Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /im powerdatarecovery.exe
Terminates or attempts to terminate
the following user processes:
- safari.exe
- opera.exe
- firefox.exe
- iexplore.exe
- chrome.exe
Modifies file system:
Creates the following files:
- %ProgramFiles%\MiniToolPowerDataRecovery\is-9VF70.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-AFJU4.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\is-2KPTK.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\is-F6QOE.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\is-MG322.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-JBNDT.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-STO4B.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-ADR6V.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-9HTJP.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-4MQII.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\MiniTool Power Data Recovery\Uninstall MiniTool Power Data Recovery 7.5.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\MiniTool Power Data Recovery\MiniTool Power Data Recovery 7.5 on the Web.url
- %ALLUSERSPROFILE%\Desktop\MiniTool Power Data Recovery 7.5.lnk
- %ProgramFiles%\MiniToolPowerDataRecovery\unins000.dat
- %ProgramFiles%\MiniToolPowerDataRecovery\unins000.msg
- %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\is-S8866.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\is-48B9M.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\is-IFJJT.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\MiniTool Power Data Recovery\MiniTool Power Data Recovery 7.5.lnk
- %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\is-72RKM.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-5ECMV.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-T033G.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-T35MG.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-VGV8L.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-1JNBG.tmp
- %CommonProgramFiles%\~saoxwca.ibo
- %TEMP%\aut1.tmp
- %TEMP%\is-67498.tmp\~saoxwca.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-L5CNS.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-4Q00P.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-TBE2V.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-H9120.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-89MK3.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-K4CN9.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-VGE6T.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-Q38D0.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-1JSVL.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-FLRIU.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-BNMO2.tmp
- %ProgramFiles%\MiniToolPowerDataRecovery\is-KR60U.tmp
Sets the 'hidden' attribute to the following files:
- %CommonProgramFiles%\~saoxwca.ibo
Deletes the following files:
- %TEMP%\is-67498.tmp\~saoxwca.tmp
- %TEMP%\aut1.tmp
Moves the following files:
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-4MQII.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\QtWebKit4.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-9HTJP.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\RawObjects.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-AFJU4.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\ssleay32.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-ADR6V.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\QtNetwork4.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-K4CN9.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\powerdatarecovery.exe.mfh
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-STO4B.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\QtCore4.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-JBNDT.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\QtGui4.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-9VF70.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\vld_x86.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\is-S8866.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\qsvg4.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\is-IFJJT.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\qtga4.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\is-72RKM.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\qtiff4.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\is-48B9M.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\qmng4.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\is-2KPTK.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\qgif4.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\is-MG322.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\qico4.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\is-F6QOE.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\imageformats\qjpeg4.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-VGE6T.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\PowerDataRecovery.exe.manifest
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-T35MG.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\libcurl.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-1JNBG.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\libeay32.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-VGV8L.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\Microsoft.DTfW.DHL.manifest
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-5ECMV.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\efs.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-4Q00P.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\unins000.exe
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-L5CNS.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\cppunit_dll.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-T033G.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\dbghelp.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-1JSVL.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\Microsoft.VC90.CRT.manifest
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-H9120.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\PASServer.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-TBE2V.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\powerdatarecovery.exe
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-89MK3.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\PowerDataRecovery.exe.ini
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-BNMO2.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\Pas2.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-Q38D0.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\msvcp90.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-FLRIU.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\msvcr90.dll
- from %ProgramFiles%\MiniToolPowerDataRecovery\is-KR60U.tmp to %ProgramFiles%\MiniToolPowerDataRecovery\pas.cnf
Network activity:
Connects to:
- 'tr#####g.minitool.com':80
- 'po#####tarecovery.com':80
- 'localhost':1037
TCP:
HTTP GET requests:
- http://tr#####g.minitool.com/pdr/installation.php?V7#######
- http://www.po#####tarecovery.com/check-version/update-checking.ini via po#####tarecovery.com
- http://www.po#####tarecovery.com/feedback/install-power-data-recovery.html?fr######### via po#####tarecovery.com
UDP:
- DNS ASK tr#####g.minitool.com
- DNS ASK www.po#####tarecovery.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
Creates and executes the following:
- '%ProgramFiles%\MiniToolPowerDataRecovery\powerdatarecovery.exe' /first
- '%TEMP%\is-67498.tmp\~saoxwca.tmp' /SL5="$100E2,23792015,301056,%CommonProgramFiles%\~saoxwca.ibo" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%CommonProgramFiles%\~saoxwca.ibo' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Executes the following:
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -nohome
