Trojan.MulDrop28.26727

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\Equal Math Calculator 10.5.46] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\Equal Math Calculator 10.5.46] 'ImagePath' = '%ALLUSERSPROFILE%\Equal Math Calculator 10.5.46\Equal Math Calculator 10.5.46.exe'

Creates the following services

'Equal Math Calculator 10.5.46' %ALLUSERSPROFILE%\Equal Math Calculator 10.5.46\Equal Math Calculator 10.5.46.exe

Modifies file system

Creates the following files

%TEMP%\is-2v0dm.tmp\<File name>.tmp
%LOCALAPPDATA%\screen camera lite\is-8b7n7.tmp
%LOCALAPPDATA%\screen camera lite\is-k13a2.tmp
%LOCALAPPDATA%\screen camera lite\is-b848g.tmp
%LOCALAPPDATA%\screen camera lite\is-ak41t.tmp
%LOCALAPPDATA%\screen camera lite\is-g5i75.tmp
%LOCALAPPDATA%\screen camera lite\is-gmd0p.tmp
%LOCALAPPDATA%\screen camera lite\is-ihut3.tmp
%LOCALAPPDATA%\screen camera lite\is-44rnu.tmp
%LOCALAPPDATA%\screen camera lite\is-a650c.tmp
%LOCALAPPDATA%\screen camera lite\is-e4olr.tmp
%LOCALAPPDATA%\screen camera lite\is-39tpb.tmp
%LOCALAPPDATA%\screen camera lite\is-j0d46.tmp
%LOCALAPPDATA%\screen camera lite\is-21eoj.tmp
%LOCALAPPDATA%\screen camera lite\is-707lv.tmp
%LOCALAPPDATA%\screen camera lite\uninstall\unins000.dat
%LOCALAPPDATA%\screen camera lite\is-vakna.tmp
%LOCALAPPDATA%\screen camera lite\screencameralite.exe
%LOCALAPPDATA%\screen camera lite\is-12rvp.tmp
%LOCALAPPDATA%\screen camera lite\is-nugup.tmp
%TEMP%\is-06nd3.tmp\_isetup\_regdll.tmp
%TEMP%\is-06nd3.tmp\_isetup\_setup64.tmp
%TEMP%\is-06nd3.tmp\_isetup\_shfoldr.dll
%TEMP%\is-06nd3.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\screen camera lite\uninstall\is-uuhrf.tmp
%LOCALAPPDATA%\screen camera lite\is-83djf.tmp
%LOCALAPPDATA%\screen camera lite\is-eolso.tmp
%LOCALAPPDATA%\screen camera lite\is-fcr1g.tmp
%LOCALAPPDATA%\screen camera lite\is-5178c.tmp
%LOCALAPPDATA%\screen camera lite\is-3c8n0.tmp
%LOCALAPPDATA%\screen camera lite\is-ahdtg.tmp
%LOCALAPPDATA%\screen camera lite\is-am5g4.tmp
%LOCALAPPDATA%\screen camera lite\is-cun8j.tmp
%LOCALAPPDATA%\screen camera lite\is-b13b6.tmp
%LOCALAPPDATA%\screen camera lite\is-uj81d.tmp
%LOCALAPPDATA%\screen camera lite\is-fvsot.tmp
%ALLUSERSPROFILE%\equal math calculator 10.5.46\equal math calculator 10.5.46.exe

Moves the following files

from %LOCALAPPDATA%\screen camera lite\uninstall\is-uuhrf.tmp to %LOCALAPPDATA%\screen camera lite\uninstall\unins000.exe
from %LOCALAPPDATA%\screen camera lite\is-j0d46.tmp to %LOCALAPPDATA%\screen camera lite\libwinpthread-1.dll
from %LOCALAPPDATA%\screen camera lite\is-39tpb.tmp to %LOCALAPPDATA%\screen camera lite\libtiff-5.dll
from %LOCALAPPDATA%\screen camera lite\is-e4olr.tmp to %LOCALAPPDATA%\screen camera lite\libsigc-2.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-a650c.tmp to %LOCALAPPDATA%\screen camera lite\librsvg-2-2.dll
from %LOCALAPPDATA%\screen camera lite\is-44rnu.tmp to %LOCALAPPDATA%\screen camera lite\libpng16-16.dll
from %LOCALAPPDATA%\screen camera lite\is-ihut3.tmp to %LOCALAPPDATA%\screen camera lite\libpixman-1-0.dll
from %LOCALAPPDATA%\screen camera lite\is-gmd0p.tmp to %LOCALAPPDATA%\screen camera lite\libpcre-1.dll
from %LOCALAPPDATA%\screen camera lite\is-g5i75.tmp to %LOCALAPPDATA%\screen camera lite\libpangowin32-1.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-ak41t.tmp to %LOCALAPPDATA%\screen camera lite\libpangomm-1.4-1.dll
from %LOCALAPPDATA%\screen camera lite\is-b848g.tmp to %LOCALAPPDATA%\screen camera lite\libpangoft2-1.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-k13a2.tmp to %LOCALAPPDATA%\screen camera lite\libpangocairo-1.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-8b7n7.tmp to %LOCALAPPDATA%\screen camera lite\libpango-1.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-21eoj.tmp to %LOCALAPPDATA%\screen camera lite\zlib1.dll
from %LOCALAPPDATA%\screen camera lite\is-vakna.tmp to %LOCALAPPDATA%\screen camera lite\liblzma-5.dll
from %LOCALAPPDATA%\screen camera lite\is-fvsot.tmp to %LOCALAPPDATA%\screen camera lite\libjpeg-8.dll
from %LOCALAPPDATA%\screen camera lite\is-nugup.tmp to %LOCALAPPDATA%\screen camera lite\libintl-8.dll
from %LOCALAPPDATA%\screen camera lite\is-uj81d.tmp to %LOCALAPPDATA%\screen camera lite\libharfbuzz-0.dll
from %LOCALAPPDATA%\screen camera lite\is-b13b6.tmp to %LOCALAPPDATA%\screen camera lite\libgraphite2.dll
from %LOCALAPPDATA%\screen camera lite\is-cun8j.tmp to %LOCALAPPDATA%\screen camera lite\libgomp-1.dll
from %LOCALAPPDATA%\screen camera lite\is-am5g4.tmp to %LOCALAPPDATA%\screen camera lite\libgobject-2.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-ahdtg.tmp to %LOCALAPPDATA%\screen camera lite\libgmodule-2.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-3c8n0.tmp to %LOCALAPPDATA%\screen camera lite\libglibmm-2.4-1.dll
from %LOCALAPPDATA%\screen camera lite\is-5178c.tmp to %LOCALAPPDATA%\screen camera lite\libgdk_pixbuf-2.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-fcr1g.tmp to %LOCALAPPDATA%\screen camera lite\libgdkmm-2.4-1.dll
from %LOCALAPPDATA%\screen camera lite\is-eolso.tmp to %LOCALAPPDATA%\screen camera lite\libgdk-win32-2.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-83djf.tmp to %LOCALAPPDATA%\screen camera lite\libgcc_s_dw2-1.dll
from %LOCALAPPDATA%\screen camera lite\is-12rvp.tmp to %LOCALAPPDATA%\screen camera lite\liblcms2-2.dll
from %LOCALAPPDATA%\screen camera lite\is-707lv.tmp to %LOCALAPPDATA%\screen camera lite\screencameralite.exe