Trojan.DownLoader48.35725

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-tfl52.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-57uml.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-u6gkb.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-fp2mu.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-h5o8m.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-lpmsg.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-suu3n.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-d2avd.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-9u93p.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-3uhot.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-nuv7j.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-hh2lj.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-5t5o1.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\uninstall\is-t3pn5.tmp
%TEMP%\is-hqe28.tmp\_isetup\_iscrypt.dll
%TEMP%\is-hqe28.tmp\_isetup\_shfoldr.dll
%TEMP%\is-hqe28.tmp\_isetup\_setup64.tmp
%TEMP%\is-hqe28.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\uninstall\unins000.dat
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\freefilerecoveryutility27.exe

Перемещает следующие файлы

%LOCALAPPDATA%\free file recovery utility 21.1.2.7\uninstall\is-t3pn5.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.7\uninstall\unins000.exe
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-5t5o1.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.7\icuin51.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-hh2lj.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.7\icuuc51.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-nuv7j.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.7\libegl.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-3uhot.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.7\libglesv2.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-9u93p.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.7\msvcp100.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-d2avd.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.7\msvcr100.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-suu3n.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.7\sqlite3.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-lpmsg.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.7\qt5concurrent.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-h5o8m.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.7\qt5core.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-fp2mu.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.7\qt5gui.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-u6gkb.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.7\qt5printsupport.dll
%LOCALAPPDATA%\free file recovery utility 21.1.2.7\is-57uml.tmp в %LOCALAPPDATA%\free file recovery utility 21.1.2.7\freefilerecoveryutility27.exe

Сетевая активность

Подключается к

'st###7345724.ru':80

TCP

Запросы HTTP POST

http://st###7345724.ru/new/net_api

UDP

DNS ASK st###7345724.ru

Другое

Ищет следующие окна

ClassName: 'FreeFileRecoveryUtility_2543' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-tfl52.tmp\<Имя файла>.tmp' /SL5="$60248,7062294,54272,<Полный путь к файлу>"
'%LOCALAPPDATA%\free file recovery utility 21.1.2.7\freefilerecoveryutility27.exe' 078695a075f7683504d6894c6fc89d19