Trojan.DownLoader45.7115

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-lbkv8.tmp\is-sqaum.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\unins000.dat
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-vcedl.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-0rand.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-lbvd0.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-stvqc.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-3m92m.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\is-g97aj.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\is-3uk0k.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\is-00tus.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-5eo50.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-7s1t8.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-n1c45.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-7slt0.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-71p2q.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-e5uok.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-28vfu.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-4rled.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-jenpu.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-u2kvt.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-eq96u.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-udku0.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-nr6if.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-mqpkj.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-0di59.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-j3fbs.tmp
%TEMP%\is-lhe7e.tmp\_isetup\_iscrypt.dll
%TEMP%\is-lhe7e.tmp\_isetup\_shfoldr.dll
%TEMP%\is-lhe7e.tmp\_isetup\_setup64.tmp
%TEMP%\is-lhe7e.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-qe6vr.tmp
%TEMP%\iofdiow.txt

Moves the following files

from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-j3fbs.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\unins000.exe
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-lbvd0.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\turbosearch.exe
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-stvqc.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\sqlite3.dll
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-3m92m.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\toolbar_gray.bmp
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\is-g97aj.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\search.ico
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\is-3uk0k.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\diskcleaner.ico
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\is-00tus.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\data\win-uninstall.ico
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-5eo50.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\ukr.lzn
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-7s1t8.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\fra.lzn
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-n1c45.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\enu.lzn
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\is-7slt0.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\lang\rus.lzn
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-0rand.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\diskcleanerfree.exe
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-71p2q.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\vcl140.bpl
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-qe6vr.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\rtl140.bpl
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-28vfu.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\report.dll
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-4rled.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\logger.dll
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-jenpu.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\localizer.dll
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-u2kvt.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\helper.dll
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-eq96u.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\diskcleanercore.dll
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-udku0.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\cc32100mt.dll
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-nr6if.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\bvcomponents.bpl
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-mqpkj.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\borlndmm.dll
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-0di59.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\borlndmm.dat
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-e5uok.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\settings.dll
from %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\is-vcedl.tmp to %ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\extensionmanager.exe

Network activity

Connects to

'fi###specate.cf':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?74######

HTTP POST requests

http://fi###specate.cf/new/net_api

UDP

DNS ASK fi###specate.cf

Miscellaneous

Searches for the following windows

ClassName: '{E3E3B5FD-54AF-48AE-8D9B-99C51763B646}' WindowName: ''

Creates and executes the following

'%TEMP%\is-lbkv8.tmp\is-sqaum.tmp' /SL4 $B021A "<Full path to file>" 7156854 236544
'%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\diskcleanerfree.exe'
'%ProgramFiles(x86)%\aisvik\aisvik disk cleaner free\diskcleanerfree.exe' 153d851fcf5b209959f47efa7e708dd9

Executes the following