Trojan.MulDrop31.31179

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\EMAIL Safe Storage 10.2.46] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\EMAIL Safe Storage 10.2.46] 'ImagePath' = '%ALLUSERSPROFILE%\EMAIL Safe Storage 10.2.46\EMAIL Safe Storage 10.2.46.exe'

Creates the following services

'EMAIL Safe Storage 10.2.46' %ALLUSERSPROFILE%\EMAIL Safe Storage 10.2.46\EMAIL Safe Storage 10.2.46.exe

Modifies file system

Creates the following files

%TEMP%\is-n26bj.tmp\<File name>.tmp
%LOCALAPPDATA%\zexter video codec\is-60tgm.tmp
%LOCALAPPDATA%\zexter video codec\is-rnft3.tmp
%LOCALAPPDATA%\zexter video codec\is-4k1ge.tmp
%LOCALAPPDATA%\zexter video codec\is-k68ou.tmp
%LOCALAPPDATA%\zexter video codec\is-o36qa.tmp
%LOCALAPPDATA%\zexter video codec\is-dukp7.tmp
%LOCALAPPDATA%\zexter video codec\is-v4jnf.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-bgv92.tmp
%LOCALAPPDATA%\zexter video codec\is-rteiv.tmp
%LOCALAPPDATA%\zexter video codec\is-fp84e.tmp
%LOCALAPPDATA%\zexter video codec\is-fd5hg.tmp
%LOCALAPPDATA%\zexter video codec\is-1nm75.tmp
%LOCALAPPDATA%\zexter video codec\is-fvkvu.tmp
%LOCALAPPDATA%\zexter video codec\is-v3ahu.tmp
%LOCALAPPDATA%\zexter video codec\is-sm28q.tmp
%LOCALAPPDATA%\zexter video codec\is-540aq.tmp
%LOCALAPPDATA%\zexter video codec\is-70ava.tmp
%LOCALAPPDATA%\zexter video codec\is-vkt0f.tmp
%LOCALAPPDATA%\zexter video codec\is-955nt.tmp
%LOCALAPPDATA%\zexter video codec\is-etnen.tmp
%LOCALAPPDATA%\zexter video codec\uninstall\unins000.dat
%LOCALAPPDATA%\zexter video codec\is-kesrp.tmp
%LOCALAPPDATA%\zexter video codec\is-0shg7.tmp
%LOCALAPPDATA%\zexter video codec\is-ds435.tmp
%LOCALAPPDATA%\zexter video codec\is-smcud.tmp
%LOCALAPPDATA%\zexter video codec\is-0jkhg.tmp
%LOCALAPPDATA%\zexter video codec\is-i7t9v.tmp
%LOCALAPPDATA%\zexter video codec\is-331gq.tmp
%LOCALAPPDATA%\zexter video codec\is-4hbm6.tmp
%LOCALAPPDATA%\zexter video codec\is-uc52v.tmp
%LOCALAPPDATA%\zexter video codec\is-umnvl.tmp
%LOCALAPPDATA%\zexter video codec\is-q652l.tmp
%LOCALAPPDATA%\zexter video codec\is-24093.tmp
%LOCALAPPDATA%\zexter video codec\is-rv56e.tmp
%LOCALAPPDATA%\zexter video codec\is-ruu2i.tmp
%LOCALAPPDATA%\zexter video codec\is-nef67.tmp
%LOCALAPPDATA%\zexter video codec\is-spfhn.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-bofbk.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-bgp76.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-cpa95.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-md5m4.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-pi8e4.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-2pj00.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-it8mq.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-8s2ie.tmp
%LOCALAPPDATA%\zexter video codec\themes\is-3s06q.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-ggjar.tmp
%LOCALAPPDATA%\zexter video codec\themes\is-ttd8n.tmp
%LOCALAPPDATA%\zexter video codec\themes\is-h731d.tmp
%LOCALAPPDATA%\zexter video codec\uninstall\is-st7pj.tmp
%TEMP%\is-82f09.tmp\_isetup\_iscrypt.dll
%TEMP%\is-82f09.tmp\_isetup\_isdecmp.dll
%TEMP%\is-82f09.tmp\_isetup\_shfoldr.dll
%TEMP%\is-82f09.tmp\_isetup\_setup64.tmp
%TEMP%\is-82f09.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\zexter video codec\themes\is-ftfmo.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-2so7c.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-4qq4c.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-tpr3a.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-t0650.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-kaksb.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-31uc7.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-v62pg.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-atl67.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-5fll0.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-tov0q.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-ncuj1.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-5597t.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-iih3m.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-b25h7.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-4jnp0.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-pq72g.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-9pli8.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-q8mj2.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-2vd4m.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-na6e8.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-h8e20.tmp
%LOCALAPPDATA%\zexter video codec\zextervideocodec32_64.exe
%ALLUSERSPROFILE%\email safe storage 10.2.46\email safe storage 10.2.46.exe

Moves the following files

from %LOCALAPPDATA%\zexter video codec\uninstall\is-st7pj.tmp to %LOCALAPPDATA%\zexter video codec\uninstall\unins000.exe
from %LOCALAPPDATA%\zexter video codec\is-4k1ge.tmp to %LOCALAPPDATA%\zexter video codec\libiconv-2.dll
from %LOCALAPPDATA%\zexter video codec\is-k68ou.tmp to %LOCALAPPDATA%\zexter video codec\libharfbuzz-0.dll
from %LOCALAPPDATA%\zexter video codec\is-o36qa.tmp to %LOCALAPPDATA%\zexter video codec\libgraphite2.dll
from %LOCALAPPDATA%\zexter video codec\is-dukp7.tmp to %LOCALAPPDATA%\zexter video codec\libgomp-1.dll
from %LOCALAPPDATA%\zexter video codec\is-v4jnf.tmp to %LOCALAPPDATA%\zexter video codec\libgobject-2.0-0.dll
from %LOCALAPPDATA%\zexter video codec\is-rteiv.tmp to %LOCALAPPDATA%\zexter video codec\libgmodule-2.0-0.dll
from %LOCALAPPDATA%\zexter video codec\is-rnft3.tmp to %LOCALAPPDATA%\zexter video codec\libintl-8.dll
from %LOCALAPPDATA%\zexter video codec\is-70ava.tmp to %LOCALAPPDATA%\zexter video codec\libglibmm-2.4-1.dll
from %LOCALAPPDATA%\zexter video codec\is-fd5hg.tmp to %LOCALAPPDATA%\zexter video codec\libgiomm-2.4-1.dll
from %LOCALAPPDATA%\zexter video codec\is-1nm75.tmp to %LOCALAPPDATA%\zexter video codec\libgio-2.0-0.dll
from %LOCALAPPDATA%\zexter video codec\is-fvkvu.tmp to %LOCALAPPDATA%\zexter video codec\libgdk_pixbuf-2.0-0.dll
from %LOCALAPPDATA%\zexter video codec\is-v3ahu.tmp to %LOCALAPPDATA%\zexter video codec\libgdkmm-2.4-1.dll
from %LOCALAPPDATA%\zexter video codec\is-sm28q.tmp to %LOCALAPPDATA%\zexter video codec\libgdk-win32-2.0-0.dll
from %LOCALAPPDATA%\zexter video codec\is-540aq.tmp to %LOCALAPPDATA%\zexter video codec\libgcc_s_dw2-1.dll
from %LOCALAPPDATA%\zexter video codec\is-fp84e.tmp to %LOCALAPPDATA%\zexter video codec\libglib-2.0-0.dll
from %LOCALAPPDATA%\zexter video codec\is-umnvl.tmp to %LOCALAPPDATA%\zexter video codec\libpixman-1-0.dll
from %LOCALAPPDATA%\zexter video codec\is-0shg7.tmp to %LOCALAPPDATA%\zexter video codec\zlib1.dll
from %LOCALAPPDATA%\zexter video codec\is-4hbm6.tmp to %LOCALAPPDATA%\zexter video codec\liblzma-5.dll
from %LOCALAPPDATA%\zexter video codec\is-ds435.tmp to %LOCALAPPDATA%\zexter video codec\libxml2-2.dll
from %LOCALAPPDATA%\zexter video codec\is-smcud.tmp to %LOCALAPPDATA%\zexter video codec\libwinpthread-1.dll
from %LOCALAPPDATA%\zexter video codec\is-0jkhg.tmp to %LOCALAPPDATA%\zexter video codec\libtiff-5.dll
from %LOCALAPPDATA%\zexter video codec\is-i7t9v.tmp to %LOCALAPPDATA%\zexter video codec\libstdc++-6.dll
from %LOCALAPPDATA%\zexter video codec\is-spfhn.tmp to %LOCALAPPDATA%\zexter video codec\libsigc-2.0-0.dll
from %LOCALAPPDATA%\zexter video codec\is-etnen.tmp to %LOCALAPPDATA%\zexter video codec\librsvg-2-2.dll
from %LOCALAPPDATA%\zexter video codec\is-vkt0f.tmp to %LOCALAPPDATA%\zexter video codec\libfreetype-6.dll
from %LOCALAPPDATA%\zexter video codec\is-uc52v.tmp to %LOCALAPPDATA%\zexter video codec\libpng16-16.dll
from %LOCALAPPDATA%\zexter video codec\is-q652l.tmp to %LOCALAPPDATA%\zexter video codec\libpcre-1.dll
from %LOCALAPPDATA%\zexter video codec\is-24093.tmp to %LOCALAPPDATA%\zexter video codec\libpangowin32-1.0-0.dll
from %LOCALAPPDATA%\zexter video codec\is-rv56e.tmp to %LOCALAPPDATA%\zexter video codec\libpangomm-1.4-1.dll
from %LOCALAPPDATA%\zexter video codec\is-ruu2i.tmp to %LOCALAPPDATA%\zexter video codec\libpangoft2-1.0-0.dll
from %LOCALAPPDATA%\zexter video codec\is-nef67.tmp to %LOCALAPPDATA%\zexter video codec\libpangocairo-1.0-0.dll
from %LOCALAPPDATA%\zexter video codec\is-331gq.tmp to %LOCALAPPDATA%\zexter video codec\libpango-1.0-0.dll
from %LOCALAPPDATA%\zexter video codec\is-60tgm.tmp to %LOCALAPPDATA%\zexter video codec\libjpeg-8.dll
from %LOCALAPPDATA%\zexter video codec\is-955nt.tmp to %LOCALAPPDATA%\zexter video codec\liblcms2-2.dll
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-bgv92.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\trough2.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-2vd4m.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\button-insensitive.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-b25h7.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-up-ins.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-tpr3a.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-right.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-2so7c.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-right-pre.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-ggjar.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-right-ins.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-4qq4c.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-left.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-md5m4.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-left-pre.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-h8e20.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-up-pre.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-pi8e4.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-left-ins.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-it8mq.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-down-pre.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-8s2ie.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-down-ins.png
from %LOCALAPPDATA%\zexter video codec\themes\is-3s06q.tmp to %LOCALAPPDATA%\zexter video codec\themes\system.iconset
from %LOCALAPPDATA%\zexter video codec\themes\is-ttd8n.tmp to %LOCALAPPDATA%\zexter video codec\themes\slim
from %LOCALAPPDATA%\zexter video codec\themes\is-ftfmo.tmp to %LOCALAPPDATA%\zexter video codec\themes\92-beige-darkcyan.iconset
from %LOCALAPPDATA%\zexter video codec\themes\is-h731d.tmp to %LOCALAPPDATA%\zexter video codec\themes\92-beige-darkcyan.gtkrc
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-2pj00.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-down.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-ncuj1.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\rangeslider-ins.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-bgp76.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\slider-v.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-q8mj2.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\button-normal.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-cpa95.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\slider-v-pre.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-t0650.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\slider-v-ins.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-31uc7.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\slider-h.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-v62pg.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\slider-h-pre.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-atl67.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\slider-h-ins.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-5fll0.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\rangeslider.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-bofbk.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\trough2-h.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-tov0q.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\rangeslider-pre.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-5597t.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\pbtroughv.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-kaksb.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\pbtroughh.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-iih3m.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\null.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-4jnp0.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\button-pressed.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-pq72g.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\button-prelight.png
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-9pli8.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\button-normal.xcf
from %LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-na6e8.tmp to %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-up.png
from %LOCALAPPDATA%\zexter video codec\is-kesrp.tmp to %LOCALAPPDATA%\zexter video codec\zextervideocodec32_64.exe

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'Tc912d_emBox1023_Tc912d'

Creates and executes the following

'%TEMP%\is-n26bj.tmp\<File name>.tmp' /SL5="$5024A,8066431,54272,<Full path to file>"
'%LOCALAPPDATA%\zexter video codec\zextervideocodec32_64.exe' -i

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней