Trojan.MulDrop5.4331

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'C:\ProgramData\Microsoft\Windows\DRM\Server\notificatoin_1.0.0.exe' /S

Завершает или пытается завершить

следующие пользовательские процессы:

firefox.exe
iexplore.exe
chrome.exe

Изменения в файловой системе:

Создает следующие файлы:

<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\message_target.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\legacy.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\lang.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\storage.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\messaging.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\message_target_module.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\kango.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\i18n.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\console.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\browser.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\io.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\invoke_async.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\initialize.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\icons\icon16.png
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\icons\icon128.png
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\icons\icon100.png
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\id.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\icons\icon48.png
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\icons\icon32.png
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\icons\button.png
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\userscript_engine.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\userscript_client.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\timer.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\includes\content.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\xhr.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\utils.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\background.html
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\b.js
%TEMP%\nsk2.tmp\ZipDLL.dll
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\jquery.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\f.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\extension_info.json
C:\ProgramData\Microsoft\Windows\DRM\Server\notificatoin_1.0.0.crx
%TEMP%\nsk2.tmp\nsProcess.dll
%TEMP%\nsk2.tmp\System.dll
%TEMP%\nsk2.tmp\UserMgr.dll
C:\ProgramData\Microsoft\Windows\DRM\Server\prefpend
C:\ProgramData\Microsoft\Windows\DRM\Server\notificatoin_1.0.0.xpi
C:\ProgramData\Microsoft\Windows\DRM\Server\notificatoin_1.0.0.exe
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango-ui\remote_popup_host.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango-ui\remote_popup_host.html
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango-ui\options.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\base.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\backgroundscript_engine.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango-ui\ui_base.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango-ui\notifications.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\readme.txt
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\p.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\manifest.json
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango-ui\kango_api.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango-ui\context_menu.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango-ui\browser_button.js