Trojan.DownLoader35.47663

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-2kvu2.tmp\<File name>.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-n35bh.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-blr5c.tmp
%ProgramFiles(x86)%\pwis copy\is-sf5to.tmp
%ProgramFiles(x86)%\pwis copy\is-aoobu.tmp
%ProgramFiles(x86)%\pwis copy\is-arbo3.tmp
%ProgramFiles(x86)%\pwis copy\is-mj8f7.tmp
%ProgramFiles(x86)%\pwis copy\is-43b63.tmp
%ProgramFiles(x86)%\pwis copy\is-fq08j.tmp
%ProgramFiles(x86)%\pwis copy\is-f2n6c.tmp
%ProgramFiles(x86)%\pwis copy\is-lslhk.tmp
%WINDIR%\is-i4fp0.tmp
%ProgramFiles(x86)%\pwis copy\help\is-817a4.tmp
%ProgramFiles(x86)%\pwis copy\is-5hat4.tmp
%WINDIR%\syswow64\is-89ae8.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pwis copy\pwis copy.lnk
%ProgramFiles(x86)%\pwis copy\skins\0\is-05dcd.tmp
%ProgramFiles(x86)%\pwis copy\windvdcopy.url
%ProgramFiles(x86)%\pwis copy\skins\0\is-2c4b8.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-7dudt.tmp
%TEMP%\is-71sv9.tmp\_isetup\_regdll.tmp
%TEMP%\is-71sv9.tmp\_isetup\_setup64.tmp
%TEMP%\is-71sv9.tmp\_isetup\_shfoldr.dll
%TEMP%\is-71sv9.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\pwis copy\is-ikss2.tmp
%ProgramFiles(x86)%\pwis copy\language\is-ip8j7.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-pp8b7.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-9o8oh.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-5br5b.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-8qgon.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-pv4pq.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-r6p0g.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-08m86.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-mb9dq.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-8sm69.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-ispm8.tmp
%ProgramFiles(x86)%\pwis copy\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\pwis copy\is-ikss2.tmp to %ProgramFiles(x86)%\pwis copy\unins000.exe
from %ProgramFiles(x86)%\pwis copy\help\is-817a4.tmp to %ProgramFiles(x86)%\pwis copy\help\winavi dvd copy help.chm
from %WINDIR%\is-i4fp0.tmp to %WINDIR%\windvdbootrecdoe.sys
from %ProgramFiles(x86)%\pwis copy\is-lslhk.tmp to %ProgramFiles(x86)%\pwis copy\readme.txt
from %ProgramFiles(x86)%\pwis copy\is-f2n6c.tmp to %ProgramFiles(x86)%\pwis copy\videoburn.dll
from %ProgramFiles(x86)%\pwis copy\is-fq08j.tmp to %ProgramFiles(x86)%\pwis copy\fileio.dll
from %ProgramFiles(x86)%\pwis copy\is-43b63.tmp to %ProgramFiles(x86)%\pwis copy\aspi.dll
from %ProgramFiles(x86)%\pwis copy\is-mj8f7.tmp to %ProgramFiles(x86)%\pwis copy\dvdcopy.dll
from %ProgramFiles(x86)%\pwis copy\is-arbo3.tmp to %ProgramFiles(x86)%\pwis copy\core.dll
from %ProgramFiles(x86)%\pwis copy\is-aoobu.tmp to %ProgramFiles(x86)%\pwis copy\dvd2one.dll
from %ProgramFiles(x86)%\pwis copy\is-sf5to.tmp to %ProgramFiles(x86)%\pwis copy\mpeg2videotranslator.dll
from %ProgramFiles(x86)%\pwis copy\skins\0\is-blr5c.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\animation.gif
from %ProgramFiles(x86)%\pwis copy\skins\0\is-n35bh.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\copynow.bmp
from %ProgramFiles(x86)%\pwis copy\is-5hat4.tmp to %ProgramFiles(x86)%\pwis copy\mwiscopy.exe
from %ProgramFiles(x86)%\pwis copy\skins\0\is-05dcd.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\setting.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-ispm8.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\down.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-7dudt.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\wizard.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-8sm69.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\splash.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-mb9dq.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\min.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-08m86.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\menu.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-r6p0g.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\help.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-pv4pq.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\close.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-8qgon.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\web.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-5br5b.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\buynow.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-9o8oh.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\background.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-pp8b7.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\skin.ini
from %ProgramFiles(x86)%\pwis copy\language\is-ip8j7.tmp to %ProgramFiles(x86)%\pwis copy\language\english.ini
from %ProgramFiles(x86)%\pwis copy\skins\0\is-2c4b8.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\select.bmp
from %WINDIR%\syswow64\is-89ae8.tmp to %WINDIR%\syswow64\sqlite3.dll