Trojan.DownLoader35.49840

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-q6em6.tmp\<File name>.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-oiuec.tmp
%ProgramFiles(x86)%\owis copy\is-8bm6h.tmp
%ProgramFiles(x86)%\owis copy\is-mi12h.tmp
%ProgramFiles(x86)%\owis copy\is-5i3uq.tmp
%ProgramFiles(x86)%\owis copy\is-pcoth.tmp
%ProgramFiles(x86)%\owis copy\is-kead9.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-qf2uh.tmp
%ProgramFiles(x86)%\owis copy\is-m1lba.tmp
%ProgramFiles(x86)%\owis copy\is-3ocn4.tmp
%WINDIR%\is-raroa.tmp
%ProgramFiles(x86)%\owis copy\help\is-17jpe.tmp
%ProgramFiles(x86)%\owis copy\is-ask7a.tmp
%WINDIR%\syswow64\is-cg7lu.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\owis copy\owis copy.lnk
%ProgramFiles(x86)%\owis copy\skins\0\is-5p7ma.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-sprep.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-pek29.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-16j2t.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-b9ult.tmp
%TEMP%\is-jfv4i.tmp\_isetup\_setup64.tmp
%TEMP%\is-jfv4i.tmp\_isetup\_shfoldr.dll
%TEMP%\is-jfv4i.tmp\_isetup\_isdecmp.dll
%TEMP%\is-jfv4i.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\owis copy\is-g2dv9.tmp
%ProgramFiles(x86)%\owis copy\language\is-t1lf5.tmp
%ProgramFiles(x86)%\owis copy\windvdcopy.url
%ProgramFiles(x86)%\owis copy\is-ojldo.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-vulhl.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-4v0eb.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-0q9kl.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-hcpgd.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-0vq8e.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-h4t2q.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-i6ehu.tmp
%TEMP%\is-jfv4i.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\owis copy\skins\0\is-c6f04.tmp
%ProgramFiles(x86)%\owis copy\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\owis copy\is-g2dv9.tmp to %ProgramFiles(x86)%\owis copy\unins000.exe
from %ProgramFiles(x86)%\owis copy\help\is-17jpe.tmp to %ProgramFiles(x86)%\owis copy\help\winavi dvd copy help.chm
from %WINDIR%\is-raroa.tmp to %WINDIR%\windvdbootrecdoe.sys
from %ProgramFiles(x86)%\owis copy\is-3ocn4.tmp to %ProgramFiles(x86)%\owis copy\readme.txt
from %ProgramFiles(x86)%\owis copy\is-ojldo.tmp to %ProgramFiles(x86)%\owis copy\videoburn.dll
from %ProgramFiles(x86)%\owis copy\is-m1lba.tmp to %ProgramFiles(x86)%\owis copy\fileio.dll
from %ProgramFiles(x86)%\owis copy\is-kead9.tmp to %ProgramFiles(x86)%\owis copy\aspi.dll
from %ProgramFiles(x86)%\owis copy\is-pcoth.tmp to %ProgramFiles(x86)%\owis copy\dvdcopy.dll
from %ProgramFiles(x86)%\owis copy\is-5i3uq.tmp to %ProgramFiles(x86)%\owis copy\core.dll
from %ProgramFiles(x86)%\owis copy\is-mi12h.tmp to %ProgramFiles(x86)%\owis copy\dvd2one.dll
from %ProgramFiles(x86)%\owis copy\is-8bm6h.tmp to %ProgramFiles(x86)%\owis copy\mpeg2videotranslator.dll
from %ProgramFiles(x86)%\owis copy\skins\0\is-oiuec.tmp to %ProgramFiles(x86)%\owis copy\skins\0\animation.gif
from %ProgramFiles(x86)%\owis copy\skins\0\is-sprep.tmp to %ProgramFiles(x86)%\owis copy\skins\0\copynow.bmp
from %ProgramFiles(x86)%\owis copy\is-ask7a.tmp to %ProgramFiles(x86)%\owis copy\mwiscopy.exe
from %ProgramFiles(x86)%\owis copy\skins\0\is-5p7ma.tmp to %ProgramFiles(x86)%\owis copy\skins\0\setting.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-16j2t.tmp to %ProgramFiles(x86)%\owis copy\skins\0\down.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-b9ult.tmp to %ProgramFiles(x86)%\owis copy\skins\0\wizard.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-i6ehu.tmp to %ProgramFiles(x86)%\owis copy\skins\0\splash.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-h4t2q.tmp to %ProgramFiles(x86)%\owis copy\skins\0\min.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-0vq8e.tmp to %ProgramFiles(x86)%\owis copy\skins\0\menu.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-hcpgd.tmp to %ProgramFiles(x86)%\owis copy\skins\0\help.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-0q9kl.tmp to %ProgramFiles(x86)%\owis copy\skins\0\close.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-4v0eb.tmp to %ProgramFiles(x86)%\owis copy\skins\0\web.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-c6f04.tmp to %ProgramFiles(x86)%\owis copy\skins\0\buynow.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-qf2uh.tmp to %ProgramFiles(x86)%\owis copy\skins\0\background.bmp
from %ProgramFiles(x86)%\owis copy\skins\0\is-vulhl.tmp to %ProgramFiles(x86)%\owis copy\skins\0\skin.ini
from %ProgramFiles(x86)%\owis copy\language\is-t1lf5.tmp to %ProgramFiles(x86)%\owis copy\language\english.ini
from %ProgramFiles(x86)%\owis copy\skins\0\is-pek29.tmp to %ProgramFiles(x86)%\owis copy\skins\0\select.bmp
from %WINDIR%\syswow64\is-cg7lu.tmp to %WINDIR%\syswow64\sqlite3.dll