Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall set rule group="Network Discovery" new enable=Yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall set rule group="ÐÐÐÑÐâЧзÐÑÐÐÐâ" new enable=Yes
Modifies file system
Creates the following files
- %ProgramFiles%\easeusdatarecovery\dict
- %ProgramFiles%\easeusdatarecovery\remote_config_data
- %ProgramFiles%\easeusdatarecovery\start.cmd
- %ProgramFiles%\easeusdatarecovery\filefilter.xml
- %ProgramFiles%\easeusdatarecovery\resourcedark\imageresource.xml
- %ProgramFiles%\easeusdatarecovery\config\prioritydisplaytype.xml
- %ProgramFiles%\easeusdatarecovery\config\usefullostfiles.xml
- %ProgramFiles%\easeusdatarecovery\style.css
- %ProgramFiles%\easeusdatarecovery\config\config.ini
- %ProgramFiles%\easeusdatarecovery\config\filterfolder.ini
- %ProgramFiles%\easeusdatarecovery\config\nasconfig.ini
- %ProgramFiles%\easeusdatarecovery\config\rawconfig.ini
- %ProgramFiles%\easeusdatarecovery\config\shellexe.ini
- %ProgramFiles%\easeusdatarecovery\config\themdark.ini
- %ProgramFiles%\easeusdatarecovery\config\version.ini
- %ProgramFiles%\easeusdatarecovery\google-services.json
- %ProgramFiles%\easeusdatarecovery\language\english.qm
- %ProgramFiles%\easeusdatarecovery\language\qtbase_en.qm
- %ProgramFiles%\easeusdatarecovery\language\russian.qm
- %ProgramFiles%\easeusdatarecovery\resourcedark\drw_dark.rcc
- %ProgramFiles%\easeusdatarecovery\drw.exe
- %ProgramFiles%\easeusdatarecovery\drwservice.exe
- %ProgramFiles%\easeusdatarecovery\drwui.exe
- %ProgramFiles%\easeusdatarecovery\euhwpviewer.exe
- %ProgramFiles%\easeusdatarecovery\euimgrepair.exe
- %ProgramFiles%\easeusdatarecovery\euinapp.exe
- %ProgramFiles%\easeusdatarecovery\euofficerepairwin32.exe
- %ProgramFiles%\easeusdatarecovery\euofficetools.exe
- %ProgramFiles%\easeusdatarecovery\euofficeviewer.exe
- %ProgramFiles%\easeusdatarecovery\eurawimg.exe
- %ProgramFiles%\easeusdatarecovery\eurepairhost.exe
- %ProgramFiles%\easeusdatarecovery\euunzip.exe
- %ProgramFiles%\easeusdatarecovery\firebasefetch.exe
- %ProgramFiles%\easeusdatarecovery\pdfviewer.exe
- %ProgramFiles%\easeusdatarecovery\archive.dll
- %ProgramFiles%\easeusdatarecovery\btrfssearchdll.dll
- %ProgramFiles%\easeusdatarecovery\d3d11.dll
- %ProgramFiles%\easeusdatarecovery\de265.dll
- %ProgramFiles%\easeusdatarecovery\dxgi.dll
- %ProgramFiles%\easeusdatarecovery\euhwpfilepathcheckermodule.dll
- %ProgramFiles%\easeusdatarecovery\euimageenhance.dll
- %ProgramFiles%\easeusdatarecovery\euvideorepair.dll
- %ProgramFiles%\easeusdatarecovery\exfatsearchdll.dll
- %ProgramFiles%\easeusdatarecovery\ext4searchdll.dll
- %ProgramFiles%\easeusdatarecovery\fatsearchdll.dll
- %ProgramFiles%\easeusdatarecovery\firebaseonlineconfig.dll
- %ProgramFiles%\easeusdatarecovery\heif.dll
- %ProgramFiles%\easeusdatarecovery\hfsplussearchdll.dll
- %ProgramFiles%\easeusdatarecovery\japanese.dll
- %ProgramFiles%\easeusdatarecovery\libcrypto-1_1-x64.dll
- %ProgramFiles%\easeusdatarecovery\libeay32.dll
- %ProgramFiles%\easeusdatarecovery\liblzma.dll
- %ProgramFiles%\easeusdatarecovery\libzmq-mt-4_3_5.dll
- %ProgramFiles%\easeusdatarecovery\msvcp140.dll
- %ProgramFiles%\easeusdatarecovery\msvcr120.dll
- %ProgramFiles%\easeusdatarecovery\ntfssearchdll.dll
- %ProgramFiles%\easeusdatarecovery\pdfium.dll
- %ProgramFiles%\easeusdatarecovery\pe_tools.dll
- %ProgramFiles%\easeusdatarecovery\publog.dll
- %ProgramFiles%\easeusdatarecovery\imageformats\qgif.dll
- %ProgramFiles%\easeusdatarecovery\imageformats\qjpeg.dll
- %ProgramFiles%\easeusdatarecovery\platforms\qminimal.dll
- %ProgramFiles%\easeusdatarecovery\platforms\qoffscreen.dll
- %ProgramFiles%\easeusdatarecovery\iconengines\qsvgicon.dll
- %ProgramFiles%\easeusdatarecovery\qt5core.dll
- %ProgramFiles%\easeusdatarecovery\qt5gui.dll
- %ProgramFiles%\easeusdatarecovery\qt5network.dll
- %ProgramFiles%\easeusdatarecovery\qt5svg.dll
- %ProgramFiles%\easeusdatarecovery\qt5widgets.dll
- %ProgramFiles%\easeusdatarecovery\qt5winextras.dll
- %ProgramFiles%\easeusdatarecovery\platforms\qwindows.dll
- %ProgramFiles%\easeusdatarecovery\rawsearchdll.dll
- %ProgramFiles%\easeusdatarecovery\refssearchdll.dll
- %ProgramFiles%\easeusdatarecovery\vcruntime140.dll
- %ProgramFiles%\easeusdatarecovery\zlib.dll
- %ProgramFiles%\easeusdatarecovery\config\config.ini.lock
- %ProgramFiles%\easeusdatarecovery\config\config.ini.iskweb
- %ProgramFiles%\easeusdatarecovery\config\config.ini.viqiea
- %ProgramFiles%\easeusdatarecovery\drwui.log
- %ProgramFiles%\easeusdatarecovery\eaolog.log
- %TEMP%\{c3ada2f4-8958-41dd-bac8-8a2e050d344f}\remote_config_data
- %ProgramFiles%\easeusdatarecovery\drwlog.log
- %ProgramFiles%\easeusdatarecovery\recoverytrial.ini
- %ProgramFiles%\easeusdatarecovery\defaultlog.txt
- %ProgramFiles%\easeusdatarecovery\config\config.ini.jpabvd
Deletes following files that it created itself
- %ProgramFiles%\easeusdatarecovery\config\config.ini.lock
- %TEMP%\{c3ada2f4-8958-41dd-bac8-8a2e050d344f}\remote_config_data
Moves the following files
- from %ProgramFiles%\easeusdatarecovery\config\config.ini.iskweb to %ProgramFiles%\easeusdatarecovery\config\config.ini
- from %ProgramFiles%\easeusdatarecovery\config\config.ini.viqiea to %ProgramFiles%\easeusdatarecovery\config\config.ini
- from %ProgramFiles%\easeusdatarecovery\config\config.ini.jpabvd to %ProgramFiles%\easeusdatarecovery\config\config.ini
Substitutes the following files
- %ProgramFiles%\easeusdatarecovery\config\config.ini.lock
Network activity
Connects to
- 'mo#####.map.fastly.net':443
- 'localhost':49695
- 'fi########moteconfig.googleapis.com':443
TCP
Other
- 'localhost':49695
- 'localhost':49696
- 'fi########moteconfig.googleapis.com':443
UDP
- DNS ASK mo#####.map.fastly.net
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- DNS ASK fi########moteconfig.googleapis.com
Miscellaneous
Creates and executes the following
- '%ProgramFiles%\easeusdatarecovery\drw.exe'
- '%ProgramFiles%\easeusdatarecovery\drwui.exe'
- '%ProgramFiles%\easeusdatarecovery\firebasefetch.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%ProgramFiles%\EaseUSDataRecovery\start.cmd" "
- '<SYSTEM32>\fsutil.exe' behavior query disabledeletenotify
- '<SYSTEM32>\cmd.exe' /c ""%ProgramFiles%\EaseUSDataRecovery\start.cmd" "' (with hidden window)
- '%ProgramFiles%\easeusdatarecovery\firebasefetch.exe' ' (with hidden window)
- '<SYSTEM32>\fsutil.exe' behavior query disabledeletenotify' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall set rule group="Network Discovery" new enable=Yes' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall set rule group="ÐÐÐÑÐâЧзÐÑÐÐÐâ" new enable=Yes' (with hidden window)
