Trojan.DownLoader35.47671

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-8p366.tmp\<File name>.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-mve80.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-74ung.tmp
%ProgramFiles(x86)%\pwis copy\is-8v3b8.tmp
%ProgramFiles(x86)%\pwis copy\is-38td7.tmp
%ProgramFiles(x86)%\pwis copy\is-j4mj8.tmp
%ProgramFiles(x86)%\pwis copy\is-n9eum.tmp
%ProgramFiles(x86)%\pwis copy\is-fnkq3.tmp
%ProgramFiles(x86)%\pwis copy\is-eomec.tmp
%ProgramFiles(x86)%\pwis copy\is-5jsc4.tmp
%ProgramFiles(x86)%\pwis copy\is-s9mq2.tmp
%WINDIR%\is-dtitu.tmp
%ProgramFiles(x86)%\pwis copy\help\is-18v8k.tmp
%ProgramFiles(x86)%\pwis copy\is-l93ic.tmp
%WINDIR%\syswow64\is-oa28c.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pwis copy\pwis copy.lnk
%ProgramFiles(x86)%\pwis copy\skins\0\is-sehoc.tmp
%ProgramFiles(x86)%\pwis copy\windvdcopy.url
%ProgramFiles(x86)%\pwis copy\skins\0\is-le2rm.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-dgsem.tmp
%TEMP%\is-188kg.tmp\_isetup\_regdll.tmp
%TEMP%\is-188kg.tmp\_isetup\_setup64.tmp
%TEMP%\is-188kg.tmp\_isetup\_shfoldr.dll
%TEMP%\is-188kg.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\pwis copy\is-oulps.tmp
%ProgramFiles(x86)%\pwis copy\language\is-h7mb2.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-cfqg9.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-2muml.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-n78jn.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-utanb.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-hsg4l.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-pfpff.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-5lnep.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-e01pk.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-n93n3.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-r8bpq.tmp
%ProgramFiles(x86)%\pwis copy\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\pwis copy\is-oulps.tmp to %ProgramFiles(x86)%\pwis copy\unins000.exe
from %ProgramFiles(x86)%\pwis copy\help\is-18v8k.tmp to %ProgramFiles(x86)%\pwis copy\help\winavi dvd copy help.chm
from %WINDIR%\is-dtitu.tmp to %WINDIR%\windvdbootrecdoe.sys
from %ProgramFiles(x86)%\pwis copy\is-s9mq2.tmp to %ProgramFiles(x86)%\pwis copy\readme.txt
from %ProgramFiles(x86)%\pwis copy\is-5jsc4.tmp to %ProgramFiles(x86)%\pwis copy\videoburn.dll
from %ProgramFiles(x86)%\pwis copy\is-eomec.tmp to %ProgramFiles(x86)%\pwis copy\fileio.dll
from %ProgramFiles(x86)%\pwis copy\is-fnkq3.tmp to %ProgramFiles(x86)%\pwis copy\aspi.dll
from %ProgramFiles(x86)%\pwis copy\is-n9eum.tmp to %ProgramFiles(x86)%\pwis copy\dvdcopy.dll
from %ProgramFiles(x86)%\pwis copy\is-j4mj8.tmp to %ProgramFiles(x86)%\pwis copy\core.dll
from %ProgramFiles(x86)%\pwis copy\is-38td7.tmp to %ProgramFiles(x86)%\pwis copy\dvd2one.dll
from %ProgramFiles(x86)%\pwis copy\is-8v3b8.tmp to %ProgramFiles(x86)%\pwis copy\mpeg2videotranslator.dll
from %ProgramFiles(x86)%\pwis copy\skins\0\is-74ung.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\animation.gif
from %ProgramFiles(x86)%\pwis copy\skins\0\is-mve80.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\copynow.bmp
from %ProgramFiles(x86)%\pwis copy\is-l93ic.tmp to %ProgramFiles(x86)%\pwis copy\mwiscopy.exe
from %ProgramFiles(x86)%\pwis copy\skins\0\is-sehoc.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\setting.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-r8bpq.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\down.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-dgsem.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\wizard.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-n93n3.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\splash.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-e01pk.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\min.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-5lnep.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\menu.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-pfpff.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\help.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-hsg4l.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\close.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-utanb.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\web.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-n78jn.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\buynow.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-2muml.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\background.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-cfqg9.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\skin.ini
from %ProgramFiles(x86)%\pwis copy\language\is-h7mb2.tmp to %ProgramFiles(x86)%\pwis copy\language\english.ini
from %ProgramFiles(x86)%\pwis copy\skins\0\is-le2rm.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\select.bmp
from %WINDIR%\syswow64\is-oa28c.tmp to %WINDIR%\syswow64\sqlite3.dll