Trojan.DownLoader44.59916

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-fdnsn.tmp\<File name>.tmp
%ProgramFiles(x86)%\non\possimus\is-24pr3.tmp
%ProgramFiles(x86)%\non\possimus\is-2p1j7.tmp
%ProgramFiles(x86)%\non\possimus\is-fq9ma.tmp
%ProgramFiles(x86)%\non\possimus\is-kn5sv.tmp
%ProgramFiles(x86)%\non\ipsam\is-hhvsv.tmp
%ProgramFiles(x86)%\non\ipsam\is-r0ll0.tmp
%ProgramFiles(x86)%\non\ipsam\is-jrns2.tmp
%ProgramFiles(x86)%\non\ipsam\is-h9dan.tmp
%ProgramFiles(x86)%\non\ipsam\is-ji29t.tmp
%ProgramFiles(x86)%\non\ipsam\is-r45lp.tmp
%ProgramFiles(x86)%\non\ipsam\is-8l0o1.tmp
%ProgramFiles(x86)%\non\possimus\is-doumk.tmp
%ProgramFiles(x86)%\non\aliquid\is-jp604.tmp
%ProgramFiles(x86)%\non\aliquid\is-65ivr.tmp
%ProgramFiles(x86)%\non\aliquid\is-d72ve.tmp
%ProgramFiles(x86)%\non\is-qne1d.tmp
%ProgramFiles(x86)%\non\is-fjp61.tmp
%ProgramFiles(x86)%\non\is-dap1d.tmp
%ProgramFiles(x86)%\non\is-g98rh.tmp
%ProgramFiles(x86)%\non\is-n5imq.tmp
%ProgramFiles(x86)%\non\is-nlcnn.tmp
%TEMP%\is-pgvco.tmp\_isetup\_iscrypt.dll
%TEMP%\is-pgvco.tmp\_isetup\_shfoldr.dll
%TEMP%\is-pgvco.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\non\aliquid\is-71fl6.tmp
%ProgramFiles(x86)%\non\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\non\is-nlcnn.tmp to %ProgramFiles(x86)%\non\unins000.exe
from %ProgramFiles(x86)%\non\possimus\is-2p1j7.tmp to %ProgramFiles(x86)%\non\possimus\blanditiis.txt
from %ProgramFiles(x86)%\non\possimus\is-fq9ma.tmp to %ProgramFiles(x86)%\non\possimus\aut.txt
from %ProgramFiles(x86)%\non\possimus\is-kn5sv.tmp to %ProgramFiles(x86)%\non\possimus\aperiam.txt
from %ProgramFiles(x86)%\non\ipsam\is-hhvsv.tmp to %ProgramFiles(x86)%\non\ipsam\vel.txt
from %ProgramFiles(x86)%\non\ipsam\is-r0ll0.tmp to %ProgramFiles(x86)%\non\ipsam\rerum.txt
from %ProgramFiles(x86)%\non\ipsam\is-jrns2.tmp to %ProgramFiles(x86)%\non\ipsam\maxime.txt
from %ProgramFiles(x86)%\non\ipsam\is-h9dan.tmp to %ProgramFiles(x86)%\non\ipsam\id.txt
from %ProgramFiles(x86)%\non\ipsam\is-ji29t.tmp to %ProgramFiles(x86)%\non\ipsam\et.exe
from %ProgramFiles(x86)%\non\ipsam\is-r45lp.tmp to %ProgramFiles(x86)%\non\ipsam\debitis.txt
from %ProgramFiles(x86)%\non\ipsam\is-8l0o1.tmp to %ProgramFiles(x86)%\non\ipsam\accusantium.txt
from %ProgramFiles(x86)%\non\aliquid\is-jp604.tmp to %ProgramFiles(x86)%\non\aliquid\voluptates.txt
from %ProgramFiles(x86)%\non\aliquid\is-71fl6.tmp to %ProgramFiles(x86)%\non\aliquid\laboriosam.txt
from %ProgramFiles(x86)%\non\aliquid\is-65ivr.tmp to %ProgramFiles(x86)%\non\aliquid\dolore.txt
from %ProgramFiles(x86)%\non\aliquid\is-d72ve.tmp to %ProgramFiles(x86)%\non\aliquid\ab.txt
from %ProgramFiles(x86)%\non\is-qne1d.tmp to %ProgramFiles(x86)%\non\tenetur.txt
from %ProgramFiles(x86)%\non\is-fjp61.tmp to %ProgramFiles(x86)%\non\sunt.txt
from %ProgramFiles(x86)%\non\is-dap1d.tmp to %ProgramFiles(x86)%\non\iste.txt
from %ProgramFiles(x86)%\non\is-g98rh.tmp to %ProgramFiles(x86)%\non\facilis.txt
from %ProgramFiles(x86)%\non\is-n5imq.tmp to %ProgramFiles(x86)%\non\dicta.txt
from %ProgramFiles(x86)%\non\possimus\is-24pr3.tmp to %ProgramFiles(x86)%\non\possimus\eum.txt
from %ProgramFiles(x86)%\non\possimus\is-doumk.tmp to %ProgramFiles(x86)%\non\possimus\suscipit.txt

Network activity

Connects to

'jo###fornk.live':80

TCP

HTTP POST requests

http://jo###fornk.live/v3/api

UDP

DNS ASK jo###fornk.live

Miscellaneous

Searches for the following windows

ClassName: '706FAF7F-6AF1-4754-9FBF-F754B437068B' WindowName: ''

Creates and executes the following

'%TEMP%\is-fdnsn.tmp\<File name>.tmp' /SL5="$11022C,3365580,140800,<Full path to file>"
'%ProgramFiles(x86)%\non\ipsam\et.exe' d8c21b5331d78f982607f51196edf00c