Trojan.DownLoader45.9803

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-vk82q.tmp\is-dk7ju.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\unins000.dat
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-qskj8.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-55big.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-hkmh7.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-2r7od.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-nj4tt.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-fv1ge.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-0cqq6.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-ndvkd.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-0f5b9.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-qju5a.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-t614i.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-2c7df.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-7gc1n.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-crnid.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-g9ems.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-ma7bc.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-57lcu.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-mc92g.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-5knns.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-oefmj.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-inqu6.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-9tg2i.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-t2hbm.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-48pli.tmp
%TEMP%\is-1dh3c.tmp\_isetup\_iscrypt.dll
%TEMP%\is-1dh3c.tmp\_isetup\_shfoldr.dll
%TEMP%\is-1dh3c.tmp\_isetup\_setup64.tmp
%TEMP%\is-1dh3c.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-tsvgj.tmp
%TEMP%\iofdiow.txt

Перемещает следующие файлы

%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-48pli.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\unins000.exe
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-hkmh7.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\turbosearch.exe
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-2r7od.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\sqlite3.dll
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-nj4tt.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\toolbar_gray.bmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-fv1ge.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\search.ico
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-0cqq6.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\diskcleaner.ico
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-ndvkd.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\win-uninstall.ico
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-0f5b9.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\ukr.lzn
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-qju5a.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\fra.lzn
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-t614i.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\enu.lzn
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-2c7df.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\rus.lzn
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-55big.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-7gc1n.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\vcl140.bpl
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-tsvgj.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\rtl140.bpl
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-g9ems.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\report.dll
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-ma7bc.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\logger.dll
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-57lcu.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\localizer.dll
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-mc92g.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\helper.dll
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-5knns.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanercore.dll
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-oefmj.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\cc32100mt.dll
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-inqu6.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\bvcomponents.bpl
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-9tg2i.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\borlndmm.dll
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-t2hbm.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\borlndmm.dat
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-crnid.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\settings.dll
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-qskj8.tmp в %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\extensionmanager.exe

Сетевая активность

Подключается к

'fi###specate.cf':80

TCP

Запросы HTTP GET

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?74######

Запросы HTTP POST

http://fi###specate.cf/new/net_api

UDP

DNS ASK fi###specate.cf

Другое

Ищет следующие окна

ClassName: '{E3E3B5FD-54AF-48AE-8D9B-99C51763B646}' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-vk82q.tmp\is-dk7ju.tmp' /SL4 $12022A "<Полный путь к файлу>" 7164589 236544
'%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanerfree.exe'
'%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanerfree.exe' 52c81c97777548095dc451bc8b368a51

Запускает на исполнение