Trojan.MulDrop28.40165

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\EditResyncTool46] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\EditResyncTool46] 'ImagePath' = '%ALLUSERSPROFILE%\EditResyncTool46\EditResyncTool46.exe'

Создает следующие сервисы

'EditResyncTool46' %ALLUSERSPROFILE%\EditResyncTool46\EditResyncTool46.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-97d1l.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\edit resync 0.32\unins000.dat
%LOCALAPPDATA%\edit resync 0.32\is-joinh.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-h9dfd.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-gvpjl.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-bg7a5.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-rfrb9.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-5hlmc.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-28ef8.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-tvs48.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-r6jfg.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-9mba7.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-s7btd.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-erout.tmp
%LOCALAPPDATA%\edit resync 0.32\editresync32_64.exe
%LOCALAPPDATA%\edit resync 0.32\library\is-phbte.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-26a9d.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-jtds9.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-haj2a.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-0buti.tmp
%LOCALAPPDATA%\edit resync 0.32\is-060if.tmp
%LOCALAPPDATA%\edit resync 0.32\is-s8h2n.tmp
%LOCALAPPDATA%\edit resync 0.32\is-stuvd.tmp
%LOCALAPPDATA%\edit resync 0.32\is-p8dpj.tmp
%LOCALAPPDATA%\edit resync 0.32\is-udubs.tmp
%LOCALAPPDATA%\edit resync 0.32\is-gkgsc.tmp
%TEMP%\is-7gn9u.tmp\_isetup\_iscrypt.dll
%TEMP%\is-7gn9u.tmp\_isetup\_shfoldr.dll
%TEMP%\is-7gn9u.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-5rg36.tmp
%ALLUSERSPROFILE%\editresynctool46\editresynctool46.exe

Перемещает следующие файлы

%LOCALAPPDATA%\edit resync 0.32\is-gkgsc.tmp в %LOCALAPPDATA%\edit resync 0.32\unins000.exe
%LOCALAPPDATA%\edit resync 0.32\library\is-gvpjl.tmp в %LOCALAPPDATA%\edit resync 0.32\library\weather.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-bg7a5.tmp в %LOCALAPPDATA%\edit resync 0.32\library\usa.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-rfrb9.tmp в %LOCALAPPDATA%\edit resync 0.32\library\talk bubbles.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-5hlmc.tmp в %LOCALAPPDATA%\edit resync 0.32\library\tags, signs & banners.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-28ef8.tmp в %LOCALAPPDATA%\edit resync 0.32\library\symbols.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-tvs48.tmp в %LOCALAPPDATA%\edit resync 0.32\library\swirls.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-r6jfg.tmp в %LOCALAPPDATA%\edit resync 0.32\library\summer.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-9mba7.tmp в %LOCALAPPDATA%\edit resync 0.32\library\spring.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-s7btd.tmp в %LOCALAPPDATA%\edit resync 0.32\library\newborn.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-erout.tmp в %LOCALAPPDATA%\edit resync 0.32\library\music.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-phbte.tmp в %LOCALAPPDATA%\edit resync 0.32\library\michellemybelle creations.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-5rg36.tmp в %LOCALAPPDATA%\edit resync 0.32\library\game.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-26a9d.tmp в %LOCALAPPDATA%\edit resync 0.32\library\fall.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-jtds9.tmp в %LOCALAPPDATA%\edit resync 0.32\library\createinspain designs.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-haj2a.tmp в %LOCALAPPDATA%\edit resync 0.32\library\basic shapes.scal
%LOCALAPPDATA%\edit resync 0.32\library\is-0buti.tmp в %LOCALAPPDATA%\edit resync 0.32\library\arrows.scal
%LOCALAPPDATA%\edit resync 0.32\is-060if.tmp в %LOCALAPPDATA%\edit resync 0.32\winsparkle.dll
%LOCALAPPDATA%\edit resync 0.32\is-s8h2n.tmp в %LOCALAPPDATA%\edit resync 0.32\ch375dll.dll
%LOCALAPPDATA%\edit resync 0.32\is-stuvd.tmp в %LOCALAPPDATA%\edit resync 0.32\cairogfx.dll
%LOCALAPPDATA%\edit resync 0.32\is-p8dpj.tmp в %LOCALAPPDATA%\edit resync 0.32\msvcr71.dll
%LOCALAPPDATA%\edit resync 0.32\is-udubs.tmp в %LOCALAPPDATA%\edit resync 0.32\msvcp71.dll
%LOCALAPPDATA%\edit resync 0.32\library\is-h9dfd.tmp в %LOCALAPPDATA%\edit resync 0.32\library\winter.scal
%LOCALAPPDATA%\edit resync 0.32\is-joinh.tmp в %LOCALAPPDATA%\edit resync 0.32\editresync32_64.exe