCALAPPDATA%\vex video extensions\libpcre-1.dll
%LOCALAPPDATA%\vex video extensions\is-2l65o.tmp в %LOCALAPPDATA%\vex video extensions\libpangowin32-1.0-0.dll
%LOCALAPPDATA%\vex video extensions\is-5f4hd.tmp в %LOCALAPPDATA%\vex video extensions\libpangomm-1.4-1.dll
%LOCALAPPDATA%\vex video extensions\is-6prvd.tmp в %LOCALAPPDATA%\vex video extensions\libpangoft2-1.0-0.dll
%LOCALAPPDATA%\vex video extensions\is-lv538.tmp в %LOCALAPPDATA%\vex video extensions\libpangocairo-1.0-0.dll
%LOCALAPPDATA%\vex video extensions\is-jvmr8.tmp в %LOCALAPPDATA%\vex video extensions\libpango-1.0-0.dll
%LOCALAPPDATA%\vex video extensions\is-lolo1.tmp в %LOCALAPPDATA%\vex video extensions\zlib1.dll
%LOCALAPPDATA%\vex video extensions\is-ovo4n.tmp в %LOCALAPPDATA%\vex video extensions\liblzma-5.dll
%LOCALAPPDATA%\vex video extensions\is-37pbk.tmp в %LOCALAPPDATA%\vex video extensions\libjpeg-8.dll
%LOCALAPPDATA%\vex video extensions\is-ciahh.tmp в %LOCALAPPDATA%\vex video extensions\libintl-8.dll
%LOCALAPPDATA%\vex video extensions\is-raskv.tmp в %LOCALAPPDATA%\vex video extensions\libharfbuzz-0.dll
%LOCALAPPDATA%\vex video extensions\is-572sg.tmp в %LOCALAPPDATA%\vex video extensions\libgraphite2.dll
%LOCALAPPDATA%\vex video extensions\is-rdv72.tmp в %LOCALAPPDATA%\vex video extensions\libgomp-1.dll
%LOCALAPPDATA%\vex video extensions\is-lqueq.tmp в %LOCALAPPDATA%\vex video extensions\libgobject-2.0-0.dll
%LOCALAPPDATA%\vex video extensions\is-0b33e.tmp в %LOCALAPPDATA%\vex video extensions\libgmodule-2.0-0.dll
%LOCALAPPDATA%\vex video extensions\is-9bb2d.tmp в %LOCALAPPDATA%\vex video extensions\libglibmm-2.4-1.dll
%LOCALAPPDATA%\vex video extensions\is-ppp8r.tmp в %LOCALAPPDATA%\vex video extensions\libgdk_pixbuf-2.0-0.dll
%LOCALAPPDATA%\vex video extensions\is-hantc.tmp в %LOCALAPPDATA%\vex video extensions\libgdkmm-2.4-1.dll
%LOCALAPPDATA%\vex video extensions\is-ltu5b.tmp в %LOCALAPPDATA%\vex video extensions\libgdk-win32-2.0-0.dll
%LOCALAPPDATA%\vex video extensions\is-01ks6.tmp в %LOCALAPPDATA%\vex video extensions\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\vex video extensions\is-vnq68.tmp в %LOCALAPPDATA%\vex video extensions\liblcms2-2.dll
%LOCALAPPDATA%\vex video extensions\is-qrt83.tmp в %LOCALAPPDATA%\vex video extensions\vexvideoextensions32.exe