Trojan.DownLoader48.60647

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-nlv5k.tmp\is-55bo4.tmp
%TEMP%\is-5vuha.tmp\_isetup\_setup64.tmp
%TEMP%\is-5vuha.tmp\_isetup\_shfoldr.dll
%TEMP%\is-5vuha.tmp\_iscrypt.dll
%ProgramFiles(x86)%\eskit subtitle extractor\is-ek59g.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\is-cttmo.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\is-j2gu8.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\is-d9mtu.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\is-u0pvj.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\is-hvao5.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\is-d7e49.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\is-vmkn2.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-v2a48.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-2i3if.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-k0imo.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-cbluf.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-pb408.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-7j7hd.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-r2jge.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-h2qps.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-3r0ga.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-lmb4n.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-9nf02.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-bkjj2.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-9e956.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-9hm06.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-6q38d.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-b2eno.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-dhu3m.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-530ri.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-8f407.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-ki6pn.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-ics4f.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-ktjii.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-dagi6.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-nagem.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-ae2kb.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-dh34u.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\is-ci9t5.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\item\is-j08ge.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\item\is-6fpk2.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\loading\is-npfmf.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\loading\is-ie8jq.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\scrollbar\is-s51sm.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\scrollbar\is-pvnob.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\scrollbar\is-c82et.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\images\scrollbar\is-6kist.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-i6jl7.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-ms89v.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-4lbpv.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-23ij7.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-2f6vo.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-amh5l.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-jc17d.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-1ob5f.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-rn561.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-e9os5.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-nsrb0.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-bifme.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\pic\is-tn5ls.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\pic\is-1nci8.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\pic\is-gbjsf.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\pic\is-3kosr.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\pic\is-obs0u.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\pic\is-lo60m.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\pic\is-f53nj.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\pic\is-mir3f.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\platforms\is-lq5t2.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\is-cihk6.tmp
%ProgramFiles(x86)%\eskit subtitle extractor\unins000.dat
%ProgramFiles(x86)%\eskit subtitle extractor\subtitleextractor.exe
%TEMP%\license.txt

Moves the following files

from %ProgramFiles(x86)%\eskit subtitle extractor\is-ek59g.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\unins000.exe
from %ProgramFiles(x86)%\eskit subtitle extractor\is-cttmo.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\libmp4v2.dll
from %ProgramFiles(x86)%\eskit subtitle extractor\is-j2gu8.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\mmsubtitle.dll
from %ProgramFiles(x86)%\eskit subtitle extractor\is-d9mtu.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\msvcm90.dll
from %ProgramFiles(x86)%\eskit subtitle extractor\is-u0pvj.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\msvcp90.dll
from %ProgramFiles(x86)%\eskit subtitle extractor\is-hvao5.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\msvcr90.dll
from %ProgramFiles(x86)%\eskit subtitle extractor\is-d7e49.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\winsparkle.dll
from %ProgramFiles(x86)%\eskit subtitle extractor\is-vmkn2.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\microsoft.vc90.crt.manifest
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-v2a48.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\background.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-2i3if.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\background_2.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-k0imo.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\bg_1.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-cbluf.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\bg_2.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-pb408.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\bg_combobox3.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-7j7hd.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\bg_nofile.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-r2jge.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\btn_add_files.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-h2qps.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\btn_check_off.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-3r0ga.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\btn_check_on.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-lmb4n.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\btn_close.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-9nf02.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\btn_common1.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-bkjj2.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\btn_convert.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-9e956.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\btn_edit.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-9hm06.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\btn_menu.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-6q38d.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\btn_min.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-b2eno.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\btn_open.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-dhu3m.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\btn_output.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-530ri.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\btn_prefer.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-8f407.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\down.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-ki6pn.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\edit_selections_no.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-ics4f.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\edit_selections_yes.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-ktjii.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\main_logo.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-dagi6.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\new.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-nagem.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\no_title_logo.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-ae2kb.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\seleted.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-dh34u.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\tag.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\is-ci9t5.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\warning.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\item\is-j08ge.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\item\btn_delete.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\item\is-6fpk2.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\item\btn_t.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\loading\is-npfmf.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\loading\loading_trake.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\loading\is-ie8jq.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\loading\loading_trake2.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\scrollbar\is-s51sm.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\scrollbar\btn_down.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\scrollbar\is-pvnob.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\scrollbar\btn_down2.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\scrollbar\is-c82et.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\scrollbar\btn_up.png
from %ProgramFiles(x86)%\eskit subtitle extractor\images\scrollbar\is-6kist.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\images\scrollbar\btn_up2.png
from %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-i6jl7.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\microsoft.vc90.crt.manifest
from %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-ms89v.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\msvcm90.dll
from %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-4lbpv.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\msvcp90.dll
from %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-23ij7.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\msvcr90.dll
from %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-2f6vo.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\qicns.dll
from %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-amh5l.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\qico.dll
from %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-jc17d.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\qjpeg.dll
from %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-1ob5f.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\qsvg.dll
from %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-rn561.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\qtga.dll
from %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-e9os5.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\qtiff.dll
from %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-nsrb0.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\qwbmp.dll
from %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\is-bifme.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\imageformats\qwebp.dll
from %ProgramFiles(x86)%\eskit subtitle extractor\pic\is-tn5ls.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\pic\bg_msg.png
from %ProgramFiles(x86)%\eskit subtitle extractor\pic\is-1nci8.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\pic\btn_close.png
from %ProgramFiles(x86)%\eskit subtitle extractor\pic\is-gbjsf.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\pic\btn_common.png
from %ProgramFiles(x86)%\eskit subtitle extractor\pic\is-3kosr.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\pic\error.png
from %ProgramFiles(x86)%\eskit subtitle extractor\pic\is-obs0u.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\pic\help.png
from %ProgramFiles(x86)%\eskit subtitle extractor\pic\is-lo60m.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\pic\msg_title_icon.png
from %ProgramFiles(x86)%\eskit subtitle extractor\pic\is-f53nj.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\pic\success.png
from %ProgramFiles(x86)%\eskit subtitle extractor\pic\is-mir3f.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\pic\warning.png
from %ProgramFiles(x86)%\eskit subtitle extractor\platforms\is-lq5t2.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\platforms\qwindows.dll
from %ProgramFiles(x86)%\eskit subtitle extractor\is-cihk6.tmp to %ProgramFiles(x86)%\eskit subtitle extractor\subtitleextractor.exe

Network activity

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?43######

UDP

DNS ASK mi####njobs.works

Miscellaneous

Searches for the following windows

ClassName: 'v5db95_fd821Class_v5db95' WindowName: ''

Creates and executes the following

'%TEMP%\is-nlv5k.tmp\is-55bo4.tmp' /SL4 $5023A "<Full path to file>" 5230114 52224
'%ProgramFiles(x86)%\eskit subtitle extractor\subtitleextractor.exe'
'%ProgramFiles(x86)%\eskit subtitle extractor\subtitleextractor.exe' 2e4e433d07a78a23893aa17b8051a663

Executes the following

'%WINDIR%\syswow64\net.exe' helpmsg 22
'%WINDIR%\syswow64\net1.exe' helpmsg 22
'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "SubtitleExtractor-822"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней