Trojan.DownLoader44.59939

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-rrt1p.tmp\is-ucnmr.tmp
%ProgramFiles(x86)%\fml drive recovery\unins000.dat
%ProgramFiles(x86)%\fml drive recovery\is-ofha5.tmp
%ProgramFiles(x86)%\fml drive recovery\is-16fn9.tmp
%ProgramFiles(x86)%\fml drive recovery\is-9u3r5.tmp
%ProgramFiles(x86)%\fml drive recovery\is-opffd.tmp
%ProgramFiles(x86)%\fml drive recovery\is-ejpd3.tmp
%ProgramFiles(x86)%\fml drive recovery\is-5qra3.tmp
%ProgramFiles(x86)%\fml drive recovery\is-do1ob.tmp
%ProgramFiles(x86)%\fml drive recovery\is-9hkik.tmp
%ProgramFiles(x86)%\fml drive recovery\is-0mc5h.tmp
%ProgramFiles(x86)%\fml drive recovery\is-rg7ni.tmp
%ProgramFiles(x86)%\fml drive recovery\is-r8rnk.tmp
%ProgramFiles(x86)%\fml drive recovery\is-msgcm.tmp
%ProgramFiles(x86)%\fml drive recovery\is-fe85o.tmp
%ProgramFiles(x86)%\fml drive recovery\frecover.exe
%ProgramFiles(x86)%\fml drive recovery\is-smvt0.tmp
%ProgramFiles(x86)%\fml drive recovery\is-2cacq.tmp
%ProgramFiles(x86)%\fml drive recovery\is-05q3v.tmp
%ProgramFiles(x86)%\fml drive recovery\is-toubl.tmp
%ProgramFiles(x86)%\fml drive recovery\is-e9shl.tmp
%ProgramFiles(x86)%\fml drive recovery\is-6cam9.tmp
%ProgramFiles(x86)%\fml drive recovery\is-2oeqf.tmp
%ProgramFiles(x86)%\fml drive recovery\is-v5n8o.tmp
%ProgramFiles(x86)%\fml drive recovery\is-7e9gs.tmp
%ProgramFiles(x86)%\fml drive recovery\is-9pk0b.tmp
%ProgramFiles(x86)%\fml drive recovery\is-bh57f.tmp
%TEMP%\is-ac2di.tmp\_isetup\_iscrypt.dll
%TEMP%\is-ac2di.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ac2di.tmp\_isetup\_setup64.tmp
%TEMP%\is-ac2di.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\fml drive recovery\is-52v5a.tmp
%TEMP%\iobit.cab

Moves the following files

from %ProgramFiles(x86)%\fml drive recovery\is-bh57f.tmp to %ProgramFiles(x86)%\fml drive recovery\unins000.exe
from %ProgramFiles(x86)%\fml drive recovery\is-9u3r5.tmp to %ProgramFiles(x86)%\fml drive recovery\pt.lan
from %ProgramFiles(x86)%\fml drive recovery\is-opffd.tmp to %ProgramFiles(x86)%\fml drive recovery\ar.lan
from %ProgramFiles(x86)%\fml drive recovery\is-ejpd3.tmp to %ProgramFiles(x86)%\fml drive recovery\sk.lan
from %ProgramFiles(x86)%\fml drive recovery\is-5qra3.tmp to %ProgramFiles(x86)%\fml drive recovery\pl.lan
from %ProgramFiles(x86)%\fml drive recovery\is-do1ob.tmp to %ProgramFiles(x86)%\fml drive recovery\fa.lan
from %ProgramFiles(x86)%\fml drive recovery\is-9hkik.tmp to %ProgramFiles(x86)%\fml drive recovery\cnt.lan
from %ProgramFiles(x86)%\fml drive recovery\is-0mc5h.tmp to %ProgramFiles(x86)%\fml drive recovery\cn.lan
from %ProgramFiles(x86)%\fml drive recovery\is-rg7ni.tmp to %ProgramFiles(x86)%\fml drive recovery\it.lan
from %ProgramFiles(x86)%\fml drive recovery\is-r8rnk.tmp to %ProgramFiles(x86)%\fml drive recovery\fin.lan
from %ProgramFiles(x86)%\fml drive recovery\is-msgcm.tmp to %ProgramFiles(x86)%\fml drive recovery\bg.lan
from %ProgramFiles(x86)%\fml drive recovery\is-16fn9.tmp to %ProgramFiles(x86)%\fml drive recovery\turbosearch.exe
from %ProgramFiles(x86)%\fml drive recovery\is-fe85o.tmp to %ProgramFiles(x86)%\fml drive recovery\tr.lan
from %ProgramFiles(x86)%\fml drive recovery\is-52v5a.tmp to %ProgramFiles(x86)%\fml drive recovery\es.lan
from %ProgramFiles(x86)%\fml drive recovery\is-2cacq.tmp to %ProgramFiles(x86)%\fml drive recovery\ro.lan
from %ProgramFiles(x86)%\fml drive recovery\is-05q3v.tmp to %ProgramFiles(x86)%\fml drive recovery\hu.lan
from %ProgramFiles(x86)%\fml drive recovery\is-toubl.tmp to %ProgramFiles(x86)%\fml drive recovery\ru.lan
from %ProgramFiles(x86)%\fml drive recovery\is-e9shl.tmp to %ProgramFiles(x86)%\fml drive recovery\de.lan
from %ProgramFiles(x86)%\fml drive recovery\is-6cam9.tmp to %ProgramFiles(x86)%\fml drive recovery\fr.lan
from %ProgramFiles(x86)%\fml drive recovery\is-2oeqf.tmp to %ProgramFiles(x86)%\fml drive recovery\en.lan
from %ProgramFiles(x86)%\fml drive recovery\is-v5n8o.tmp to %ProgramFiles(x86)%\fml drive recovery\frecover.exe.manifest
from %ProgramFiles(x86)%\fml drive recovery\is-7e9gs.tmp to %ProgramFiles(x86)%\fml drive recovery\license.txt
from %ProgramFiles(x86)%\fml drive recovery\is-9pk0b.tmp to %ProgramFiles(x86)%\fml drive recovery\readme.txt
from %ProgramFiles(x86)%\fml drive recovery\is-smvt0.tmp to %ProgramFiles(x86)%\fml drive recovery\du.lan
from %ProgramFiles(x86)%\fml drive recovery\is-ofha5.tmp to %ProgramFiles(x86)%\fml drive recovery\frecover.exe

Network activity

Connects to

'tu####lotneli.cf':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?56#######

HTTP POST requests

http://tu####lotneli.cf/new/net_api

UDP

DNS ASK tu####lotneli.cf

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'FmlbitsWindowClassFml15'

Creates and executes the following

'%TEMP%\is-rrt1p.tmp\is-ucnmr.tmp' /SL4 $B0216 "<Full path to file>" 4954246 50176
'%ProgramFiles(x86)%\fml drive recovery\frecover.exe'
'%ProgramFiles(x86)%\fml drive recovery\frecover.exe' 11e583986979df7e22633b8dbced2993

Executes the following