Trojan.DownLoader45.21226

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-j5h3o.tmp\is-9mfp0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5367l.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fq7hp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bi3qi.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4v5lo.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-53t9v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-a13c8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-v1dpe.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-12s93.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ojp9v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-967du.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-12edc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-isihq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cflc7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5di5i.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mojei.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tf4po.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-egrgt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-12v3o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tvmu8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rtqb0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ft3hf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8r7ii.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-grvd6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ufgsi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6ijso.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m44ts.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dec4s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5ulog.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p7ie4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5d7r4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9o162.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rjruv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-46m6o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-eu760.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-dj8re.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-dqp4q.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ki4rj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kdoem.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hc1lt.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-3pmr8.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-0hggn.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-e2cj8.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-lpt75.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-gedet.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-uroav.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ntn1h.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-q733f.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-1l1pf.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-0m25l.tmp
%ProgramFiles(x86)%\universal extractor\is-hfvpc.tmp
%ProgramFiles(x86)%\universal extractor\is-q6v3o.tmp
%ProgramFiles(x86)%\universal extractor\is-6r0jv.tmp
%ProgramFiles(x86)%\universal extractor\is-g98ib.tmp
%ProgramFiles(x86)%\universal extractor\is-knqce.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ujpqg.tmp
%ProgramFiles(x86)%\universal extractor\is-j4o3u.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-1390n.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ecdid.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-54u6d.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3bbj2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q09ln.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vdj57.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-oh9tv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-it8i2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fo9fm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hst26.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cpml6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7dhlr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6k22l.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-auhbu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qilti.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q1d5v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2lc1a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m6306.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ood9r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6vuce.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9kc85.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-h8ifm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nco1b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m9jne.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g1uri.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rma7q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ic759.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qijpr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6o76t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hul7d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6lqq6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r543c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hq468.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0ef7b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v06os.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ukj9s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-36bt3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m0gkb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l90st.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1g3do.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nidlf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qi8fq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v451p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jrfjk.tmp
%TEMP%\is-e8ain.tmp\_isetup\_shfoldr.dll
%TEMP%\is-e8ain.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-ro68g.tmp
%ProgramFiles(x86)%\universal extractor\is-ucq9n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9aml2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5v57v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i2q9n.tmp
%TEMP%\is-e8ain.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2j82o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ettfn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n02ng.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ptuam.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v6n7q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ap6bo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3gmqk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dh9d8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hkbh7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8clcu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-piaf6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vcrk7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l0vm2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mk6ki.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5sqiu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-frg45.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-knsoe.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fr8l6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-smbp3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7e33d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4uopn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nd9hr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mnb2c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ijtv8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l3b5u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tguml.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8evmh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ir9j3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8qd7u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-82hpk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dppc6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qetn0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5vmi0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j7t2b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8kccj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-279c3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c0k6v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pajvf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9fala.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-57rap.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-di39n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-inivc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qe464.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-te81s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sok1p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cqjbi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ft8fp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t1l53.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qjbgs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-516kk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g30l1.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-ro68g.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fq7hp.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bi3qi.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-4v5lo.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-53t9v.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-a13c8.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ki4rj.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-ojp9v.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-egrgt.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-967du.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-12edc.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-isihq.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-cflc7.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-5di5i.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-v1dpe.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-tf4po.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-5367l.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-12s93.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-12v3o.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-tvmu8.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-grvd6.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ufgsi.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6ijso.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m44ts.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dec4s.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-mojei.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-p7ie4.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5ulog.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-5d7r4.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rjruv.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-46m6o.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-eu760.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-dj8re.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-dqp4q.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-ft3hf.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-rtqb0.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9o162.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-8r7ii.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-kdoem.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-cpml6.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-q733f.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-1l1pf.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-0hggn.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-e2cj8.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-lpt75.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-gedet.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-ood9r.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-uroav.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-0m25l.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ujpqg.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-j4o3u.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-hfvpc.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-q6v3o.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-6r0jv.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ecdid.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-1390n.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-54u6d.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-m6306.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-qe464.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-3bbj2.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-q09ln.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vdj57.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-oh9tv.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-it8i2.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-h8ifm.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3pmr8.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hc1lt.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-fo9fm.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6k22l.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-auhbu.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-qilti.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-q1d5v.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2lc1a.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hst26.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7dhlr.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6vuce.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-9kc85.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nco1b.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g30l1.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6o76t.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hul7d.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hq468.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1g3do.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nidlf.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0ef7b.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l0vm2.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v06os.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-36bt3.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m0gkb.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l90st.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8clcu.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m9jne.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rma7q.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g1uri.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qijpr.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r543c.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6lqq6.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-ucq9n.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-5v57v.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-i2q9n.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2j82o.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hkbh7.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ettfn.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-piaf6.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n02ng.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ukj9s.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v6n7q.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3gmqk.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dh9d8.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jrfjk.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v451p.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-qi8fq.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ptuam.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9aml2.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ap6bo.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ic759.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-di39n.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mk6ki.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-frg45.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-knsoe.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fr8l6.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-smbp3.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nd9hr.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4uopn.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j7t2b.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5sqiu.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8qd7u.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l3b5u.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tguml.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-8evmh.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-ir9j3.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vcrk7.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-82hpk.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mnb2c.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ijtv8.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ntn1h.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-g98ib.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-qetn0.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-279c3.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c0k6v.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-pajvf.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9fala.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-57rap.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-inivc.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dppc6.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7e33d.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-516kk.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sok1p.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cqjbi.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ft8fp.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t1l53.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qjbgs.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5vmi0.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8kccj.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-te81s.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-knqce.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{995C1CF5-54FF-11D3-8BDA-00600893B1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-j5h3o.tmp\is-9mfp0.tmp' /SL4 $11013A "<Full path to file>" 7482327 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' e2c1aa14e304ade4d28d8c1c13a75dfa

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 29"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней