Trojan.DownLoader45.21246

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-02gq4.tmp\is-kv1ch.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tvpuj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mo00l.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-okji7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-h57e8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hcdfn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qi11b.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ojd4l.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nu27e.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-k8lcj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-femlh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5luoj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1p143.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-96mas.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vnnf0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4moes.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9q057.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7pn1i.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8bmmb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tme6j.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6hct0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f3rco.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fdcbl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ghiuh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2dkm3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6u9a3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-48ibd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-iulg5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-sd95o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3dk5d.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0hd10.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9gmv6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6mc7e.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ipg6r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-69cj5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u6529.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ko6nt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vkou7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-342o1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-b9k3f.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-h1arj.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-bg5j5.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-9le10.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-9bcjg.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-9oji7.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-a24n3.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-bfdc1.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-gaa7k.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-brifl.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-q6idr.tmp
%ProgramFiles(x86)%\universal extractor\is-d5jvl.tmp
%ProgramFiles(x86)%\universal extractor\is-1mcqm.tmp
%ProgramFiles(x86)%\universal extractor\is-m00s6.tmp
%ProgramFiles(x86)%\universal extractor\is-lv46u.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-jdsjk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4gjfi.tmp
%ProgramFiles(x86)%\universal extractor\is-ca983.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-d4lga.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-b7n14.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-b4ocf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-t15cn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m9j1f.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-44rpg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fr62v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-e9q8f.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lcaj8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hetle.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lt52q.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-aubti.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-19bqc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-j4ac0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rhcdc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-o3d2h.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-c78ji.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-uqjcu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lnuj0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bt5og.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0l6f7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6afcd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-97k4h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-03snd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-iscch.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ekuac.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3flmo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6k78u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i1m93.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h3jb8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-04i39.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-61epd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-63t47.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m43mk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-memi0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dd974.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fake4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3oq38.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bbif3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kc4lj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7ad7c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4i9ut.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dr26q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-43287.tmp
%TEMP%\is-tou9n.tmp\_isetup\_shfoldr.dll
%TEMP%\is-tou9n.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-1to2v.tmp
%ProgramFiles(x86)%\universal extractor\is-6sfjh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-thu1h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cbafp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q1609.tmp
%TEMP%\is-tou9n.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bia12.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uah87.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mbl9h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-htpqb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b9a1n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oi36q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fih1g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f4ed6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hhac7.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-j7ds8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3ae9a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4o2bt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4ism7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h7v82.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jgfdi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1ap68.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t2ek0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6765h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jnoju.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l0t8t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ni5cq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k6a5s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vqloj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-og7bb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d7tjb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0ccel.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f0crs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o34k8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jt8fp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c7dtt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-davgn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gh5q0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-64oju.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kuf6b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rkclm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0872k.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-iim4h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ml0k9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6f0eh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ukp2d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1kh0i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5h3bg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-iakdf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5isff.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l7aiq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-36m1n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f7g3j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vvf57.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-luu14.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9taft.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-1to2v.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-tvpuj.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mo00l.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-okji7.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-h57e8.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-hcdfn.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-qi11b.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-u6529.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-k8lcj.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7pn1i.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-femlh.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-5luoj.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-1p143.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-96mas.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vnnf0.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-ojd4l.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-nu27e.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-sd95o.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-48ibd.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6hct0.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-0l6f7.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f3rco.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fdcbl.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ghiuh.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2dkm3.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6u9a3.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-4moes.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-9q057.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-3dk5d.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-vkou7.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0hd10.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9gmv6.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6mc7e.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ipg6r.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-69cj5.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-iulg5.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-ko6nt.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-lcaj8.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\is-m00s6.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-b9k3f.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-bfdc1.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-h1arj.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-brifl.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-bg5j5.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-9le10.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-9bcjg.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-tme6j.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-9oji7.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-gaa7k.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-jdsjk.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-q6idr.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-ca983.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-d5jvl.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-1mcqm.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\bin\is-d4lga.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-4gjfi.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-b7n14.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-uqjcu.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-c78ji.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-b4ocf.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-lt52q.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-t15cn.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-m9j1f.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-44rpg.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fr62v.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-8bmmb.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-lnuj0.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-e9q8f.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-aubti.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bt5og.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-19bqc.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-j4ac0.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rhcdc.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-o3d2h.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-j7ds8.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-hetle.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-a24n3.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\docs\is-6afcd.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ni5cq.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3flmo.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6k78u.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-i1m93.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-63t47.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bbif3.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kc4lj.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-htpqb.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7ad7c.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-memi0.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dd974.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fake4.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3oq38.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-43287.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3ae9a.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-iscch.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ekuac.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-61epd.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o34k8.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h3jb8.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-thu1h.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cbafp.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q1609.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bia12.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hhac7.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uah87.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-342o1.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m43mk.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mbl9h.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oi36q.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fih1g.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f4ed6.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dr26q.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-04i39.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-4i9ut.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\is-6sfjh.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-b9a1n.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1kh0i.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-03snd.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4o2bt.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4ism7.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h7v82.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jgfdi.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1ap68.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t2ek0.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jnoju.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9taft.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f0crs.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jt8fp.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k6a5s.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vqloj.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-og7bb.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-d7tjb.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-0ccel.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c7dtt.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l0t8t.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6765h.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-davgn.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gh5q0.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kuf6b.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rkclm.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-0872k.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-iim4h.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ml0k9.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ukp2d.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6f0eh.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-97k4h.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vvf57.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-iakdf.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5isff.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l7aiq.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-36m1n.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f7g3j.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-luu14.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-64oju.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5h3bg.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-lv46u.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{995C1CF5-54FF-11D3-8BDA-00600893B1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-02gq4.tmp\is-kv1ch.tmp' /SL4 $B0218 "<Full path to file>" 6702517 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' 3c650385176dff8ba827f6b4f6de86e9

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 29"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней