Trojan.DownLoader36.27207

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-etd6n.tmp\<Имя файла>.tmp
%ProgramFiles(x86)%\sxnativemessage\cmb.url
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sxnativemessage\swnativemessage.lnk
%ProgramFiles(x86)%\sxnativemessage\is-e2re1.tmp
%ProgramFiles(x86)%\sxnativemessage\is-hji6p.tmp
%ProgramFiles(x86)%\sxnativemessage\is-kb2gi.tmp
%ProgramFiles(x86)%\sxnativemessage\is-qhoec.tmp
%ProgramFiles(x86)%\sxnativemessage\is-ho6kp.tmp
%ProgramFiles(x86)%\sxnativemessage\is-fcron.tmp
%ProgramFiles(x86)%\sxnativemessage\is-njdib.tmp
%ProgramFiles(x86)%\sxnativemessage\is-2m6nb.tmp
%ProgramFiles(x86)%\sxnativemessage\is-rrjj6.tmp
%ProgramFiles(x86)%\sxnativemessage\is-tf6p0.tmp
%ProgramFiles(x86)%\sxnativemessage\purchase.url
%ProgramFiles(x86)%\sxnativemessage\is-1eqdd.tmp
%ProgramFiles(x86)%\sxnativemessage\is-308df.tmp
%WINDIR%\syswow64\is-lrcer.tmp
%ProgramFiles(x86)%\sxnativemessage\is-5vcfv.tmp
%ProgramFiles(x86)%\sxnativemessage\is-q9h4r.tmp
%ProgramFiles(x86)%\sxnativemessage\is-mdqbs.tmp
%ProgramFiles(x86)%\sxnativemessage\is-0v2lh.tmp
%ProgramFiles(x86)%\sxnativemessage\is-c2jca.tmp
%ProgramFiles(x86)%\sxnativemessage\is-jq7fu.tmp
%ProgramFiles(x86)%\sxnativemessage\is-42fqm.tmp
%TEMP%\is-4rlsa.tmp\_isetup\_iscrypt.dll
%TEMP%\is-4rlsa.tmp\_isetup\_shfoldr.dll
%TEMP%\is-4rlsa.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\sxnativemessage\is-u18ro.tmp
%ProgramFiles(x86)%\sxnativemessage\unins000.dat

Перемещает следующие файлы

%ProgramFiles(x86)%\sxnativemessage\is-42fqm.tmp в %ProgramFiles(x86)%\sxnativemessage\unins000.exe
%ProgramFiles(x86)%\sxnativemessage\is-kb2gi.tmp в %ProgramFiles(x86)%\sxnativemessage\mp4tag.dll
%ProgramFiles(x86)%\sxnativemessage\is-qhoec.tmp в %ProgramFiles(x86)%\sxnativemessage\bass_ac3.dll
%ProgramFiles(x86)%\sxnativemessage\is-ho6kp.tmp в %ProgramFiles(x86)%\sxnativemessage\bass_tta.dll
%ProgramFiles(x86)%\sxnativemessage\is-fcron.tmp в %ProgramFiles(x86)%\sxnativemessage\bass_spx.dll
%ProgramFiles(x86)%\sxnativemessage\is-njdib.tmp в %ProgramFiles(x86)%\sxnativemessage\bass_wv.dll
%ProgramFiles(x86)%\sxnativemessage\is-2m6nb.tmp в %ProgramFiles(x86)%\sxnativemessage\bass_ofr.dll
%ProgramFiles(x86)%\sxnativemessage\is-rrjj6.tmp в %ProgramFiles(x86)%\sxnativemessage\bass_mpc.dll
%ProgramFiles(x86)%\sxnativemessage\is-tf6p0.tmp в %ProgramFiles(x86)%\sxnativemessage\bass_ape.dll
%ProgramFiles(x86)%\sxnativemessage\is-hji6p.tmp в %ProgramFiles(x86)%\sxnativemessage\bass_alac.dll
%ProgramFiles(x86)%\sxnativemessage\is-1eqdd.tmp в %ProgramFiles(x86)%\sxnativemessage\bass_aac.dll
%ProgramFiles(x86)%\sxnativemessage\is-308df.tmp в %ProgramFiles(x86)%\sxnativemessage\optimfrog.dll
%WINDIR%\syswow64\is-lrcer.tmp в %WINDIR%\syswow64\nmsdvdxu.dll
%ProgramFiles(x86)%\sxnativemessage\is-5vcfv.tmp в %ProgramFiles(x86)%\sxnativemessage\bass.dll
%ProgramFiles(x86)%\sxnativemessage\is-q9h4r.tmp в %ProgramFiles(x86)%\sxnativemessage\basscd.dll
%ProgramFiles(x86)%\sxnativemessage\is-mdqbs.tmp в %ProgramFiles(x86)%\sxnativemessage\basswma.dll
%ProgramFiles(x86)%\sxnativemessage\is-0v2lh.tmp в %ProgramFiles(x86)%\sxnativemessage\cmb.chm
%ProgramFiles(x86)%\sxnativemessage\is-c2jca.tmp в %ProgramFiles(x86)%\sxnativemessage\cmb.exe.manifest
%ProgramFiles(x86)%\sxnativemessage\is-jq7fu.tmp в %ProgramFiles(x86)%\sxnativemessage\cmb.exe
%ProgramFiles(x86)%\sxnativemessage\is-u18ro.tmp в %ProgramFiles(x86)%\sxnativemessage\bassflac.dll
%ProgramFiles(x86)%\sxnativemessage\is-e2re1.tmp в %ProgramFiles(x86)%\sxnativemessage\sqlite3.dll