Trojan.DownLoader45.9762

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-9igbv.tmp\<File name>.tmp
%ProgramFiles(x86)%\saepe\voluptas\is-g2uro.tmp
%ProgramFiles(x86)%\saepe\voluptas\is-89csd.tmp
%ProgramFiles(x86)%\saepe\voluptas\is-4qb46.tmp
%ProgramFiles(x86)%\saepe\quo\is-f5jp6.tmp
%ProgramFiles(x86)%\saepe\quo\is-obln2.tmp
%ProgramFiles(x86)%\saepe\quo\is-ao2k2.tmp
%ProgramFiles(x86)%\saepe\quo\is-ms28n.tmp
%ProgramFiles(x86)%\saepe\quo\is-oo54a.tmp
%ProgramFiles(x86)%\saepe\modi\is-a1ets.tmp
%ProgramFiles(x86)%\saepe\modi\is-shh4e.tmp
%ProgramFiles(x86)%\saepe\modi\is-8f0ld.tmp
%ProgramFiles(x86)%\saepe\voluptas\is-qoenm.tmp
%ProgramFiles(x86)%\saepe\modi\is-2j2k8.tmp
%ProgramFiles(x86)%\saepe\modi\is-9aqao.tmp
%ProgramFiles(x86)%\saepe\modi\is-dcumf.tmp
%ProgramFiles(x86)%\saepe\is-oa2o8.tmp
%ProgramFiles(x86)%\saepe\is-oncr2.tmp
%ProgramFiles(x86)%\saepe\is-49vo9.tmp
%ProgramFiles(x86)%\saepe\is-9i7s5.tmp
%ProgramFiles(x86)%\saepe\is-1dcjj.tmp
%ProgramFiles(x86)%\saepe\is-b511u.tmp
%TEMP%\is-saci8.tmp\_isetup\_iscrypt.dll
%TEMP%\is-saci8.tmp\_isetup\_shfoldr.dll
%TEMP%\is-saci8.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\saepe\modi\is-iis2f.tmp
%ProgramFiles(x86)%\saepe\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\saepe\is-b511u.tmp to %ProgramFiles(x86)%\saepe\unins000.exe
from %ProgramFiles(x86)%\saepe\voluptas\is-89csd.tmp to %ProgramFiles(x86)%\saepe\voluptas\laudantium.txt
from %ProgramFiles(x86)%\saepe\voluptas\is-4qb46.tmp to %ProgramFiles(x86)%\saepe\voluptas\autem.txt
from %ProgramFiles(x86)%\saepe\quo\is-f5jp6.tmp to %ProgramFiles(x86)%\saepe\quo\ullam.txt
from %ProgramFiles(x86)%\saepe\quo\is-obln2.tmp to %ProgramFiles(x86)%\saepe\quo\repudiandae.txt
from %ProgramFiles(x86)%\saepe\quo\is-ao2k2.tmp to %ProgramFiles(x86)%\saepe\quo\provident.txt
from %ProgramFiles(x86)%\saepe\quo\is-ms28n.tmp to %ProgramFiles(x86)%\saepe\quo\occaecati.txt
from %ProgramFiles(x86)%\saepe\quo\is-oo54a.tmp to %ProgramFiles(x86)%\saepe\quo\nesciunt.txt
from %ProgramFiles(x86)%\saepe\modi\is-a1ets.tmp to %ProgramFiles(x86)%\saepe\modi\tenetur.txt
from %ProgramFiles(x86)%\saepe\modi\is-shh4e.tmp to %ProgramFiles(x86)%\saepe\modi\quia.exe
from %ProgramFiles(x86)%\saepe\modi\is-8f0ld.tmp to %ProgramFiles(x86)%\saepe\modi\nulla.txt
from %ProgramFiles(x86)%\saepe\modi\is-2j2k8.tmp to %ProgramFiles(x86)%\saepe\modi\fugit.txt
from %ProgramFiles(x86)%\saepe\modi\is-iis2f.tmp to %ProgramFiles(x86)%\saepe\modi\et.txt
from %ProgramFiles(x86)%\saepe\modi\is-9aqao.tmp to %ProgramFiles(x86)%\saepe\modi\commodi.txt
from %ProgramFiles(x86)%\saepe\modi\is-dcumf.tmp to %ProgramFiles(x86)%\saepe\modi\aut.txt
from %ProgramFiles(x86)%\saepe\is-oa2o8.tmp to %ProgramFiles(x86)%\saepe\molestias.txt
from %ProgramFiles(x86)%\saepe\is-oncr2.tmp to %ProgramFiles(x86)%\saepe\iste.txt
from %ProgramFiles(x86)%\saepe\is-49vo9.tmp to %ProgramFiles(x86)%\saepe\in.txt
from %ProgramFiles(x86)%\saepe\is-9i7s5.tmp to %ProgramFiles(x86)%\saepe\impedit.txt
from %ProgramFiles(x86)%\saepe\is-1dcjj.tmp to %ProgramFiles(x86)%\saepe\id.txt
from %ProgramFiles(x86)%\saepe\voluptas\is-g2uro.tmp to %ProgramFiles(x86)%\saepe\voluptas\recusandae.txt
from %ProgramFiles(x86)%\saepe\voluptas\is-qoenm.tmp to %ProgramFiles(x86)%\saepe\voluptas\sint.txt

Network activity

Connects to

'jo###fornk.live':80

TCP

HTTP POST requests

http://jo###fornk.live/v3/api

UDP

DNS ASK jo###fornk.live

Miscellaneous

Searches for the following windows

ClassName: '4E66F296-3CC8-4E31-9923-49B1484815FC' WindowName: ''

Creates and executes the following

'%TEMP%\is-9igbv.tmp\<File name>.tmp' /SL5="$B0236,3458600,140800,<Full path to file>"
'%ProgramFiles(x86)%\saepe\modi\quia.exe' 64000990f1ec573162fabcd3229f8ee4