Trojan.MulDrop28.40165

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\EditResyncTool46] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\EditResyncTool46] 'ImagePath' = '%ALLUSERSPROFILE%\EditResyncTool46\EditResyncTool46.exe'

Creates the following services

'EditResyncTool46' %ALLUSERSPROFILE%\EditResyncTool46\EditResyncTool46.exe

Modifies file system

Creates the following files

%TEMP%\is-97d1l.tmp\<File name>.tmp
%LOCALAPPDATA%\edit resync 0.32\unins000.dat
%LOCALAPPDATA%\edit resync 0.32\is-joinh.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-h9dfd.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-gvpjl.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-bg7a5.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-rfrb9.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-5hlmc.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-28ef8.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-tvs48.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-r6jfg.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-9mba7.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-s7btd.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-erout.tmp
%LOCALAPPDATA%\edit resync 0.32\editresync32_64.exe
%LOCALAPPDATA%\edit resync 0.32\library\is-phbte.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-26a9d.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-jtds9.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-haj2a.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-0buti.tmp
%LOCALAPPDATA%\edit resync 0.32\is-060if.tmp
%LOCALAPPDATA%\edit resync 0.32\is-s8h2n.tmp
%LOCALAPPDATA%\edit resync 0.32\is-stuvd.tmp
%LOCALAPPDATA%\edit resync 0.32\is-p8dpj.tmp
%LOCALAPPDATA%\edit resync 0.32\is-udubs.tmp
%LOCALAPPDATA%\edit resync 0.32\is-gkgsc.tmp
%TEMP%\is-7gn9u.tmp\_isetup\_iscrypt.dll
%TEMP%\is-7gn9u.tmp\_isetup\_shfoldr.dll
%TEMP%\is-7gn9u.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\edit resync 0.32\library\is-5rg36.tmp
%ALLUSERSPROFILE%\editresynctool46\editresynctool46.exe

Moves the following files

from %LOCALAPPDATA%\edit resync 0.32\is-gkgsc.tmp to %LOCALAPPDATA%\edit resync 0.32\unins000.exe
from %LOCALAPPDATA%\edit resync 0.32\library\is-gvpjl.tmp to %LOCALAPPDATA%\edit resync 0.32\library\weather.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-bg7a5.tmp to %LOCALAPPDATA%\edit resync 0.32\library\usa.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-rfrb9.tmp to %LOCALAPPDATA%\edit resync 0.32\library\talk bubbles.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-5hlmc.tmp to %LOCALAPPDATA%\edit resync 0.32\library\tags, signs & banners.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-28ef8.tmp to %LOCALAPPDATA%\edit resync 0.32\library\symbols.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-tvs48.tmp to %LOCALAPPDATA%\edit resync 0.32\library\swirls.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-r6jfg.tmp to %LOCALAPPDATA%\edit resync 0.32\library\summer.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-9mba7.tmp to %LOCALAPPDATA%\edit resync 0.32\library\spring.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-s7btd.tmp to %LOCALAPPDATA%\edit resync 0.32\library\newborn.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-erout.tmp to %LOCALAPPDATA%\edit resync 0.32\library\music.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-phbte.tmp to %LOCALAPPDATA%\edit resync 0.32\library\michellemybelle creations.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-5rg36.tmp to %LOCALAPPDATA%\edit resync 0.32\library\game.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-26a9d.tmp to %LOCALAPPDATA%\edit resync 0.32\library\fall.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-jtds9.tmp to %LOCALAPPDATA%\edit resync 0.32\library\createinspain designs.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-haj2a.tmp to %LOCALAPPDATA%\edit resync 0.32\library\basic shapes.scal
from %LOCALAPPDATA%\edit resync 0.32\library\is-0buti.tmp to %LOCALAPPDATA%\edit resync 0.32\library\arrows.scal
from %LOCALAPPDATA%\edit resync 0.32\is-060if.tmp to %LOCALAPPDATA%\edit resync 0.32\winsparkle.dll
from %LOCALAPPDATA%\edit resync 0.32\is-s8h2n.tmp to %LOCALAPPDATA%\edit resync 0.32\ch375dll.dll
from %LOCALAPPDATA%\edit resync 0.32\is-stuvd.tmp to %LOCALAPPDATA%\edit resync 0.32\cairogfx.dll
from %LOCALAPPDATA%\edit resync 0.32\is-p8dpj.tmp to %LOCALAPPDATA%\edit resync 0.32\msvcr71.dll
from %LOCALAPPDATA%\edit resync 0.32\is-udubs.tmp to %LOCALAPPDATA%\edit resync 0.32\msvcp71.dll
from %LOCALAPPDATA%\edit resync 0.32\library\is-h9dfd.tmp to %LOCALAPPDATA%\edit resync 0.32\library\winter.scal
from %LOCALAPPDATA%\edit resync 0.32\is-joinh.tmp to %LOCALAPPDATA%\edit resync 0.32\editresync32_64.exe