Trojan.DownLoader44.63612

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-97nc8.tmp\is-unqvg.tmp
%ProgramFiles(x86)%\fml drive recovery\unins000.dat
%ProgramFiles(x86)%\fml drive recovery\is-pip0s.tmp
%ProgramFiles(x86)%\fml drive recovery\is-4ibph.tmp
%ProgramFiles(x86)%\fml drive recovery\is-ih1ah.tmp
%ProgramFiles(x86)%\fml drive recovery\is-e250v.tmp
%ProgramFiles(x86)%\fml drive recovery\is-60ppt.tmp
%ProgramFiles(x86)%\fml drive recovery\is-0c0bu.tmp
%ProgramFiles(x86)%\fml drive recovery\is-s5v96.tmp
%ProgramFiles(x86)%\fml drive recovery\is-bg3cg.tmp
%ProgramFiles(x86)%\fml drive recovery\is-0ng8q.tmp
%ProgramFiles(x86)%\fml drive recovery\is-36v5u.tmp
%ProgramFiles(x86)%\fml drive recovery\is-ciopd.tmp
%ProgramFiles(x86)%\fml drive recovery\is-c85uo.tmp
%ProgramFiles(x86)%\fml drive recovery\is-v7mls.tmp
%ProgramFiles(x86)%\fml drive recovery\frecover.exe
%ProgramFiles(x86)%\fml drive recovery\is-g5v2o.tmp
%ProgramFiles(x86)%\fml drive recovery\is-ujtku.tmp
%ProgramFiles(x86)%\fml drive recovery\is-8f8da.tmp
%ProgramFiles(x86)%\fml drive recovery\is-23thk.tmp
%ProgramFiles(x86)%\fml drive recovery\is-shurb.tmp
%ProgramFiles(x86)%\fml drive recovery\is-11b0b.tmp
%ProgramFiles(x86)%\fml drive recovery\is-oc3vc.tmp
%ProgramFiles(x86)%\fml drive recovery\is-0nolr.tmp
%ProgramFiles(x86)%\fml drive recovery\is-pr0tj.tmp
%ProgramFiles(x86)%\fml drive recovery\is-lv866.tmp
%ProgramFiles(x86)%\fml drive recovery\is-g8d0b.tmp
%TEMP%\is-ht96k.tmp\_isetup\_iscrypt.dll
%TEMP%\is-ht96k.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ht96k.tmp\_isetup\_setup64.tmp
%TEMP%\is-ht96k.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\fml drive recovery\is-dcadc.tmp
%TEMP%\iobit.cab

Moves the following files

from %ProgramFiles(x86)%\fml drive recovery\is-g8d0b.tmp to %ProgramFiles(x86)%\fml drive recovery\unins000.exe
from %ProgramFiles(x86)%\fml drive recovery\is-ih1ah.tmp to %ProgramFiles(x86)%\fml drive recovery\pt.lan
from %ProgramFiles(x86)%\fml drive recovery\is-e250v.tmp to %ProgramFiles(x86)%\fml drive recovery\ar.lan
from %ProgramFiles(x86)%\fml drive recovery\is-60ppt.tmp to %ProgramFiles(x86)%\fml drive recovery\sk.lan
from %ProgramFiles(x86)%\fml drive recovery\is-0c0bu.tmp to %ProgramFiles(x86)%\fml drive recovery\pl.lan
from %ProgramFiles(x86)%\fml drive recovery\is-s5v96.tmp to %ProgramFiles(x86)%\fml drive recovery\fa.lan
from %ProgramFiles(x86)%\fml drive recovery\is-bg3cg.tmp to %ProgramFiles(x86)%\fml drive recovery\cnt.lan
from %ProgramFiles(x86)%\fml drive recovery\is-0ng8q.tmp to %ProgramFiles(x86)%\fml drive recovery\cn.lan
from %ProgramFiles(x86)%\fml drive recovery\is-36v5u.tmp to %ProgramFiles(x86)%\fml drive recovery\it.lan
from %ProgramFiles(x86)%\fml drive recovery\is-ciopd.tmp to %ProgramFiles(x86)%\fml drive recovery\fin.lan
from %ProgramFiles(x86)%\fml drive recovery\is-c85uo.tmp to %ProgramFiles(x86)%\fml drive recovery\bg.lan
from %ProgramFiles(x86)%\fml drive recovery\is-4ibph.tmp to %ProgramFiles(x86)%\fml drive recovery\turbosearch.exe
from %ProgramFiles(x86)%\fml drive recovery\is-v7mls.tmp to %ProgramFiles(x86)%\fml drive recovery\tr.lan
from %ProgramFiles(x86)%\fml drive recovery\is-dcadc.tmp to %ProgramFiles(x86)%\fml drive recovery\es.lan
from %ProgramFiles(x86)%\fml drive recovery\is-ujtku.tmp to %ProgramFiles(x86)%\fml drive recovery\ro.lan
from %ProgramFiles(x86)%\fml drive recovery\is-8f8da.tmp to %ProgramFiles(x86)%\fml drive recovery\hu.lan
from %ProgramFiles(x86)%\fml drive recovery\is-23thk.tmp to %ProgramFiles(x86)%\fml drive recovery\ru.lan
from %ProgramFiles(x86)%\fml drive recovery\is-shurb.tmp to %ProgramFiles(x86)%\fml drive recovery\de.lan
from %ProgramFiles(x86)%\fml drive recovery\is-11b0b.tmp to %ProgramFiles(x86)%\fml drive recovery\fr.lan
from %ProgramFiles(x86)%\fml drive recovery\is-oc3vc.tmp to %ProgramFiles(x86)%\fml drive recovery\en.lan
from %ProgramFiles(x86)%\fml drive recovery\is-0nolr.tmp to %ProgramFiles(x86)%\fml drive recovery\frecover.exe.manifest
from %ProgramFiles(x86)%\fml drive recovery\is-pr0tj.tmp to %ProgramFiles(x86)%\fml drive recovery\license.txt
from %ProgramFiles(x86)%\fml drive recovery\is-lv866.tmp to %ProgramFiles(x86)%\fml drive recovery\readme.txt
from %ProgramFiles(x86)%\fml drive recovery\is-g5v2o.tmp to %ProgramFiles(x86)%\fml drive recovery\du.lan
from %ProgramFiles(x86)%\fml drive recovery\is-pip0s.tmp to %ProgramFiles(x86)%\fml drive recovery\frecover.exe

Network activity

Connects to

'tu####lotneli.cf':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?56#######

HTTP POST requests

http://tu####lotneli.cf/new/net_api

UDP

DNS ASK tu####lotneli.cf

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'FmlbitsWindowClassFml15'

Creates and executes the following

'%TEMP%\is-97nc8.tmp\is-unqvg.tmp' /SL4 $B021A "<Full path to file>" 5104697 50176
'%ProgramFiles(x86)%\fml drive recovery\frecover.exe'
'%ProgramFiles(x86)%\fml drive recovery\frecover.exe' 13868b115254904f98ce63ae2cab7d6e

Executes the following