Trojan.MulDrop28.26729

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\Escape Division LIB 10.6.45] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\Escape Division LIB 10.6.45] 'ImagePath' = '%ALLUSERSPROFILE%\Escape Division LIB 10.6.45\Escape Division LIB 10.6.45.exe'

Creates the following services

'Escape Division LIB 10.6.45' %ALLUSERSPROFILE%\Escape Division LIB 10.6.45\Escape Division LIB 10.6.45.exe

Modifies file system

Creates the following files

%TEMP%\is-qboo3.tmp\<File name>.tmp
%LOCALAPPDATA%\screen camera lite\is-ob5p2.tmp
%LOCALAPPDATA%\screen camera lite\is-car60.tmp
%LOCALAPPDATA%\screen camera lite\is-elrhv.tmp
%LOCALAPPDATA%\screen camera lite\is-6vg5v.tmp
%LOCALAPPDATA%\screen camera lite\is-ect3a.tmp
%LOCALAPPDATA%\screen camera lite\is-c32k7.tmp
%LOCALAPPDATA%\screen camera lite\is-2nv03.tmp
%LOCALAPPDATA%\screen camera lite\is-atofk.tmp
%LOCALAPPDATA%\screen camera lite\is-a9q2g.tmp
%LOCALAPPDATA%\screen camera lite\is-iukr7.tmp
%LOCALAPPDATA%\screen camera lite\is-a40q1.tmp
%LOCALAPPDATA%\screen camera lite\is-ms34d.tmp
%LOCALAPPDATA%\screen camera lite\is-dun9d.tmp
%LOCALAPPDATA%\screen camera lite\is-3oeon.tmp
%LOCALAPPDATA%\screen camera lite\uninstall\unins000.dat
%LOCALAPPDATA%\screen camera lite\is-m7g3n.tmp
%LOCALAPPDATA%\screen camera lite\screencameralite.exe
%LOCALAPPDATA%\screen camera lite\is-b3set.tmp
%LOCALAPPDATA%\screen camera lite\is-5gh51.tmp
%TEMP%\is-jmq6k.tmp\_isetup\_regdll.tmp
%TEMP%\is-jmq6k.tmp\_isetup\_setup64.tmp
%TEMP%\is-jmq6k.tmp\_isetup\_shfoldr.dll
%TEMP%\is-jmq6k.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\screen camera lite\uninstall\is-vu6to.tmp
%LOCALAPPDATA%\screen camera lite\is-08icn.tmp
%LOCALAPPDATA%\screen camera lite\is-cqevq.tmp
%LOCALAPPDATA%\screen camera lite\is-hqm8h.tmp
%LOCALAPPDATA%\screen camera lite\is-ves2d.tmp
%LOCALAPPDATA%\screen camera lite\is-u98b1.tmp
%LOCALAPPDATA%\screen camera lite\is-87pqd.tmp
%LOCALAPPDATA%\screen camera lite\is-5htse.tmp
%LOCALAPPDATA%\screen camera lite\is-7opgr.tmp
%LOCALAPPDATA%\screen camera lite\is-miga6.tmp
%LOCALAPPDATA%\screen camera lite\is-73994.tmp
%LOCALAPPDATA%\screen camera lite\is-oqnmp.tmp
%ALLUSERSPROFILE%\escape division lib 10.6.45\escape division lib 10.6.45.exe

Moves the following files

from %LOCALAPPDATA%\screen camera lite\uninstall\is-vu6to.tmp to %LOCALAPPDATA%\screen camera lite\uninstall\unins000.exe
from %LOCALAPPDATA%\screen camera lite\is-ms34d.tmp to %LOCALAPPDATA%\screen camera lite\libwinpthread-1.dll
from %LOCALAPPDATA%\screen camera lite\is-a40q1.tmp to %LOCALAPPDATA%\screen camera lite\libtiff-5.dll
from %LOCALAPPDATA%\screen camera lite\is-iukr7.tmp to %LOCALAPPDATA%\screen camera lite\libsigc-2.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-a9q2g.tmp to %LOCALAPPDATA%\screen camera lite\librsvg-2-2.dll
from %LOCALAPPDATA%\screen camera lite\is-atofk.tmp to %LOCALAPPDATA%\screen camera lite\libpng16-16.dll
from %LOCALAPPDATA%\screen camera lite\is-2nv03.tmp to %LOCALAPPDATA%\screen camera lite\libpixman-1-0.dll
from %LOCALAPPDATA%\screen camera lite\is-c32k7.tmp to %LOCALAPPDATA%\screen camera lite\libpcre-1.dll
from %LOCALAPPDATA%\screen camera lite\is-ect3a.tmp to %LOCALAPPDATA%\screen camera lite\libpangowin32-1.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-6vg5v.tmp to %LOCALAPPDATA%\screen camera lite\libpangomm-1.4-1.dll
from %LOCALAPPDATA%\screen camera lite\is-elrhv.tmp to %LOCALAPPDATA%\screen camera lite\libpangoft2-1.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-car60.tmp to %LOCALAPPDATA%\screen camera lite\libpangocairo-1.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-ob5p2.tmp to %LOCALAPPDATA%\screen camera lite\libpango-1.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-dun9d.tmp to %LOCALAPPDATA%\screen camera lite\zlib1.dll
from %LOCALAPPDATA%\screen camera lite\is-m7g3n.tmp to %LOCALAPPDATA%\screen camera lite\liblzma-5.dll
from %LOCALAPPDATA%\screen camera lite\is-oqnmp.tmp to %LOCALAPPDATA%\screen camera lite\libjpeg-8.dll
from %LOCALAPPDATA%\screen camera lite\is-5gh51.tmp to %LOCALAPPDATA%\screen camera lite\libintl-8.dll
from %LOCALAPPDATA%\screen camera lite\is-73994.tmp to %LOCALAPPDATA%\screen camera lite\libharfbuzz-0.dll
from %LOCALAPPDATA%\screen camera lite\is-miga6.tmp to %LOCALAPPDATA%\screen camera lite\libgraphite2.dll
from %LOCALAPPDATA%\screen camera lite\is-7opgr.tmp to %LOCALAPPDATA%\screen camera lite\libgomp-1.dll
from %LOCALAPPDATA%\screen camera lite\is-5htse.tmp to %LOCALAPPDATA%\screen camera lite\libgobject-2.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-87pqd.tmp to %LOCALAPPDATA%\screen camera lite\libgmodule-2.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-u98b1.tmp to %LOCALAPPDATA%\screen camera lite\libglibmm-2.4-1.dll
from %LOCALAPPDATA%\screen camera lite\is-ves2d.tmp to %LOCALAPPDATA%\screen camera lite\libgdk_pixbuf-2.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-hqm8h.tmp to %LOCALAPPDATA%\screen camera lite\libgdkmm-2.4-1.dll
from %LOCALAPPDATA%\screen camera lite\is-cqevq.tmp to %LOCALAPPDATA%\screen camera lite\libgdk-win32-2.0-0.dll
from %LOCALAPPDATA%\screen camera lite\is-08icn.tmp to %LOCALAPPDATA%\screen camera lite\libgcc_s_dw2-1.dll
from %LOCALAPPDATA%\screen camera lite\is-b3set.tmp to %LOCALAPPDATA%\screen camera lite\liblcms2-2.dll
from %LOCALAPPDATA%\screen camera lite\is-3oeon.tmp to %LOCALAPPDATA%\screen camera lite\screencameralite.exe