Trojan.DownLoader47.7253

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-4ccqh.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\is-e7gsi.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\is-lo7ip.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\printsupport\is-vkem2.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\platforms\is-067av.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\platforms\is-vetcq.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\platforms\is-8qlhq.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\imageformats\is-hlq5m.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\imageformats\is-sacl3.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\is-v799r.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\is-edd9r.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\is-vgrgm.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\is-1kvea.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\is-987ps.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\is-ucts1.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\is-7mdna.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\is-ntg9q.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\is-9vk76.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\is-sfntm.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\is-qrotr.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\is-cbieu.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\is-s4400.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\is-s3no2.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\is-2jkch.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\is-k8los.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\is-ooomj.tmp
%TEMP%\is-r8f8c.tmp\_isetup\_iscrypt.dll
%TEMP%\is-r8f8c.tmp\_isetup\_isdecmp.dll
%TEMP%\is-r8f8c.tmp\_isetup\_shfoldr.dll
%TEMP%\is-r8f8c.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\bcie mp3 to wav converter\unins000.dat
%LOCALAPPDATA%\bcie mp3 to wav converter\bciemp3towavconverter32.exe

Перемещает следующие файлы

%LOCALAPPDATA%\bcie mp3 to wav converter\is-ooomj.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\unins000.exe
%LOCALAPPDATA%\bcie mp3 to wav converter\printsupport\is-vkem2.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\printsupport\windowsprintersupport.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\platforms\is-067av.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\platforms\qwindows.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\platforms\is-vetcq.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\platforms\qoffscreen.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\platforms\is-8qlhq.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\platforms\qminimal.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\imageformats\is-hlq5m.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\imageformats\qjpeg.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\imageformats\is-sacl3.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\imageformats\qgif.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\is-v799r.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\ssleay32.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\is-edd9r.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\qt5webkitwidgets.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\is-vgrgm.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\qt5webchannel.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\is-1kvea.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\qt5sql.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\is-lo7ip.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\firealpaca_mdp.ico
%LOCALAPPDATA%\bcie mp3 to wav converter\is-987ps.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\qt5sensors.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\is-7mdna.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\qt5positioning.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\is-ntg9q.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\qt5opengl.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\is-9vk76.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\qt5network.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\is-sfntm.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\qt5multimediawidgets.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\is-qrotr.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\qt5multimedia.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\is-cbieu.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\qt5concurrent.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\is-s4400.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\libwinpthread-1.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\is-s3no2.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\libstdc++-6.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\is-2jkch.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\is-k8los.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\qt.conf
%LOCALAPPDATA%\bcie mp3 to wav converter\is-ucts1.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\qt5printsupport.dll
%LOCALAPPDATA%\bcie mp3 to wav converter\is-e7gsi.tmp в %LOCALAPPDATA%\bcie mp3 to wav converter\bciemp3towavconverter32.exe

Сетевая активность

Подключается к

'so####rvice.shop':80

TCP

Запросы HTTP POST

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Другое

Ищет следующие окна

ClassName: 'je8a89_Wnd_6152je8a89' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-4ccqh.tmp\<Имя файла>.tmp' /SL5="$70242,7132895,56832,<Полный путь к файлу>"
'%LOCALAPPDATA%\bcie mp3 to wav converter\bciemp3towavconverter32.exe' 3f65156c42df6d9a0e9245236305f89f

Запускает на исполнение