Trojan.DownLoader45.9235

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-1d3j4.tmp\is-gkhvr.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\unins000.dat
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-kfuvi.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-qg2r1.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-qt9b5.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-9mhs1.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-9djdl.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\data\is-3egqe.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\data\is-qehur.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\data\is-lqm1c.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\is-ijsdo.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\is-3tmq8.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\is-6h22k.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\is-rq56o.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-8f9h0.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-m1man.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-o656b.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-d0jsn.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-n8602.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-3enrc.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-tftug.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-hu8a5.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-2ljih.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-ft1is.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-90bhc.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-7ih6h.tmp
%TEMP%\is-db5ud.tmp\_isetup\_iscrypt.dll
%TEMP%\is-db5ud.tmp\_isetup\_shfoldr.dll
%TEMP%\is-db5ud.tmp\_isetup\_setup64.tmp
%TEMP%\is-db5ud.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-hsupn.tmp
%TEMP%\iofdiow.txt

Moves the following files

from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-7ih6h.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\unins000.exe
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-qt9b5.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\turbosearch.exe
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-9mhs1.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\sqlite3.dll
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-9djdl.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\toolbar_gray.bmp
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\data\is-3egqe.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\data\search.ico
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\data\is-qehur.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\data\diskcleaner.ico
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\data\is-lqm1c.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\data\win-uninstall.ico
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\is-ijsdo.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\ukr.lzn
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\is-3tmq8.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\fra.lzn
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\is-6h22k.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\enu.lzn
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\is-rq56o.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\lang\rus.lzn
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-qg2r1.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\diskcleanerfree.exe
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-8f9h0.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\vcl140.bpl
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-hsupn.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\rtl140.bpl
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-o656b.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\report.dll
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-d0jsn.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\logger.dll
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-n8602.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\localizer.dll
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-3enrc.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\helper.dll
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-tftug.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\diskcleanercore.dll
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-hu8a5.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\cc32100mt.dll
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-2ljih.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\bvcomponents.bpl
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-ft1is.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\borlndmm.dll
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-90bhc.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\borlndmm.dat
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-m1man.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\settings.dll
from %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\is-kfuvi.tmp to %ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\extensionmanager.exe

Network activity

Connects to

'fi###specate.cf':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?74######

HTTP POST requests

http://fi###specate.cf/new/net_api

UDP

DNS ASK fi###specate.cf

Miscellaneous

Searches for the following windows

ClassName: '{E3BE35FD-54AF-48AE-8D9B-C5172469639B}' WindowName: ''

Creates and executes the following

'%TEMP%\is-1d3j4.tmp\is-gkhvr.tmp' /SL4 $B0218 "<Full path to file>" 6721251 236544
'%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\diskcleanerfree.exe'
'%ProgramFiles(x86)%\bisvin\bisvin disk cleaner free\diskcleanerfree.exe' a13f3a5e6e046cc1f03295650582627d

Executes the following