Trojan.DownLoader36.2395

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-t5mfh.tmp\<File name>.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-q87m3.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-9amo5.tmp
%ProgramFiles(x86)%\pwis copy\is-3uvho.tmp
%ProgramFiles(x86)%\pwis copy\is-m36u0.tmp
%ProgramFiles(x86)%\pwis copy\is-t6soe.tmp
%ProgramFiles(x86)%\pwis copy\is-176eu.tmp
%ProgramFiles(x86)%\pwis copy\is-a8dqk.tmp
%ProgramFiles(x86)%\pwis copy\is-6gcta.tmp
%ProgramFiles(x86)%\pwis copy\is-5hjk0.tmp
%ProgramFiles(x86)%\pwis copy\is-27ljn.tmp
%WINDIR%\is-bs9pi.tmp
%ProgramFiles(x86)%\pwis copy\help\is-4i9r1.tmp
%ProgramFiles(x86)%\pwis copy\is-dmpnh.tmp
%WINDIR%\syswow64\is-oqvg9.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pwis copy\pwis copy.lnk
%ProgramFiles(x86)%\pwis copy\skins\0\is-l30db.tmp
%ProgramFiles(x86)%\pwis copy\windvdcopy.url
%ProgramFiles(x86)%\pwis copy\skins\0\is-e8v27.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-590i6.tmp
%TEMP%\is-ljatn.tmp\_isetup\_regdll.tmp
%TEMP%\is-ljatn.tmp\_isetup\_setup64.tmp
%TEMP%\is-ljatn.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ljatn.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\pwis copy\is-6nei7.tmp
%ProgramFiles(x86)%\pwis copy\language\is-psso3.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-sjnhl.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-ck8uo.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-lk12e.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-6e705.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-qdfct.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-4nn60.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-3hr1l.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-kt739.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-416vi.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-b0b9l.tmp
%ProgramFiles(x86)%\pwis copy\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\pwis copy\is-6nei7.tmp to %ProgramFiles(x86)%\pwis copy\unins000.exe
from %ProgramFiles(x86)%\pwis copy\help\is-4i9r1.tmp to %ProgramFiles(x86)%\pwis copy\help\winavi dvd copy help.chm
from %WINDIR%\is-bs9pi.tmp to %WINDIR%\windvdbootrecdoe.sys
from %ProgramFiles(x86)%\pwis copy\is-27ljn.tmp to %ProgramFiles(x86)%\pwis copy\readme.txt
from %ProgramFiles(x86)%\pwis copy\is-5hjk0.tmp to %ProgramFiles(x86)%\pwis copy\videoburn.dll
from %ProgramFiles(x86)%\pwis copy\is-6gcta.tmp to %ProgramFiles(x86)%\pwis copy\fileio.dll
from %ProgramFiles(x86)%\pwis copy\is-a8dqk.tmp to %ProgramFiles(x86)%\pwis copy\aspi.dll
from %ProgramFiles(x86)%\pwis copy\is-176eu.tmp to %ProgramFiles(x86)%\pwis copy\dvdcopy.dll
from %ProgramFiles(x86)%\pwis copy\is-t6soe.tmp to %ProgramFiles(x86)%\pwis copy\core.dll
from %ProgramFiles(x86)%\pwis copy\is-m36u0.tmp to %ProgramFiles(x86)%\pwis copy\dvd2one.dll
from %ProgramFiles(x86)%\pwis copy\is-3uvho.tmp to %ProgramFiles(x86)%\pwis copy\mpeg2videotranslator.dll
from %ProgramFiles(x86)%\pwis copy\skins\0\is-9amo5.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\animation.gif
from %ProgramFiles(x86)%\pwis copy\skins\0\is-q87m3.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\copynow.bmp
from %ProgramFiles(x86)%\pwis copy\is-dmpnh.tmp to %ProgramFiles(x86)%\pwis copy\mwiscopy.exe
from %ProgramFiles(x86)%\pwis copy\skins\0\is-l30db.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\setting.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-b0b9l.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\down.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-590i6.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\wizard.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-416vi.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\splash.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-kt739.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\min.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-3hr1l.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\menu.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-4nn60.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\help.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-qdfct.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\close.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-6e705.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\web.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-lk12e.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\buynow.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-ck8uo.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\background.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-sjnhl.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\skin.ini
from %ProgramFiles(x86)%\pwis copy\language\is-psso3.tmp to %ProgramFiles(x86)%\pwis copy\language\english.ini
from %ProgramFiles(x86)%\pwis copy\skins\0\is-e8v27.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\select.bmp
from %WINDIR%\syswow64\is-oqvg9.tmp to %WINDIR%\syswow64\sqlite3.dll