Trojan.DownLoader45.10823

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-744je.tmp\is-sev3k.tmp
%ProgramFiles(x86)%\sql server repair toolbox\unins000.dat
%ProgramFiles(x86)%\sql server repair toolbox\is-insuq.tmp
%ProgramFiles(x86)%\sql server repair toolbox\is-451kv.tmp
%ProgramFiles(x86)%\sql server repair toolbox\is-178a2.tmp
%ProgramFiles(x86)%\sql server repair toolbox\is-efr3h.tmp
%ProgramFiles(x86)%\sql server repair toolbox\is-ngnpl.tmp
%ProgramFiles(x86)%\sql server repair toolbox\is-4b4oh.tmp
%ProgramFiles(x86)%\sql server repair toolbox\is-fnk05.tmp
%ProgramFiles(x86)%\sql server repair toolbox\is-kt7au.tmp
%ProgramFiles(x86)%\sql server repair toolbox\is-m9plb.tmp
%ProgramFiles(x86)%\sql server repair toolbox\is-9s15s.tmp
%ProgramFiles(x86)%\sql server repair toolbox\is-q5888.tmp
%ProgramFiles(x86)%\sql server repair toolbox\sqlserverrepairtoolboxlauncher.exe
%ProgramFiles(x86)%\sql server repair toolbox\is-pvfio.tmp
%ProgramFiles(x86)%\sql server repair toolbox\is-1hcj8.tmp
%ProgramFiles(x86)%\sql server repair toolbox\is-bmkjg.tmp
%ProgramFiles(x86)%\sql server repair toolbox\is-8clb7.tmp
%ProgramFiles(x86)%\sql server repair toolbox\is-7ql07.tmp
%ProgramFiles(x86)%\sql server repair toolbox\is-eucqr.tmp
%ProgramFiles(x86)%\sql server repair toolbox\is-e6i77.tmp
%ProgramFiles(x86)%\sql server repair toolbox\is-v4f8i.tmp
%ProgramFiles(x86)%\sql server repair toolbox\is-nr39s.tmp
%TEMP%\is-4m9r0.tmp\_isetup\_iscrypt.dll
%TEMP%\is-4m9r0.tmp\_isetup\_shfoldr.dll
%TEMP%\is-4m9r0.tmp\_isetup\_setup64.tmp
%TEMP%\is-4m9r0.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\sql server repair toolbox\is-v1n14.tmp
%TEMP%\authrootstl.cab

Перемещает следующие файлы

%ProgramFiles(x86)%\sql server repair toolbox\is-nr39s.tmp в %ProgramFiles(x86)%\sql server repair toolbox\unins000.exe
%ProgramFiles(x86)%\sql server repair toolbox\is-178a2.tmp в %ProgramFiles(x86)%\sql server repair toolbox\wmfdist.exe
%ProgramFiles(x86)%\sql server repair toolbox\is-efr3h.tmp в %ProgramFiles(x86)%\sql server repair toolbox\settings.bin
%ProgramFiles(x86)%\sql server repair toolbox\is-ngnpl.tmp в %ProgramFiles(x86)%\sql server repair toolbox\ssleay32.dll
%ProgramFiles(x86)%\sql server repair toolbox\is-4b4oh.tmp в %ProgramFiles(x86)%\sql server repair toolbox\libeay32.dll
%ProgramFiles(x86)%\sql server repair toolbox\is-fnk05.tmp в %ProgramFiles(x86)%\sql server repair toolbox\sql server repair toolbox license.txt
%ProgramFiles(x86)%\sql server repair toolbox\is-kt7au.tmp в %ProgramFiles(x86)%\sql server repair toolbox\sqlserverrepairtoolbox.trk
%ProgramFiles(x86)%\sql server repair toolbox\is-m9plb.tmp в %ProgramFiles(x86)%\sql server repair toolbox\sqlserverrepairtoolbox.rus
%ProgramFiles(x86)%\sql server repair toolbox\is-9s15s.tmp в %ProgramFiles(x86)%\sql server repair toolbox\sqlserverrepairtoolbox.ptb
%ProgramFiles(x86)%\sql server repair toolbox\is-451kv.tmp в %ProgramFiles(x86)%\sql server repair toolbox\sqlite3.dll
%ProgramFiles(x86)%\sql server repair toolbox\is-q5888.tmp в %ProgramFiles(x86)%\sql server repair toolbox\sqlserverrepairtoolbox.plk
%ProgramFiles(x86)%\sql server repair toolbox\is-v1n14.tmp в %ProgramFiles(x86)%\sql server repair toolbox\sqlserverrepairtoolbox.kor
%ProgramFiles(x86)%\sql server repair toolbox\is-1hcj8.tmp в %ProgramFiles(x86)%\sql server repair toolbox\sqlserverrepairtoolbox.jpn
%ProgramFiles(x86)%\sql server repair toolbox\is-bmkjg.tmp в %ProgramFiles(x86)%\sql server repair toolbox\sqlserverrepairtoolbox.ita
%ProgramFiles(x86)%\sql server repair toolbox\is-8clb7.tmp в %ProgramFiles(x86)%\sql server repair toolbox\sqlserverrepairtoolbox.fra
%ProgramFiles(x86)%\sql server repair toolbox\is-7ql07.tmp в %ProgramFiles(x86)%\sql server repair toolbox\sqlserverrepairtoolbox.esn
%ProgramFiles(x86)%\sql server repair toolbox\is-eucqr.tmp в %ProgramFiles(x86)%\sql server repair toolbox\sqlserverrepairtoolbox.deu
%ProgramFiles(x86)%\sql server repair toolbox\is-e6i77.tmp в %ProgramFiles(x86)%\sql server repair toolbox\sqlserverrepairtoolbox.chs
%ProgramFiles(x86)%\sql server repair toolbox\is-v4f8i.tmp в %ProgramFiles(x86)%\sql server repair toolbox\sqlserverrepairtoolbox.ara
%ProgramFiles(x86)%\sql server repair toolbox\is-pvfio.tmp в %ProgramFiles(x86)%\sql server repair toolbox\sqlserverrepairtoolbox.nld
%ProgramFiles(x86)%\sql server repair toolbox\is-insuq.tmp в %ProgramFiles(x86)%\sql server repair toolbox\sqlserverrepairtoolboxlauncher.exe

Сетевая активность

Подключается к

'pe###igold.xyz':80

TCP

Запросы HTTP GET

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?eb##############

Запросы HTTP POST

http://pe###igold.xyz/new/net_api

UDP

DNS ASK pe###igold.xyz

Другое

Ищет следующие окна

ClassName: 'SQLServerRTBWindowQA1' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-744je.tmp\is-sev3k.tmp' /SL4 $E0162 "<Полный путь к файлу>" 9423980 151552
'%ProgramFiles(x86)%\sql server repair toolbox\sqlserverrepairtoolboxlauncher.exe'
'%ProgramFiles(x86)%\sql server repair toolbox\wmfdist.exe' /Q:A /R:N
'%ProgramFiles(x86)%\sql server repair toolbox\sqlserverrepairtoolboxlauncher.exe' 57d53425b169e745cecb03971eeeb1bf