Trojan.DownLoader45.10658

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-86cc5.tmp\is-iuqgh.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\unins000.dat
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-q01v0.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-3m27i.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-vb8la.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-ddenu.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-hctct.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\is-8l6hb.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\is-33nbs.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\is-f0e1r.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-7eeem.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-it88m.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-u5v1u.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-f348e.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-8u6cj.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-ec98s.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-m0591.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-jq7it.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-8a215.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-ev5pl.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-jk4kp.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-sg7hs.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-b3rko.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-3q8bo.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-81vh0.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-s1gtn.tmp
%TEMP%\is-2d9qt.tmp\_isetup\_iscrypt.dll
%TEMP%\is-2d9qt.tmp\_isetup\_shfoldr.dll
%TEMP%\is-2d9qt.tmp\_isetup\_setup64.tmp
%TEMP%\is-2d9qt.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-vcb9p.tmp
%TEMP%\iofdiow.txt

Перемещает следующие файлы

%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-s1gtn.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\unins000.exe
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-vb8la.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\turbosearch.exe
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-ddenu.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\sqlite3.dll
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-hctct.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\toolbar_gray.bmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\is-8l6hb.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\search.ico
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\is-33nbs.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\diskcleaner.ico
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\is-f0e1r.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\win-uninstall.ico
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-7eeem.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\ukr.lzn
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-it88m.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\fra.lzn
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-u5v1u.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\enu.lzn
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-f348e.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\rus.lzn
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-3m27i.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-8u6cj.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\vcl140.bpl
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-vcb9p.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\rtl140.bpl
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-m0591.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\report.dll
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-jq7it.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\logger.dll
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-8a215.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\localizer.dll
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-ev5pl.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\helper.dll
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-jk4kp.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\diskcleanercore.dll
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-sg7hs.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\cc32100mt.dll
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-b3rko.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\bvcomponents.bpl
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-3q8bo.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\borlndmm.dll
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-81vh0.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\borlndmm.dat
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-ec98s.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\settings.dll
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-q01v0.tmp в %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\extensionmanager.exe

Сетевая активность

Подключается к

'fi###specate.cf':80

TCP

Запросы HTTP GET

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?74######

Запросы HTTP POST

http://fi###specate.cf/new/net_api

UDP

DNS ASK fi###specate.cf

Другое

Ищет следующие окна

ClassName: '{E3E3B5FD-54AF-48AE-8D9B-99C51763B646}' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-86cc5.tmp\is-iuqgh.tmp' /SL4 $C013E "<Полный путь к файлу>" 7127389 236544
'%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\diskcleanerfree.exe'
'%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\diskcleanerfree.exe' a16958ca4188417add97b1bb572b9d28

Запускает на исполнение