Trojan.DownLoader45.38593

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-86ur8.tmp\<File name>.tmp
%ProgramFiles(x86)%\reg organizer\is-hvoh0.tmp
%ProgramFiles(x86)%\reg organizer\languages\is-n3n9k.tmp
%ProgramFiles(x86)%\reg organizer\documentation\russian\is-2otuc.tmp
%ProgramFiles(x86)%\reg organizer\is-0j80j.tmp
%ProgramFiles(x86)%\reg organizer\is-b9vu3.tmp
%ProgramFiles(x86)%\reg organizer\is-jm677.tmp
%ProgramFiles(x86)%\reg organizer\documentation\english\is-83ug3.tmp
%ProgramFiles(x86)%\reg organizer\is-u8s3u.tmp
%ProgramFiles(x86)%\reg organizer\is-876lo.tmp
%ProgramFiles(x86)%\reg organizer\is-42ktc.tmp
%ProgramFiles(x86)%\reg organizer\is-ak43h.tmp
%ProgramFiles(x86)%\reg organizer\is-vad4d.tmp
%ProgramFiles(x86)%\reg organizer\is-qrh38.tmp
%ProgramFiles(x86)%\reg organizer\is-l1fe8.tmp
%ProgramFiles(x86)%\reg organizer\is-0t95t.tmp
%ProgramFiles(x86)%\reg organizer\is-3khu9.tmp
%ProgramFiles(x86)%\reg organizer\is-uo25q.tmp
%ProgramFiles(x86)%\reg organizer\is-pj806.tmp
%ProgramFiles(x86)%\reg organizer\is-tafog.tmp
%ProgramFiles(x86)%\reg organizer\is-n7shq.tmp
%ProgramFiles(x86)%\reg organizer\is-falgn.tmp
%ProgramFiles(x86)%\reg organizer\is-ia8tb.tmp
%ProgramFiles(x86)%\reg organizer\is-q6bgh.tmp
%TEMP%\is-7gs37.tmp\_isetup\_iscrypt.dll
%TEMP%\is-7gs37.tmp\_isetup\_shfoldr.dll
%TEMP%\is-7gs37.tmp\_isetup\_setup64.tmp
%TEMP%\is-7gs37.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\reg organizer\unins000.dat
%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe

Moves the following files

from %ProgramFiles(x86)%\reg organizer\is-q6bgh.tmp to %ProgramFiles(x86)%\reg organizer\unins000.exe
from %ProgramFiles(x86)%\reg organizer\documentation\russian\is-2otuc.tmp to %ProgramFiles(x86)%\reg organizer\documentation\russian\documentation.chm
from %ProgramFiles(x86)%\reg organizer\is-0j80j.tmp to %ProgramFiles(x86)%\reg organizer\whatsnew-russian.txt
from %ProgramFiles(x86)%\reg organizer\is-b9vu3.tmp to %ProgramFiles(x86)%\reg organizer\readme-russian.txt
from %ProgramFiles(x86)%\reg organizer\is-jm677.tmp to %ProgramFiles(x86)%\reg organizer\license-russian.txt
from %ProgramFiles(x86)%\reg organizer\documentation\english\is-83ug3.tmp to %ProgramFiles(x86)%\reg organizer\documentation\english\documentation.chm
from %ProgramFiles(x86)%\reg organizer\is-u8s3u.tmp to %ProgramFiles(x86)%\reg organizer\whatsnew.txt
from %ProgramFiles(x86)%\reg organizer\is-876lo.tmp to %ProgramFiles(x86)%\reg organizer\readme.txt
from %ProgramFiles(x86)%\reg organizer\is-42ktc.tmp to %ProgramFiles(x86)%\reg organizer\license.txt
from %ProgramFiles(x86)%\reg organizer\is-ak43h.tmp to %ProgramFiles(x86)%\reg organizer\updaterdll.dll
from %ProgramFiles(x86)%\reg organizer\languages\is-n3n9k.tmp to %ProgramFiles(x86)%\reg organizer\languages\russian.sib
from %ProgramFiles(x86)%\reg organizer\is-vad4d.tmp to %ProgramFiles(x86)%\reg organizer\updater.exe
from %ProgramFiles(x86)%\reg organizer\is-l1fe8.tmp to %ProgramFiles(x86)%\reg organizer\reg64call.exe
from %ProgramFiles(x86)%\reg organizer\is-0t95t.tmp to %ProgramFiles(x86)%\reg organizer\optimizationanimation.avi
from %ProgramFiles(x86)%\reg organizer\is-3khu9.tmp to %ProgramFiles(x86)%\reg organizer\installertracingagent.dll
from %ProgramFiles(x86)%\reg organizer\is-uo25q.tmp to %ProgramFiles(x86)%\reg organizer\ignore_dc.first
from %ProgramFiles(x86)%\reg organizer\is-pj806.tmp to %ProgramFiles(x86)%\reg organizer\ignore_arc.first
from %ProgramFiles(x86)%\reg organizer\is-tafog.tmp to %ProgramFiles(x86)%\reg organizer\filemasks.first
from %ProgramFiles(x86)%\reg organizer\is-n7shq.tmp to %ProgramFiles(x86)%\reg organizer\closeapplication.dll
from %ProgramFiles(x86)%\reg organizer\is-falgn.tmp to %ProgramFiles(x86)%\reg organizer\cleanfolders.first
from %ProgramFiles(x86)%\reg organizer\is-ia8tb.tmp to %ProgramFiles(x86)%\reg organizer\links.xml
from %ProgramFiles(x86)%\reg organizer\is-qrh38.tmp to %ProgramFiles(x86)%\reg organizer\regorganizeragent.exe
from %ProgramFiles(x86)%\reg organizer\is-hvoh0.tmp to %ProgramFiles(x86)%\reg organizer\turbosearch.exe

Network activity

Connects to

'ma####elminobhei.ml':80

TCP

HTTP POST requests

http://ma####elminobhei.ml/new/net_api

UDP

DNS ASK ma####elminobhei.ml

Miscellaneous

Searches for the following windows

ClassName: '{ca81f2863c5da4620934ab17371a5da4}' WindowName: ''

Creates and executes the following

'%TEMP%\is-86ur8.tmp\<File name>.tmp' /SL5="$B0218,5005375,50688,<Full path to file>"
'%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe'
'%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe' e21cfdfcd066d221ee5bdefe4c16c89d

Executes the following