Trojan.DownLoader45.21247

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-nfgcv.tmp\is-mvhm1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-imfgp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-20k1r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m28nb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1te47.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-md7ar.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3i4b6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cgafh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ihcu1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ovo93.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7dhor.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-e5k0f.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ohnvp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tifqh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ih2nj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-dfjt7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9hibt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-f4cs6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-93d42.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fgvs7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-odc2g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g0ckg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7rma5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m6vdp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lcgk2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-260om.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a7sa5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3v44n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ovt9d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h49pr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-181gl.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6q5c8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-clk2g.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7neeu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-60eve.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-378d4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-od1pq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4b6kj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q0euj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-sum86.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-r0b34.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-umh42.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-0gfgh.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-0lr81.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-m40rt.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-lhrme.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-1p3fd.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-lqnfi.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-fmj6e.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-43qhg.tmp
%ProgramFiles(x86)%\universal extractor\is-e685e.tmp
%ProgramFiles(x86)%\universal extractor\is-pc1ul.tmp
%ProgramFiles(x86)%\universal extractor\is-gfrit.tmp
%ProgramFiles(x86)%\universal extractor\is-j2v7e.tmp
%ProgramFiles(x86)%\universal extractor\is-hqaqc.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-j76m5.tmp
%ProgramFiles(x86)%\universal extractor\is-6v7gl.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-it851.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-p2bop.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lpsrv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cjj99.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-js9vb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-n25pu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rncs3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7u3p6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-n905r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-oh7dc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-l6er4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-b3hs9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-sn5od.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0u8d6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-f6gad.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-o556p.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8ro7p.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1qkd5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-r2q98.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8udl3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0u6il.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-jqnvl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7aaiu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-16df5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-utusm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j2cjt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ove26.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nldcq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-66ai7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d26ui.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7mpse.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fh9p3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mbhie.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-572rl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5prev.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-me7an.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e7utn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4sa5v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6lktg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-udu53.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1jqel.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kkdku.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7ge6a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3esl7.tmp
%TEMP%\is-nl9l5.tmp\_isetup\_shfoldr.dll
%TEMP%\is-nl9l5.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-d8m36.tmp
%ProgramFiles(x86)%\universal extractor\is-dbvnk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fuh52.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3kmcf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uev6q.tmp
%TEMP%\is-nl9l5.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m8skq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fe8bu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ucn35.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ri9tg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-suu0e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qooba.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o3hev.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-av23f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5dedu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7ceqd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ms0c7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hcdm5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d877p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b04eq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9r06m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2vepd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-efiv8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kho5n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v5bkb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o35e6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3lpk2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t9k4n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qverp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5sp0s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u3aqi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2g6s7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9maan.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4vnij.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3paqr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7o0uk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sra92.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v9tb2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kl89h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-48umo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kioh6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qb9rk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mppf0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fccc7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-30bbj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2cgam.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5or4t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1t3he.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-55d67.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vhoaq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pe5ou.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9ktjs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-he3vp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ienll.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c1569.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-66fbb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n47l8.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-d8m36.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-20k1r.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-m28nb.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-1te47.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-md7ar.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3i4b6.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4b6kj.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-ovo93.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-f4cs6.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-7dhor.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-e5k0f.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ohnvp.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-tifqh.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-ih2nj.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-cgafh.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9hibt.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-imfgp.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-ihcu1.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-93d42.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-fgvs7.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-m6vdp.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lcgk2.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-260om.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a7sa5.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3v44n.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-dfjt7.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-h49pr.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ovt9d.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-181gl.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-clk2g.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7neeu.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-60eve.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-378d4.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-od1pq.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-g0ckg.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-odc2g.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6q5c8.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-7rma5.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-q0euj.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-l6er4.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-lqnfi.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-fmj6e.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-umh42.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-0gfgh.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-0lr81.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-m40rt.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-r2q98.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-lhrme.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-43qhg.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-j76m5.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-6v7gl.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-e685e.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-pc1ul.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-gfrit.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-p2bop.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-it851.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-lpsrv.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-1qkd5.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-55d67.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-cjj99.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-js9vb.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-n25pu.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rncs3.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-7u3p6.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-jqnvl.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-r0b34.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-sum86.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-n905r.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-sn5od.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0u8d6.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-f6gad.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-o556p.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8ro7p.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-oh7dc.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-b3hs9.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8udl3.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-0u6il.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7aaiu.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n47l8.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-66ai7.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d26ui.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mbhie.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-udu53.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1jqel.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-572rl.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d877p.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5prev.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e7utn.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4sa5v.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6lktg.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7ceqd.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-16df5.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j2cjt.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-utusm.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nldcq.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fh9p3.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7mpse.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-dbvnk.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-3kmcf.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uev6q.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m8skq.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5dedu.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fe8bu.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ms0c7.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ucn35.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-me7an.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-suu0e.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o3hev.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-av23f.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3esl7.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7ge6a.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-kkdku.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ri9tg.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fuh52.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qooba.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ove26.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5or4t.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-b04eq.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2vepd.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-efiv8.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kho5n.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v5bkb.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t9k4n.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3lpk2.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-48umo.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9r06m.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3paqr.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u3aqi.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2g6s7.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-9maan.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-4vnij.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hcdm5.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7o0uk.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qverp.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5sp0s.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-1p3fd.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-j2v7e.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-v9tb2.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qb9rk.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mppf0.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-fccc7.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-30bbj.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2cgam.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1t3he.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sra92.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o35e6.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-66fbb.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pe5ou.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9ktjs.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-he3vp.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ienll.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c1569.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kl89h.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kioh6.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vhoaq.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-hqaqc.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{995C1CF5-54FF-11D3-8BDA-00600893B1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-nfgcv.tmp\is-mvhm1.tmp' /SL4 $110022 "<Full path to file>" 7492255 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' 3358b5cb172becb40aa1ed78e66c3e55

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 29"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней