Trojan.DownLoader45.11077

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-cccui.tmp\is-ee1nq.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\unins000.dat
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-gerd6.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-qur22.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-40c4f.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-o574j.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-0g09m.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\data\is-gp7lu.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\data\is-gqedr.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\data\is-40hpf.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\is-csvb8.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\is-jafqs.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\is-oshne.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\is-klro0.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-hjc55.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-o1lr1.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-8cc4d.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-ducul.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-om64o.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-vb5k7.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-bk96v.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-40kiv.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-939a7.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-vtadt.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-3gqbt.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-f2shb.tmp
%TEMP%\is-o4m1m.tmp\_isetup\_iscrypt.dll
%TEMP%\is-o4m1m.tmp\_isetup\_shfoldr.dll
%TEMP%\is-o4m1m.tmp\_isetup\_setup64.tmp
%TEMP%\is-o4m1m.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-2n1mf.tmp
%TEMP%\iofdiow.txt

Перемещает следующие файлы

%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-f2shb.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\unins000.exe
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-40c4f.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\turbosearch.exe
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-o574j.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\sqlite3.dll
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-0g09m.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\toolbar_gray.bmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\data\is-gp7lu.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\data\search.ico
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\data\is-gqedr.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\data\diskcleaner.ico
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\data\is-40hpf.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\data\win-uninstall.ico
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\is-csvb8.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\ukr.lzn
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\is-jafqs.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\fra.lzn
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\is-oshne.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\enu.lzn
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\is-klro0.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\rus.lzn
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-qur22.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-hjc55.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\vcl140.bpl
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-2n1mf.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\rtl140.bpl
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-8cc4d.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\report.dll
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-ducul.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\logger.dll
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-om64o.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\localizer.dll
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-vb5k7.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\helper.dll
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-bk96v.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\diskcleanercore.dll
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-40kiv.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\cc32100mt.dll
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-939a7.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\bvcomponents.bpl
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-vtadt.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\borlndmm.dll
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-3gqbt.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\borlndmm.dat
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-o1lr1.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\settings.dll
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-gerd6.tmp в %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\extensionmanager.exe

Сетевая активность

Подключается к

'fi###specate.cf':80

TCP

Запросы HTTP GET

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?74######

Запросы HTTP POST

http://fi###specate.cf/new/net_api

UDP

DNS ASK fi###specate.cf

Другое

Ищет следующие окна

ClassName: '{3E3BE5FD-54AF-48AE-8D9B-9C517646639B}' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-cccui.tmp\is-ee1nq.tmp' /SL4 $B0234 "<Полный путь к файлу>" 6865508 236544
'%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\diskcleanerfree.exe'
'%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\diskcleanerfree.exe' 676a07a5fba95c3ea44daf72c352ef5f

Запускает на исполнение