Trojan.DownLoader35.63706

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-p7uk7.tmp\<File name>.tmp
%ProgramFiles(x86)%\urning studio\is-u2uaq.tmp
%ProgramFiles(x86)%\urning studio\is-lltic.tmp
%ProgramFiles(x86)%\urning studio\is-sgaeu.tmp
%ProgramFiles(x86)%\urning studio\is-3g8tt.tmp
%ProgramFiles(x86)%\urning studio\is-3q12o.tmp
%ProgramFiles(x86)%\urning studio\is-u4uuv.tmp
%ProgramFiles(x86)%\urning studio\is-skat8.tmp
%ProgramFiles(x86)%\urning studio\is-4l56v.tmp
%ProgramFiles(x86)%\urning studio\is-ogqeo.tmp
%ProgramFiles(x86)%\urning studio\is-ae7vi.tmp
%ProgramFiles(x86)%\urning studio\is-eirip.tmp
%ProgramFiles(x86)%\urning studio\is-g5gkl.tmp
%ProgramFiles(x86)%\urning studio\is-q1hi3.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\urning studio\urning studio .lnk
%ProgramFiles(x86)%\urning studio\is-79oee.tmp
%ProgramFiles(x86)%\urning studio\is-e6br8.tmp
%ProgramFiles(x86)%\urning studio\is-ajo40.tmp
%ProgramFiles(x86)%\urning studio\is-14i9q.tmp
%ProgramFiles(x86)%\urning studio\is-prdse.tmp
%ProgramFiles(x86)%\urning studio\is-ggej0.tmp
%ProgramFiles(x86)%\urning studio\is-324fo.tmp
%ProgramFiles(x86)%\urning studio\is-n8bjv.tmp
%ProgramFiles(x86)%\urning studio\is-jian2.tmp
%ProgramFiles(x86)%\urning studio\is-h69o4.tmp
%TEMP%\is-q5bkj.tmp\_isetup\_iscrypt.dll
%TEMP%\is-q5bkj.tmp\_isetup\_isdecmp.dll
%TEMP%\is-q5bkj.tmp\_isetup\_shfoldr.dll
%TEMP%\is-q5bkj.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\urning studio\is-k17ko.tmp
%ProgramFiles(x86)%\urning studio\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\urning studio\is-h69o4.tmp to %ProgramFiles(x86)%\urning studio\unins000.exe
from %ProgramFiles(x86)%\urning studio\is-sgaeu.tmp to %ProgramFiles(x86)%\urning studio\wmfdist.exe
from %ProgramFiles(x86)%\urning studio\is-3g8tt.tmp to %ProgramFiles(x86)%\urning studio\startrescueexplorer.ico
from %ProgramFiles(x86)%\urning studio\is-3q12o.tmp to %ProgramFiles(x86)%\urning studio\license-curl.txt
from %ProgramFiles(x86)%\urning studio\is-u4uuv.tmp to %ProgramFiles(x86)%\urning studio\license-fi.txt
from %ProgramFiles(x86)%\urning studio\is-skat8.tmp to %ProgramFiles(x86)%\urning studio\ash_libcurl.dll
from %ProgramFiles(x86)%\urning studio\is-4l56v.tmp to %ProgramFiles(x86)%\urning studio\gdiplus.dll
from %ProgramFiles(x86)%\urning studio\is-ogqeo.tmp to %ProgramFiles(x86)%\urning studio\irrlicht.dll
from %ProgramFiles(x86)%\urning studio\is-ae7vi.tmp to %ProgramFiles(x86)%\urning studio\d3dx9_43.dll
from %ProgramFiles(x86)%\urning studio\is-eirip.tmp to %ProgramFiles(x86)%\urning studio\avfilter_ash-6.dll
from %ProgramFiles(x86)%\urning studio\is-g5gkl.tmp to %ProgramFiles(x86)%\urning studio\swresample_ash-2.dll
from %ProgramFiles(x86)%\urning studio\is-q1hi3.tmp to %ProgramFiles(x86)%\urning studio\swscale_ash-4.dll
from %ProgramFiles(x86)%\urning studio\is-79oee.tmp to %ProgramFiles(x86)%\urning studio\avutil_ash-55.dll
from %ProgramFiles(x86)%\urning studio\is-k17ko.tmp to %ProgramFiles(x86)%\urning studio\ash_amf.dll
from %ProgramFiles(x86)%\urning studio\is-e6br8.tmp to %ProgramFiles(x86)%\urning studio\bsnotify.exe
from %ProgramFiles(x86)%\urning studio\is-ajo40.tmp to %ProgramFiles(x86)%\urning studio\ash_spti.dll
from %ProgramFiles(x86)%\urning studio\is-14i9q.tmp to %ProgramFiles(x86)%\urning studio\decmpa.dll
from %ProgramFiles(x86)%\urning studio\is-prdse.tmp to %ProgramFiles(x86)%\urning studio\audiotools.dll
from %ProgramFiles(x86)%\urning studio\is-ggej0.tmp to %ProgramFiles(x86)%\urning studio\info.xml
from %ProgramFiles(x86)%\urning studio\is-324fo.tmp to %ProgramFiles(x86)%\urning studio\version.info
from %ProgramFiles(x86)%\urning studio\is-n8bjv.tmp to %ProgramFiles(x86)%\urning studio\product.xml
from %ProgramFiles(x86)%\urning studio\is-jian2.tmp to %ProgramFiles(x86)%\urning studio\license-en.txt
from %ProgramFiles(x86)%\urning studio\is-lltic.tmp to %ProgramFiles(x86)%\urning studio\urningstudio.exe
from %ProgramFiles(x86)%\urning studio\is-u2uaq.tmp to %ProgramFiles(x86)%\urning studio\sqlite3.dll

Network activity

Connects to

'op###olad.com':80

TCP

HTTP POST requests

http://op###olad.com/v2/events

UDP

DNS ASK op###olad.com

Miscellaneous

Searches for the following windows

ClassName: 'B9339C17-155F-C10C-D4D6-BA0C805EA3E4' WindowName: ''

Creates and executes the following

'%TEMP%\is-p7uk7.tmp\<File name>.tmp' /SL5="$12022C,11643252,56832,<Full path to file>"
'%ProgramFiles(x86)%\urning studio\wmfdist.exe' /Q:A /R:N
'%ProgramFiles(x86)%\urning studio\urningstudio.exe' <File name>.exe