Trojan.DownLoader36.3143

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-n4l8r.tmp\<File name>.tmp
%ProgramFiles(x86)%\xwis copy\is-ks6tr.tmp
%ProgramFiles(x86)%\xwis copy\is-a4sl3.tmp
%ProgramFiles(x86)%\xwis copy\is-mflhj.tmp
%ProgramFiles(x86)%\xwis copy\is-min9b.tmp
%ProgramFiles(x86)%\xwis copy\is-5l2ec.tmp
%ProgramFiles(x86)%\xwis copy\skins\0\is-kpsgh.tmp
%ProgramFiles(x86)%\xwis copy\skins\0\is-73951.tmp
%ProgramFiles(x86)%\xwis copy\is-emeep.tmp
%WINDIR%\is-i4tql.tmp
%ProgramFiles(x86)%\xwis copy\help\is-ln839.tmp
%ProgramFiles(x86)%\xwis copy\is-5bbek.tmp
%WINDIR%\syswow64\is-sik8i.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\xwis copy\xwis copy.lnk
%ProgramFiles(x86)%\xwis copy\is-vonl1.tmp
%ProgramFiles(x86)%\xwis copy\is-tpf9j.tmp
%ProgramFiles(x86)%\xwis copy\skins\0\is-qvs5f.tmp
%ProgramFiles(x86)%\xwis copy\skins\0\is-t0hva.tmp
%ProgramFiles(x86)%\xwis copy\skins\0\is-4qhdu.tmp
%TEMP%\is-7vu56.tmp\_isetup\_shfoldr.dll
%TEMP%\is-7vu56.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\xwis copy\is-ntagb.tmp
%ProgramFiles(x86)%\xwis copy\language\is-qdbab.tmp
%ProgramFiles(x86)%\xwis copy\skins\0\is-ep6nj.tmp
%ProgramFiles(x86)%\xwis copy\skins\0\is-iici6.tmp
%TEMP%\is-7vu56.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\xwis copy\skins\0\is-k61ga.tmp
%ProgramFiles(x86)%\xwis copy\skins\0\is-4ji5f.tmp
%ProgramFiles(x86)%\xwis copy\skins\0\is-31kqi.tmp
%ProgramFiles(x86)%\xwis copy\skins\0\is-pem99.tmp
%ProgramFiles(x86)%\xwis copy\skins\0\is-duad2.tmp
%ProgramFiles(x86)%\xwis copy\skins\0\is-lmn36.tmp
%ProgramFiles(x86)%\xwis copy\skins\0\is-2f723.tmp
%ProgramFiles(x86)%\xwis copy\skins\0\is-am95a.tmp
%ProgramFiles(x86)%\xwis copy\windvdcopy.url
%ProgramFiles(x86)%\xwis copy\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\xwis copy\is-ntagb.tmp to %ProgramFiles(x86)%\xwis copy\unins000.exe
from %ProgramFiles(x86)%\xwis copy\help\is-ln839.tmp to %ProgramFiles(x86)%\xwis copy\help\winavi dvd copy help.chm
from %WINDIR%\is-i4tql.tmp to %WINDIR%\windvdbootrecdoe.sys
from %ProgramFiles(x86)%\xwis copy\is-tpf9j.tmp to %ProgramFiles(x86)%\xwis copy\readme.txt
from %ProgramFiles(x86)%\xwis copy\is-vonl1.tmp to %ProgramFiles(x86)%\xwis copy\videoburn.dll
from %ProgramFiles(x86)%\xwis copy\is-emeep.tmp to %ProgramFiles(x86)%\xwis copy\fileio.dll
from %ProgramFiles(x86)%\xwis copy\is-5l2ec.tmp to %ProgramFiles(x86)%\xwis copy\aspi.dll
from %ProgramFiles(x86)%\xwis copy\is-min9b.tmp to %ProgramFiles(x86)%\xwis copy\dvdcopy.dll
from %ProgramFiles(x86)%\xwis copy\is-mflhj.tmp to %ProgramFiles(x86)%\xwis copy\core.dll
from %ProgramFiles(x86)%\xwis copy\is-a4sl3.tmp to %ProgramFiles(x86)%\xwis copy\dvd2one.dll
from %ProgramFiles(x86)%\xwis copy\is-ks6tr.tmp to %ProgramFiles(x86)%\xwis copy\mpeg2videotranslator.dll
from %ProgramFiles(x86)%\xwis copy\skins\0\is-73951.tmp to %ProgramFiles(x86)%\xwis copy\skins\0\animation.gif
from %ProgramFiles(x86)%\xwis copy\skins\0\is-kpsgh.tmp to %ProgramFiles(x86)%\xwis copy\skins\0\copynow.bmp
from %ProgramFiles(x86)%\xwis copy\is-5bbek.tmp to %ProgramFiles(x86)%\xwis copy\mwiscopy.exe
from %ProgramFiles(x86)%\xwis copy\skins\0\is-qvs5f.tmp to %ProgramFiles(x86)%\xwis copy\skins\0\setting.bmp
from %ProgramFiles(x86)%\xwis copy\skins\0\is-4qhdu.tmp to %ProgramFiles(x86)%\xwis copy\skins\0\down.bmp
from %ProgramFiles(x86)%\xwis copy\skins\0\is-2f723.tmp to %ProgramFiles(x86)%\xwis copy\skins\0\wizard.bmp
from %ProgramFiles(x86)%\xwis copy\skins\0\is-lmn36.tmp to %ProgramFiles(x86)%\xwis copy\skins\0\splash.bmp
from %ProgramFiles(x86)%\xwis copy\skins\0\is-duad2.tmp to %ProgramFiles(x86)%\xwis copy\skins\0\min.bmp
from %ProgramFiles(x86)%\xwis copy\skins\0\is-pem99.tmp to %ProgramFiles(x86)%\xwis copy\skins\0\menu.bmp
from %ProgramFiles(x86)%\xwis copy\skins\0\is-31kqi.tmp to %ProgramFiles(x86)%\xwis copy\skins\0\help.bmp
from %ProgramFiles(x86)%\xwis copy\skins\0\is-4ji5f.tmp to %ProgramFiles(x86)%\xwis copy\skins\0\close.bmp
from %ProgramFiles(x86)%\xwis copy\skins\0\is-am95a.tmp to %ProgramFiles(x86)%\xwis copy\skins\0\web.bmp
from %ProgramFiles(x86)%\xwis copy\skins\0\is-k61ga.tmp to %ProgramFiles(x86)%\xwis copy\skins\0\buynow.bmp
from %ProgramFiles(x86)%\xwis copy\skins\0\is-iici6.tmp to %ProgramFiles(x86)%\xwis copy\skins\0\background.bmp
from %ProgramFiles(x86)%\xwis copy\skins\0\is-ep6nj.tmp to %ProgramFiles(x86)%\xwis copy\skins\0\skin.ini
from %ProgramFiles(x86)%\xwis copy\language\is-qdbab.tmp to %ProgramFiles(x86)%\xwis copy\language\english.ini
from %ProgramFiles(x86)%\xwis copy\skins\0\is-t0hva.tmp to %ProgramFiles(x86)%\xwis copy\skins\0\select.bmp
from %WINDIR%\syswow64\is-sik8i.tmp to %WINDIR%\syswow64\sqlite3.dll