Trojan.DownLoader35.19227

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-gklec.tmp\<File name>.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\is-3pl3o.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\is-vopbq.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\is-hhf7f.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\is-ldnfl.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\is-vcbgh.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\is-8lt3p.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\is-1cd8s.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\is-36imu.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\filters\is-7jl6j.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\filters\is-rmo76.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\filters\is-po0m5.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\filters\is-42o3p.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\filters\is-0odk5.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\filters\is-hpkv9.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\filters\is-qgmni.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\is-kasbg.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\is-5dlhf.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\is-nll6n.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\language\is-eb8dn.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\fvd suite\fvd player.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\fvd suite\fvd converter.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\fvd suite\fvd downloader.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\fvd suite\fvd suite.lnk
%APPDATA%\fvdtoolbar\is-mlavq.tmp
%APPDATA%\fvdtoolbar\is-0r35a.tmp
%TEMP%\is-v0ii4.tmp\is-jvf2f.tmp
%TEMP%\is-v0ii4.tmp\is-g27k5.tmp
%ProgramFiles(x86)%\fvd suite\fvd downloader\database\is-ds9uk.tmp
%TEMP%\is-v0ii4.tmp\is-bk9mp.tmp
%TEMP%\is-v0ii4.tmp\is-sf50v.tmp
%TEMP%\is-v0ii4.tmp\is-t2ut8.tmp
%TEMP%\is-v0ii4.tmp\is-3l7rc.tmp
%TEMP%\is-v0ii4.tmp\is-n2t8r.tmp
%ProgramFiles(x86)%\fvd suite\fvd recorder\is-k6glv.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\language\is-f7ea2.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\is-9dj9c.tmp
%ProgramFiles(x86)%\fvd suite\fvd player\is-jldpc.tmp
%ProgramFiles(x86)%\fvd suite\fvd downloader\language\is-s2ff8.tmp
%ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-d51sp.tmp
%ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-hooif.tmp
%ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-akn1f.tmp
%ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-nmu5a.tmp
%ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-0ol7h.tmp
%ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-9obu1.tmp
%ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-iamap.tmp
%ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-r4irp.tmp
%ProgramFiles(x86)%\fvd suite\addons\is-q53u7.tmp
%ProgramFiles(x86)%\fvd suite\is-88brv.tmp
%ProgramFiles(x86)%\fvd suite\is-2ske5.tmp
%ProgramFiles(x86)%\fvd suite\is-88tk8.tmp
%TEMP%\is-v0ii4.tmp\_isetup\_iscrypt.dll
%TEMP%\is-v0ii4.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-jkl2v.tmp
%ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-2k2d2.tmp
%ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-no0qj.tmp
%ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-bal0o.tmp
%ProgramFiles(x86)%\fvd suite\fvd downloader\language\is-pn72s.tmp
%ProgramFiles(x86)%\fvd suite\fvd converter\is-h4a9e.tmp
%ProgramFiles(x86)%\fvd suite\fvd downloader\language\is-69imk.tmp
%ProgramFiles(x86)%\fvd suite\fvd downloader\language\is-hinbr.tmp
%ProgramFiles(x86)%\fvd suite\fvd downloader\language\is-r7r0b.tmp
%ProgramFiles(x86)%\fvd suite\fvd downloader\language\is-ab3kf.tmp
%ProgramFiles(x86)%\fvd suite\fvd downloader\language\is-d0scb.tmp
%ProgramFiles(x86)%\fvd suite\fvd downloader\language\is-26q36.tmp
%TEMP%\is-v0ii4.tmp\is-s55o5.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\fvd suite\fvd recorder.lnk
%ProgramFiles(x86)%\fvd suite\fvd downloader\is-t4d3p.tmp
%ProgramFiles(x86)%\fvd suite\fvd downloader\is-jejnl.tmp
%ProgramFiles(x86)%\fvd suite\fvd downloader\is-giadg.tmp
%ProgramFiles(x86)%\fvd suite\fvd downloader\is-j063g.tmp
%ProgramFiles(x86)%\fvd suite\fvd converter\language\is-k0va5.tmp
%ProgramFiles(x86)%\fvd suite\fvd converter\language\is-jbr5h.tmp
%ProgramFiles(x86)%\fvd suite\fvd converter\is-julk2.tmp
%ProgramFiles(x86)%\fvd suite\fvd downloader\language\is-3gns0.tmp
%ProgramFiles(x86)%\fvd suite\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\fvd suite\is-88tk8.tmp to %ProgramFiles(x86)%\fvd suite\unins000.exe
from %ProgramFiles(x86)%\fvd suite\fvd player\is-9dj9c.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\fvd player.exe
from %ProgramFiles(x86)%\fvd suite\fvd player\is-kasbg.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\innopsapi.dll
from %ProgramFiles(x86)%\fvd suite\fvd player\is-5dlhf.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\winico.dll
from %ProgramFiles(x86)%\fvd suite\fvd player\filters\is-qgmni.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\filters\flvsplitter.ax
from %ProgramFiles(x86)%\fvd suite\fvd player\filters\is-hpkv9.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\filters\matroskasplitter.ax
from %ProgramFiles(x86)%\fvd suite\fvd player\filters\is-0odk5.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\filters\mp4splitter.ax
from %ProgramFiles(x86)%\fvd suite\fvd player\filters\is-42o3p.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\filters\mpadecfilter.ax
from %ProgramFiles(x86)%\fvd suite\fvd player\filters\is-po0m5.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\filters\mpcvideodec.ax
from %ProgramFiles(x86)%\fvd suite\fvd player\filters\is-rmo76.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\filters\mpeg2decfilter.ax
from %ProgramFiles(x86)%\fvd suite\fvd player\filters\is-7jl6j.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\filters\mpegsplitter.ax
from %ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\is-36imu.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\avcodec-lav-53.dll
from %ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\is-1cd8s.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\avfilter-lav-2.dll
from %ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\is-8lt3p.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\avformat-lav-53.dll
from %ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\is-vcbgh.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\avutil-lav-51.dll
from %ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\is-hhf7f.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\lavsplitter.ax
from %APPDATA%\fvdtoolbar\is-0r35a.tmp to %APPDATA%\fvdtoolbar\11.ico
from %ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\is-vopbq.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\lavvideo.ax
from %ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\is-3pl3o.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\libbluray.dll
from %ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\is-nll6n.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\swscale-lav-2.dll
from %ProgramFiles(x86)%\fvd suite\fvd player\language\is-eb8dn.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\language\english.lng
from %ProgramFiles(x86)%\fvd suite\fvd player\language\is-f7ea2.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\language\russian.lng
from %ProgramFiles(x86)%\fvd suite\fvd recorder\is-k6glv.tmp to %ProgramFiles(x86)%\fvd suite\fvd recorder\fvd recorder.exe
from %TEMP%\is-v0ii4.tmp\is-n2t8r.tmp to %TEMP%\is-v0ii4.tmp\yandex.exe
from %TEMP%\is-v0ii4.tmp\is-3l7rc.tmp to %TEMP%\is-v0ii4.tmp\fvdtoolbar.exe
from %TEMP%\is-v0ii4.tmp\is-t2ut8.tmp to %TEMP%\is-v0ii4.tmp\s1.bmp
from %TEMP%\is-v0ii4.tmp\is-sf50v.tmp to %TEMP%\is-v0ii4.tmp\s2.bmp
from %TEMP%\is-v0ii4.tmp\is-bk9mp.tmp to %TEMP%\is-v0ii4.tmp\s3.bmp
from %TEMP%\is-v0ii4.tmp\is-g27k5.tmp to %TEMP%\is-v0ii4.tmp\s0.bmp
from %TEMP%\is-v0ii4.tmp\is-s55o5.tmp to %TEMP%\is-v0ii4.tmp\t0.bmp
from %TEMP%\is-v0ii4.tmp\is-jvf2f.tmp to %TEMP%\is-v0ii4.tmp\y0.bmp
from %ProgramFiles(x86)%\fvd suite\fvd player\is-jldpc.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\default.m3u
from %ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\is-ldnfl.tmp to %ProgramFiles(x86)%\fvd suite\fvd player\filters\lav\lavaudio.ax
from %ProgramFiles(x86)%\fvd suite\fvd downloader\language\is-s2ff8.tmp to %ProgramFiles(x86)%\fvd suite\fvd downloader\language\spain.lng
from %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-bal0o.tmp to %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\wmv.xml
from %ProgramFiles(x86)%\fvd suite\is-2ske5.tmp to %ProgramFiles(x86)%\fvd suite\fvdsuite.exe
from %ProgramFiles(x86)%\fvd suite\is-88brv.tmp to %ProgramFiles(x86)%\fvd suite\innopsapi.dll
from %ProgramFiles(x86)%\fvd suite\addons\is-q53u7.tmp to %ProgramFiles(x86)%\fvd suite\addons\fvdext.crx
from %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-r4irp.tmp to %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\3gp.xml
from %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-iamap.tmp to %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\avi.xml
from %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-9obu1.tmp to %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\dvd.xml
from %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-0ol7h.tmp to %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\flv.xml
from %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-nmu5a.tmp to %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\mkv.xml
from %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-akn1f.tmp to %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\mov.xml
from %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-hooif.tmp to %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\mp3.xml
from %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-d51sp.tmp to %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\mp4.xml
from %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-no0qj.tmp to %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\mpeg.xml
from %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-jkl2v.tmp to %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\wav.xml
from %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\is-2k2d2.tmp to %ProgramFiles(x86)%\fvd suite\ffmpeg\profiles\webm.xml
from %ProgramFiles(x86)%\fvd suite\fvd converter\is-h4a9e.tmp to %ProgramFiles(x86)%\fvd suite\fvd converter\fvd converter.exe
from %ProgramFiles(x86)%\fvd suite\fvd downloader\language\is-69imk.tmp to %ProgramFiles(x86)%\fvd suite\fvd downloader\language\portugese.lng
from %ProgramFiles(x86)%\fvd suite\fvd converter\is-julk2.tmp to %ProgramFiles(x86)%\fvd suite\fvd converter\mediainfo.dll
from %ProgramFiles(x86)%\fvd suite\fvd converter\language\is-jbr5h.tmp to %ProgramFiles(x86)%\fvd suite\fvd converter\language\english.lng
from %ProgramFiles(x86)%\fvd suite\fvd converter\language\is-k0va5.tmp to %ProgramFiles(x86)%\fvd suite\fvd converter\language\russian.lng
from %ProgramFiles(x86)%\fvd suite\fvd downloader\is-j063g.tmp to %ProgramFiles(x86)%\fvd suite\fvd downloader\fvd downloader.exe
from %ProgramFiles(x86)%\fvd suite\fvd downloader\is-giadg.tmp to %ProgramFiles(x86)%\fvd suite\fvd downloader\libeay32.dll
from %ProgramFiles(x86)%\fvd suite\fvd downloader\is-jejnl.tmp to %ProgramFiles(x86)%\fvd suite\fvd downloader\ssleay32.dll
from %ProgramFiles(x86)%\fvd suite\fvd downloader\is-t4d3p.tmp to %ProgramFiles(x86)%\fvd suite\fvd downloader\zlib1.dll
from %ProgramFiles(x86)%\fvd suite\fvd downloader\database\is-ds9uk.tmp to %ProgramFiles(x86)%\fvd suite\fvd downloader\database\database.csv
from %ProgramFiles(x86)%\fvd suite\fvd downloader\language\is-3gns0.tmp to %ProgramFiles(x86)%\fvd suite\fvd downloader\language\armenian.lng
from %ProgramFiles(x86)%\fvd suite\fvd downloader\language\is-26q36.tmp to %ProgramFiles(x86)%\fvd suite\fvd downloader\language\english.lng
from %ProgramFiles(x86)%\fvd suite\fvd downloader\language\is-d0scb.tmp to %ProgramFiles(x86)%\fvd suite\fvd downloader\language\french.lng
from %ProgramFiles(x86)%\fvd suite\fvd downloader\language\is-ab3kf.tmp to %ProgramFiles(x86)%\fvd suite\fvd downloader\language\germany.lng
from %ProgramFiles(x86)%\fvd suite\fvd downloader\language\is-r7r0b.tmp to %ProgramFiles(x86)%\fvd suite\fvd downloader\language\italian.lng
from %ProgramFiles(x86)%\fvd suite\fvd downloader\language\is-hinbr.tmp to %ProgramFiles(x86)%\fvd suite\fvd downloader\language\japan.lng
from %ProgramFiles(x86)%\fvd suite\fvd downloader\language\is-pn72s.tmp to %ProgramFiles(x86)%\fvd suite\fvd downloader\language\russian.lng
from %APPDATA%\fvdtoolbar\is-mlavq.tmp to %APPDATA%\fvdtoolbar\9.ico

Network activity

Connects to

'op###olad.com':80

TCP

HTTP POST requests

http://op###olad.com/v2/events

UDP

DNS ASK op###olad.com

Miscellaneous

Creates and executes the following

'%TEMP%\is-gklec.tmp\<File name>.tmp' /SL5="$B01F8,13770622,88576,<Full path to file>"
'%ProgramFiles(x86)%\fvd suite\fvdsuite.exe' <File name>.exe

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial