Trojan.DownLoader45.39146

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-8a9ra.tmp\<File name>.tmp
%ProgramFiles(x86)%\reg organizer\is-9nirb.tmp
%ProgramFiles(x86)%\reg organizer\languages\is-f2cjs.tmp
%ProgramFiles(x86)%\reg organizer\documentation\russian\is-88gu8.tmp
%ProgramFiles(x86)%\reg organizer\is-5q4go.tmp
%ProgramFiles(x86)%\reg organizer\is-c5r74.tmp
%ProgramFiles(x86)%\reg organizer\is-8s718.tmp
%ProgramFiles(x86)%\reg organizer\documentation\english\is-6e09g.tmp
%ProgramFiles(x86)%\reg organizer\is-euh97.tmp
%ProgramFiles(x86)%\reg organizer\is-1mk67.tmp
%ProgramFiles(x86)%\reg organizer\is-p168r.tmp
%ProgramFiles(x86)%\reg organizer\is-ifgt7.tmp
%ProgramFiles(x86)%\reg organizer\is-9d26i.tmp
%ProgramFiles(x86)%\reg organizer\is-g8dfs.tmp
%ProgramFiles(x86)%\reg organizer\is-hsi90.tmp
%ProgramFiles(x86)%\reg organizer\is-nlfil.tmp
%ProgramFiles(x86)%\reg organizer\is-8k511.tmp
%ProgramFiles(x86)%\reg organizer\is-4jrfc.tmp
%ProgramFiles(x86)%\reg organizer\is-lh73s.tmp
%ProgramFiles(x86)%\reg organizer\is-0s6n1.tmp
%ProgramFiles(x86)%\reg organizer\is-6v0kt.tmp
%ProgramFiles(x86)%\reg organizer\is-96h3u.tmp
%ProgramFiles(x86)%\reg organizer\is-3i6vq.tmp
%ProgramFiles(x86)%\reg organizer\is-iv8bk.tmp
%TEMP%\is-44n2e.tmp\_isetup\_iscrypt.dll
%TEMP%\is-44n2e.tmp\_isetup\_shfoldr.dll
%TEMP%\is-44n2e.tmp\_isetup\_setup64.tmp
%TEMP%\is-44n2e.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\reg organizer\unins000.dat
%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe

Moves the following files

from %ProgramFiles(x86)%\reg organizer\is-iv8bk.tmp to %ProgramFiles(x86)%\reg organizer\unins000.exe
from %ProgramFiles(x86)%\reg organizer\documentation\russian\is-88gu8.tmp to %ProgramFiles(x86)%\reg organizer\documentation\russian\documentation.chm
from %ProgramFiles(x86)%\reg organizer\is-5q4go.tmp to %ProgramFiles(x86)%\reg organizer\whatsnew-russian.txt
from %ProgramFiles(x86)%\reg organizer\is-c5r74.tmp to %ProgramFiles(x86)%\reg organizer\readme-russian.txt
from %ProgramFiles(x86)%\reg organizer\is-8s718.tmp to %ProgramFiles(x86)%\reg organizer\license-russian.txt
from %ProgramFiles(x86)%\reg organizer\documentation\english\is-6e09g.tmp to %ProgramFiles(x86)%\reg organizer\documentation\english\documentation.chm
from %ProgramFiles(x86)%\reg organizer\is-euh97.tmp to %ProgramFiles(x86)%\reg organizer\whatsnew.txt
from %ProgramFiles(x86)%\reg organizer\is-1mk67.tmp to %ProgramFiles(x86)%\reg organizer\readme.txt
from %ProgramFiles(x86)%\reg organizer\is-p168r.tmp to %ProgramFiles(x86)%\reg organizer\license.txt
from %ProgramFiles(x86)%\reg organizer\is-ifgt7.tmp to %ProgramFiles(x86)%\reg organizer\updaterdll.dll
from %ProgramFiles(x86)%\reg organizer\languages\is-f2cjs.tmp to %ProgramFiles(x86)%\reg organizer\languages\russian.sib
from %ProgramFiles(x86)%\reg organizer\is-9d26i.tmp to %ProgramFiles(x86)%\reg organizer\updater.exe
from %ProgramFiles(x86)%\reg organizer\is-hsi90.tmp to %ProgramFiles(x86)%\reg organizer\reg64call.exe
from %ProgramFiles(x86)%\reg organizer\is-nlfil.tmp to %ProgramFiles(x86)%\reg organizer\optimizationanimation.avi
from %ProgramFiles(x86)%\reg organizer\is-8k511.tmp to %ProgramFiles(x86)%\reg organizer\installertracingagent.dll
from %ProgramFiles(x86)%\reg organizer\is-4jrfc.tmp to %ProgramFiles(x86)%\reg organizer\ignore_dc.first
from %ProgramFiles(x86)%\reg organizer\is-lh73s.tmp to %ProgramFiles(x86)%\reg organizer\ignore_arc.first
from %ProgramFiles(x86)%\reg organizer\is-0s6n1.tmp to %ProgramFiles(x86)%\reg organizer\filemasks.first
from %ProgramFiles(x86)%\reg organizer\is-6v0kt.tmp to %ProgramFiles(x86)%\reg organizer\closeapplication.dll
from %ProgramFiles(x86)%\reg organizer\is-96h3u.tmp to %ProgramFiles(x86)%\reg organizer\cleanfolders.first
from %ProgramFiles(x86)%\reg organizer\is-3i6vq.tmp to %ProgramFiles(x86)%\reg organizer\links.xml
from %ProgramFiles(x86)%\reg organizer\is-g8dfs.tmp to %ProgramFiles(x86)%\reg organizer\regorganizeragent.exe
from %ProgramFiles(x86)%\reg organizer\is-9nirb.tmp to %ProgramFiles(x86)%\reg organizer\turbosearch.exe

Network activity

Connects to

'ma####elminobhei.ml':80

TCP

HTTP POST requests

http://ma####elminobhei.ml/new/net_api

UDP

DNS ASK ma####elminobhei.ml

Miscellaneous

Searches for the following windows

ClassName: '{81caf26c853da204693b14a73a571da}' WindowName: ''

Creates and executes the following

'%TEMP%\is-8a9ra.tmp\<File name>.tmp' /SL5="$C013A,5125933,134656,<Full path to file>"
'%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe'
'%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe' 3f329d590d64826708318c6f08ede9d9

Executes the following