Trojan.MulDrop28.40291

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\EditResyncTool46] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\EditResyncTool46] 'ImagePath' = '%ALLUSERSPROFILE%\EditResyncTool46\EditResyncTool46.exe'

Creates the following services

'EditResyncTool46' %ALLUSERSPROFILE%\EditResyncTool46\EditResyncTool46.exe

Modifies file system

Creates the following files

%TEMP%\is-ruuvb.tmp\<File name>.tmp
%LOCALAPPDATA%\edit resync 0.32\unins000.dat
%LOCALAPPDATA%\edit resync 0.32\is-09ard.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-2d9bj.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-dgfa9.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-k09of.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-4faqb.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-irb4p.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-qsovt.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-vf8e6.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-58rqg.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-u32kk.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-fn1ms.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-h0rk6.tmp
%LOCALAPPDATA%\edit resync 0.32\editresync32_64.exe
%LOCALAPPDATA%\edit resync 0.32\library\is-k9u13.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-dfo6e.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-33u8m.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-prl7d.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-0m0d6.tmp
%LOCALAPPDATA%\edit resync 0.32\is-hsvpq.tmp
%LOCALAPPDATA%\edit resync 0.32\is-qkfdv.tmp
%LOCALAPPDATA%\edit resync 0.32\is-piiql.tmp
%LOCALAPPDATA%\edit resync 0.32\is-2j1ae.tmp
%LOCALAPPDATA%\edit resync 0.32\is-pdag8.tmp
%LOCALAPPDATA%\edit resync 0.32\is-tc4a8.tmp
%TEMP%\is-ehvs4.tmp\_isetup\_iscrypt.dll
%TEMP%\is-ehvs4.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ehvs4.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-5m1fb.tmp
%ALLUSERSPROFILE%\editresynctool46\editresynctool46.exe

Moves the following files

from %LOCALAPPDATA%\edit resync 0.32\is-tc4a8.tmp to %LOCALAPPDATA%\edit resync 0.32\unins000.exe
from %LOCALAPPDATA%\edit resync 0.32\library\is-dgfa9.tmp to %LOCALAPPDATA%\edit resync 0.32\library\weather.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-k09of.tmp to %LOCALAPPDATA%\edit resync 0.32\library\usa.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-4faqb.tmp to %LOCALAPPDATA%\edit resync 0.32\library\talk bubbles.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-irb4p.tmp to %LOCALAPPDATA%\edit resync 0.32\library\tags, signs & banners.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-qsovt.tmp to %LOCALAPPDATA%\edit resync 0.32\library\symbols.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-vf8e6.tmp to %LOCALAPPDATA%\edit resync 0.32\library\swirls.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-58rqg.tmp to %LOCALAPPDATA%\edit resync 0.32\library\summer.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-u32kk.tmp to %LOCALAPPDATA%\edit resync 0.32\library\spring.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-fn1ms.tmp to %LOCALAPPDATA%\edit resync 0.32\library\newborn.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-h0rk6.tmp to %LOCALAPPDATA%\edit resync 0.32\library\music.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-k9u13.tmp to %LOCALAPPDATA%\edit resync 0.32\library\michellemybelle creations.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-5m1fb.tmp to %LOCALAPPDATA%\edit resync 0.32\library\game.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-dfo6e.tmp to %LOCALAPPDATA%\edit resync 0.32\library\fall.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-33u8m.tmp to %LOCALAPPDATA%\edit resync 0.32\library\createinspain designs.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-prl7d.tmp to %LOCALAPPDATA%\edit resync 0.32\library\basic shapes.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-0m0d6.tmp to %LOCALAPPDATA%\edit resync 0.32\library\arrows.scal
from %LOCALAPPDATA%\edit resync 0.32\is-hsvpq.tmp to %LOCALAPPDATA%\edit resync 0.32\winsparkle.dll
from %LOCALAPPDATA%\edit resync 0.32\is-qkfdv.tmp to %LOCALAPPDATA%\edit resync 0.32\ch375dll.dll
from %LOCALAPPDATA%\edit resync 0.32\is-piiql.tmp to %LOCALAPPDATA%\edit resync 0.32\cairogfx.dll
from %LOCALAPPDATA%\edit resync 0.32\is-2j1ae.tmp to %LOCALAPPDATA%\edit resync 0.32\msvcr71.dll
from %LOCALAPPDATA%\edit resync 0.32\is-pdag8.tmp to %LOCALAPPDATA%\edit resync 0.32\msvcp71.dll
from %LOCALAPPDATA%\edit resync 0.32\library\is-2d9bj.tmp to %LOCALAPPDATA%\edit resync 0.32\library\winter.scal
from %LOCALAPPDATA%\edit resync 0.32\is-09ard.tmp to %LOCALAPPDATA%\edit resync 0.32\editresync32_64.exe