Trojan.DownLoader48.35729

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-kfje9.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-3l1fo.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-5k3uf.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-4np1l.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-qddru.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-j46ul.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-hr318.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-r4n60.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-vrkr0.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-ho9q8.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-iatg5.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-idv36.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-g28rr.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\uninstall\is-i15vr.tmp
%TEMP%\is-oltnf.tmp\_isetup\_iscrypt.dll
%TEMP%\is-oltnf.tmp\_isetup\_shfoldr.dll
%TEMP%\is-oltnf.tmp\_isetup\_setup64.tmp
%TEMP%\is-oltnf.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\uninstall\unins000.dat
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\freefilerecoveryutility28.exe

Перемещает следующие файлы

%LOCALAPPDATA%\free file recovery utility 21.1.2.8\uninstall\is-i15vr.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.8\uninstall\unins000.exe
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-g28rr.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.8\icuin51.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-idv36.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.8\icuuc51.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-iatg5.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.8\libegl.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-ho9q8.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.8\libglesv2.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-vrkr0.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.8\msvcp100.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-r4n60.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.8\msvcr100.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-hr318.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.8\sqlite3.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-j46ul.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.8\qt5concurrent.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-qddru.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.8\qt5core.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-4np1l.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.8\qt5gui.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-5k3uf.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.8\qt5printsupport.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.8\is-3l1fo.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.8\freefilerecoveryutility28.exe

Сетевая активность

Подключается к

'st###7345724.ru':80

TCP

Запросы HTTP POST

http://st###7345724.ru/new/net_api

UDP

DNS ASK st###7345724.ru

Другое

Ищет следующие окна

ClassName: 'FreeFileRecoveryUtility_2542' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-kfje9.tmp\<Имя файла>.tmp' /SL5="$140098,7021824,54272,<Полный путь к файлу>"
'%LOCALAPPDATA%\free file recovery utility 21.1.2.8\freefilerecoveryutility28.exe' e15ec33742ba206b4548a99894c6215a