Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\EB MP4 Downloader 11.3.46] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\EB MP4 Downloader 11.3.46] 'ImagePath' = '%ALLUSERSPROFILE%\EB MP4 Downloader 11.3.46\EB MP4 Downloader 11.3.46.exe'
Creates the following services
- 'EB MP4 Downloader 11.3.46' %ALLUSERSPROFILE%\EB MP4 Downloader 11.3.46\EB MP4 Downloader 11.3.46.exe
Modifies file system
Creates the following files
- %TEMP%\is-vc5qm.tmp\<File name>.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-norkr.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-n60qp.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-ps9a7.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-vcnmi.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-d6719.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-37dhs.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-dbs11.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-1h3rc.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-vqke4.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-dep4v.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-g9t72.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-9spia.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-8p9hk.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-aoneb.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-hvs1h.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-nlrnd.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-klt9p.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-b993g.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\mp4addon32_64.exe
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-vr0l7.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\unins000.dat
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-n6jcr.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-al3se.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-71ahj.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-dn0ms.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-6rglj.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-pgupv.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-eh1g1.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-drldn.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-q6jj4.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-3m4og.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-tcmd7.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-2ci77.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-47jbl.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-82op6.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-1icgb.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-uovhb.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-b6f9f.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-aguc7.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-j4jg4.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-lfqem.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.windows.common-controls\is-oae4b.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.mfc\is-n4soh.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.mfc\is-f0d11.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.mfc\is-81l65.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.mfc\is-tfegr.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.mfc\is-72hjk.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-kibem.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.crt\is-3jp68.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.crt\is-bs3jr.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.crt\is-g0fme.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\is-c8smj.tmp
- %TEMP%\is-sda23.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-sda23.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-sda23.tmp\_isetup\_setup64.tmp
- %TEMP%\is-sda23.tmp\_isetup\_regdll.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.crt\is-s8nu7.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-eca79.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-o66ll.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-52l0i.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-givg9.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-upo0s.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-e2rcr.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-b1v99.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-vkshk.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-5kkih.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-v44c5.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-5fr9n.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-6g5ih.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-nrsbf.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-9pfsv.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-02mln.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-7jcog.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-9t1pt.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-r8j8e.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-oner0.tmp
- %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-lp9bs.tmp
- %ALLUSERSPROFILE%\eb mp4 downloader 11.3.46\eb mp4 downloader 11.3.46.exe
Deletes the following files
- %LOCALAPPDATA%\mp4searchextension 3.15.3\verify.dll
Moves the following files
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-c8smj.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\unins000.exe
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-ps9a7.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\postproc-51.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-vcnmi.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\encodesettings.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-d6719.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\intelhw.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-37dhs.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\nvencoderkernel.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-dbs11.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\cudaencoderkernel.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-norkr.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\recwin7.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-vqke4.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\capture.wav
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-dep4v.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\avutil-52.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-g9t72.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\avformat.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-9spia.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\postproc-52.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-8p9hk.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\avdevice-55.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-aoneb.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\audioresample.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-hvs1h.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\bitmap2avi.dll.intermediate.manifest
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-klt9p.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\camcapture.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-v44c5.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\waverec_russian.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-1h3rc.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\screenhook.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-dn0ms.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\istask.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-6rglj.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\apngdecoder.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-pgupv.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\servicectrl.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-drldn.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\installhelp.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-b993g.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\ve64.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-q6jj4.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\ve32.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-nlrnd.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\pthreadvc2.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-n60qp.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\pthreadgc2.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-2ci77.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\xvidcore.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-47jbl.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\waverec.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-82op6.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\waverec.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-1icgb.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\utlis.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-vr0l7.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\textdlg.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-b6f9f.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\swscale-2.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-tcmd7.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\magicskin.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-uovhb.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\swresample-0.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-eh1g1.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\autosettings_spanish.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-aguc7.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\autosettings_russian.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-5fr9n.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\autosettings_portugues.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.mfc\is-81l65.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.mfc\mfcm90.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.crt\is-g0fme.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.crt\microsoft.vc90.crt.manifest
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.crt\is-bs3jr.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.crt\msvcm90.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.crt\is-s8nu7.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.crt\msvcp90.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.crt\is-3jp68.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.crt\msvcr90.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.mfc\is-72hjk.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.mfc\mfc90.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-al3se.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\gsdownload.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.mfc\is-tfegr.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.mfc\mfc90u.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-52l0i.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\italian.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.mfc\is-n4soh.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.mfc\microsoft.vc90.mfc.manifest
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.windows.common-controls\is-oae4b.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.windows.common-controls\comctl32.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-lfqem.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\chinese(traditional).ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-kibem.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\english.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-lp9bs.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\frence.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.mfc\is-f0d11.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\microsoft.vc90.mfc\mfcm90u.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-3m4og.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\verify.dll
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-oner0.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\portugues.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-7jcog.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\waverec_chinese(traditional).ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-r8j8e.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\russian.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-o66ll.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\autosettings_italian.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-givg9.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\autosettings_japanese.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-upo0s.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\autosettings_frence.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-e2rcr.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\autosettings_english.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-b1v99.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\autosettings_chinese(traditional).ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-9t1pt.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\spanish.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-vkshk.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\index.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-j4jg4.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\japanese.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-6g5ih.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\waverec_portugues.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-eca79.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\waverec_italian.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-nrsbf.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\waverec_japanese.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-9pfsv.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\waverec_frence.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-02mln.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\waverec_english.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\language\is-5kkih.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\language\waverec_spanish.ini
- from %LOCALAPPDATA%\mp4searchextension 3.15.3\is-n6jcr.tmp to %LOCALAPPDATA%\mp4searchextension 3.15.3\mp4addon32_64.exe
Substitutes the following files
- %LOCALAPPDATA%\mp4searchextension 3.15.3\verify.dll
Miscellaneous
Searches for the following windows
- ClassName: 'v3d3d5_mp4Down_1133_v3d3d5' WindowName: ''
Creates and executes the following
- '%TEMP%\is-vc5qm.tmp\<File name>.tmp' /SL5="$50246,5404351,54272,<Full path to file>"
- '%LOCALAPPDATA%\mp4searchextension 3.15.3\mp4addon32_64.exe' -i
