Trojan.DownLoader45.11075

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-i1cbi.tmp\is-u2oei.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\unins000.dat
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-170a2.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-gal4k.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-7dnl0.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-hskua.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-4duuq.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\data\is-jli3p.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\data\is-7920k.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\data\is-j760e.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\is-u3gsl.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\is-uq97u.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\is-iijge.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\is-a8u06.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-jkbmq.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-gnmrc.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-che1s.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-8jnkh.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-uq1ca.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-j9u5n.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-666dl.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-ul9h3.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-h6bd1.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-q3fhl.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-esofr.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-kbsrn.tmp
%TEMP%\is-i75jo.tmp\_isetup\_iscrypt.dll
%TEMP%\is-i75jo.tmp\_isetup\_shfoldr.dll
%TEMP%\is-i75jo.tmp\_isetup\_setup64.tmp
%TEMP%\is-i75jo.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-e49po.tmp
%TEMP%\iofdiow.txt

Moves the following files

from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-kbsrn.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\unins000.exe
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-7dnl0.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\turbosearch.exe
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-hskua.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\sqlite3.dll
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-4duuq.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\toolbar_gray.bmp
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\data\is-jli3p.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\data\search.ico
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\data\is-7920k.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\data\diskcleaner.ico
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\data\is-j760e.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\data\win-uninstall.ico
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\is-u3gsl.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\ukr.lzn
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\is-uq97u.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\fra.lzn
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\is-iijge.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\enu.lzn
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\is-a8u06.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\rus.lzn
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-gal4k.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\diskcleanerfree.exe
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-jkbmq.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\vcl140.bpl
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-e49po.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\rtl140.bpl
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-che1s.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\report.dll
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-8jnkh.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\logger.dll
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-uq1ca.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\localizer.dll
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-j9u5n.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\helper.dll
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-666dl.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\diskcleanercore.dll
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-ul9h3.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\cc32100mt.dll
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-h6bd1.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\bvcomponents.bpl
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-q3fhl.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\borlndmm.dll
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-esofr.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\borlndmm.dat
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-gnmrc.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\settings.dll
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-170a2.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\extensionmanager.exe

Network activity

Connects to

'fi###specate.cf':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?74######

HTTP POST requests

http://fi###specate.cf/new/net_api

UDP

DNS ASK fi###specate.cf

Miscellaneous

Searches for the following windows

ClassName: '{E3BE35FD-54AF-48AE-8D9B-C5172469639B}' WindowName: ''

Creates and executes the following

'%TEMP%\is-i1cbi.tmp\is-u2oei.tmp' /SL4 $D0022 "<Full path to file>" 6874029 236544
'%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\diskcleanerfree.exe'
'%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\diskcleanerfree.exe' 0a22587b150c0b1a9db3e331f52337fb

Executes the following