Trojan.DownLoader35.40306

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-ibfv8.tmp\<File name>.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-s9125.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-n0j3o.tmp
%ProgramFiles(x86)%\pwis copy\is-qt8o0.tmp
%ProgramFiles(x86)%\pwis copy\is-h35qe.tmp
%ProgramFiles(x86)%\pwis copy\is-fmjou.tmp
%ProgramFiles(x86)%\pwis copy\is-9vgck.tmp
%ProgramFiles(x86)%\pwis copy\is-plpna.tmp
%ProgramFiles(x86)%\pwis copy\is-c6jm0.tmp
%ProgramFiles(x86)%\pwis copy\is-5iltn.tmp
%ProgramFiles(x86)%\pwis copy\is-6tbbi.tmp
%WINDIR%\is-v9hl1.tmp
%ProgramFiles(x86)%\pwis copy\help\is-l50ph.tmp
%ProgramFiles(x86)%\pwis copy\is-742q9.tmp
%WINDIR%\syswow64\is-su4hb.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pwis copy\pwis copy.lnk
%ProgramFiles(x86)%\pwis copy\skins\0\is-3k9o3.tmp
%ProgramFiles(x86)%\pwis copy\windvdcopy.url
%ProgramFiles(x86)%\pwis copy\skins\0\is-a077b.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-j02jl.tmp
%TEMP%\is-5qcs7.tmp\_isetup\_regdll.tmp
%TEMP%\is-5qcs7.tmp\_isetup\_setup64.tmp
%TEMP%\is-5qcs7.tmp\_isetup\_shfoldr.dll
%TEMP%\is-5qcs7.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\pwis copy\is-tlka3.tmp
%ProgramFiles(x86)%\pwis copy\language\is-p1dbl.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-aim0o.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-qe2ce.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-9qdi5.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-3sg6t.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-esr80.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-sdfbl.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-fhcl9.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-0o2pi.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-albk6.tmp
%ProgramFiles(x86)%\pwis copy\skins\0\is-nhjk7.tmp
%ProgramFiles(x86)%\pwis copy\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\pwis copy\is-tlka3.tmp to %ProgramFiles(x86)%\pwis copy\unins000.exe
from %ProgramFiles(x86)%\pwis copy\help\is-l50ph.tmp to %ProgramFiles(x86)%\pwis copy\help\winavi dvd copy help.chm
from %WINDIR%\is-v9hl1.tmp to %WINDIR%\windvdbootrecdoe.sys
from %ProgramFiles(x86)%\pwis copy\is-6tbbi.tmp to %ProgramFiles(x86)%\pwis copy\readme.txt
from %ProgramFiles(x86)%\pwis copy\is-5iltn.tmp to %ProgramFiles(x86)%\pwis copy\videoburn.dll
from %ProgramFiles(x86)%\pwis copy\is-c6jm0.tmp to %ProgramFiles(x86)%\pwis copy\fileio.dll
from %ProgramFiles(x86)%\pwis copy\is-plpna.tmp to %ProgramFiles(x86)%\pwis copy\aspi.dll
from %ProgramFiles(x86)%\pwis copy\is-9vgck.tmp to %ProgramFiles(x86)%\pwis copy\dvdcopy.dll
from %ProgramFiles(x86)%\pwis copy\is-fmjou.tmp to %ProgramFiles(x86)%\pwis copy\core.dll
from %ProgramFiles(x86)%\pwis copy\is-h35qe.tmp to %ProgramFiles(x86)%\pwis copy\dvd2one.dll
from %ProgramFiles(x86)%\pwis copy\is-qt8o0.tmp to %ProgramFiles(x86)%\pwis copy\mpeg2videotranslator.dll
from %ProgramFiles(x86)%\pwis copy\skins\0\is-n0j3o.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\animation.gif
from %ProgramFiles(x86)%\pwis copy\skins\0\is-s9125.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\copynow.bmp
from %ProgramFiles(x86)%\pwis copy\is-742q9.tmp to %ProgramFiles(x86)%\pwis copy\mwiscopy.exe
from %ProgramFiles(x86)%\pwis copy\skins\0\is-3k9o3.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\setting.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-nhjk7.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\down.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-j02jl.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\wizard.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-albk6.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\splash.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-0o2pi.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\min.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-fhcl9.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\menu.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-sdfbl.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\help.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-esr80.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\close.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-3sg6t.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\web.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-9qdi5.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\buynow.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-qe2ce.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\background.bmp
from %ProgramFiles(x86)%\pwis copy\skins\0\is-aim0o.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\skin.ini
from %ProgramFiles(x86)%\pwis copy\language\is-p1dbl.tmp to %ProgramFiles(x86)%\pwis copy\language\english.ini
from %ProgramFiles(x86)%\pwis copy\skins\0\is-a077b.tmp to %ProgramFiles(x86)%\pwis copy\skins\0\select.bmp
from %WINDIR%\syswow64\is-su4hb.tmp to %WINDIR%\syswow64\sqlite3.dll