Trojan.DownLoader45.1199

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-mnc9c.tmp\is-s1kmi.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\unins000.dat
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-lu392.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-a85np.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-ek2ap.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-pb5lk.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-10kt1.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-tgnvi.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-smfah.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-aqmu5.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-kf485.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-lpkf6.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-ou9f2.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-m6knm.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-fkt6l.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-hgf5t.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-1bq3c.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-1fmop.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-is4mt.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-u8a3d.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-9n3mh.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-6vl2q.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-0pk9h.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-0spbn.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-r2pqd.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-90bd0.tmp
%TEMP%\is-kdpov.tmp\_isetup\_iscrypt.dll
%TEMP%\is-kdpov.tmp\_isetup\_shfoldr.dll
%TEMP%\is-kdpov.tmp\_isetup\_setup64.tmp
%TEMP%\is-kdpov.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-h4vuj.tmp
%TEMP%\lohkos.cab

Перемещает следующие файлы

%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-90bd0.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\unins000.exe
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-ek2ap.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\turbosearch.exe
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-pb5lk.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\sqlite3.dll
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-10kt1.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\toolbar_gray.bmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-tgnvi.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\search.ico
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-smfah.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\diskcleaner.ico
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-aqmu5.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\win-uninstall.ico
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-kf485.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\ukr.lzn
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-lpkf6.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\fra.lzn
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-ou9f2.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\enu.lzn
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-m6knm.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\rus.lzn
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-a85np.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-fkt6l.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\vcl140.bpl
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-h4vuj.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\rtl140.bpl
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-1bq3c.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\report.dll
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-1fmop.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\logger.dll
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-is4mt.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\localizer.dll
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-u8a3d.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\helper.dll
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-9n3mh.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanercore.dll
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-6vl2q.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\cc32100mt.dll
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-0pk9h.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\bvcomponents.bpl
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-0spbn.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\borlndmm.dll
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-r2pqd.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\borlndmm.dat
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-hgf5t.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\settings.dll
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-lu392.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\extensionmanager.exe

Сетевая активность

Подключается к

'so###como.gq':80

TCP

Запросы HTTP GET

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?08######

Запросы HTTP POST

http://so###como.gq/new/net_api

UDP

DNS ASK so###como.gq

Другое

Ищет следующие окна

ClassName: '{E3E3B5FD-54AF-48AE-8D9B-99C51763B646}' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-mnc9c.tmp\is-s1kmi.tmp' /SL4 $B0230 "<Полный путь к файлу>" 7141744 236544
'%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanerfree.exe'
'%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanerfree.exe' e5e505dc4c87c6a7d7d16ba8b54b5342

Запускает на исполнение