Trojan.DownLoader45.19248

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-22n60.tmp\is-d3cfc.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\unins000.dat
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-5f1f6.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-sitbr.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-30j71.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-4r8ja.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-k0mbk.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\data\is-2kqm4.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\data\is-741ug.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\data\is-qlie7.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\is-o73ud.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\is-rto1m.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\is-0mtpd.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\is-kasd0.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-47neo.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-q3sso.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-jrvnt.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-jeqnu.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-qaspj.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-cqbij.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-926r7.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-eme97.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-8o9ef.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-b6kvb.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-gqf76.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-q235q.tmp
%TEMP%\is-vp4li.tmp\_isetup\_iscrypt.dll
%TEMP%\is-vp4li.tmp\_isetup\_shfoldr.dll
%TEMP%\is-vp4li.tmp\_isetup\_setup64.tmp
%TEMP%\is-vp4li.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-vdd10.tmp
%TEMP%\iofdiow.txt

Перемещает следующие файлы

%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-q235q.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\unins000.exe
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-30j71.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\turbosearch.exe
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-4r8ja.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\sqlite3.dll
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-k0mbk.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\toolbar_gray.bmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\data\is-2kqm4.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\data\search.ico
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\data\is-741ug.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\data\diskcleaner.ico
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\data\is-qlie7.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\data\win-uninstall.ico
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\is-o73ud.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\ukr.lzn
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\is-rto1m.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\fra.lzn
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\is-0mtpd.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\enu.lzn
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\is-kasd0.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\rus.lzn
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-sitbr.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-47neo.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\vcl140.bpl
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-vdd10.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\rtl140.bpl
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-jrvnt.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\report.dll
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-jeqnu.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\logger.dll
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-qaspj.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\localizer.dll
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-cqbij.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\helper.dll
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-926r7.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\diskcleanercore.dll
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-eme97.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\cc32100mt.dll
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-8o9ef.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\bvcomponents.bpl
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-b6kvb.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\borlndmm.dll
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-gqf76.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\borlndmm.dat
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-q3sso.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\settings.dll
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-5f1f6.tmp в %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\extensionmanager.exe

Сетевая активность

Подключается к

'fi###specate.cf':80

TCP

Запросы HTTP GET

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?74######

Запросы HTTP POST

http://fi###specate.cf/new/net_api

UDP

DNS ASK fi###specate.cf

Другое

Ищет следующие окна

ClassName: '{E3BE35FD-54AF-48AE-8D9B-C5172469639B}' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-22n60.tmp\is-d3cfc.tmp' /SL4 $11022C "<Полный путь к файлу>" 6725338 236544
'%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\diskcleanerfree.exe'
'%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\diskcleanerfree.exe' 1e51109e8bcd522681145b5ed680476d

Запускает на исполнение