Trojan.Zadved.1654

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-9unuf.tmp\<File name>.tmp
%ProgramFiles(x86)%\showdec\is-jgru4.tmp
%WINDIR%\syswow64\is-s72hh.tmp
%WINDIR%\syswow64\is-2t2uf.tmp
%WINDIR%\syswow64\is-gitd3.tmp
%ProgramFiles(x86)%\showdec\is-02533.tmp
%ProgramFiles(x86)%\showdec\is-takru.tmp
%ProgramFiles(x86)%\showdec\is-6prqo.tmp
%ProgramFiles(x86)%\showdec\is-3h6k5.tmp
%ProgramFiles(x86)%\showdec\is-il03g.tmp
%ProgramFiles(x86)%\showdec\is-u1l27.tmp
%ProgramFiles(x86)%\showdec\is-vgtcj.tmp
%ProgramFiles(x86)%\showdec\is-8eb2n.tmp
%ProgramFiles(x86)%\showdec\is-b6v8j.tmp
%ProgramFiles(x86)%\showdec\is-4eock.tmp
%ProgramFiles(x86)%\showdec\is-0etf9.tmp
%ProgramFiles(x86)%\showdec\is-eqqb2.tmp
%ProgramFiles(x86)%\showdec\is-7qafm.tmp
%ProgramFiles(x86)%\showdec\is-ur57e.tmp
%ProgramFiles(x86)%\showdec\is-m48i2.tmp
%ProgramFiles(x86)%\showdec\is-h723e.tmp
%ProgramFiles(x86)%\showdec\is-ud99u.tmp
%ProgramFiles(x86)%\showdec\is-21l2t.tmp
%ProgramFiles(x86)%\showdec\is-70ro5.tmp
%ProgramFiles(x86)%\showdec\is-b9061.tmp
%ProgramFiles(x86)%\showdec\is-iecsl.tmp
%ProgramFiles(x86)%\showdec\xforms\is-0imj8.tmp
%ProgramFiles(x86)%\showdec\xforms\is-ckuoq.tmp
%ProgramFiles(x86)%\showdec\xforms\is-82kh6.tmp
%ProgramFiles(x86)%\showdec\xforms\is-8tq13.tmp
%ProgramFiles(x86)%\showdec\xforms\is-b6tva.tmp
%ProgramFiles(x86)%\showdec\xforms\is-r1fgn.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-0ebva.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-iapgh.tmp
%ProgramFiles(x86)%\showdec\is-odj4p.tmp
%ProgramFiles(x86)%\showdec\is-tdfkf.tmp
%ProgramFiles(x86)%\showdec\is-9mg72.tmp
%ProgramFiles(x86)%\showdec\is-780t7.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-6v0r3.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-hft8n.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-gevbn.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-nrlp5.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-728it.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-8676t.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-oa6ru.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-jmlqj.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-9unlc.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-hl1n6.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-pq7jq.tmp
%ProgramFiles(x86)%\showdec\languages\is-050ov.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-1q0vq.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-3j25s.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-73904.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-nuvr1.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-m773f.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-3c137.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-r136j.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-2ijah.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-0j65i.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-4ss3e.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-1e8tl.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-0m90h.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-ittvc.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-uonup.tmp
%ProgramFiles(x86)%\showdec\xforms\is-spj72.tmp
%ProgramFiles(x86)%\showdec\xforms\is-5bj4f.tmp
%ProgramFiles(x86)%\showdec\xforms\is-i9unj.tmp
%ProgramFiles(x86)%\showdec\skin\is-6207q.tmp
%ProgramFiles(x86)%\showdec\skin\is-u5nd6.tmp
%ProgramFiles(x86)%\showdec\skin\is-1e5bm.tmp
%ProgramFiles(x86)%\showdec\skin\is-a3rjr.tmp
%ProgramFiles(x86)%\showdec\skin\is-80pcu.tmp
%ProgramFiles(x86)%\showdec\xforms\is-adi60.tmp
%ProgramFiles(x86)%\showdec\xforms\is-mfk62.tmp
%ProgramFiles(x86)%\showdec\xforms\is-f4q2h.tmp
%ProgramFiles(x86)%\showdec\xforms\is-163ms.tmp
%ProgramFiles(x86)%\showdec\xforms\is-un1sj.tmp
%ProgramFiles(x86)%\showdec\xforms\is-k5amc.tmp
%ProgramFiles(x86)%\showdec\xforms\is-l815j.tmp
%ProgramFiles(x86)%\showdec\xforms\is-uc5ks.tmp
%ProgramFiles(x86)%\showdec\xforms\is-oe676.tmp
%ProgramFiles(x86)%\showdec\xforms\is-evqdt.tmp
%ProgramFiles(x86)%\showdec\xforms\is-gicd9.tmp
%ProgramFiles(x86)%\showdec\xforms\is-dhma7.tmp
%ProgramFiles(x86)%\showdec\xforms\is-h5f02.tmp
%ProgramFiles(x86)%\showdec\xforms\is-ecuhs.tmp
%ProgramFiles(x86)%\showdec\xforms\is-77cds.tmp
%ProgramFiles(x86)%\showdec\xforms\is-dane4.tmp
%ProgramFiles(x86)%\showdec\xforms\is-hce5e.tmp
%ProgramFiles(x86)%\showdec\xforms\is-r95ri.tmp
%ProgramFiles(x86)%\showdec\is-q68vk.tmp
%ProgramFiles(x86)%\showdec\is-36fbs.tmp
%ProgramFiles(x86)%\showdec\is-nn9pj.tmp
%TEMP%\is-vdso6.tmp\_isetup\_iscrypt.dll
%TEMP%\is-vdso6.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\showdec\skin\default\is-b9ca1.tmp
%ProgramFiles(x86)%\showdec\skin\default\is-64fvs.tmp
%ProgramFiles(x86)%\showdec\skin\is-satda.tmp
%ProgramFiles(x86)%\showdec\skin\default\is-088ca.tmp
%ProgramFiles(x86)%\showdec\xforms\is-me4as.tmp
%ProgramFiles(x86)%\showdec\skin\default\is-vf86m.tmp
%ProgramFiles(x86)%\showdec\xforms\is-cfme0.tmp
%ProgramFiles(x86)%\showdec\xforms\is-23282.tmp
%ProgramFiles(x86)%\showdec\xforms\is-bvu84.tmp
%ProgramFiles(x86)%\showdec\xforms\is-q2lep.tmp
%ProgramFiles(x86)%\showdec\xforms\is-pcgg5.tmp
%ProgramFiles(x86)%\showdec\xforms\is-uj313.tmp
%ProgramFiles(x86)%\showdec\xforms\is-1n56h.tmp
%ProgramFiles(x86)%\showdec\xforms\is-4i7i9.tmp
%ProgramFiles(x86)%\showdec\is-g7trs.tmp
%ProgramFiles(x86)%\showdec\is-63cor.tmp
%ProgramFiles(x86)%\showdec\is-rk9r3.tmp
%ProgramFiles(x86)%\showdec\is-q9tgj.tmp
%ProgramFiles(x86)%\showdec\skin\is-25n3b.tmp
%ProgramFiles(x86)%\showdec\decplugins\is-p8fj0.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\showdec\showdec.lnk
%ProgramFiles(x86)%\showdec\languages\is-9i2sq.tmp
%ProgramFiles(x86)%\showdec\languages\is-cqude.tmp
%ProgramFiles(x86)%\showdec\skin\default\is-vdcrj.tmp
%ProgramFiles(x86)%\showdec\skin\default\is-jgrem.tmp
%ProgramFiles(x86)%\showdec\skin\default\is-uf82i.tmp
%ProgramFiles(x86)%\showdec\skin\default\is-p3p0p.tmp
%ProgramFiles(x86)%\showdec\skin\default\is-gv5c2.tmp
%ProgramFiles(x86)%\showdec\skin\default\is-eli8v.tmp
%ProgramFiles(x86)%\showdec\skin\default\is-73viq.tmp
%ProgramFiles(x86)%\showdec\skin\default\is-qllvq.tmp
%ProgramFiles(x86)%\showdec\skin\default\is-i3jrm.tmp
%ProgramFiles(x86)%\showdec\skin\default\is-vjuj3.tmp
%ProgramFiles(x86)%\showdec\skin\default\is-or6fr.tmp
%ProgramFiles(x86)%\showdec\skin\default\is-grcnr.tmp
%ProgramFiles(x86)%\showdec\skin\is-p6sch.tmp
%ProgramFiles(x86)%\showdec\unins000.dat

Deletes the following files

%ProgramFiles(x86)%\showdec\xforms\taboutform.xfm
%ProgramFiles(x86)%\showdec\xforms\tupdatemainform.xfm
%ProgramFiles(x86)%\showdec\xforms\ttrialhintform.xfm
%ProgramFiles(x86)%\showdec\xforms\tsplashform.xfm
%ProgramFiles(x86)%\showdec\xforms\tshutdownform.xfm
%ProgramFiles(x86)%\showdec\xforms\tsettingsform.xfm
%ProgramFiles(x86)%\showdec\xforms\tregisterform.xfm
%ProgramFiles(x86)%\showdec\xforms\tpropertiesform.xfm
%ProgramFiles(x86)%\showdec\xforms\toptionsform.xfm
%ProgramFiles(x86)%\showdec\xforms\tmainform.xfm
%ProgramFiles(x86)%\showdec\xforms\tinputqueryform.xfm
%ProgramFiles(x86)%\showdec\xforms\tcustomprofileform.xfm
%ProgramFiles(x86)%\showdec\xforms\tconvertqueryform.xfm
%ProgramFiles(x86)%\showdec\xforms\tconfirmeraseform.xfm
%ProgramFiles(x86)%\showdec\xforms\tbconverterform.xfm
%ProgramFiles(x86)%\showdec\xforms\taddprogressform.xfm
%ProgramFiles(x86)%\showdec\xforms\tvideoclipform.xfm
%ProgramFiles(x86)%\showdec\xforms\tvideoeditform.xfm

Moves the following files

from %ProgramFiles(x86)%\showdec\is-nn9pj.tmp to %ProgramFiles(x86)%\showdec\unins000.exe
from %ProgramFiles(x86)%\showdec\decplugins\is-iapgh.tmp to %ProgramFiles(x86)%\showdec\decplugins\fdpavi.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-0ebva.tmp to %ProgramFiles(x86)%\showdec\decplugins\fdpac3.dll
from %ProgramFiles(x86)%\showdec\is-jgru4.tmp to %ProgramFiles(x86)%\showdec\ws_agentprocess.dll
from %WINDIR%\syswow64\is-s72hh.tmp to %WINDIR%\syswow64\xvid.ax
from %WINDIR%\syswow64\is-2t2uf.tmp to %WINDIR%\syswow64\iconv.dll
from %WINDIR%\syswow64\is-gitd3.tmp to %WINDIR%\syswow64\ac3filter.ax
from %ProgramFiles(x86)%\showdec\is-02533.tmp to %ProgramFiles(x86)%\showdec\ws_imagedecoder.dll
from %ProgramFiles(x86)%\showdec\is-takru.tmp to %ProgramFiles(x86)%\showdec\subpic.dll
from %ProgramFiles(x86)%\showdec\is-6prqo.tmp to %ProgramFiles(x86)%\showdec\ws_log.dll
from %ProgramFiles(x86)%\showdec\is-3h6k5.tmp to %ProgramFiles(x86)%\showdec\ws_text.dll
from %ProgramFiles(x86)%\showdec\is-il03g.tmp to %ProgramFiles(x86)%\showdec\ws_versionprocess.dll
from %ProgramFiles(x86)%\showdec\is-u1l27.tmp to %ProgramFiles(x86)%\showdec\ws_saleprocess.dll
from %ProgramFiles(x86)%\showdec\is-vgtcj.tmp to %ProgramFiles(x86)%\showdec\ws_imageproc.dll
from %ProgramFiles(x86)%\showdec\is-8eb2n.tmp to %ProgramFiles(x86)%\showdec\ws_avdec.dll
from %ProgramFiles(x86)%\showdec\is-b6v8j.tmp to %ProgramFiles(x86)%\showdec\ws_dataprocess.dll
from %ProgramFiles(x86)%\showdec\is-4eock.tmp to %ProgramFiles(x86)%\showdec\ws_decmgr.dll
from %ProgramFiles(x86)%\showdec\is-0etf9.tmp to %ProgramFiles(x86)%\showdec\ws_encmgr.dll
from %ProgramFiles(x86)%\showdec\is-eqqb2.tmp to %ProgramFiles(x86)%\showdec\ws_videosrc.dll
from %ProgramFiles(x86)%\showdec\is-7qafm.tmp to %ProgramFiles(x86)%\showdec\demuxmgr.dll
from %ProgramFiles(x86)%\showdec\is-ur57e.tmp to %ProgramFiles(x86)%\showdec\decodermgr.dll
from %ProgramFiles(x86)%\showdec\is-m48i2.tmp to %ProgramFiles(x86)%\showdec\mediainfo.dll
from %ProgramFiles(x86)%\showdec\is-h723e.tmp to %ProgramFiles(x86)%\showdec\streamreader.dll
from %ProgramFiles(x86)%\showdec\is-ud99u.tmp to %ProgramFiles(x86)%\showdec\mp3enc.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-uonup.tmp to %ProgramFiles(x86)%\showdec\decplugins\fdpflv.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-ittvc.tmp to %ProgramFiles(x86)%\showdec\decplugins\fdpmp4.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-0m90h.tmp to %ProgramFiles(x86)%\showdec\decplugins\fdpmpeg.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-1e8tl.tmp to %ProgramFiles(x86)%\showdec\decplugins\fdpmpgaudio.dll
from %ProgramFiles(x86)%\showdec\is-9mg72.tmp to %ProgramFiles(x86)%\showdec\cmdconverter.exe
from %ProgramFiles(x86)%\showdec\is-780t7.tmp to %ProgramFiles(x86)%\showdec\ws_batchconvproc.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-6v0r3.tmp to %ProgramFiles(x86)%\showdec\decplugins\vdprmvb.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-hft8n.tmp to %ProgramFiles(x86)%\showdec\decplugins\vdpape.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-gevbn.tmp to %ProgramFiles(x86)%\showdec\decplugins\vdpqcel.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-nrlp5.tmp to %ProgramFiles(x86)%\showdec\decplugins\vdpwmsdk.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-728it.tmp to %ProgramFiles(x86)%\showdec\decplugins\vdpvorbis.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-8676t.tmp to %ProgramFiles(x86)%\showdec\decplugins\vdppcm.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-oa6ru.tmp to %ProgramFiles(x86)%\showdec\decplugins\vdpnelly.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-jmlqj.tmp to %ProgramFiles(x86)%\showdec\decplugins\vdpmpeg.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-9unlc.tmp to %ProgramFiles(x86)%\showdec\decplugins\vdpmpeg4.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-p8fj0.tmp to %ProgramFiles(x86)%\showdec\decplugins\vdpdts.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-hl1n6.tmp to %ProgramFiles(x86)%\showdec\decplugins\vdpmpa.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-pq7jq.tmp to %ProgramFiles(x86)%\showdec\decplugins\vdpamr.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-1q0vq.tmp to %ProgramFiles(x86)%\showdec\decplugins\vdpac3.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-3j25s.tmp to %ProgramFiles(x86)%\showdec\decplugins\vdpaac.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-73904.tmp to %ProgramFiles(x86)%\showdec\decplugins\fdpdpg.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-nuvr1.tmp to %ProgramFiles(x86)%\showdec\decplugins\fdprmvb.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-m773f.tmp to %ProgramFiles(x86)%\showdec\decplugins\fdpogg.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-3c137.tmp to %ProgramFiles(x86)%\showdec\decplugins\fdpape.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-r136j.tmp to %ProgramFiles(x86)%\showdec\decplugins\fdpaac.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-2ijah.tmp to %ProgramFiles(x86)%\showdec\decplugins\fdpwmv.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-0j65i.tmp to %ProgramFiles(x86)%\showdec\decplugins\fdpmkv.dll
from %ProgramFiles(x86)%\showdec\decplugins\is-4ss3e.tmp to %ProgramFiles(x86)%\showdec\decplugins\fdpts.dll
from %ProgramFiles(x86)%\showdec\is-tdfkf.tmp to %ProgramFiles(x86)%\showdec\ws_batchconv.dll
from %ProgramFiles(x86)%\showdec\is-21l2t.tmp to %ProgramFiles(x86)%\showdec\wsplayer.dll
from %ProgramFiles(x86)%\showdec\is-70ro5.tmp to %ProgramFiles(x86)%\showdec\ijl15.dll
from %ProgramFiles(x86)%\showdec\is-b9061.tmp to %ProgramFiles(x86)%\showdec\auth.dll
from %ProgramFiles(x86)%\showdec\skin\is-1e5bm.tmp to %ProgramFiles(x86)%\showdec\skin\iconinfo.png
from %ProgramFiles(x86)%\showdec\skin\is-a3rjr.tmp to %ProgramFiles(x86)%\showdec\skin\iconerror.png
from %ProgramFiles(x86)%\showdec\skin\is-80pcu.tmp to %ProgramFiles(x86)%\showdec\skin\gettingstart.jpg
from %ProgramFiles(x86)%\showdec\xforms\is-adi60.tmp to %ProgramFiles(x86)%\showdec\xforms\tvideoeditform.xfm
from %ProgramFiles(x86)%\showdec\xforms\is-mfk62.tmp to %ProgramFiles(x86)%\showdec\xforms\tvideoclipform.xfm
from %ProgramFiles(x86)%\showdec\xforms\is-f4q2h.tmp to %ProgramFiles(x86)%\showdec\xforms\tupdatemainform.xfm
from %ProgramFiles(x86)%\showdec\xforms\is-163ms.tmp to %ProgramFiles(x86)%\showdec\xforms\ttrialhintform.xfm
from %ProgramFiles(x86)%\showdec\xforms\is-un1sj.tmp to %ProgramFiles(x86)%\showdec\xforms\tsplashform.xfm
from %ProgramFiles(x86)%\showdec\xforms\is-k5amc.tmp to %ProgramFiles(x86)%\showdec\xforms\tshutdownform.xfm
from %ProgramFiles(x86)%\showdec\xforms\is-l815j.tmp to %ProgramFiles(x86)%\showdec\xforms\tsettingsform.xfm
from %ProgramFiles(x86)%\showdec\xforms\is-uc5ks.tmp to %ProgramFiles(x86)%\showdec\xforms\tregisterform.xfm
from %ProgramFiles(x86)%\showdec\xforms\is-oe676.tmp to %ProgramFiles(x86)%\showdec\xforms\tpropertiesform.xfm
from %ProgramFiles(x86)%\showdec\xforms\is-evqdt.tmp to %ProgramFiles(x86)%\showdec\xforms\toptionsform.xfm
from %ProgramFiles(x86)%\showdec\xforms\is-gicd9.tmp to %ProgramFiles(x86)%\showdec\xforms\tmainform.xfm
from %ProgramFiles(x86)%\showdec\xforms\is-dhma7.tmp to %ProgramFiles(x86)%\showdec\xforms\tinputqueryform.xfm
from %ProgramFiles(x86)%\showdec\xforms\is-h5f02.tmp to %ProgramFiles(x86)%\showdec\xforms\tcustomprofileform.xfm
from %ProgramFiles(x86)%\showdec\xforms\is-ecuhs.tmp to %ProgramFiles(x86)%\showdec\xforms\tconvertqueryform.xfm
from %ProgramFiles(x86)%\showdec\xforms\is-77cds.tmp to %ProgramFiles(x86)%\showdec\xforms\tconfirmeraseform.xfm
from %ProgramFiles(x86)%\showdec\xforms\is-dane4.tmp to %ProgramFiles(x86)%\showdec\xforms\tbconverterform.xfm
from %ProgramFiles(x86)%\showdec\xforms\is-hce5e.tmp to %ProgramFiles(x86)%\showdec\xforms\taddprogressform.xfm
from %ProgramFiles(x86)%\showdec\xforms\is-r95ri.tmp to %ProgramFiles(x86)%\showdec\xforms\taboutform.xfm
from %ProgramFiles(x86)%\showdec\is-q68vk.tmp to %ProgramFiles(x86)%\showdec\showdec.exe
from %ProgramFiles(x86)%\showdec\is-36fbs.tmp to %ProgramFiles(x86)%\showdec\wmfdist.exe
from %ProgramFiles(x86)%\showdec\skin\is-u5nd6.tmp to %ProgramFiles(x86)%\showdec\skin\iconquest.png
from %ProgramFiles(x86)%\showdec\skin\is-6207q.tmp to %ProgramFiles(x86)%\showdec\skin\iconwarning.png
from %ProgramFiles(x86)%\showdec\skin\is-satda.tmp to %ProgramFiles(x86)%\showdec\skin\information.png
from %ProgramFiles(x86)%\showdec\skin\default\is-b9ca1.tmp to %ProgramFiles(x86)%\showdec\skin\default\controls.png
from %ProgramFiles(x86)%\showdec\is-g7trs.tmp to %ProgramFiles(x86)%\showdec\config.xml
from %ProgramFiles(x86)%\showdec\is-63cor.tmp to %ProgramFiles(x86)%\showdec\profile.dat
from %ProgramFiles(x86)%\showdec\is-rk9r3.tmp to %ProgramFiles(x86)%\showdec\format.dat
from %ProgramFiles(x86)%\showdec\is-q9tgj.tmp to %ProgramFiles(x86)%\showdec\mkvconverter.ini
from %ProgramFiles(x86)%\showdec\skin\is-25n3b.tmp to %ProgramFiles(x86)%\showdec\skin\splash.png
from %ProgramFiles(x86)%\showdec\skin\is-p6sch.tmp to %ProgramFiles(x86)%\showdec\skin\reg.png
from %ProgramFiles(x86)%\showdec\languages\is-050ov.tmp to %ProgramFiles(x86)%\showdec\languages\english.dat
from %ProgramFiles(x86)%\showdec\languages\is-9i2sq.tmp to %ProgramFiles(x86)%\showdec\languages\cht.dat
from %ProgramFiles(x86)%\showdec\languages\is-cqude.tmp to %ProgramFiles(x86)%\showdec\languages\chs.dat
from %ProgramFiles(x86)%\showdec\skin\default\is-vdcrj.tmp to %ProgramFiles(x86)%\showdec\skin\default\videoeditform.xml
from %ProgramFiles(x86)%\showdec\skin\default\is-jgrem.tmp to %ProgramFiles(x86)%\showdec\skin\default\videoeditform.png
from %ProgramFiles(x86)%\showdec\skin\default\is-p3p0p.tmp to %ProgramFiles(x86)%\showdec\skin\default\videoclipform.png
from %ProgramFiles(x86)%\showdec\skin\default\is-uf82i.tmp to %ProgramFiles(x86)%\showdec\skin\default\videoclipform.xml
from %ProgramFiles(x86)%\showdec\skin\default\is-gv5c2.tmp to %ProgramFiles(x86)%\showdec\skin\default\taskiconlist.bmp
from %ProgramFiles(x86)%\showdec\skin\default\is-eli8v.tmp to %ProgramFiles(x86)%\showdec\skin\default\splashform.xml
from %ProgramFiles(x86)%\showdec\skin\default\is-73viq.tmp to %ProgramFiles(x86)%\showdec\skin\default\skinform.xml
from %ProgramFiles(x86)%\showdec\skin\default\is-qllvq.tmp to %ProgramFiles(x86)%\showdec\skin\default\skinform.png
from %ProgramFiles(x86)%\showdec\skin\default\is-i3jrm.tmp to %ProgramFiles(x86)%\showdec\skin\default\profileicons.xml
from %ProgramFiles(x86)%\showdec\skin\default\is-vjuj3.tmp to %ProgramFiles(x86)%\showdec\skin\default\profileicons.png
from %ProgramFiles(x86)%\showdec\skin\default\is-or6fr.tmp to %ProgramFiles(x86)%\showdec\skin\default\pictures.xml
from %ProgramFiles(x86)%\showdec\skin\default\is-grcnr.tmp to %ProgramFiles(x86)%\showdec\skin\default\mainform.xml
from %ProgramFiles(x86)%\showdec\skin\default\is-vf86m.tmp to %ProgramFiles(x86)%\showdec\skin\default\mainform.png
from %ProgramFiles(x86)%\showdec\skin\default\is-088ca.tmp to %ProgramFiles(x86)%\showdec\skin\default\converticonlist.bmp
from %ProgramFiles(x86)%\showdec\skin\default\is-64fvs.tmp to %ProgramFiles(x86)%\showdec\skin\default\controls.xml
from %ProgramFiles(x86)%\showdec\is-iecsl.tmp to %ProgramFiles(x86)%\showdec\gdiplus.dll
from %ProgramFiles(x86)%\showdec\is-odj4p.tmp to %ProgramFiles(x86)%\showdec\ws_converter.dll

Substitutes the following files

%ProgramFiles(x86)%\showdec\xforms\taboutform.xfm
%ProgramFiles(x86)%\showdec\xforms\tupdatemainform.xfm
%ProgramFiles(x86)%\showdec\xforms\ttrialhintform.xfm
%ProgramFiles(x86)%\showdec\xforms\tsplashform.xfm
%ProgramFiles(x86)%\showdec\xforms\tshutdownform.xfm
%ProgramFiles(x86)%\showdec\xforms\tsettingsform.xfm
%ProgramFiles(x86)%\showdec\xforms\tregisterform.xfm
%ProgramFiles(x86)%\showdec\xforms\tpropertiesform.xfm
%ProgramFiles(x86)%\showdec\xforms\toptionsform.xfm
%ProgramFiles(x86)%\showdec\xforms\tmainform.xfm
%ProgramFiles(x86)%\showdec\xforms\tinputqueryform.xfm
%ProgramFiles(x86)%\showdec\xforms\tcustomprofileform.xfm
%ProgramFiles(x86)%\showdec\xforms\tconvertqueryform.xfm
%ProgramFiles(x86)%\showdec\xforms\tconfirmeraseform.xfm
%ProgramFiles(x86)%\showdec\xforms\tbconverterform.xfm
%ProgramFiles(x86)%\showdec\xforms\taddprogressform.xfm
%ProgramFiles(x86)%\showdec\xforms\tvideoclipform.xfm
%ProgramFiles(x86)%\showdec\xforms\tvideoeditform.xfm

Network activity

Connects to

'op###olad.com':80

TCP

HTTP POST requests

http://op###olad.com/v2/events

UDP

DNS ASK op###olad.com

Miscellaneous

Searches for the following windows

ClassName: '22EC645A-CD7E-44D8-B186-2C8C20C3B50F' WindowName: ''

Creates and executes the following

'%TEMP%\is-9unuf.tmp\<File name>.tmp' /SL5="$A0214,13501184,793600,<Full path to file>"
'%ProgramFiles(x86)%\showdec\wmfdist.exe' /Q:A /R:N
'%ProgramFiles(x86)%\showdec\showdec.exe' <File name>.exe

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней