Trojan.DownLoader45.25454

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-n8s7u.tmp\is-vaspk.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\unins000.dat
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-i3c71.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-98prd.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-h3g3b.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-t9cjp.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-t87eh.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-vnlr4.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-6gfv3.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-h88sb.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-8c8gr.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-t0nmj.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-j27mp.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-1t479.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-73ot7.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-hl642.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-g2p4r.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-652mu.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-ic7tq.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-l4aj1.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-5u79a.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-nhal7.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-ghm22.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-0v5m2.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-bjlcu.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-hia3b.tmp
%TEMP%\is-35dj3.tmp\_isetup\_iscrypt.dll
%TEMP%\is-35dj3.tmp\_isetup\_shfoldr.dll
%TEMP%\is-35dj3.tmp\_isetup\_setup64.tmp
%TEMP%\is-35dj3.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-9n3rm.tmp
%TEMP%\iofdiow.txt

Moves the following files

from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-hia3b.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\unins000.exe
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-h3g3b.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\turbosearch.exe
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-t9cjp.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\sqlite3.dll
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-t87eh.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\toolbar_gray.bmp
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-vnlr4.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\search.ico
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-6gfv3.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\diskcleaner.ico
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\is-h88sb.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\data\win-uninstall.ico
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-8c8gr.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\ukr.lzn
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-t0nmj.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\fra.lzn
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-j27mp.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\enu.lzn
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\is-1t479.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\lang\rus.lzn
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-98prd.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanerfree.exe
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-73ot7.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\vcl140.bpl
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-9n3rm.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\rtl140.bpl
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-g2p4r.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\report.dll
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-652mu.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\logger.dll
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-ic7tq.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\localizer.dll
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-l4aj1.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\helper.dll
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-5u79a.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanercore.dll
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-nhal7.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\cc32100mt.dll
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-ghm22.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\bvcomponents.bpl
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-0v5m2.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\borlndmm.dll
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-bjlcu.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\borlndmm.dat
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-hl642.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\settings.dll
from %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\is-i3c71.tmp to %ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\extensionmanager.exe

Network activity

Connects to

'fi###specate.cf':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?74######

HTTP POST requests

http://fi###specate.cf/new/net_api

UDP

DNS ASK fi###specate.cf

Miscellaneous

Searches for the following windows

ClassName: '{E3E3B5FD-54AF-48AE-8D9B-99C51763B646}' WindowName: ''

Creates and executes the following

'%TEMP%\is-n8s7u.tmp\is-vaspk.tmp' /SL4 $11022E "<Full path to file>" 7168052 236544
'%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanerfree.exe'
'%ProgramFiles(x86)%\baisvik\baisvik disk cleaner free\diskcleanerfree.exe' 0fc8d2df10c24e1c5178cb5e8b50ebcb

Executes the following