Trojan.DownLoader35.36858

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-l5g5e.tmp\<File name>.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-do47k.tmp
%ProgramFiles(x86)%\owis copy\is-s5kqg.tmp
%ProgramFiles(x86)%\owis copy\is-v1qj7.tmp
%ProgramFiles(x86)%\owis copy\is-4bti1.tmp
%ProgramFiles(x86)%\owis copy\is-erisd.tmp
%ProgramFiles(x86)%\owis copy\is-dk61d.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-ijt26.tmp
%ProgramFiles(x86)%\owis copy\is-8rogn.tmp
%ProgramFiles(x86)%\owis copy\is-tn742.tmp
%WINDIR%\is-aivmo.tmp
%ProgramFiles(x86)%\owis copy\help\is-abv6g.tmp
%ProgramFiles(x86)%\owis copy\is-19rge.tmp
%WINDIR%\syswow64\is-q7bac.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\owis copy\owis copy.lnk
%ProgramFiles(x86)%\owis copy\skins\0\is-0k4c7.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-357o3.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-p53ra.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-fintv.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-7eg9v.tmp
%TEMP%\is-b8131.tmp\_isetup\_setup64.tmp
%TEMP%\is-b8131.tmp\_isetup\_shfoldr.dll
%TEMP%\is-b8131.tmp\_isetup\_isdecmp.dll
%TEMP%\is-b8131.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\owis copy\is-pplid.tmp
%ProgramFiles(x86)%\owis copy\language\is-h38ke.tmp
%ProgramFiles(x86)%\owis copy\windvdcopy.url
%ProgramFiles(x86)%\owis copy\is-4uqci.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-47f8r.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-i3ft1.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-ehhep.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-9dt6t.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-6hjrn.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-5loh2.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-pnou0.tmp
%TEMP%\is-b8131.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-o2914.tmp
%ProgramFiles(x86)%\owis copy\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\owis copy\is-pplid.tmp to %ProgramFiles(x86)%\owis copy\unins000.exe
from %ProgramFiles(x86)%\owis copy\help\is-abv6g.tmp to %ProgramFiles(x86)%\owis copy\help\winavi dvd copy help.chm
from %WINDIR%\is-aivmo.tmp to %WINDIR%\windvdbootrecdoe.sys
from %ProgramFiles(x86)%\owis copy\is-tn742.tmp to %ProgramFiles(x86)%\owis copy\readme.txt
from %ProgramFiles(x86)%\owis copy\is-4uqci.tmp to %ProgramFiles(x86)%\owis copy\videoburn.dll
from %ProgramFiles(x86)%\owis copy\is-8rogn.tmp to %ProgramFiles(x86)%\owis copy\fileio.dll
from %ProgramFiles(x86)%\owis copy\is-dk61d.tmp to %ProgramFiles(x86)%\owis copy\aspi.dll
from %ProgramFiles(x86)%\owis copy\is-erisd.tmp to %ProgramFiles(x86)%\owis copy\dvdcopy.dll
from %ProgramFiles(x86)%\owis copy\is-4bti1.tmp to %ProgramFiles(x86)%\owis copy\core.dll
from %ProgramFiles(x86)%\owis copy\is-v1qj7.tmp to %ProgramFiles(x86)%\owis copy\dvd2one.dll
from %ProgramFiles(x86)%\owis copy\is-s5kqg.tmp to %ProgramFiles(x86)%\owis copy\mpeg2videotranslator.dll
from %ProgramFiles(x86)%\owis copy\skins\0\is-do47k.tmp to %ProgramFiles(x86)%\owis copy\skins\0\animation.gif
from %ProgramFiles(x86)%\owis copy\skins\0\is-357o3.tmp to %ProgramFiles(x86)%\owis copy\skins\0\copynow.bmp
from %ProgramFiles(x86)%\owis copy\is-19rge.tmp to %ProgramFiles(x86)%\owis copy\mwiscopy.exe
from %ProgramFiles(x86)%\owis copy\skins\0\is-0k4c7.tmp to %ProgramFiles(x86)%\owis copy\skins\0\setting.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-fintv.tmp to %ProgramFiles(x86)%\owis copy\skins\0\down.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-7eg9v.tmp to %ProgramFiles(x86)%\owis copy\skins\0\wizard.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-pnou0.tmp to %ProgramFiles(x86)%\owis copy\skins\0\splash.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-5loh2.tmp to %ProgramFiles(x86)%\owis copy\skins\0\min.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-6hjrn.tmp to %ProgramFiles(x86)%\owis copy\skins\0\menu.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-9dt6t.tmp to %ProgramFiles(x86)%\owis copy\skins\0\help.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-ehhep.tmp to %ProgramFiles(x86)%\owis copy\skins\0\close.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-i3ft1.tmp to %ProgramFiles(x86)%\owis copy\skins\0\web.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-o2914.tmp to %ProgramFiles(x86)%\owis copy\skins\0\buynow.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-ijt26.tmp to %ProgramFiles(x86)%\owis copy\skins\0\background.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-47f8r.tmp to %ProgramFiles(x86)%\owis copy\skins\0\skin.ini
from %ProgramFiles(x86)%\owis copy\language\is-h38ke.tmp to %ProgramFiles(x86)%\owis copy\language\english.ini
from %ProgramFiles(x86)%\owis copy\skins\0\is-p53ra.tmp to %ProgramFiles(x86)%\owis copy\skins\0\select.bmp
from %WINDIR%\syswow64\is-q7bac.tmp to %WINDIR%\syswow64\sqlite3.dll