Trojan.DownLoader44.59475

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-uj89e.tmp\is-bkppm.tmp
%ProgramFiles(x86)%\fnc drive recovery\unins000.dat
%ProgramFiles(x86)%\fnc drive recovery\is-42mi7.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-v5cpq.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-qol0v.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-5tcrr.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-9ie2f.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-uu4af.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-ppuot.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-87bvl.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-34fsl.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-59a6m.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-5ihmb.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-cdoe4.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-isg8u.tmp
%ProgramFiles(x86)%\fnc drive recovery\frecover.exe
%ProgramFiles(x86)%\fnc drive recovery\is-dq79o.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-o154i.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-c04jk.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-5db2s.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-8hrep.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-nfkk7.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-kq5cv.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-bs5lb.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-1srq9.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-ih32a.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-tmg96.tmp
%TEMP%\is-pm1od.tmp\_isetup\_iscrypt.dll
%TEMP%\is-pm1od.tmp\_isetup\_shfoldr.dll
%TEMP%\is-pm1od.tmp\_isetup\_setup64.tmp
%TEMP%\is-pm1od.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-tqkbi.tmp
%TEMP%\iobit.cab

Перемещает следующие файлы

%ProgramFiles(x86)%\fnc drive recovery\is-tmg96.tmp в %ProgramFiles(x86)%\fnc drive recovery\unins000.exe
%ProgramFiles(x86)%\fnc drive recovery\is-qol0v.tmp в %ProgramFiles(x86)%\fnc drive recovery\pt.lan
%ProgramFiles(x86)%\fnc drive recovery\is-5tcrr.tmp в %ProgramFiles(x86)%\fnc drive recovery\ar.lan
%ProgramFiles(x86)%\fnc drive recovery\is-9ie2f.tmp в %ProgramFiles(x86)%\fnc drive recovery\sk.lan
%ProgramFiles(x86)%\fnc drive recovery\is-uu4af.tmp в %ProgramFiles(x86)%\fnc drive recovery\pl.lan
%ProgramFiles(x86)%\fnc drive recovery\is-ppuot.tmp в %ProgramFiles(x86)%\fnc drive recovery\fa.lan
%ProgramFiles(x86)%\fnc drive recovery\is-87bvl.tmp в %ProgramFiles(x86)%\fnc drive recovery\cnt.lan
%ProgramFiles(x86)%\fnc drive recovery\is-34fsl.tmp в %ProgramFiles(x86)%\fnc drive recovery\cn.lan
%ProgramFiles(x86)%\fnc drive recovery\is-59a6m.tmp в %ProgramFiles(x86)%\fnc drive recovery\it.lan
%ProgramFiles(x86)%\fnc drive recovery\is-5ihmb.tmp в %ProgramFiles(x86)%\fnc drive recovery\fin.lan
%ProgramFiles(x86)%\fnc drive recovery\is-cdoe4.tmp в %ProgramFiles(x86)%\fnc drive recovery\bg.lan
%ProgramFiles(x86)%\fnc drive recovery\is-v5cpq.tmp в %ProgramFiles(x86)%\fnc drive recovery\turbosearch.exe
%ProgramFiles(x86)%\fnc drive recovery\is-isg8u.tmp в %ProgramFiles(x86)%\fnc drive recovery\tr.lan
%ProgramFiles(x86)%\fnc drive recovery\is-tqkbi.tmp в %ProgramFiles(x86)%\fnc drive recovery\es.lan
%ProgramFiles(x86)%\fnc drive recovery\is-o154i.tmp в %ProgramFiles(x86)%\fnc drive recovery\ro.lan
%ProgramFiles(x86)%\fnc drive recovery\is-c04jk.tmp в %ProgramFiles(x86)%\fnc drive recovery\hu.lan
%ProgramFiles(x86)%\fnc drive recovery\is-5db2s.tmp в %ProgramFiles(x86)%\fnc drive recovery\ru.lan
%ProgramFiles(x86)%\fnc drive recovery\is-8hrep.tmp в %ProgramFiles(x86)%\fnc drive recovery\de.lan
%ProgramFiles(x86)%\fnc drive recovery\is-nfkk7.tmp в %ProgramFiles(x86)%\fnc drive recovery\fr.lan
%ProgramFiles(x86)%\fnc drive recovery\is-kq5cv.tmp в %ProgramFiles(x86)%\fnc drive recovery\en.lan
%ProgramFiles(x86)%\fnc drive recovery\is-bs5lb.tmp в %ProgramFiles(x86)%\fnc drive recovery\frecover.exe.manifest
%ProgramFiles(x86)%\fnc drive recovery\is-1srq9.tmp в %ProgramFiles(x86)%\fnc drive recovery\license.txt
%ProgramFiles(x86)%\fnc drive recovery\is-ih32a.tmp в %ProgramFiles(x86)%\fnc drive recovery\readme.txt
%ProgramFiles(x86)%\fnc drive recovery\is-dq79o.tmp в %ProgramFiles(x86)%\fnc drive recovery\du.lan
%ProgramFiles(x86)%\fnc drive recovery\is-42mi7.tmp в %ProgramFiles(x86)%\fnc drive recovery\frecover.exe

Сетевая активность

Подключается к

'tu####lotneli.cf':80

TCP

Запросы HTTP GET

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?56#######

Запросы HTTP POST

http://tu####lotneli.cf/new/net_api

UDP

DNS ASK tu####lotneli.cf

Другое

Ищет следующие окна

ClassName: '' WindowName: 'FncbitsWindowClassFnc32'

Создает и запускает на исполнение

'%TEMP%\is-uj89e.tmp\is-bkppm.tmp' /SL4 $A0218 "<Полный путь к файлу>" 5159543 92160
'%ProgramFiles(x86)%\fnc drive recovery\frecover.exe'
'%ProgramFiles(x86)%\fnc drive recovery\frecover.exe' b96591980ee6d19f4954dfda2738e447

Запускает на исполнение