Trojan.DownLoader36.28618

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-nu0hm.tmp\<Имя файла>.tmp
%ProgramFiles(x86)%\tenativemessage\cmb.url
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\tenativemessage\tenativemessage.lnk
%ProgramFiles(x86)%\tenativemessage\is-nung6.tmp
%ProgramFiles(x86)%\tenativemessage\is-a3k55.tmp
%ProgramFiles(x86)%\tenativemessage\is-oqgid.tmp
%ProgramFiles(x86)%\tenativemessage\is-tst13.tmp
%ProgramFiles(x86)%\tenativemessage\is-6q33s.tmp
%ProgramFiles(x86)%\tenativemessage\is-7kev9.tmp
%ProgramFiles(x86)%\tenativemessage\is-qs6bd.tmp
%ProgramFiles(x86)%\tenativemessage\is-ifqdt.tmp
%ProgramFiles(x86)%\tenativemessage\is-6jmv1.tmp
%ProgramFiles(x86)%\tenativemessage\is-ic2ha.tmp
%ProgramFiles(x86)%\tenativemessage\purchase.url
%ProgramFiles(x86)%\tenativemessage\is-7cq61.tmp
%ProgramFiles(x86)%\tenativemessage\is-dnrat.tmp
%WINDIR%\syswow64\is-8g23g.tmp
%ProgramFiles(x86)%\tenativemessage\is-8j7tf.tmp
%ProgramFiles(x86)%\tenativemessage\is-09u4a.tmp
%ProgramFiles(x86)%\tenativemessage\is-fqe4n.tmp
%ProgramFiles(x86)%\tenativemessage\is-mji22.tmp
%ProgramFiles(x86)%\tenativemessage\is-sl20v.tmp
%ProgramFiles(x86)%\tenativemessage\is-61tmd.tmp
%ProgramFiles(x86)%\tenativemessage\is-4ucto.tmp
%TEMP%\is-5i9t8.tmp\_isetup\_iscrypt.dll
%TEMP%\is-5i9t8.tmp\_isetup\_shfoldr.dll
%TEMP%\is-5i9t8.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\tenativemessage\is-o6gu7.tmp
%ProgramFiles(x86)%\tenativemessage\unins000.dat

Перемещает следующие файлы

%ProgramFiles(x86)%\tenativemessage\is-4ucto.tmp в %ProgramFiles(x86)%\tenativemessage\unins000.exe
%ProgramFiles(x86)%\tenativemessage\is-oqgid.tmp в %ProgramFiles(x86)%\tenativemessage\mp4tag.dll
%ProgramFiles(x86)%\tenativemessage\is-tst13.tmp в %ProgramFiles(x86)%\tenativemessage\bass_ac3.dll
%ProgramFiles(x86)%\tenativemessage\is-6q33s.tmp в %ProgramFiles(x86)%\tenativemessage\bass_tta.dll
%ProgramFiles(x86)%\tenativemessage\is-7kev9.tmp в %ProgramFiles(x86)%\tenativemessage\bass_spx.dll
%ProgramFiles(x86)%\tenativemessage\is-qs6bd.tmp в %ProgramFiles(x86)%\tenativemessage\bass_wv.dll
%ProgramFiles(x86)%\tenativemessage\is-ifqdt.tmp в %ProgramFiles(x86)%\tenativemessage\bass_ofr.dll
%ProgramFiles(x86)%\tenativemessage\is-6jmv1.tmp в %ProgramFiles(x86)%\tenativemessage\bass_mpc.dll
%ProgramFiles(x86)%\tenativemessage\is-ic2ha.tmp в %ProgramFiles(x86)%\tenativemessage\bass_ape.dll
%ProgramFiles(x86)%\tenativemessage\is-a3k55.tmp в %ProgramFiles(x86)%\tenativemessage\bass_alac.dll
%ProgramFiles(x86)%\tenativemessage\is-7cq61.tmp в %ProgramFiles(x86)%\tenativemessage\bass_aac.dll
%ProgramFiles(x86)%\tenativemessage\is-dnrat.tmp в %ProgramFiles(x86)%\tenativemessage\optimfrog.dll
%WINDIR%\syswow64\is-8g23g.tmp в %WINDIR%\syswow64\nmsdvdxu.dll
%ProgramFiles(x86)%\tenativemessage\is-8j7tf.tmp в %ProgramFiles(x86)%\tenativemessage\bass.dll
%ProgramFiles(x86)%\tenativemessage\is-09u4a.tmp в %ProgramFiles(x86)%\tenativemessage\basscd.dll
%ProgramFiles(x86)%\tenativemessage\is-fqe4n.tmp в %ProgramFiles(x86)%\tenativemessage\basswma.dll
%ProgramFiles(x86)%\tenativemessage\is-mji22.tmp в %ProgramFiles(x86)%\tenativemessage\cmb.chm
%ProgramFiles(x86)%\tenativemessage\is-sl20v.tmp в %ProgramFiles(x86)%\tenativemessage\cmb.exe.manifest
%ProgramFiles(x86)%\tenativemessage\is-61tmd.tmp в %ProgramFiles(x86)%\tenativemessage\cmb.exe
%ProgramFiles(x86)%\tenativemessage\is-o6gu7.tmp в %ProgramFiles(x86)%\tenativemessage\bassflac.dll
%ProgramFiles(x86)%\tenativemessage\is-nung6.tmp в %ProgramFiles(x86)%\tenativemessage\sqlite3.dll