Trojan.DownLoader45.16568

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-jrqi9.tmp\is-5btfi.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\unins000.dat
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-93e22.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-brk4s.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-94l3g.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-uj308.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-q6sm2.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\data\is-4lf1f.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\data\is-59os7.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\data\is-81dlq.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\is-9o9oi.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\is-pc1tp.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\is-1b3o2.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\is-rk4f6.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-p74br.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\diskcleanerfree.exe
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-mhe71.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-jj9bk.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-aohm4.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-cucug.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-ie1e7.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-lv6ud.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-d8v1m.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-biopd.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-mmrd0.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-0taeo.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-eejso.tmp
%TEMP%\is-e2o10.tmp\_isetup\_iscrypt.dll
%TEMP%\is-e2o10.tmp\_isetup\_shfoldr.dll
%TEMP%\is-e2o10.tmp\_isetup\_setup64.tmp
%TEMP%\is-e2o10.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-lo7ja.tmp
%TEMP%\iofdiow.txt

Moves the following files

from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-eejso.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\unins000.exe
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-94l3g.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\turbosearch.exe
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-uj308.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\sqlite3.dll
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-q6sm2.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\toolbar_gray.bmp
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\data\is-4lf1f.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\data\search.ico
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\data\is-59os7.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\data\diskcleaner.ico
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\data\is-81dlq.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\data\win-uninstall.ico
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\is-9o9oi.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\ukr.lzn
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\is-pc1tp.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\fra.lzn
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\is-1b3o2.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\enu.lzn
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\is-rk4f6.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\lang\rus.lzn
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-brk4s.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\diskcleanerfree.exe
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-p74br.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\vcl140.bpl
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-lo7ja.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\rtl140.bpl
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-jj9bk.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\report.dll
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-aohm4.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\logger.dll
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-cucug.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\localizer.dll
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-ie1e7.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\helper.dll
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-lv6ud.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\diskcleanercore.dll
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-d8v1m.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\cc32100mt.dll
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-biopd.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\bvcomponents.bpl
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-mmrd0.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\borlndmm.dll
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-0taeo.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\borlndmm.dat
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-mhe71.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\settings.dll
from %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\is-93e22.tmp to %ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\extensionmanager.exe

Network activity

Connects to

'fi###specate.cf':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?74######

HTTP POST requests

http://fi###specate.cf/new/net_api

UDP

DNS ASK fi###specate.cf

Miscellaneous

Searches for the following windows

ClassName: '{E3BE35FD-54AF-48AE-8D9B-C5172469639B}' WindowName: ''

Creates and executes the following

'%TEMP%\is-jrqi9.tmp\is-5btfi.tmp' /SL4 $130142 "<Full path to file>" 6809364 236544
'%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\diskcleanerfree.exe'
'%ProgramFiles(x86)%\bisvio\bisvio disk cleaner free\diskcleanerfree.exe' d69f8414b36cf8be07bab6b82c6d8a60

Executes the following