Trojan.DownLoader46.64513

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-qh7s7.tmp\<File name>.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-lkt3o.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-qjtuq.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\printsupport\is-p0s8m.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\platforms\is-mqr7m.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\platforms\is-kpgao.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\platforms\is-bm6id.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\imageformats\is-lbscd.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\imageformats\is-mdoc8.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-9b7g8.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-5beln.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-n1538.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-q4l4k.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-0a9mh.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-ufflv.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-6v09g.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-qnbg2.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-mok3q.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-20qke.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-rt2vd.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-7hu1r.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-brc2c.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-n126b.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-8cf96.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-h1i16.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\is-oth0e.tmp
%TEMP%\is-t24ku.tmp\_isetup\_iscrypt.dll
%TEMP%\is-t24ku.tmp\_isetup\_isdecmp.dll
%TEMP%\is-t24ku.tmp\_isetup\_shfoldr.dll
%TEMP%\is-t24ku.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\eusing free mp3 cutter\unins000.dat
%LOCALAPPDATA%\eusing free mp3 cutter\eusingfreemp3cutter.exe

Moves the following files

from %LOCALAPPDATA%\eusing free mp3 cutter\is-oth0e.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\unins000.exe
from %LOCALAPPDATA%\eusing free mp3 cutter\printsupport\is-p0s8m.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\printsupport\windowsprintersupport.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\platforms\is-mqr7m.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\platforms\qwindows.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\platforms\is-kpgao.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\platforms\qoffscreen.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\platforms\is-bm6id.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\platforms\qminimal.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\imageformats\is-lbscd.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\imageformats\qjpeg.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\imageformats\is-mdoc8.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\imageformats\qgif.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\is-9b7g8.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\ssleay32.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\is-5beln.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\qt5webkitwidgets.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\is-n1538.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\qt5webchannel.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\is-q4l4k.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\qt5sql.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\is-qjtuq.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\firealpaca_mdp.ico
from %LOCALAPPDATA%\eusing free mp3 cutter\is-0a9mh.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\qt5sensors.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\is-6v09g.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\qt5positioning.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\is-qnbg2.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\qt5opengl.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\is-mok3q.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\qt5network.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\is-20qke.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\qt5multimediawidgets.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\is-rt2vd.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\qt5multimedia.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\is-7hu1r.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\qt5concurrent.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\is-brc2c.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\libwinpthread-1.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\is-n126b.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\libstdc++-6.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\is-8cf96.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\libgcc_s_dw2-1.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\is-h1i16.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\qt.conf
from %LOCALAPPDATA%\eusing free mp3 cutter\is-ufflv.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\qt5printsupport.dll
from %LOCALAPPDATA%\eusing free mp3 cutter\is-lkt3o.tmp to %LOCALAPPDATA%\eusing free mp3 cutter\eusingfreemp3cutter.exe

Network activity

Connects to

'so####rvice.shop':80

TCP

HTTP POST requests

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Miscellaneous

Searches for the following windows

ClassName: 'L41465_Wnd_5131L41465' WindowName: ''

Creates and executes the following

'%TEMP%\is-qh7s7.tmp\<File name>.tmp' /SL5="$D0172,6183441,56832,<Full path to file>"
'%LOCALAPPDATA%\eusing free mp3 cutter\eusingfreemp3cutter.exe' 7b8397f90f10059335a7f520121f9485

Executes the following