Trojan.DownLoader47.9343

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-l6df9.tmp\<File name>.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\is-vmm73.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\is-9aive.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\printsupport\is-bl6ho.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\platforms\is-h5bk8.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\platforms\is-fvb90.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\platforms\is-709aq.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\imageformats\is-hnv9e.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\imageformats\is-jdus0.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\is-jte4o.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\is-1n74v.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\is-n2mk2.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\is-r4ih4.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\is-ftjpj.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\unins000.dat
%LOCALAPPDATA%\audio cd to mp3 converter\is-p28k4.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\is-poijs.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\is-3a9qo.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\is-vj22i.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\is-qd2r6.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\is-vq88i.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\is-5ggff.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\is-mkhug.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\is-plum5.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\is-rrrnb.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\is-jpkj1.tmp
%TEMP%\is-0miq7.tmp\_isetup\_iscrypt.dll
%TEMP%\is-0miq7.tmp\_isetup\_shfoldr.dll
%TEMP%\is-0miq7.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\is-3agis.tmp
%LOCALAPPDATA%\audio cd to mp3 converter\audiocd2mp3converter32.exe

Moves the following files

from %LOCALAPPDATA%\audio cd to mp3 converter\is-jpkj1.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\unins000.exe
from %LOCALAPPDATA%\audio cd to mp3 converter\printsupport\is-bl6ho.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\printsupport\windowsprintersupport.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\platforms\is-h5bk8.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\platforms\qwindows.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\platforms\is-fvb90.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\platforms\qoffscreen.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\platforms\is-709aq.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\platforms\qminimal.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\imageformats\is-hnv9e.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\imageformats\qjpeg.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\imageformats\is-jdus0.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\imageformats\qgif.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\is-jte4o.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\ssleay32.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\is-1n74v.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\qt5webkitwidgets.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\is-n2mk2.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\qt5webchannel.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\is-r4ih4.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\qt5sql.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\is-9aive.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\firealpaca_mdp.ico
from %LOCALAPPDATA%\audio cd to mp3 converter\is-ftjpj.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\qt5sensors.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\is-3agis.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\qt5positioning.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\is-poijs.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\qt5opengl.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\is-3a9qo.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\qt5network.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\is-vj22i.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\qt5multimediawidgets.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\is-qd2r6.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\qt5multimedia.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\is-vq88i.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\qt5concurrent.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\is-5ggff.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\libwinpthread-1.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\is-mkhug.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\libstdc++-6.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\is-plum5.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\libgcc_s_dw2-1.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\is-rrrnb.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\qt.conf
from %LOCALAPPDATA%\audio cd to mp3 converter\is-p28k4.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\qt5printsupport.dll
from %LOCALAPPDATA%\audio cd to mp3 converter\is-vmm73.tmp to %LOCALAPPDATA%\audio cd to mp3 converter\audiocd2mp3converter32.exe

Network activity

Connects to

'so####rvice.shop':80

TCP

HTTP POST requests

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'b%x_Wnd_7132cc8f35'

Creates and executes the following

'%TEMP%\is-l6df9.tmp\<File name>.tmp' /SL5="$C024A,6038364,56832,<Full path to file>"
'%LOCALAPPDATA%\audio cd to mp3 converter\audiocd2mp3converter32.exe' c1b9fd51efff35d0e246f935823cb9e1

Executes the following