Trojan.MulDrop7.34875

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\AQiQuickStarter.lnk

Modifies file system:

Creates the following files:

%TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\cor6.tmp
%TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\dot7.tmp
%TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\DIF5.tmp
%TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\lic3.tmp
%TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\Fon4.tmp
%TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\_isB.tmp
<Current directory>\bin\AQiC.tmp
%TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\defA.tmp
%TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\Str8.tmp
%TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\isr9.tmp
%TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\set2.tmp
%TEMP%\{9C9F4AC6-F2CD-4EB8-8E48-1CD3F40ECF6A}\Disk1\ISSetup.dll
%TEMP%\{9C9F4AC6-F2CD-4EB8-8E48-1CD3F40ECF6A}\Disk1\layout.bin
%TEMP%\{9C9F4AC6-F2CD-4EB8-8E48-1CD3F40ECF6A}\Disk1\data1.hdr
%TEMP%\{9C9F4AC6-F2CD-4EB8-8E48-1CD3F40ECF6A}\Disk1\0x0409.ini
%TEMP%\{9C9F4AC6-F2CD-4EB8-8E48-1CD3F40ECF6A}\Disk1\data1.cab
%TEMP%\{9C9F4AC6-F2CD-4EB8-8E48-1CD3F40ECF6A}\setup.ini
%TEMP%\{9C9F4AC6-F2CD-4EB8-8E48-1CD3F40ECF6A}\0x0409.ini
%TEMP%\{9C9F4AC6-F2CD-4EB8-8E48-1CD3F40ECF6A}\Disk1\setup.inx
%TEMP%\{9C9F4AC6-F2CD-4EB8-8E48-1CD3F40ECF6A}\Disk1\setup.exe
%TEMP%\{9C9F4AC6-F2CD-4EB8-8E48-1CD3F40ECF6A}\Disk1\setup.ini

Moves the following files:

from %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\isr9.tmp to %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\isrt.dll
from %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\Str8.tmp to %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\StringTable_0x0409.ips
from %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\defA.tmp to %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\default.pal
from <Current directory>\bin\AQiC.tmp to <Current directory>\bin\AQiQuickStarter.exe
from %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\_isB.tmp to %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\_isres_0x0409.dll
from %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\dot7.tmp to %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\dotnetinstaller.exe
from %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\lic3.tmp to %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\license.rtf
from %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\set2.tmp to %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\setup.inx
from %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\Fon4.tmp to %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\FontData.ini
from %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\cor6.tmp to %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\corecomp.ini
from %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\DIF5.tmp to %TEMP%\{44AB8E0E-5E6E-4B62-8CF9-CE6D82F52856}\{78508ACB-DC6A-4F92-A062-55D356C5C413}\DIFxData.ini