Trojan.MulDrop28.40291

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\EditResyncTool46] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\EditResyncTool46] 'ImagePath' = '%ALLUSERSPROFILE%\EditResyncTool46\EditResyncTool46.exe'

Создает следующие сервисы

'EditResyncTool46' %ALLUSERSPROFILE%\EditResyncTool46\EditResyncTool46.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-ruuvb.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\edit resync 0.32\unins000.dat
%LOCALAPPDATA%\edit resync 0.32\is-09ard.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-2d9bj.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-dgfa9.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-k09of.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-4faqb.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-irb4p.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-qsovt.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-vf8e6.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-58rqg.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-u32kk.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-fn1ms.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-h0rk6.tmp
%LOCALAPPDATA%\edit resync 0.32\editresync32_64.exe
%LOCALAPPDATA%\edit resync 0.32\library\is-k9u13.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-dfo6e.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-33u8m.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-prl7d.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-0m0d6.tmp
%LOCALAPPDATA%\edit resync 0.32\is-hsvpq.tmp
%LOCALAPPDATA%\edit resync 0.32\is-qkfdv.tmp
%LOCALAPPDATA%\edit resync 0.32\is-piiql.tmp
%LOCALAPPDATA%\edit resync 0.32\is-2j1ae.tmp
%LOCALAPPDATA%\edit resync 0.32\is-pdag8.tmp
%LOCALAPPDATA%\edit resync 0.32\is-tc4a8.tmp
%TEMP%\is-ehvs4.tmp\_isetup\_iscrypt.dll
%TEMP%\is-ehvs4.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ehvs4.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-5m1fb.tmp
%ALLUSERSPROFILE%\editresynctool46\editresynctool46.exe

Перемещает следующие файлы

%LOCALAPPDATA%\edit resync 0.32\is-tc4a8.tmp в %LOCALAPPDATA%\edit resync 0.32\unins000.exe
%LOCALAPPDATA%\edit resync 0.32\library\is-dgfa9.tmp в %LOCALAPPDATA%\edit resync 0.32\library\weather.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-k09of.tmp в %LOCALAPPDATA%\edit resync 0.32\library\usa.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-4faqb.tmp в %LOCALAPPDATA%\edit resync 0.32\library\talk bubbles.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-irb4p.tmp в %LOCALAPPDATA%\edit resync 0.32\library\tags, signs & banners.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-qsovt.tmp в %LOCALAPPDATA%\edit resync 0.32\library\symbols.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-vf8e6.tmp в %LOCALAPPDATA%\edit resync 0.32\library\swirls.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-58rqg.tmp в %LOCALAPPDATA%\edit resync 0.32\library\summer.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-u32kk.tmp в %LOCALAPPDATA%\edit resync 0.32\library\spring.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-fn1ms.tmp в %LOCALAPPDATA%\edit resync 0.32\library\newborn.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-h0rk6.tmp в %LOCALAPPDATA%\edit resync 0.32\library\music.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-k9u13.tmp в %LOCALAPPDATA%\edit resync 0.32\library\michellemybelle creations.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-5m1fb.tmp в %LOCALAPPDATA%\edit resync 0.32\library\game.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-dfo6e.tmp в %LOCALAPPDATA%\edit resync 0.32\library\fall.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-33u8m.tmp в %LOCALAPPDATA%\edit resync 0.32\library\createinspain designs.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-prl7d.tmp в %LOCALAPPDATA%\edit resync 0.32\library\basic shapes.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-0m0d6.tmp в %LOCALAPPDATA%\edit resync 0.32\library\arrows.scal
%LOCALAPPDATA%\edit resync 0.32\is-hsvpq.tmp в %LOCALAPPDATA%\edit resync 0.32\winsparkle.dll
%LOCALAPPDATA%\edit resync 0.32\is-qkfdv.tmp в %LOCALAPPDATA%\edit resync 0.32\ch375dll.dll
%LOCALAPPDATA%\edit resync 0.32\is-piiql.tmp в %LOCALAPPDATA%\edit resync 0.32\cairogfx.dll
%LOCALAPPDATA%\edit resync 0.32\is-2j1ae.tmp в %LOCALAPPDATA%\edit resync 0.32\msvcr71.dll
%LOCALAPPDATA%\edit resync 0.32\is-pdag8.tmp в %LOCALAPPDATA%\edit resync 0.32\msvcp71.dll
%LOCALAPPDATA%\edit resync 0.32\library\is-2d9bj.tmp в %LOCALAPPDATA%\edit resync 0.32\library\winter.scal
%LOCALAPPDATA%\edit resync 0.32\is-09ard.tmp в %LOCALAPPDATA%\edit resync 0.32\editresync32_64.exe