Trojan.MulDrop5.59371

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'FromDocToPDF EPM Support' = '"%ProgramFiles%\FROMDO~1\bar\1.bin\65medint.exe" T8EPMSUP.DLL,S'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'FromDocToPDF AppIntegrator 32-bit' = '%ProgramFiles%\FROMDO~1\bar\1.bin\AppIntegrator.exe'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'FromDocToPDF AppIntegrator 64-bit' = '%ProgramFiles%\FROMDO~1\bar\1.bin\AppIntegrator64.exe'

Создает следующие сервисы

[<HKLM>\System\CurrentControlSet\Services\FromDocToPDF_65Service] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\FromDocToPDF_65Service] 'ImagePath' = '%ProgramFiles%\FROMDO~1\bar\1.bin\65barsvc.exe'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\00000a18t8setup.ex_
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65regiet.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65regfft.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65plugin.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65mlbtn.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65medint.exe
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65idle.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65httpct.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65htmlmu.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\t8html.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65highin.exe
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65feedmg.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\t8extpex.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\t8extex.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65dlghk64.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65dlghk.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65script.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65skplay.exe
%ProgramFiles(x86)%\fromdoctopdf_65\bar\assists\common.t8s
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65srcas.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\gen1\common.t8s
%ProgramFiles(x86)%\fromdoctopdf_65\bar\message\common.t8s
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\65ffxtbr@fromdoctopdf_65.com\bootstrap.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\65ffxtbr@fromdoctopdf_65.com\installkeys.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\65ffxtbr@fromdoctopdf_65.com\chrome.manifest
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\65ffxtbr@fromdoctopdf_65.com\install.rdf
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\65ffxtbr@fromdoctopdf_65.com\chrome\65ffxtbr.jar
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\installkeys.js
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\chrome\65ffxtbr.jar
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\verify.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\tpimanagerconsole.exe
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\toolbarguard64.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\toolbarguard.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65tpinst.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\t8ticker.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65datact.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65skin.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65bprtct.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\assists\apa\dialog\assist.exe
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\assists\apa\bar\assist.exe
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\assists\apa\arbiter64.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\assists\apa\arbiter.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\assists\ie_enable\config.xml
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\assists\ie_enable\arbiter64.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\assists\ie_enable\arbiter.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\assists\ie_default_search_provider\config.xml
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\assists\ie_default_search_provider\assist.exe
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\assists\ie_default_search_provider\arbiter64.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\assists\ie_default_search_provider\arbiter.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\t8res.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\t8epmsup.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65barsvc.exe
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\installenabler.dll
%TEMP%\00000a18t8setup.exe
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\assists\apa\bar\config.xml
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\assists\apa\dialog\config.xml
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\ff-nativemessagingdispatcher.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\appintegrator.exe
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\logo.bmp
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\install.rdf
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\hkfxmgr64.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\hkfxmgr.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\hiddentoolbarreminder.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\dpnmngr.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\crextp65.exe
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\crext.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\chrome.manifest
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\bootstrap.js
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\assistmonitor64.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\assistmonitor.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\appintegratorstub64.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\appintegratorstub.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\appintegrator64.exe
%ProgramFiles(x86)%\fromdoctopdf_65\bar\1.bin\65bar.dll
%ProgramFiles(x86)%\fromdoctopdf_65\bar\settings\s_pid.dat