Trojan.DownLoader45.22854

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-cuom1.tmp\is-ola0a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tknm3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mapr6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-naefr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-h2evc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vbnm9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-e1an3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5159b.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-i4ebu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-l7n2d.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-h6p8p.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-s5shp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gn9v5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-d4638.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lqntv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m8j2p.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mquv6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5814d.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fqib9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tfel4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0o4l4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8t69b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fm1u7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-92acr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5tjl6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u34r3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1kh5t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0d6u6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e40br.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-prk2r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0lhpp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-pvgsh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3k81j.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-i9ef7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ujjoj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9kg1l.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-41ei6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mlvif.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m6cn1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3f58e.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-ljbe2.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-fsnvo.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-r6dso.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-nfndv.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-o2r59.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-42q03.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-3ip5b.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-i0f5s.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ervtq.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-aqlru.tmp
%ProgramFiles(x86)%\universal extractor\is-j02u9.tmp
%ProgramFiles(x86)%\universal extractor\is-ld7bi.tmp
%ProgramFiles(x86)%\universal extractor\is-cuc7a.tmp
%ProgramFiles(x86)%\universal extractor\is-o2mg9.tmp
%ProgramFiles(x86)%\universal extractor\is-f7bk9.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-0uhq6.tmp
%ProgramFiles(x86)%\universal extractor\is-ml3jl.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-rljbo.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8a60v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-o1jd2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8ad21.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-84ptt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-anp0e.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-j0m1d.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-urnbg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fomo5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7onql.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-naj2h.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cfpne.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9iikt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9iihe.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vibcc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-54eg8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-f48lu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8o8di.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-r7vbu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kdpol.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lgbip.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-sqe9i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8u5o1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tigo6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2fop0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j48u7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-49q5j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hlqcm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qdlre.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t3atb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gpsb6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-58stk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-57n07.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gj85s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gnopp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tovnl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-emdg9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k9hrh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p1d52.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3n9cq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1br2u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a0c8o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ienet.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6ij9p.tmp
%TEMP%\is-fjtmq.tmp\_isetup\_shfoldr.dll
%TEMP%\is-fjtmq.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-o8s47.tmp
%ProgramFiles(x86)%\universal extractor\is-b0uoi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tv8ke.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tihf3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qkr0l.tmp
%TEMP%\is-fjtmq.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ku5ll.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vjdkn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cbufn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d27vv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7d9vg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-24o4d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q9s15.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kv967.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h79gv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7apb2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kci62.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o16e2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-93v8q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-moj62.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tkdim.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q9sc5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mb4en.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nabbr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mreej.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vkvc5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o7cnp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vj8il.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1818u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-idd1e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-19un4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f4hbq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bkpsg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ng4u7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7k8m8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u24kg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ljeeg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c6grd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jtgsl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-43d3d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sdah8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3odvn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r0omb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nklen.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-iqhcr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bg1ok.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l868m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8hitp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dsgci.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-902m7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vvlcn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1gesj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1a285.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-daef8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n3cku.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fpdas.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qf91h.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-o8s47.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mapr6.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-naefr.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-h2evc.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vbnm9.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-e1an3.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mlvif.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-l7n2d.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-5814d.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-h6p8p.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-s5shp.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-gn9v5.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-d4638.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-lqntv.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-5159b.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mquv6.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-tknm3.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-i4ebu.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fqib9.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-tfel4.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-92acr.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5tjl6.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u34r3.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1kh5t.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0d6u6.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-m8j2p.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-prk2r.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e40br.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-0lhpp.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3k81j.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-i9ef7.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ujjoj.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9kg1l.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-41ei6.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-8t69b.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-0o4l4.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-pvgsh.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-fm1u7.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-m6cn1.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-naj2h.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-i0f5s.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ervtq.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-fsnvo.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-r6dso.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-nfndv.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-o2r59.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-r7vbu.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-42q03.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-aqlru.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-0uhq6.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-ml3jl.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-j02u9.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-ld7bi.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-cuc7a.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8a60v.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-rljbo.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-o1jd2.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-8o8di.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-dsgci.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-8ad21.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-84ptt.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-anp0e.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-j0m1d.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-urnbg.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-sqe9i.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ljbe2.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3f58e.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-fomo5.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9iikt.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9iihe.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vibcc.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-54eg8.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-f48lu.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7onql.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-cfpne.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-kdpol.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-lgbip.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8u5o1.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qf91h.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qdlre.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t3atb.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-57n07.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3n9cq.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1br2u.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gj85s.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-93v8q.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gnopp.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-emdg9.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k9hrh.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p1d52.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7apb2.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tigo6.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j48u7.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2fop0.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hlqcm.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-58stk.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gpsb6.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-b0uoi.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-tihf3.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qkr0l.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ku5ll.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h79gv.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vjdkn.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kci62.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cbufn.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tovnl.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7d9vg.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q9s15.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kv967.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6ij9p.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ienet.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-a0c8o.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d27vv.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tv8ke.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-24o4d.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-49q5j.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l868m.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-moj62.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q9sc5.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mb4en.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nabbr.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mreej.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vj8il.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o7cnp.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-43d3d.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tkdim.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7k8m8.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-19un4.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f4hbq.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-bkpsg.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-ng4u7.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o16e2.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u24kg.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1818u.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-idd1e.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-3ip5b.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-o2mg9.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-c6grd.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3odvn.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r0omb.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-nklen.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-iqhcr.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bg1ok.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8hitp.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ljeeg.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vkvc5.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fpdas.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vvlcn.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1gesj.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1a285.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-daef8.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n3cku.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jtgsl.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sdah8.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-902m7.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-f7bk9.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{995C1CF5-54FF-11D3-8BDA-00600893B1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-cuom1.tmp\is-ola0a.tmp' /SL4 $120144 "<Full path to file>" 7488868 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' 947fd64eac2845e6067db681e2739dc2

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 29"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней