Trojan.DownLoader35.49739

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-72uqg.tmp\<File name>.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-ofv1f.tmp
%ProgramFiles(x86)%\nwis copy\is-mvugf.tmp
%ProgramFiles(x86)%\nwis copy\is-31l8o.tmp
%ProgramFiles(x86)%\nwis copy\is-roe4c.tmp
%ProgramFiles(x86)%\nwis copy\is-irlpo.tmp
%ProgramFiles(x86)%\nwis copy\is-qlssv.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-ocaj4.tmp
%ProgramFiles(x86)%\nwis copy\is-4bc67.tmp
%ProgramFiles(x86)%\nwis copy\is-clv94.tmp
%WINDIR%\is-mmbcr.tmp
%ProgramFiles(x86)%\nwis copy\help\is-91g4m.tmp
%ProgramFiles(x86)%\nwis copy\is-7kom3.tmp
%WINDIR%\syswow64\is-u0vgb.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nwis copy\nwis copy.lnk
%ProgramFiles(x86)%\nwis copy\skins\0\is-orede.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-5v7gt.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-rnf7j.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-udvjf.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-9t72n.tmp
%TEMP%\is-5cnq7.tmp\_isetup\_setup64.tmp
%TEMP%\is-5cnq7.tmp\_isetup\_shfoldr.dll
%TEMP%\is-5cnq7.tmp\_isetup\_isdecmp.dll
%TEMP%\is-5cnq7.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\nwis copy\is-k8uk1.tmp
%ProgramFiles(x86)%\nwis copy\language\is-dc31c.tmp
%ProgramFiles(x86)%\nwis copy\windvdcopy.url
%ProgramFiles(x86)%\nwis copy\is-qjrir.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-6ud19.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-f3tlq.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-1nf6f.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-4i681.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-1aun3.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-qlr6k.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-j3s9j.tmp
%TEMP%\is-5cnq7.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\nwis copy\skins\0\is-9807h.tmp
%ProgramFiles(x86)%\nwis copy\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\nwis copy\is-k8uk1.tmp to %ProgramFiles(x86)%\nwis copy\unins000.exe
from %ProgramFiles(x86)%\nwis copy\help\is-91g4m.tmp to %ProgramFiles(x86)%\nwis copy\help\winavi dvd copy help.chm
from %WINDIR%\is-mmbcr.tmp to %WINDIR%\windvdbootrecdoe.sys
from %ProgramFiles(x86)%\nwis copy\is-clv94.tmp to %ProgramFiles(x86)%\nwis copy\readme.txt
from %ProgramFiles(x86)%\nwis copy\is-qjrir.tmp to %ProgramFiles(x86)%\nwis copy\videoburn.dll
from %ProgramFiles(x86)%\nwis copy\is-4bc67.tmp to %ProgramFiles(x86)%\nwis copy\fileio.dll
from %ProgramFiles(x86)%\nwis copy\is-qlssv.tmp to %ProgramFiles(x86)%\nwis copy\aspi.dll
from %ProgramFiles(x86)%\nwis copy\is-irlpo.tmp to %ProgramFiles(x86)%\nwis copy\dvdcopy.dll
from %ProgramFiles(x86)%\nwis copy\is-roe4c.tmp to %ProgramFiles(x86)%\nwis copy\core.dll
from %ProgramFiles(x86)%\nwis copy\is-31l8o.tmp to %ProgramFiles(x86)%\nwis copy\dvd2one.dll
from %ProgramFiles(x86)%\nwis copy\is-mvugf.tmp to %ProgramFiles(x86)%\nwis copy\mpeg2videotranslator.dll
from %ProgramFiles(x86)%\nwis copy\skins\0\is-ofv1f.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\animation.gif
from %ProgramFiles(x86)%\nwis copy\skins\0\is-5v7gt.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\copynow.bmp
from %ProgramFiles(x86)%\nwis copy\is-7kom3.tmp to %ProgramFiles(x86)%\nwis copy\mwiscopy.exe
from %ProgramFiles(x86)%\nwis copy\skins\0\is-orede.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\setting.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-udvjf.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\down.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-9t72n.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\wizard.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-j3s9j.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\splash.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-qlr6k.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\min.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-1aun3.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\menu.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-4i681.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\help.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-1nf6f.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\close.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-f3tlq.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\web.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-9807h.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\buynow.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-ocaj4.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\background.bmp
from %ProgramFiles(x86)%\nwis copy\skins\0\is-6ud19.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\skin.ini
from %ProgramFiles(x86)%\nwis copy\language\is-dc31c.tmp to %ProgramFiles(x86)%\nwis copy\language\english.ini
from %ProgramFiles(x86)%\nwis copy\skins\0\is-rnf7j.tmp to %ProgramFiles(x86)%\nwis copy\skins\0\select.bmp
from %WINDIR%\syswow64\is-u0vgb.tmp to %WINDIR%\syswow64\sqlite3.dll