Trojan.DownLoader35.39397

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-9qnc8.tmp\<File name>.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-mr4ud.tmp
%ProgramFiles(x86)%\owis copy\is-lljee.tmp
%ProgramFiles(x86)%\owis copy\is-nnr0q.tmp
%ProgramFiles(x86)%\owis copy\is-f347u.tmp
%ProgramFiles(x86)%\owis copy\is-7fb3t.tmp
%ProgramFiles(x86)%\owis copy\is-8fh8t.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-08r1n.tmp
%ProgramFiles(x86)%\owis copy\is-21b09.tmp
%ProgramFiles(x86)%\owis copy\is-4posp.tmp
%WINDIR%\is-c0hkc.tmp
%ProgramFiles(x86)%\owis copy\help\is-2lm4h.tmp
%ProgramFiles(x86)%\owis copy\is-o20oh.tmp
%WINDIR%\syswow64\is-2o2cq.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\owis copy\owis copy.lnk
%ProgramFiles(x86)%\owis copy\skins\0\is-r1lcb.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-25ial.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-eij64.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-61tch.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-1u17l.tmp
%TEMP%\is-t9k97.tmp\_isetup\_setup64.tmp
%TEMP%\is-t9k97.tmp\_isetup\_shfoldr.dll
%TEMP%\is-t9k97.tmp\_isetup\_isdecmp.dll
%TEMP%\is-t9k97.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\owis copy\is-oalba.tmp
%ProgramFiles(x86)%\owis copy\language\is-ov6iv.tmp
%ProgramFiles(x86)%\owis copy\windvdcopy.url
%ProgramFiles(x86)%\owis copy\is-5kqca.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-oo0bi.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-ne9l5.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-590hf.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-vkg69.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-5qoii.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-j6d59.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-hrhd5.tmp
%TEMP%\is-t9k97.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-q89oo.tmp
%ProgramFiles(x86)%\owis copy\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\owis copy\is-oalba.tmp to %ProgramFiles(x86)%\owis copy\unins000.exe
from %ProgramFiles(x86)%\owis copy\help\is-2lm4h.tmp to %ProgramFiles(x86)%\owis copy\help\winavi dvd copy help.chm
from %WINDIR%\is-c0hkc.tmp to %WINDIR%\windvdbootrecdoe.sys
from %ProgramFiles(x86)%\owis copy\is-4posp.tmp to %ProgramFiles(x86)%\owis copy\readme.txt
from %ProgramFiles(x86)%\owis copy\is-5kqca.tmp to %ProgramFiles(x86)%\owis copy\videoburn.dll
from %ProgramFiles(x86)%\owis copy\is-21b09.tmp to %ProgramFiles(x86)%\owis copy\fileio.dll
from %ProgramFiles(x86)%\owis copy\is-8fh8t.tmp to %ProgramFiles(x86)%\owis copy\aspi.dll
from %ProgramFiles(x86)%\owis copy\is-7fb3t.tmp to %ProgramFiles(x86)%\owis copy\dvdcopy.dll
from %ProgramFiles(x86)%\owis copy\is-f347u.tmp to %ProgramFiles(x86)%\owis copy\core.dll
from %ProgramFiles(x86)%\owis copy\is-nnr0q.tmp to %ProgramFiles(x86)%\owis copy\dvd2one.dll
from %ProgramFiles(x86)%\owis copy\is-lljee.tmp to %ProgramFiles(x86)%\owis copy\mpeg2videotranslator.dll
from %ProgramFiles(x86)%\owis copy\skins\0\is-mr4ud.tmp to %ProgramFiles(x86)%\owis copy\skins\0\animation.gif
from %ProgramFiles(x86)%\owis copy\skins\0\is-25ial.tmp to %ProgramFiles(x86)%\owis copy\skins\0\copynow.bmp
from %ProgramFiles(x86)%\owis copy\is-o20oh.tmp to %ProgramFiles(x86)%\owis copy\mwiscopy.exe
from %ProgramFiles(x86)%\owis copy\skins\0\is-r1lcb.tmp to %ProgramFiles(x86)%\owis copy\skins\0\setting.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-61tch.tmp to %ProgramFiles(x86)%\owis copy\skins\0\down.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-1u17l.tmp to %ProgramFiles(x86)%\owis copy\skins\0\wizard.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-hrhd5.tmp to %ProgramFiles(x86)%\owis copy\skins\0\splash.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-j6d59.tmp to %ProgramFiles(x86)%\owis copy\skins\0\min.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-5qoii.tmp to %ProgramFiles(x86)%\owis copy\skins\0\menu.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-vkg69.tmp to %ProgramFiles(x86)%\owis copy\skins\0\help.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-590hf.tmp to %ProgramFiles(x86)%\owis copy\skins\0\close.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-ne9l5.tmp to %ProgramFiles(x86)%\owis copy\skins\0\web.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-q89oo.tmp to %ProgramFiles(x86)%\owis copy\skins\0\buynow.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-08r1n.tmp to %ProgramFiles(x86)%\owis copy\skins\0\background.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-oo0bi.tmp to %ProgramFiles(x86)%\owis copy\skins\0\skin.ini
from %ProgramFiles(x86)%\owis copy\language\is-ov6iv.tmp to %ProgramFiles(x86)%\owis copy\language\english.ini
from %ProgramFiles(x86)%\owis copy\skins\0\is-eij64.tmp to %ProgramFiles(x86)%\owis copy\skins\0\select.bmp
from %WINDIR%\syswow64\is-2o2cq.tmp to %WINDIR%\syswow64\sqlite3.dll