Trojan.DownLoader35.32789

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-gb765.tmp\<File name>.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-e4860.tmp
%ProgramFiles(x86)%\nwis copy\is-6ckic.tmp
%ProgramFiles(x86)%\nwis copy\is-7olaj.tmp
%ProgramFiles(x86)%\nwis copy\is-o1f6t.tmp
%ProgramFiles(x86)%\nwis copy\is-5o74p.tmp
%ProgramFiles(x86)%\nwis copy\is-2nnb9.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-9hof2.tmp
%ProgramFiles(x86)%\nwis copy\is-bjb23.tmp
%ProgramFiles(x86)%\nwis copy\is-haeme.tmp
%WINDIR%\is-chhik.tmp
%ProgramFiles(x86)%\nwis copy\help\is-vskhs.tmp
%ProgramFiles(x86)%\nwis copy\is-3ki9a.tmp
%WINDIR%\syswow64\is-3hp6o.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nwis copy\nwis copy.lnk
%ProgramFiles(x86)%\nwis copy\skins\0\is-k429j.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-lu9av.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-01h16.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-thuib.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-2boqr.tmp
%TEMP%\is-ep8dt.tmp\_isetup\_setup64.tmp
%TEMP%\is-ep8dt.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ep8dt.tmp\_isetup\_isdecmp.dll
%TEMP%\is-ep8dt.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\nwis copy\is-bmm8p.tmp
%ProgramFiles(x86)%\nwis copy\language\is-7mo4a.tmp
%ProgramFiles(x86)%\nwis copy\windvdcopy.url
%ProgramFiles(x86)%\nwis copy\is-ci33e.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-ikoo7.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-a6kut.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-bv6o5.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-h7jlp.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-0t063.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-6524u.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-nk51c.tmp
%TEMP%\is-ep8dt.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-10e1g.tmp
%ProgramFiles(x86)%\nwis copy\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\nwis copy\is-bmm8p.tmp to %ProgramFiles(x86)%\nwis copy\unins000.exe
from %ProgramFiles(x86)%\nwis copy\help\is-vskhs.tmp to %ProgramFiles(x86)%\nwis copy\help\winavi dvd copy help.chm
from %WINDIR%\is-chhik.tmp to %WINDIR%\windvdbootrecdoe.sys
from %ProgramFiles(x86)%\nwis copy\is-haeme.tmp to %ProgramFiles(x86)%\nwis copy\readme.txt
from %ProgramFiles(x86)%\nwis copy\is-ci33e.tmp to %ProgramFiles(x86)%\nwis copy\videoburn.dll
from %ProgramFiles(x86)%\nwis copy\is-bjb23.tmp to %ProgramFiles(x86)%\nwis copy\fileio.dll
from %ProgramFiles(x86)%\nwis copy\is-2nnb9.tmp to %ProgramFiles(x86)%\nwis copy\aspi.dll
from %ProgramFiles(x86)%\nwis copy\is-5o74p.tmp to %ProgramFiles(x86)%\nwis copy\dvdcopy.dll
from %ProgramFiles(x86)%\nwis copy\is-o1f6t.tmp to %ProgramFiles(x86)%\nwis copy\core.dll
from %ProgramFiles(x86)%\nwis copy\is-7olaj.tmp to %ProgramFiles(x86)%\nwis copy\dvd2one.dll
from %ProgramFiles(x86)%\nwis copy\is-6ckic.tmp to %ProgramFiles(x86)%\nwis copy\mpeg2videotranslator.dll
from %ProgramFiles(x86)%\nwis copy\skins\0\is-e4860.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\animation.gif
from %ProgramFiles(x86)%\nwis copy\skins\0\is-lu9av.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\copynow.bmp
from %ProgramFiles(x86)%\nwis copy\is-3ki9a.tmp to %ProgramFiles(x86)%\nwis copy\mwiscopy.exe
from %ProgramFiles(x86)%\nwis copy\skins\0\is-k429j.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\setting.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-thuib.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\down.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-2boqr.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\wizard.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-nk51c.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\splash.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-6524u.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\min.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-0t063.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\menu.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-h7jlp.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\help.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-bv6o5.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\close.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-a6kut.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\web.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-10e1g.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\buynow.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-9hof2.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\background.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-ikoo7.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\skin.ini
from %ProgramFiles(x86)%\nwis copy\language\is-7mo4a.tmp to %ProgramFiles(x86)%\nwis copy\language\english.ini
from %ProgramFiles(x86)%\nwis copy\skins\0\is-01h16.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\select.bmp
from %WINDIR%\syswow64\is-3hp6o.tmp to %WINDIR%\syswow64\sqlite3.dll