Trojan.DownLoader45.11413

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-3qbr8.tmp\is-u0ms7.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\unins000.dat
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-gumtj.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-95e0e.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-qtqu2.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-eqr0q.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-aa4eq.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\data\is-vp7t9.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\data\is-1l617.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\data\is-bo7cf.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\lang\is-ofcpo.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\lang\is-ao9f8.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\lang\is-abgi7.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\lang\is-l4oar.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-186bk.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-ajlik.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-k4c29.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-2jf5n.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-hma7l.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-7noem.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-8iosu.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-ttmt8.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-cd2ii.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-1mnkm.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-ldv95.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-bm8rg.tmp
%TEMP%\is-4nork.tmp\_isetup\_iscrypt.dll
%TEMP%\is-4nork.tmp\_isetup\_shfoldr.dll
%TEMP%\is-4nork.tmp\_isetup\_setup64.tmp
%TEMP%\is-4nork.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-b2pg9.tmp
%TEMP%\iofdiow.txt

Moves the following files

from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-bm8rg.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\unins000.exe
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-qtqu2.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\turbosearch.exe
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-eqr0q.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\sqlite3.dll
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-aa4eq.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\toolbar_gray.bmp
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\data\is-vp7t9.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\data\search.ico
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\data\is-1l617.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\data\diskcleaner.ico
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\data\is-bo7cf.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\data\win-uninstall.ico
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\lang\is-ofcpo.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\lang\ukr.lzn
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\lang\is-ao9f8.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\lang\fra.lzn
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\lang\is-abgi7.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\lang\enu.lzn
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\lang\is-l4oar.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\lang\rus.lzn
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-95e0e.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\diskcleanerfree.exe
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-186bk.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\vcl140.bpl
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-b2pg9.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\rtl140.bpl
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-k4c29.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\report.dll
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-2jf5n.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\logger.dll
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-hma7l.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\localizer.dll
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-7noem.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\helper.dll
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-8iosu.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\diskcleanercore.dll
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-ttmt8.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\cc32100mt.dll
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-cd2ii.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\bvcomponents.bpl
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-1mnkm.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\borlndmm.dll
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-ldv95.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\borlndmm.dat
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-ajlik.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\settings.dll
from %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\is-gumtj.tmp to %ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\extensionmanager.exe

Network activity

Connects to

'fi###specate.cf':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?74######

HTTP POST requests

http://fi###specate.cf/new/net_api

UDP

DNS ASK fi###specate.cf

Miscellaneous

Searches for the following windows

ClassName: '{E3BE35FD-54AF-48AE-8D9B-51724C69639B}' WindowName: ''

Creates and executes the following

'%TEMP%\is-3qbr8.tmp\is-u0ms7.tmp' /SL4 $12015C "<Full path to file>" 6674127 236544
'%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\diskcleanerfree.exe'
'%ProgramFiles(x86)%\bisvip\bisvip disk cleaner free\diskcleanerfree.exe' 158ef0a7a496f82ed8aa82bcef74ef34

Executes the following