Trojan.DownLoader35.59467

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-s46j1.tmp\<File name>.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-9uefv.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-pk9qb.tmp
%ProgramFiles(x86)%\swis copy\is-scc0b.tmp
%ProgramFiles(x86)%\swis copy\is-vkupm.tmp
%ProgramFiles(x86)%\swis copy\is-ikc0l.tmp
%ProgramFiles(x86)%\swis copy\is-q82co.tmp
%ProgramFiles(x86)%\swis copy\is-tcvng.tmp
%ProgramFiles(x86)%\swis copy\is-u7tkg.tmp
%ProgramFiles(x86)%\swis copy\is-u9j9o.tmp
%ProgramFiles(x86)%\swis copy\is-i5895.tmp
%WINDIR%\is-9d4ge.tmp
%ProgramFiles(x86)%\swis copy\help\is-2qq85.tmp
%ProgramFiles(x86)%\swis copy\is-bppuv.tmp
%WINDIR%\syswow64\is-11vi8.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\swis copy\swis copy.lnk
%ProgramFiles(x86)%\swis copy\skins\0\is-jau6v.tmp
%ProgramFiles(x86)%\swis copy\windvdcopy.url
%ProgramFiles(x86)%\swis copy\skins\0\is-pjr17.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-3vo7u.tmp
%TEMP%\is-n8h24.tmp\_isetup\_setup64.tmp
%TEMP%\is-n8h24.tmp\_isetup\_shfoldr.dll
%TEMP%\is-n8h24.tmp\_isetup\_isdecmp.dll
%TEMP%\is-n8h24.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\swis copy\is-3fvp4.tmp
%ProgramFiles(x86)%\swis copy\language\is-v97eb.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-7lc3n.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-2b36o.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-nktf8.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-5panv.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-am6qn.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-v7rsp.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-j2oca.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-43eka.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-4ccvi.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-0pq33.tmp
%ProgramFiles(x86)%\swis copy\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\swis copy\is-3fvp4.tmp to %ProgramFiles(x86)%\swis copy\unins000.exe
from %ProgramFiles(x86)%\swis copy\help\is-2qq85.tmp to %ProgramFiles(x86)%\swis copy\help\winavi dvd copy help.chm
from %WINDIR%\is-9d4ge.tmp to %WINDIR%\windvdbootrecdoe.sys
from %ProgramFiles(x86)%\swis copy\is-i5895.tmp to %ProgramFiles(x86)%\swis copy\readme.txt
from %ProgramFiles(x86)%\swis copy\is-u9j9o.tmp to %ProgramFiles(x86)%\swis copy\videoburn.dll
from %ProgramFiles(x86)%\swis copy\is-u7tkg.tmp to %ProgramFiles(x86)%\swis copy\fileio.dll
from %ProgramFiles(x86)%\swis copy\is-tcvng.tmp to %ProgramFiles(x86)%\swis copy\aspi.dll
from %ProgramFiles(x86)%\swis copy\is-q82co.tmp to %ProgramFiles(x86)%\swis copy\dvdcopy.dll
from %ProgramFiles(x86)%\swis copy\is-ikc0l.tmp to %ProgramFiles(x86)%\swis copy\core.dll
from %ProgramFiles(x86)%\swis copy\is-vkupm.tmp to %ProgramFiles(x86)%\swis copy\dvd2one.dll
from %ProgramFiles(x86)%\swis copy\is-scc0b.tmp to %ProgramFiles(x86)%\swis copy\mpeg2videotranslator.dll
from %ProgramFiles(x86)%\swis copy\skins\0\is-pk9qb.tmp to %ProgramFiles(x86)%\swis copy\skins\0\animation.gif
from %ProgramFiles(x86)%\swis copy\skins\0\is-9uefv.tmp to %ProgramFiles(x86)%\swis copy\skins\0\copynow.bmp
from %ProgramFiles(x86)%\swis copy\is-bppuv.tmp to %ProgramFiles(x86)%\swis copy\mwiscopy.exe
from %ProgramFiles(x86)%\swis copy\skins\0\is-jau6v.tmp to %ProgramFiles(x86)%\swis copy\skins\0\setting.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-0pq33.tmp to %ProgramFiles(x86)%\swis copy\skins\0\down.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-3vo7u.tmp to %ProgramFiles(x86)%\swis copy\skins\0\wizard.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-4ccvi.tmp to %ProgramFiles(x86)%\swis copy\skins\0\splash.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-43eka.tmp to %ProgramFiles(x86)%\swis copy\skins\0\min.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-j2oca.tmp to %ProgramFiles(x86)%\swis copy\skins\0\menu.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-v7rsp.tmp to %ProgramFiles(x86)%\swis copy\skins\0\help.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-am6qn.tmp to %ProgramFiles(x86)%\swis copy\skins\0\close.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-5panv.tmp to %ProgramFiles(x86)%\swis copy\skins\0\web.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-nktf8.tmp to %ProgramFiles(x86)%\swis copy\skins\0\buynow.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-2b36o.tmp to %ProgramFiles(x86)%\swis copy\skins\0\background.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-7lc3n.tmp to %ProgramFiles(x86)%\swis copy\skins\0\skin.ini
from %ProgramFiles(x86)%\swis copy\language\is-v97eb.tmp to %ProgramFiles(x86)%\swis copy\language\english.ini
from %ProgramFiles(x86)%\swis copy\skins\0\is-pjr17.tmp to %ProgramFiles(x86)%\swis copy\skins\0\select.bmp
from %WINDIR%\syswow64\is-11vi8.tmp to %WINDIR%\syswow64\sqlite3.dll