Trojan.DownLoader45.1199

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-mnc9c.tmp\is-s1kmi.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\unins000.dat
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-lu392.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-a85np.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-ek2ap.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-pb5lk.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-10kt1.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-tgnvi.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-smfah.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-aqmu5.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-kf485.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-lpkf6.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-ou9f2.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-m6knm.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-fkt6l.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-hgf5t.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-1bq3c.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-1fmop.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-is4mt.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-u8a3d.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-9n3mh.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-6vl2q.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-0pk9h.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-0spbn.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-r2pqd.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-90bd0.tmp
%TEMP%\is-kdpov.tmp\_isetup\_iscrypt.dll
%TEMP%\is-kdpov.tmp\_isetup\_shfoldr.dll
%TEMP%\is-kdpov.tmp\_isetup\_setup64.tmp
%TEMP%\is-kdpov.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-h4vuj.tmp
%TEMP%\lohkos.cab

Moves the following files

from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-90bd0.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\unins000.exe
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-ek2ap.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\turbosearch.exe
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-pb5lk.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\sqlite3.dll
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-10kt1.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\toolbar_gray.bmp
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-tgnvi.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\search.ico
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-smfah.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\diskcleaner.ico
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-aqmu5.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\win-uninstall.ico
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-kf485.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\ukr.lzn
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-lpkf6.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\fra.lzn
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-ou9f2.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\enu.lzn
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-m6knm.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\rus.lzn
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-a85np.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanerfree.exe
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-fkt6l.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\vcl140.bpl
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-h4vuj.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\rtl140.bpl
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-1bq3c.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\report.dll
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-1fmop.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\logger.dll
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-is4mt.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\localizer.dll
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-u8a3d.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\helper.dll
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-9n3mh.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanercore.dll
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-6vl2q.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\cc32100mt.dll
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-0pk9h.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\bvcomponents.bpl
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-0spbn.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\borlndmm.dll
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-r2pqd.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\borlndmm.dat
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-hgf5t.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\settings.dll
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-lu392.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\extensionmanager.exe

Network activity

Connects to

'so###como.gq':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?08######

HTTP POST requests

http://so###como.gq/new/net_api

UDP

DNS ASK so###como.gq

Miscellaneous

Searches for the following windows

ClassName: '{E3E3B5FD-54AF-48AE-8D9B-99C51763B646}' WindowName: ''

Creates and executes the following

'%TEMP%\is-mnc9c.tmp\is-s1kmi.tmp' /SL4 $B0230 "<Full path to file>" 7141744 236544
'%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanerfree.exe'
'%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanerfree.exe' e5e505dc4c87c6a7d7d16ba8b54b5342

Executes the following