Trojan.DownLoader47.5427

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-ldvk0.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\growth music studio\is-l25ro.tmp
%LOCALAPPDATA%\growth music studio\is-pjl52.tmp
%LOCALAPPDATA%\growth music studio\printsupport\is-5empi.tmp
%LOCALAPPDATA%\growth music studio\platforms\is-tmnpn.tmp
%LOCALAPPDATA%\growth music studio\platforms\is-e8imd.tmp
%LOCALAPPDATA%\growth music studio\platforms\is-r2ldd.tmp
%LOCALAPPDATA%\growth music studio\imageformats\is-m14f1.tmp
%LOCALAPPDATA%\growth music studio\imageformats\is-c12c7.tmp
%LOCALAPPDATA%\growth music studio\is-l4fvg.tmp
%LOCALAPPDATA%\growth music studio\is-lu38k.tmp
%LOCALAPPDATA%\growth music studio\is-6n153.tmp
%LOCALAPPDATA%\growth music studio\is-alsl7.tmp
%LOCALAPPDATA%\growth music studio\is-g7lga.tmp
%LOCALAPPDATA%\growth music studio\is-6frev.tmp
%LOCALAPPDATA%\growth music studio\is-i846v.tmp
%LOCALAPPDATA%\growth music studio\is-9u9n0.tmp
%LOCALAPPDATA%\growth music studio\is-e98m2.tmp
%LOCALAPPDATA%\growth music studio\is-823sn.tmp
%LOCALAPPDATA%\growth music studio\is-vejjt.tmp
%LOCALAPPDATA%\growth music studio\is-432np.tmp
%LOCALAPPDATA%\growth music studio\is-n96i1.tmp
%LOCALAPPDATA%\growth music studio\is-b6di4.tmp
%LOCALAPPDATA%\growth music studio\is-0etv6.tmp
%LOCALAPPDATA%\growth music studio\is-6e91r.tmp
%LOCALAPPDATA%\growth music studio\is-vgdpe.tmp
%TEMP%\is-ilmjd.tmp\_isetup\_iscrypt.dll
%TEMP%\is-ilmjd.tmp\_isetup\_isdecmp.dll
%TEMP%\is-ilmjd.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ilmjd.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\growth music studio\unins000.dat
%LOCALAPPDATA%\growth music studio\growthmusicstudio.exe

Перемещает следующие файлы

%LOCALAPPDATA%\growth music studio\is-vgdpe.tmp в %LOCALAPPDATA%\growth music studio\unins000.exe
%LOCALAPPDATA%\growth music studio\printsupport\is-5empi.tmp в %LOCALAPPDATA%\growth music studio\printsupport\windowsprintersupport.dll
%LOCALAPPDATA%\growth music studio\platforms\is-tmnpn.tmp в %LOCALAPPDATA%\growth music studio\platforms\qwindows.dll
%LOCALAPPDATA%\growth music studio\platforms\is-e8imd.tmp в %LOCALAPPDATA%\growth music studio\platforms\qoffscreen.dll
%LOCALAPPDATA%\growth music studio\platforms\is-r2ldd.tmp в %LOCALAPPDATA%\growth music studio\platforms\qminimal.dll
%LOCALAPPDATA%\growth music studio\imageformats\is-m14f1.tmp в %LOCALAPPDATA%\growth music studio\imageformats\qjpeg.dll
%LOCALAPPDATA%\growth music studio\imageformats\is-c12c7.tmp в %LOCALAPPDATA%\growth music studio\imageformats\qgif.dll
%LOCALAPPDATA%\growth music studio\is-l4fvg.tmp в %LOCALAPPDATA%\growth music studio\ssleay32.dll
%LOCALAPPDATA%\growth music studio\is-lu38k.tmp в %LOCALAPPDATA%\growth music studio\qt5webkitwidgets.dll
%LOCALAPPDATA%\growth music studio\is-6n153.tmp в %LOCALAPPDATA%\growth music studio\qt5webchannel.dll
%LOCALAPPDATA%\growth music studio\is-alsl7.tmp в %LOCALAPPDATA%\growth music studio\qt5sql.dll
%LOCALAPPDATA%\growth music studio\is-pjl52.tmp в %LOCALAPPDATA%\growth music studio\firealpaca_mdp.ico
%LOCALAPPDATA%\growth music studio\is-g7lga.tmp в %LOCALAPPDATA%\growth music studio\qt5sensors.dll
%LOCALAPPDATA%\growth music studio\is-i846v.tmp в %LOCALAPPDATA%\growth music studio\qt5positioning.dll
%LOCALAPPDATA%\growth music studio\is-9u9n0.tmp в %LOCALAPPDATA%\growth music studio\qt5opengl.dll
%LOCALAPPDATA%\growth music studio\is-e98m2.tmp в %LOCALAPPDATA%\growth music studio\qt5network.dll
%LOCALAPPDATA%\growth music studio\is-823sn.tmp в %LOCALAPPDATA%\growth music studio\qt5multimediawidgets.dll
%LOCALAPPDATA%\growth music studio\is-vejjt.tmp в %LOCALAPPDATA%\growth music studio\qt5multimedia.dll
%LOCALAPPDATA%\growth music studio\is-432np.tmp в %LOCALAPPDATA%\growth music studio\qt5concurrent.dll
%LOCALAPPDATA%\growth music studio\is-n96i1.tmp в %LOCALAPPDATA%\growth music studio\libwinpthread-1.dll
%LOCALAPPDATA%\growth music studio\is-b6di4.tmp в %LOCALAPPDATA%\growth music studio\libstdc++-6.dll
%LOCALAPPDATA%\growth music studio\is-0etv6.tmp в %LOCALAPPDATA%\growth music studio\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\growth music studio\is-6e91r.tmp в %LOCALAPPDATA%\growth music studio\qt.conf
%LOCALAPPDATA%\growth music studio\is-6frev.tmp в %LOCALAPPDATA%\growth music studio\qt5printsupport.dll
%LOCALAPPDATA%\growth music studio\is-l25ro.tmp в %LOCALAPPDATA%\growth music studio\growthmusicstudio.exe

Сетевая активность

Подключается к

'so####rvice.shop':80

TCP

Запросы HTTP POST

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Другое

Ищет следующие окна

ClassName: 'n2a80d_Wnd_6191n2a80d' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-ldvk0.tmp\<Имя файла>.tmp' /SL5="$A024E,6044417,56832,<Полный путь к файлу>"
'%LOCALAPPDATA%\growth music studio\growthmusicstudio.exe' 2bd68b2e05a6f50bc2d6b51c34825708

Запускает на исполнение