Trojan.DownLoader45.39123

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-v0aih.tmp\is-ai875.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\unins000.dat
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-dg6jh.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-ko6qd.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-8f1ll.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-jfreb.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-8odab.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\data\is-0utbj.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\data\is-l8uss.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\data\is-a1vqp.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\is-i9mrq.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\is-nh9us.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\is-804qu.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\is-9unf0.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-fte58.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-jmq0i.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-rdf17.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-9mdnt.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-fnu0t.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-ks9ch.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-3mjbn.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-4d9p0.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-9qbk4.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-ariqj.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-723cn.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-69q1q.tmp
%TEMP%\is-u5vif.tmp\_isetup\_iscrypt.dll
%TEMP%\is-u5vif.tmp\_isetup\_shfoldr.dll
%TEMP%\is-u5vif.tmp\_isetup\_setup64.tmp
%TEMP%\is-u5vif.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-gnqv2.tmp
%TEMP%\iofdiow.txt

Moves the following files

from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-69q1q.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\unins000.exe
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-8f1ll.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\turbosearch.exe
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-jfreb.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\sqlite3.dll
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-8odab.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\toolbar_gray.bmp
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\data\is-0utbj.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\data\search.ico
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\data\is-l8uss.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\data\diskcleaner.ico
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\data\is-a1vqp.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\data\win-uninstall.ico
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\is-i9mrq.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\ukr.lzn
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\is-nh9us.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\fra.lzn
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\is-804qu.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\enu.lzn
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\is-9unf0.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\lang\rus.lzn
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-ko6qd.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\diskcleanerfree.exe
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-fte58.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\vcl140.bpl
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-gnqv2.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\rtl140.bpl
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-rdf17.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\report.dll
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-9mdnt.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\logger.dll
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-fnu0t.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\localizer.dll
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-ks9ch.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\helper.dll
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-3mjbn.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\diskcleanercore.dll
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-4d9p0.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\cc32100mt.dll
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-9qbk4.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\bvcomponents.bpl
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-ariqj.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\borlndmm.dll
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-723cn.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\borlndmm.dat
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-jmq0i.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\settings.dll
from %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\is-dg6jh.tmp to %ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\extensionmanager.exe

Network activity

Connects to

'fi###specate.cf':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?74######

HTTP POST requests

http://fi###specate.cf/new/net_api

UDP

DNS ASK fi###specate.cf

Miscellaneous

Searches for the following windows

ClassName: '{3E3BE5FD-54AF-48AE-8D9B-9C517646639B}' WindowName: ''

Creates and executes the following

'%TEMP%\is-v0aih.tmp\is-ai875.tmp' /SL4 $16001E "<Full path to file>" 6777078 236544
'%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\diskcleanerfree.exe'
'%ProgramFiles(x86)%\bisvim\bisvim disk cleaner free\diskcleanerfree.exe' 816c32809707da2aaeab5f8acbf94dd0

Executes the following