Trojan.DownLoader36.18978

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-ki4kc.tmp\<File name>.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-gqkog.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-f60ru.tmp
%ProgramFiles(x86)%\swis copy\is-6jlrd.tmp
%ProgramFiles(x86)%\swis copy\is-4m100.tmp
%ProgramFiles(x86)%\swis copy\is-57br7.tmp
%ProgramFiles(x86)%\swis copy\is-m69of.tmp
%ProgramFiles(x86)%\swis copy\is-37dkv.tmp
%ProgramFiles(x86)%\swis copy\is-pvgmp.tmp
%ProgramFiles(x86)%\swis copy\is-efm01.tmp
%ProgramFiles(x86)%\swis copy\is-sv6fl.tmp
%WINDIR%\is-off41.tmp
%ProgramFiles(x86)%\swis copy\help\is-1sh94.tmp
%ProgramFiles(x86)%\swis copy\is-qfmup.tmp
%WINDIR%\syswow64\is-0d1ob.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\swis copy\swis copy.lnk
%ProgramFiles(x86)%\swis copy\skins\0\is-v6j02.tmp
%ProgramFiles(x86)%\swis copy\windvdcopy.url
%ProgramFiles(x86)%\swis copy\skins\0\is-qmm9k.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-hje46.tmp
%TEMP%\is-irtk3.tmp\_isetup\_setup64.tmp
%TEMP%\is-irtk3.tmp\_isetup\_shfoldr.dll
%TEMP%\is-irtk3.tmp\_isetup\_isdecmp.dll
%TEMP%\is-irtk3.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\swis copy\is-7d49u.tmp
%ProgramFiles(x86)%\swis copy\language\is-0uqlb.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-m7r5n.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-86pbo.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-rn2f4.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-91iqb.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-7lqll.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-q4oeh.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-vo5s1.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-7ublr.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-aku66.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-n46nc.tmp
%ProgramFiles(x86)%\swis copy\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\swis copy\is-7d49u.tmp to %ProgramFiles(x86)%\swis copy\unins000.exe
from %ProgramFiles(x86)%\swis copy\help\is-1sh94.tmp to %ProgramFiles(x86)%\swis copy\help\winavi dvd copy help.chm
from %WINDIR%\is-off41.tmp to %WINDIR%\windvdbootrecdoe.sys
from %ProgramFiles(x86)%\swis copy\is-sv6fl.tmp to %ProgramFiles(x86)%\swis copy\readme.txt
from %ProgramFiles(x86)%\swis copy\is-efm01.tmp to %ProgramFiles(x86)%\swis copy\videoburn.dll
from %ProgramFiles(x86)%\swis copy\is-pvgmp.tmp to %ProgramFiles(x86)%\swis copy\fileio.dll
from %ProgramFiles(x86)%\swis copy\is-37dkv.tmp to %ProgramFiles(x86)%\swis copy\aspi.dll
from %ProgramFiles(x86)%\swis copy\is-m69of.tmp to %ProgramFiles(x86)%\swis copy\dvdcopy.dll
from %ProgramFiles(x86)%\swis copy\is-57br7.tmp to %ProgramFiles(x86)%\swis copy\core.dll
from %ProgramFiles(x86)%\swis copy\is-4m100.tmp to %ProgramFiles(x86)%\swis copy\dvd2one.dll
from %ProgramFiles(x86)%\swis copy\is-6jlrd.tmp to %ProgramFiles(x86)%\swis copy\mpeg2videotranslator.dll
from %ProgramFiles(x86)%\swis copy\skins\0\is-f60ru.tmp to %ProgramFiles(x86)%\swis copy\skins\0\animation.gif
from %ProgramFiles(x86)%\swis copy\skins\0\is-gqkog.tmp to %ProgramFiles(x86)%\swis copy\skins\0\copynow.bmp
from %ProgramFiles(x86)%\swis copy\is-qfmup.tmp to %ProgramFiles(x86)%\swis copy\mwiscopy.exe
from %ProgramFiles(x86)%\swis copy\skins\0\is-v6j02.tmp to %ProgramFiles(x86)%\swis copy\skins\0\setting.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-n46nc.tmp to %ProgramFiles(x86)%\swis copy\skins\0\down.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-hje46.tmp to %ProgramFiles(x86)%\swis copy\skins\0\wizard.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-aku66.tmp to %ProgramFiles(x86)%\swis copy\skins\0\splash.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-7ublr.tmp to %ProgramFiles(x86)%\swis copy\skins\0\min.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-vo5s1.tmp to %ProgramFiles(x86)%\swis copy\skins\0\menu.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-q4oeh.tmp to %ProgramFiles(x86)%\swis copy\skins\0\help.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-7lqll.tmp to %ProgramFiles(x86)%\swis copy\skins\0\close.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-91iqb.tmp to %ProgramFiles(x86)%\swis copy\skins\0\web.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-rn2f4.tmp to %ProgramFiles(x86)%\swis copy\skins\0\buynow.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-86pbo.tmp to %ProgramFiles(x86)%\swis copy\skins\0\background.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-m7r5n.tmp to %ProgramFiles(x86)%\swis copy\skins\0\skin.ini
from %ProgramFiles(x86)%\swis copy\language\is-0uqlb.tmp to %ProgramFiles(x86)%\swis copy\language\english.ini
from %ProgramFiles(x86)%\swis copy\skins\0\is-qmm9k.tmp to %ProgramFiles(x86)%\swis copy\skins\0\select.bmp
from %WINDIR%\syswow64\is-0d1ob.tmp to %WINDIR%\syswow64\sqlite3.dll