Trojan.DownLoader48.18384

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-40eru.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-19l6b.tmp
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-4m0qp.tmp
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-cbo9h.tmp
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-6oiq4.tmp
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-a02i3.tmp
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-30cjb.tmp
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-e22rr.tmp
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-68g5j.tmp
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-vfvpp.tmp
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-3ufe9.tmp
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-iuko7.tmp
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-87i32.tmp
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\uninstall\is-m3pem.tmp
%TEMP%\is-273rr.tmp\_isetup\_iscrypt.dll
%TEMP%\is-273rr.tmp\_isetup\_shfoldr.dll
%TEMP%\is-273rr.tmp\_isetup\_setup64.tmp
%TEMP%\is-273rr.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\uninstall\unins000.dat
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\partitionassistantse.exe

Перемещает следующие файлы

%LOCALAPPDATA%\partition assistant standard edition 9.5.27\uninstall\is-m3pem.tmp в %LOCALAPPDATA%\partition assistant standard edition 9.5.27\uninstall\unins000.exe
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-87i32.tmp в %LOCALAPPDATA%\partition assistant standard edition 9.5.27\icuin51.dll
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-iuko7.tmp в %LOCALAPPDATA%\partition assistant standard edition 9.5.27\icuuc51.dll
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-3ufe9.tmp в %LOCALAPPDATA%\partition assistant standard edition 9.5.27\libegl.dll
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-vfvpp.tmp в %LOCALAPPDATA%\partition assistant standard edition 9.5.27\libglesv2.dll
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-68g5j.tmp в %LOCALAPPDATA%\partition assistant standard edition 9.5.27\msvcp100.dll
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-e22rr.tmp в %LOCALAPPDATA%\partition assistant standard edition 9.5.27\msvcr100.dll
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-30cjb.tmp в %LOCALAPPDATA%\partition assistant standard edition 9.5.27\sqlite3.dll
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-a02i3.tmp в %LOCALAPPDATA%\partition assistant standard edition 9.5.27\qt5concurrent.dll
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-6oiq4.tmp в %LOCALAPPDATA%\partition assistant standard edition 9.5.27\qt5core.dll
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-cbo9h.tmp в %LOCALAPPDATA%\partition assistant standard edition 9.5.27\qt5gui.dll
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-4m0qp.tmp в %LOCALAPPDATA%\partition assistant standard edition 9.5.27\qt5printsupport.dll
%LOCALAPPDATA%\partition assistant standard edition 9.5.27\is-19l6b.tmp в %LOCALAPPDATA%\partition assistant standard edition 9.5.27\partitionassistantse.exe

Сетевая активность

Подключается к

'st###7345724.ru':80

TCP

Запросы HTTP POST

http://st###7345724.ru/new/net_api

UDP

DNS ASK st###7345724.ru

Другое

Ищет следующие окна

ClassName: 'L42a65_PartitionAssistantSE_831_L42a65' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-40eru.tmp\<Имя файла>.tmp' /SL5="$A0170,7341373,53248,<Полный путь к файлу>"
'%LOCALAPPDATA%\partition assistant standard edition 9.5.27\partitionassistantse.exe' 78111dd2aaacf06fbc89ab98c63705dc