Trojan.DownLoader47.7222

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-gmm2m.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\shampine music studio\is-qfsku.tmp
%LOCALAPPDATA%\shampine music studio\is-7cdei.tmp
%LOCALAPPDATA%\shampine music studio\printsupport\is-q6dbn.tmp
%LOCALAPPDATA%\shampine music studio\platforms\is-50qdd.tmp
%LOCALAPPDATA%\shampine music studio\platforms\is-tt4e6.tmp
%LOCALAPPDATA%\shampine music studio\platforms\is-cgph0.tmp
%LOCALAPPDATA%\shampine music studio\imageformats\is-o2s40.tmp
%LOCALAPPDATA%\shampine music studio\imageformats\is-uhvqs.tmp
%LOCALAPPDATA%\shampine music studio\is-9dp73.tmp
%LOCALAPPDATA%\shampine music studio\is-0799p.tmp
%LOCALAPPDATA%\shampine music studio\is-b5pti.tmp
%LOCALAPPDATA%\shampine music studio\is-q5lbp.tmp
%LOCALAPPDATA%\shampine music studio\is-d3l3s.tmp
%LOCALAPPDATA%\shampine music studio\unins000.dat
%LOCALAPPDATA%\shampine music studio\is-76q04.tmp
%LOCALAPPDATA%\shampine music studio\is-fth9c.tmp
%LOCALAPPDATA%\shampine music studio\is-9f1cp.tmp
%LOCALAPPDATA%\shampine music studio\is-655fa.tmp
%LOCALAPPDATA%\shampine music studio\is-3bchf.tmp
%LOCALAPPDATA%\shampine music studio\is-mhvgv.tmp
%LOCALAPPDATA%\shampine music studio\is-qgoe3.tmp
%LOCALAPPDATA%\shampine music studio\is-hts6j.tmp
%LOCALAPPDATA%\shampine music studio\is-966kb.tmp
%LOCALAPPDATA%\shampine music studio\is-e9bjn.tmp
%LOCALAPPDATA%\shampine music studio\is-j57o2.tmp
%TEMP%\is-9dv96.tmp\_isetup\_iscrypt.dll
%TEMP%\is-9dv96.tmp\_isetup\_shfoldr.dll
%TEMP%\is-9dv96.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\shampine music studio\is-v8u6k.tmp
%LOCALAPPDATA%\shampine music studio\shampinemusicstudio32.exe

Перемещает следующие файлы

%LOCALAPPDATA%\shampine music studio\is-j57o2.tmp в %LOCALAPPDATA%\shampine music studio\unins000.exe
%LOCALAPPDATA%\shampine music studio\printsupport\is-q6dbn.tmp в %LOCALAPPDATA%\shampine music studio\printsupport\windowsprintersupport.dll
%LOCALAPPDATA%\shampine music studio\platforms\is-50qdd.tmp в %LOCALAPPDATA%\shampine music studio\platforms\qwindows.dll
%LOCALAPPDATA%\shampine music studio\platforms\is-tt4e6.tmp в %LOCALAPPDATA%\shampine music studio\platforms\qoffscreen.dll
%LOCALAPPDATA%\shampine music studio\platforms\is-cgph0.tmp в %LOCALAPPDATA%\shampine music studio\platforms\qminimal.dll
%LOCALAPPDATA%\shampine music studio\imageformats\is-o2s40.tmp в %LOCALAPPDATA%\shampine music studio\imageformats\qjpeg.dll
%LOCALAPPDATA%\shampine music studio\imageformats\is-uhvqs.tmp в %LOCALAPPDATA%\shampine music studio\imageformats\qgif.dll
%LOCALAPPDATA%\shampine music studio\is-9dp73.tmp в %LOCALAPPDATA%\shampine music studio\ssleay32.dll
%LOCALAPPDATA%\shampine music studio\is-0799p.tmp в %LOCALAPPDATA%\shampine music studio\qt5webkitwidgets.dll
%LOCALAPPDATA%\shampine music studio\is-b5pti.tmp в %LOCALAPPDATA%\shampine music studio\qt5webchannel.dll
%LOCALAPPDATA%\shampine music studio\is-q5lbp.tmp в %LOCALAPPDATA%\shampine music studio\qt5sql.dll
%LOCALAPPDATA%\shampine music studio\is-7cdei.tmp в %LOCALAPPDATA%\shampine music studio\firealpaca_mdp.ico
%LOCALAPPDATA%\shampine music studio\is-d3l3s.tmp в %LOCALAPPDATA%\shampine music studio\qt5sensors.dll
%LOCALAPPDATA%\shampine music studio\is-v8u6k.tmp в %LOCALAPPDATA%\shampine music studio\qt5positioning.dll
%LOCALAPPDATA%\shampine music studio\is-fth9c.tmp в %LOCALAPPDATA%\shampine music studio\qt5opengl.dll
%LOCALAPPDATA%\shampine music studio\is-9f1cp.tmp в %LOCALAPPDATA%\shampine music studio\qt5network.dll
%LOCALAPPDATA%\shampine music studio\is-655fa.tmp в %LOCALAPPDATA%\shampine music studio\qt5multimediawidgets.dll
%LOCALAPPDATA%\shampine music studio\is-3bchf.tmp в %LOCALAPPDATA%\shampine music studio\qt5multimedia.dll
%LOCALAPPDATA%\shampine music studio\is-mhvgv.tmp в %LOCALAPPDATA%\shampine music studio\qt5concurrent.dll
%LOCALAPPDATA%\shampine music studio\is-qgoe3.tmp в %LOCALAPPDATA%\shampine music studio\libwinpthread-1.dll
%LOCALAPPDATA%\shampine music studio\is-hts6j.tmp в %LOCALAPPDATA%\shampine music studio\libstdc++-6.dll
%LOCALAPPDATA%\shampine music studio\is-966kb.tmp в %LOCALAPPDATA%\shampine music studio\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\shampine music studio\is-e9bjn.tmp в %LOCALAPPDATA%\shampine music studio\qt.conf
%LOCALAPPDATA%\shampine music studio\is-76q04.tmp в %LOCALAPPDATA%\shampine music studio\qt5printsupport.dll
%LOCALAPPDATA%\shampine music studio\is-qfsku.tmp в %LOCALAPPDATA%\shampine music studio\shampinemusicstudio32.exe

Сетевая активность

Подключается к

'so####rvice.shop':80

TCP

Запросы HTTP POST

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Другое

Ищет следующие окна

ClassName: '' WindowName: 'L%x_Wnd_6282c5a6a5'

Создает и запускает на исполнение

'%TEMP%\is-gmm2m.tmp\<Имя файла>.tmp' /SL5="$50238,5949415,56832,<Полный путь к файлу>"
'%LOCALAPPDATA%\shampine music studio\shampinemusicstudio32.exe' 190b0799c972495bd36294291153c3f3

Запускает на исполнение