Trojan.DownLoader35.59306

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-nf0fe.tmp\<File name>.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-b9bl1.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-77q0i.tmp
%ProgramFiles(x86)%\swis copy\is-ubl0e.tmp
%ProgramFiles(x86)%\swis copy\is-873v6.tmp
%ProgramFiles(x86)%\swis copy\is-40ul4.tmp
%ProgramFiles(x86)%\swis copy\is-jorg3.tmp
%ProgramFiles(x86)%\swis copy\is-in8p5.tmp
%ProgramFiles(x86)%\swis copy\is-1s4ho.tmp
%ProgramFiles(x86)%\swis copy\is-c7m4s.tmp
%ProgramFiles(x86)%\swis copy\is-s1ntr.tmp
%WINDIR%\is-e6pos.tmp
%ProgramFiles(x86)%\swis copy\help\is-jk7nc.tmp
%ProgramFiles(x86)%\swis copy\is-jrd41.tmp
%WINDIR%\syswow64\is-6fe8h.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\swis copy\swis copy.lnk
%ProgramFiles(x86)%\swis copy\skins\0\is-u9oiv.tmp
%ProgramFiles(x86)%\swis copy\windvdcopy.url
%ProgramFiles(x86)%\swis copy\skins\0\is-enjp0.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-54f8q.tmp
%TEMP%\is-0s620.tmp\_isetup\_setup64.tmp
%TEMP%\is-0s620.tmp\_isetup\_shfoldr.dll
%TEMP%\is-0s620.tmp\_isetup\_isdecmp.dll
%TEMP%\is-0s620.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\swis copy\is-q415d.tmp
%ProgramFiles(x86)%\swis copy\language\is-6j8cp.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-65j0p.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-jngh1.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-uklvl.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-rtiqt.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-7niug.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-10aon.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-ptu52.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-kskh2.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-r1nka.tmp
%ProgramFiles(x86)%\swis copy\skins\0\is-0cm4f.tmp
%ProgramFiles(x86)%\swis copy\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\swis copy\is-q415d.tmp to %ProgramFiles(x86)%\swis copy\unins000.exe
from %ProgramFiles(x86)%\swis copy\help\is-jk7nc.tmp to %ProgramFiles(x86)%\swis copy\help\winavi dvd copy help.chm
from %WINDIR%\is-e6pos.tmp to %WINDIR%\windvdbootrecdoe.sys
from %ProgramFiles(x86)%\swis copy\is-s1ntr.tmp to %ProgramFiles(x86)%\swis copy\readme.txt
from %ProgramFiles(x86)%\swis copy\is-c7m4s.tmp to %ProgramFiles(x86)%\swis copy\videoburn.dll
from %ProgramFiles(x86)%\swis copy\is-1s4ho.tmp to %ProgramFiles(x86)%\swis copy\fileio.dll
from %ProgramFiles(x86)%\swis copy\is-in8p5.tmp to %ProgramFiles(x86)%\swis copy\aspi.dll
from %ProgramFiles(x86)%\swis copy\is-jorg3.tmp to %ProgramFiles(x86)%\swis copy\dvdcopy.dll
from %ProgramFiles(x86)%\swis copy\is-40ul4.tmp to %ProgramFiles(x86)%\swis copy\core.dll
from %ProgramFiles(x86)%\swis copy\is-873v6.tmp to %ProgramFiles(x86)%\swis copy\dvd2one.dll
from %ProgramFiles(x86)%\swis copy\is-ubl0e.tmp to %ProgramFiles(x86)%\swis copy\mpeg2videotranslator.dll
from %ProgramFiles(x86)%\swis copy\skins\0\is-77q0i.tmp to %ProgramFiles(x86)%\swis copy\skins\0\animation.gif
from %ProgramFiles(x86)%\swis copy\skins\0\is-b9bl1.tmp to %ProgramFiles(x86)%\swis copy\skins\0\copynow.bmp
from %ProgramFiles(x86)%\swis copy\is-jrd41.tmp to %ProgramFiles(x86)%\swis copy\mwiscopy.exe
from %ProgramFiles(x86)%\swis copy\skins\0\is-u9oiv.tmp to %ProgramFiles(x86)%\swis copy\skins\0\setting.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-0cm4f.tmp to %ProgramFiles(x86)%\swis copy\skins\0\down.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-54f8q.tmp to %ProgramFiles(x86)%\swis copy\skins\0\wizard.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-r1nka.tmp to %ProgramFiles(x86)%\swis copy\skins\0\splash.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-kskh2.tmp to %ProgramFiles(x86)%\swis copy\skins\0\min.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-ptu52.tmp to %ProgramFiles(x86)%\swis copy\skins\0\menu.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-10aon.tmp to %ProgramFiles(x86)%\swis copy\skins\0\help.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-7niug.tmp to %ProgramFiles(x86)%\swis copy\skins\0\close.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-rtiqt.tmp to %ProgramFiles(x86)%\swis copy\skins\0\web.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-uklvl.tmp to %ProgramFiles(x86)%\swis copy\skins\0\buynow.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-jngh1.tmp to %ProgramFiles(x86)%\swis copy\skins\0\background.bmp
from %ProgramFiles(x86)%\swis copy\skins\0\is-65j0p.tmp to %ProgramFiles(x86)%\swis copy\skins\0\skin.ini
from %ProgramFiles(x86)%\swis copy\language\is-6j8cp.tmp to %ProgramFiles(x86)%\swis copy\language\english.ini
from %ProgramFiles(x86)%\swis copy\skins\0\is-enjp0.tmp to %ProgramFiles(x86)%\swis copy\skins\0\select.bmp
from %WINDIR%\syswow64\is-6fe8h.tmp to %WINDIR%\syswow64\sqlite3.dll