Trojan.DownLoader46.64513

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-hg2rd.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-24dgb.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-brm5j.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\printsupport\is-0bqnm.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\platforms\is-h4mou.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\platforms\is-1j5al.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\platforms\is-o0l7e.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\imageformats\is-v2rv2.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\imageformats\is-5md27.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-gvtht.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-v188m.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-fma9g.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-1k92g.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-m2v7c.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-ujs9j.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-4i0a9.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-pg842.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-ajl09.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-ekbec.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-3ur8k.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-pe1l4.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-6ll5s.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-scuv9.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-l4kvq.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-tmp7v.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-a3blf.tmp
%TEMP%\is-5oh8j.tmp\_isetup\_iscrypt.dll
%TEMP%\is-5oh8j.tmp\_isetup\_isdecmp.dll
%TEMP%\is-5oh8j.tmp\_isetup\_shfoldr.dll
%TEMP%\is-5oh8j.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\unins000.dat
%LOCALAPPDATA%\eusing free mp3 cutter\eusingfreemp3cutter.exe

Перемещает следующие файлы

%LOCALAPPDATA%\eusing free mp3 cutter\is-a3blf.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\unins000.exe
%LOCALAPPDATA%\eusing free mp3 cutter\printsupport\is-0bqnm.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\printsupport\windowsprintersupport.dll
%LOCALAPPDATA%\eusing free mp3 cutter\platforms\is-h4mou.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\platforms\qwindows.dll
%LOCALAPPDATA%\eusing free mp3 cutter\platforms\is-1j5al.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\platforms\qoffscreen.dll
%LOCALAPPDATA%\eusing free mp3 cutter\platforms\is-o0l7e.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\platforms\qminimal.dll
%LOCALAPPDATA%\eusing free mp3 cutter\imageformats\is-v2rv2.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\imageformats\qjpeg.dll
%LOCALAPPDATA%\eusing free mp3 cutter\imageformats\is-5md27.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\imageformats\qgif.dll
%LOCALAPPDATA%\eusing free mp3 cutter\is-gvtht.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\ssleay32.dll
%LOCALAPPDATA%\eusing free mp3 cutter\is-v188m.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\qt5webkitwidgets.dll
%LOCALAPPDATA%\eusing free mp3 cutter\is-fma9g.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\qt5webchannel.dll
%LOCALAPPDATA%\eusing free mp3 cutter\is-1k92g.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\qt5sql.dll
%LOCALAPPDATA%\eusing free mp3 cutter\is-brm5j.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\firealpaca_mdp.ico
%LOCALAPPDATA%\eusing free mp3 cutter\is-m2v7c.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\qt5sensors.dll
%LOCALAPPDATA%\eusing free mp3 cutter\is-4i0a9.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\qt5positioning.dll
%LOCALAPPDATA%\eusing free mp3 cutter\is-pg842.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\qt5opengl.dll
%LOCALAPPDATA%\eusing free mp3 cutter\is-ajl09.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\qt5network.dll
%LOCALAPPDATA%\eusing free mp3 cutter\is-ekbec.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\qt5multimediawidgets.dll
%LOCALAPPDATA%\eusing free mp3 cutter\is-3ur8k.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\qt5multimedia.dll
%LOCALAPPDATA%\eusing free mp3 cutter\is-pe1l4.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\qt5concurrent.dll
%LOCALAPPDATA%\eusing free mp3 cutter\is-6ll5s.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\libwinpthread-1.dll
%LOCALAPPDATA%\eusing free mp3 cutter\is-scuv9.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\libstdc++-6.dll
%LOCALAPPDATA%\eusing free mp3 cutter\is-l4kvq.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\eusing free mp3 cutter\is-tmp7v.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\qt.conf
%LOCALAPPDATA%\eusing free mp3 cutter\is-ujs9j.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\qt5printsupport.dll
%LOCALAPPDATA%\eusing free mp3 cutter\is-24dgb.tmp в %LOCALAPPDATA%\eusing free mp3 cutter\eusingfreemp3cutter.exe

Сетевая активность

Подключается к

'so####rvice.shop':80

TCP

Запросы HTTP POST

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Другое

Ищет следующие окна

ClassName: 'L41465_Wnd_5131L41465' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-hg2rd.tmp\<Имя файла>.tmp' /SL5="$60250,6183441,56832,<Полный путь к файлу>"
'%LOCALAPPDATA%\eusing free mp3 cutter\eusingfreemp3cutter.exe' 5df018135ce50cebaaa1790a4dc0c394

Запускает на исполнение