Trojan.MulDrop28.26752

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\Escape Division LIB 10.6.45] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\Escape Division LIB 10.6.45] 'ImagePath' = '%ALLUSERSPROFILE%\Escape Division LIB 10.6.45\Escape Division LIB 10.6.45.exe'

Creates the following services

'Escape Division LIB 10.6.45' %ALLUSERSPROFILE%\Escape Division LIB 10.6.45\Escape Division LIB 10.6.45.exe

Modifies file system

Creates the following files

%TEMP%\is-smss8.tmp\<File name>.tmp
%LOCALAPPDATA%\screen camera lite\is-r5kvi.tmp
%LOCALAPPDATA%\screen camera lite\is-i0lcv.tmp
%LOCALAPPDATA%\screen camera lite\is-tgll7.tmp
%LOCALAPPDATA%\screen camera lite\is-cqloq.tmp
%LOCALAPPDATA%\screen camera lite\is-3goe0.tmp
%LOCALAPPDATA%\screen camera lite\is-0uo88.tmp
%LOCALAPPDATA%\screen camera lite\is-mqrsk.tmp
%LOCALAPPDATA%\screen camera lite\is-rfcoq.tmp
%LOCALAPPDATA%\screen camera lite\is-vs2l1.tmp
%LOCALAPPDATA%\screen camera lite\is-sgved.tmp
%LOCALAPPDATA%\screen camera lite\is-cp4af.tmp
%LOCALAPPDATA%\screen camera lite\is-95d93.tmp
%LOCALAPPDATA%\screen camera lite\is-lektd.tmp
%LOCALAPPDATA%\screen camera lite\is-kr9b7.tmp
%LOCALAPPDATA%\screen camera lite\uninstall\unins000.dat
%LOCALAPPDATA%\screen camera lite\is-j4j7a.tmp
%LOCALAPPDATA%\screen camera lite\screencameralite.exe
%LOCALAPPDATA%\screen camera lite\is-505dh.tmp
%LOCALAPPDATA%\screen camera lite\is-c1bku.tmp
%TEMP%\is-cq58g.tmp\_isetup\_regdll.tmp
%TEMP%\is-cq58g.tmp\_isetup\_setup64.tmp
%TEMP%\is-cq58g.tmp\_isetup\_shfoldr.dll
%TEMP%\is-cq58g.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\screen camera lite\uninstall\is-2opdo.tmp
%LOCALAPPDATA%\screen camera lite\is-il6t5.tmp
%LOCALAPPDATA%\screen camera lite\is-ugtke.tmp
%LOCALAPPDATA%\screen camera lite\is-9hns5.tmp
%LOCALAPPDATA%\screen camera lite\is-v0e2v.tmp
%LOCALAPPDATA%\screen camera lite\is-p7468.tmp
%LOCALAPPDATA%\screen camera lite\is-33tss.tmp
%LOCALAPPDATA%\screen camera lite\is-caudc.tmp
%LOCALAPPDATA%\screen camera lite\is-488s2.tmp
%LOCALAPPDATA%\screen camera lite\is-l2cip.tmp
%LOCALAPPDATA%\screen camera lite\is-nvk6j.tmp
%LOCALAPPDATA%\screen camera lite\is-savkq.tmp
%ALLUSERSPROFILE%\escape division lib 10.6.45\escape division lib 10.6.45.exe

Moves the following files

from %LOCALAPPDATA%\screen camera lite\uninstall\is-2opdo.tmp to %LOCALAPPDATA%\screen camera lite\uninstall\unins000.exe
from %LOCALAPPDATA%\screen camera lite\is-95d93.tmp to %LOCALAPPDATA%\screen camera lite\libwinpthread-1.dll
from %LOCALAPPDATA%\screen camera lite\is-cp4af.tmp to %LOCALAPPDATA%\screen camera lite\libtiff-5.dll
from %LOCALAPPDATA%\screen camera lite\is-sgved.tmp to %LOCALAPPDATA%\screen camera lite\libsigc-2.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-vs2l1.tmp to %LOCALAPPDATA%\screen camera lite\librsvg-2-2.dll
from %LOCALAPPDATA%\screen camera lite\is-rfcoq.tmp to %LOCALAPPDATA%\screen camera lite\libpng16-16.dll
from %LOCALAPPDATA%\screen camera lite\is-mqrsk.tmp to %LOCALAPPDATA%\screen camera lite\libpixman-1-0.dll
from %LOCALAPPDATA%\screen camera lite\is-0uo88.tmp to %LOCALAPPDATA%\screen camera lite\libpcre-1.dll
from %LOCALAPPDATA%\screen camera lite\is-3goe0.tmp to %LOCALAPPDATA%\screen camera lite\libpangowin32-1.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-cqloq.tmp to %LOCALAPPDATA%\screen camera lite\libpangomm-1.4-1.dll
from %LOCALAPPDATA%\screen camera lite\is-tgll7.tmp to %LOCALAPPDATA%\screen camera lite\libpangoft2-1.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-i0lcv.tmp to %LOCALAPPDATA%\screen camera lite\libpangocairo-1.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-r5kvi.tmp to %LOCALAPPDATA%\screen camera lite\libpango-1.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-lektd.tmp to %LOCALAPPDATA%\screen camera lite\zlib1.dll
from %LOCALAPPDATA%\screen camera lite\is-j4j7a.tmp to %LOCALAPPDATA%\screen camera lite\liblzma-5.dll
from %LOCALAPPDATA%\screen camera lite\is-savkq.tmp to %LOCALAPPDATA%\screen camera lite\libjpeg-8.dll
from %LOCALAPPDATA%\screen camera lite\is-c1bku.tmp to %LOCALAPPDATA%\screen camera lite\libintl-8.dll
from %LOCALAPPDATA%\screen camera lite\is-nvk6j.tmp to %LOCALAPPDATA%\screen camera lite\libharfbuzz-0.dll
from %LOCALAPPDATA%\screen camera lite\is-l2cip.tmp to %LOCALAPPDATA%\screen camera lite\libgraphite2.dll
from %LOCALAPPDATA%\screen camera lite\is-488s2.tmp to %LOCALAPPDATA%\screen camera lite\libgomp-1.dll
from %LOCALAPPDATA%\screen camera lite\is-caudc.tmp to %LOCALAPPDATA%\screen camera lite\libgobject-2.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-33tss.tmp to %LOCALAPPDATA%\screen camera lite\libgmodule-2.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-p7468.tmp to %LOCALAPPDATA%\screen camera lite\libglibmm-2.4-1.dll
from %LOCALAPPDATA%\screen camera lite\is-v0e2v.tmp to %LOCALAPPDATA%\screen camera lite\libgdk_pixbuf-2.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-9hns5.tmp to %LOCALAPPDATA%\screen camera lite\libgdkmm-2.4-1.dll
from %LOCALAPPDATA%\screen camera lite\is-ugtke.tmp to %LOCALAPPDATA%\screen camera lite\libgdk-win32-2.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-il6t5.tmp to %LOCALAPPDATA%\screen camera lite\libgcc_s_dw2-1.dll
from %LOCALAPPDATA%\screen camera lite\is-505dh.tmp to %LOCALAPPDATA%\screen camera lite\liblcms2-2.dll
from %LOCALAPPDATA%\screen camera lite\is-kr9b7.tmp to %LOCALAPPDATA%\screen camera lite\screencameralite.exe