Trojan.DownLoader45.7372

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-d9td4.tmp\is-vhq9o.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\unins000.dat
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-ta93r.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-n80cs.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-o3r5b.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-bhu73.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-h7u1m.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\is-lve5r.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\is-smpe4.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\is-gddjr.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-cdsj7.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-9r05v.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-ebmeo.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-iuklc.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-63g5o.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-pra9f.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-36aht.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-sjrqe.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-o7bgj.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-2058f.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-8tejn.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-1u46j.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-asfvk.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-io2s3.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-q7q91.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-4ipjf.tmp
%TEMP%\is-j7iuq.tmp\_isetup\_iscrypt.dll
%TEMP%\is-j7iuq.tmp\_isetup\_shfoldr.dll
%TEMP%\is-j7iuq.tmp\_isetup\_setup64.tmp
%TEMP%\is-j7iuq.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-uke6f.tmp
%TEMP%\iofdiow.txt

Перемещает следующие файлы

%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-4ipjf.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\unins000.exe
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-o3r5b.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\turbosearch.exe
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-bhu73.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\sqlite3.dll
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-h7u1m.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\toolbar_gray.bmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\is-lve5r.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\search.ico
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\is-smpe4.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\diskcleaner.ico
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\is-gddjr.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\win-uninstall.ico
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-cdsj7.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\ukr.lzn
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-9r05v.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\fra.lzn
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-ebmeo.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\enu.lzn
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-iuklc.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\rus.lzn
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-n80cs.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-63g5o.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\vcl140.bpl
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-uke6f.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\rtl140.bpl
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-36aht.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\report.dll
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-sjrqe.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\logger.dll
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-o7bgj.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\localizer.dll
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-2058f.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\helper.dll
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-8tejn.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\diskcleanercore.dll
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-1u46j.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\cc32100mt.dll
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-asfvk.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\bvcomponents.bpl
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-io2s3.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\borlndmm.dll
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-q7q91.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\borlndmm.dat
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-pra9f.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\settings.dll
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-ta93r.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\extensionmanager.exe

Сетевая активность

Подключается к

'fi###specate.cf':80

TCP

Запросы HTTP GET

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?74######

Запросы HTTP POST

http://fi###specate.cf/new/net_api

UDP

DNS ASK fi###specate.cf

Другое

Ищет следующие окна

ClassName: '{E3E3B5FD-54AF-48AE-8D9B-99C51763B646}' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-d9td4.tmp\is-vhq9o.tmp' /SL4 $B0236 "<Полный путь к файлу>" 7111500 236544
'%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\diskcleanerfree.exe'
'%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\diskcleanerfree.exe' 19e202ab075f7a1f356f7942512135c3

Запускает на исполнение