Trojan.DownLoader47.594

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-ab1n2.tmp\<File name>.tmp
%LOCALAPPDATA%\musiland music manager\is-rvsl6.tmp
%LOCALAPPDATA%\musiland music manager\is-ah66i.tmp
%LOCALAPPDATA%\musiland music manager\printsupport\is-qe6u9.tmp
%LOCALAPPDATA%\musiland music manager\platforms\is-krr0l.tmp
%LOCALAPPDATA%\musiland music manager\platforms\is-2fgp0.tmp
%LOCALAPPDATA%\musiland music manager\platforms\is-oqe3t.tmp
%LOCALAPPDATA%\musiland music manager\imageformats\is-rl0b5.tmp
%LOCALAPPDATA%\musiland music manager\imageformats\is-4iche.tmp
%LOCALAPPDATA%\musiland music manager\is-8po1o.tmp
%LOCALAPPDATA%\musiland music manager\is-vjdol.tmp
%LOCALAPPDATA%\musiland music manager\is-m47j3.tmp
%LOCALAPPDATA%\musiland music manager\is-j5th7.tmp
%LOCALAPPDATA%\musiland music manager\is-4v7gn.tmp
%LOCALAPPDATA%\musiland music manager\is-q7e52.tmp
%LOCALAPPDATA%\musiland music manager\is-iv39c.tmp
%LOCALAPPDATA%\musiland music manager\is-107a9.tmp
%LOCALAPPDATA%\musiland music manager\is-gllr4.tmp
%LOCALAPPDATA%\musiland music manager\is-e55db.tmp
%LOCALAPPDATA%\musiland music manager\is-ibsl7.tmp
%LOCALAPPDATA%\musiland music manager\is-jatar.tmp
%LOCALAPPDATA%\musiland music manager\is-6l5a7.tmp
%LOCALAPPDATA%\musiland music manager\is-t7opo.tmp
%LOCALAPPDATA%\musiland music manager\is-3lpht.tmp
%LOCALAPPDATA%\musiland music manager\is-s2v56.tmp
%LOCALAPPDATA%\musiland music manager\is-f2dra.tmp
%TEMP%\is-7oumi.tmp\_isetup\_iscrypt.dll
%TEMP%\is-7oumi.tmp\_isetup\_isdecmp.dll
%TEMP%\is-7oumi.tmp\_isetup\_shfoldr.dll
%TEMP%\is-7oumi.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\musiland music manager\unins000.dat
%LOCALAPPDATA%\musiland music manager\musilandmusicmanager.exe

Moves the following files

from %LOCALAPPDATA%\musiland music manager\is-f2dra.tmp to %LOCALAPPDATA%\musiland music manager\unins000.exe
from %LOCALAPPDATA%\musiland music manager\printsupport\is-qe6u9.tmp to %LOCALAPPDATA%\musiland music manager\printsupport\windowsprintersupport.dll
from %LOCALAPPDATA%\musiland music manager\platforms\is-krr0l.tmp to %LOCALAPPDATA%\musiland music manager\platforms\qwindows.dll
from %LOCALAPPDATA%\musiland music manager\platforms\is-2fgp0.tmp to %LOCALAPPDATA%\musiland music manager\platforms\qoffscreen.dll
from %LOCALAPPDATA%\musiland music manager\platforms\is-oqe3t.tmp to %LOCALAPPDATA%\musiland music manager\platforms\qminimal.dll
from %LOCALAPPDATA%\musiland music manager\imageformats\is-rl0b5.tmp to %LOCALAPPDATA%\musiland music manager\imageformats\qjpeg.dll
from %LOCALAPPDATA%\musiland music manager\imageformats\is-4iche.tmp to %LOCALAPPDATA%\musiland music manager\imageformats\qgif.dll
from %LOCALAPPDATA%\musiland music manager\is-8po1o.tmp to %LOCALAPPDATA%\musiland music manager\ssleay32.dll
from %LOCALAPPDATA%\musiland music manager\is-vjdol.tmp to %LOCALAPPDATA%\musiland music manager\qt5webkitwidgets.dll
from %LOCALAPPDATA%\musiland music manager\is-m47j3.tmp to %LOCALAPPDATA%\musiland music manager\qt5webchannel.dll
from %LOCALAPPDATA%\musiland music manager\is-j5th7.tmp to %LOCALAPPDATA%\musiland music manager\qt5sql.dll
from %LOCALAPPDATA%\musiland music manager\is-ah66i.tmp to %LOCALAPPDATA%\musiland music manager\firealpaca_mdp.ico
from %LOCALAPPDATA%\musiland music manager\is-4v7gn.tmp to %LOCALAPPDATA%\musiland music manager\qt5sensors.dll
from %LOCALAPPDATA%\musiland music manager\is-iv39c.tmp to %LOCALAPPDATA%\musiland music manager\qt5positioning.dll
from %LOCALAPPDATA%\musiland music manager\is-107a9.tmp to %LOCALAPPDATA%\musiland music manager\qt5opengl.dll
from %LOCALAPPDATA%\musiland music manager\is-gllr4.tmp to %LOCALAPPDATA%\musiland music manager\qt5network.dll
from %LOCALAPPDATA%\musiland music manager\is-e55db.tmp to %LOCALAPPDATA%\musiland music manager\qt5multimediawidgets.dll
from %LOCALAPPDATA%\musiland music manager\is-ibsl7.tmp to %LOCALAPPDATA%\musiland music manager\qt5multimedia.dll
from %LOCALAPPDATA%\musiland music manager\is-jatar.tmp to %LOCALAPPDATA%\musiland music manager\qt5concurrent.dll
from %LOCALAPPDATA%\musiland music manager\is-6l5a7.tmp to %LOCALAPPDATA%\musiland music manager\libwinpthread-1.dll
from %LOCALAPPDATA%\musiland music manager\is-t7opo.tmp to %LOCALAPPDATA%\musiland music manager\libstdc++-6.dll
from %LOCALAPPDATA%\musiland music manager\is-3lpht.tmp to %LOCALAPPDATA%\musiland music manager\libgcc_s_dw2-1.dll
from %LOCALAPPDATA%\musiland music manager\is-s2v56.tmp to %LOCALAPPDATA%\musiland music manager\qt.conf
from %LOCALAPPDATA%\musiland music manager\is-q7e52.tmp to %LOCALAPPDATA%\musiland music manager\qt5printsupport.dll
from %LOCALAPPDATA%\musiland music manager\is-rvsl6.tmp to %LOCALAPPDATA%\musiland music manager\musilandmusicmanager.exe

Network activity

Connects to

'so####rvice.shop':80

TCP

HTTP POST requests

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Miscellaneous

Searches for the following windows

ClassName: 'b76081_Wnd_5152b76081' WindowName: ''

Creates and executes the following

'%TEMP%\is-ab1n2.tmp\<File name>.tmp' /SL5="$6023E,6005687,56832,<Full path to file>"
'%LOCALAPPDATA%\musiland music manager\musilandmusicmanager.exe' ab5436354d41842b1028d7611075d996

Executes the following