Trojan.MulDrop28.30772

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\DC Converter Extension 10.15.46] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\DC Converter Extension 10.15.46] 'ImagePath' = '%ALLUSERSPROFILE%\DC Converter Extension 10.15.46\DC Converter Extension 10.15.46.exe'

Создает следующие сервисы

'DC Converter Extension 10.15.46' %ALLUSERSPROFILE%\DC Converter Extension 10.15.46\DC Converter Extension 10.15.46.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-mnj5l.tmp\is-103r9.tmp
%LOCALAPPDATA%\vex video extensions\is-ra3r8.tmp
%LOCALAPPDATA%\vex video extensions\is-qln00.tmp
%LOCALAPPDATA%\vex video extensions\is-oc1v0.tmp
%LOCALAPPDATA%\vex video extensions\is-noou8.tmp
%LOCALAPPDATA%\vex video extensions\is-jlkfl.tmp
%LOCALAPPDATA%\vex video extensions\is-blhgu.tmp
%LOCALAPPDATA%\vex video extensions\is-3lbal.tmp
%LOCALAPPDATA%\vex video extensions\is-bgvbf.tmp
%LOCALAPPDATA%\vex video extensions\is-piago.tmp
%LOCALAPPDATA%\vex video extensions\is-tmdhc.tmp
%LOCALAPPDATA%\vex video extensions\is-tbsjs.tmp
%LOCALAPPDATA%\vex video extensions\is-63fsi.tmp
%LOCALAPPDATA%\vex video extensions\is-dqvl9.tmp
%LOCALAPPDATA%\vex video extensions\is-hd3j3.tmp
%LOCALAPPDATA%\vex video extensions\uninstall\unins000.dat
%LOCALAPPDATA%\vex video extensions\is-solt5.tmp
%LOCALAPPDATA%\vex video extensions\vexvideoextensions32_64.exe
%LOCALAPPDATA%\vex video extensions\is-jlac6.tmp
%LOCALAPPDATA%\vex video extensions\is-m3kgr.tmp
%TEMP%\is-llrto.tmp\_isetup\_regdll.tmp
%TEMP%\is-llrto.tmp\_isetup\_setup64.tmp
%TEMP%\is-llrto.tmp\_isetup\_shfoldr.dll
%TEMP%\is-llrto.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\vex video extensions\uninstall\is-gsj0f.tmp
%LOCALAPPDATA%\vex video extensions\is-qv057.tmp
%LOCALAPPDATA%\vex video extensions\is-seah9.tmp
%LOCALAPPDATA%\vex video extensions\is-g7hiq.tmp
%LOCALAPPDATA%\vex video extensions\is-thskq.tmp
%LOCALAPPDATA%\vex video extensions\is-q5322.tmp
%LOCALAPPDATA%\vex video extensions\is-hdmke.tmp
%LOCALAPPDATA%\vex video extensions\is-ms21j.tmp
%LOCALAPPDATA%\vex video extensions\is-mdipn.tmp
%LOCALAPPDATA%\vex video extensions\is-rk51f.tmp
%LOCALAPPDATA%\vex video extensions\is-sn0kf.tmp
%LOCALAPPDATA%\vex video extensions\is-jvhgr.tmp
%ALLUSERSPROFILE%\dc converter extension 10.15.46\dc converter extension 10.15.46.exe

Перемещает следующие файлы

%LOCALAPPDATA%\vex video extensions\uninstall\is-gsj0f.tmp в %LOCALAPPDATA%\vex video extensions\uninstall\unins000.exe
%LOCALAPPDATA%\vex video extensions\is-63fsi.tmp в %LOCALAPPDATA%\vex video extensions\libwinpthread-1.dll
%LOCALAPPDATA%\vex video extensions\is-tbsjs.tmp в %LOCALAPPDATA%\vex video extensions\libtiff-5.dll
%LOCALAPPDATA%\vex video extensions\is-tmdhc.tmp в %LOCALAPPDATA%\vex video extensions\libsigc-2.0-0.dll
%LOCALAPPDATA%\vex video extensions\is-piago.tmp в %LOCALAPPDATA%\vex video extensions\librsvg-2-2.dll
%LOCALAPPDATA%\vex video extensions\is-bgvbf.tmp в %LOCALAPPDATA%\vex video extensions\libpng16-16.dll
%LOCALAPPDATA%\vex video extensions\is-3lbal.tmp в %LOCALAPPDATA%\vex video extensions\libpixman-1-0.dll
%LOCALAPPDATA%\vex video extensions\is-blhgu.tmp в %LOCALAPPDATA%\vex video extensions\libpcre-1.dll
%LOCALAPPDATA%\vex video extensions\is-jlkfl.tmp в %LOCALAPPDATA%\vex video extensions\libpangowin32-1.0-0.dll
%LOCALAPPDATA%\vex video extensions\is-noou8.tmp в %LOCALAPPDATA%\vex video extensions\libpangomm-1.4-1.dll
%LOCALAPPDATA%\vex video extensions\is-oc1v0.tmp в %LOCALAPPDATA%\vex video extensions\libpangoft2-1.0-0.dll
%LOCALAPPDATA%\vex video extensions\is-qln00.tmp в %LOCALAPPDATA%\vex video extensions\libpangocairo-1.0-0.dll
%LOCALAPPDATA%\vex video extensions\is-ra3r8.tmp в %LOCALAPPDATA%\vex video extensions\libpango-1.0-0.dll
%LOCALAPPDATA%\vex video extensions\is-dqvl9.tmp в %LOCALAPPDATA%\vex video extensions\zlib1.dll
%LOCALAPPDATA%\vex video extensions\is-solt5.tmp в %LOCALAPPDATA%\vex video extensions\liblzma-5.dll
%LOCALAPPDATA%\vex video extensions\is-jvhgr.tmp в %LOCALAPPDATA%\vex video extensions\libjpeg-8.dll
%LOCALAPPDATA%\vex video extensions\is-m3kgr.tmp в %LOCALAPPDATA%\vex video extensions\libintl-8.dll
%LOCALAPPDATA%\vex video extensions\is-sn0kf.tmp в %LOCALAPPDATA%\vex video extensions\libharfbuzz-0.dll
%LOCALAPPDATA%\vex video extensions\is-rk51f.tmp в %LOCALAPPDATA%\vex video extensions\libgraphite2.dll
%LOCALAPPDATA%\vex video extensions\is-mdipn.tmp в %LOCALAPPDATA%\vex video extensions\libgomp-1.dll
%LOCALAPPDATA%\vex video extensions\is-ms21j.tmp в %LOCALAPPDATA%\vex video extensions\libgobject-2.0-0.dll
%LOCALAPPDATA%\vex video extensions\is-hdmke.tmp в %LOCALAPPDATA%\vex video extensions\libgmodule-2.0-0.dll
%LOCALAPPDATA%\vex video extensions\is-q5322.tmp в %LOCALAPPDATA%\vex video extensions\libglibmm-2.4-1.dll
%LOCALAPPDATA%\vex video extensions\is-thskq.tmp в %LOCALAPPDATA%\vex video extensions\libgdk_pixbuf-2.0-0.dll
%LOCALAPPDATA%\vex video extensions\is-g7hiq.tmp в %LOCALAPPDATA%\vex video extensions\libgdkmm-2.4-1.dll
%LOCALAPPDATA%\vex video extensions\is-seah9.tmp в %LOCALAPPDATA%\vex video extensions\libgdk-win32-2.0-0.dll
%LOCALAPPDATA%\vex video extensions\is-qv057.tmp в %LOCALAPPDATA%\vex video extensions\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\vex video extensions\is-jlac6.tmp в %LOCALAPPDATA%\vex video extensions\liblcms2-2.dll
%LOCALAPPDATA%\vex video extensions\is-hd3j3.tmp в %LOCALAPPDATA%\vex video extensions\vexvideoextensions32_64.exe

Другое

Ищет следующие окна

ClassName: 'z99d9_dcExt10153_z99d9' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-mnj5l.tmp\is-103r9.tmp' /SL4 $5024A "<Полный путь к файлу>" 3961815 52736
'%LOCALAPPDATA%\vex video extensions\vexvideoextensions32_64.exe' -i