Trojan.DownLoader36.27839

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-vnhb4.tmp\<Имя файла>.tmp
%ProgramFiles(x86)%\tenativemessage\cmb.url
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\tenativemessage\tenativemessage.lnk
%ProgramFiles(x86)%\tenativemessage\is-d5805.tmp
%ProgramFiles(x86)%\tenativemessage\is-euj5p.tmp
%ProgramFiles(x86)%\tenativemessage\is-1ope5.tmp
%ProgramFiles(x86)%\tenativemessage\is-t9ah9.tmp
%ProgramFiles(x86)%\tenativemessage\is-jhr1i.tmp
%ProgramFiles(x86)%\tenativemessage\is-iq9jf.tmp
%ProgramFiles(x86)%\tenativemessage\is-krd5g.tmp
%ProgramFiles(x86)%\tenativemessage\is-1d9rc.tmp
%ProgramFiles(x86)%\tenativemessage\is-pcv3c.tmp
%ProgramFiles(x86)%\tenativemessage\is-n0ch8.tmp
%ProgramFiles(x86)%\tenativemessage\is-bucss.tmp
%ProgramFiles(x86)%\tenativemessage\is-udq8k.tmp
%ProgramFiles(x86)%\tenativemessage\is-ub5lr.tmp
%WINDIR%\syswow64\is-ovh2b.tmp
%ProgramFiles(x86)%\tenativemessage\is-lneef.tmp
%ProgramFiles(x86)%\tenativemessage\is-t64ub.tmp
%ProgramFiles(x86)%\tenativemessage\is-nild6.tmp
%ProgramFiles(x86)%\tenativemessage\is-7imu0.tmp
%ProgramFiles(x86)%\tenativemessage\is-349ok.tmp
%ProgramFiles(x86)%\tenativemessage\is-5f6lp.tmp
%ProgramFiles(x86)%\tenativemessage\is-e8c1l.tmp
%TEMP%\is-gn2fg.tmp\_isetup\_iscrypt.dll
%TEMP%\is-gn2fg.tmp\_isetup\_shfoldr.dll
%TEMP%\is-gn2fg.tmp\_isetup\_setup64.tmp
%TEMP%\is-gn2fg.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\tenativemessage\purchase.url
%ProgramFiles(x86)%\tenativemessage\unins000.dat

Перемещает следующие файлы

%ProgramFiles(x86)%\tenativemessage\is-e8c1l.tmp в %ProgramFiles(x86)%\tenativemessage\unins000.exe
%ProgramFiles(x86)%\tenativemessage\is-1ope5.tmp в %ProgramFiles(x86)%\tenativemessage\mp4tag.dll
%ProgramFiles(x86)%\tenativemessage\is-t9ah9.tmp в %ProgramFiles(x86)%\tenativemessage\bass_ac3.dll
%ProgramFiles(x86)%\tenativemessage\is-jhr1i.tmp в %ProgramFiles(x86)%\tenativemessage\bass_tta.dll
%ProgramFiles(x86)%\tenativemessage\is-iq9jf.tmp в %ProgramFiles(x86)%\tenativemessage\bass_spx.dll
%ProgramFiles(x86)%\tenativemessage\is-krd5g.tmp в %ProgramFiles(x86)%\tenativemessage\bass_wv.dll
%ProgramFiles(x86)%\tenativemessage\is-1d9rc.tmp в %ProgramFiles(x86)%\tenativemessage\bass_ofr.dll
%ProgramFiles(x86)%\tenativemessage\is-pcv3c.tmp в %ProgramFiles(x86)%\tenativemessage\bass_mpc.dll
%ProgramFiles(x86)%\tenativemessage\is-n0ch8.tmp в %ProgramFiles(x86)%\tenativemessage\bass_ape.dll
%ProgramFiles(x86)%\tenativemessage\is-euj5p.tmp в %ProgramFiles(x86)%\tenativemessage\bass_alac.dll
%ProgramFiles(x86)%\tenativemessage\is-bucss.tmp в %ProgramFiles(x86)%\tenativemessage\bass_aac.dll
%ProgramFiles(x86)%\tenativemessage\is-ub5lr.tmp в %ProgramFiles(x86)%\tenativemessage\optimfrog.dll
%WINDIR%\syswow64\is-ovh2b.tmp в %WINDIR%\syswow64\nmsdvdxu.dll
%ProgramFiles(x86)%\tenativemessage\is-lneef.tmp в %ProgramFiles(x86)%\tenativemessage\bass.dll
%ProgramFiles(x86)%\tenativemessage\is-t64ub.tmp в %ProgramFiles(x86)%\tenativemessage\basscd.dll
%ProgramFiles(x86)%\tenativemessage\is-nild6.tmp в %ProgramFiles(x86)%\tenativemessage\basswma.dll
%ProgramFiles(x86)%\tenativemessage\is-7imu0.tmp в %ProgramFiles(x86)%\tenativemessage\cmb.chm
%ProgramFiles(x86)%\tenativemessage\is-349ok.tmp в %ProgramFiles(x86)%\tenativemessage\cmb.exe.manifest
%ProgramFiles(x86)%\tenativemessage\is-5f6lp.tmp в %ProgramFiles(x86)%\tenativemessage\cmb.exe
%ProgramFiles(x86)%\tenativemessage\is-udq8k.tmp в %ProgramFiles(x86)%\tenativemessage\bassflac.dll
%ProgramFiles(x86)%\tenativemessage\is-d5805.tmp в %ProgramFiles(x86)%\tenativemessage\sqlite3.dll