Trojan.DownLoader45.22840

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-i3ics.tmp\is-poscs.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m1hel.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1fpre.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1hqcl.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vqlot.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vv25e.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-j4pgc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-18hvg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-acrs5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-p4l48.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ctrfu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gj012.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3l54v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7gevo.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-sqp9s.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-j3ihq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-dp9pu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-75e1i.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lf85d.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-j9ske.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ke11t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7opr3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-912md.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pdp36.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ga3od.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v56cp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j1u5p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oni35.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dvka9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-19en8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ckamp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hl2r1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-07sti.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-n6ece.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5bp22.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7on6h.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2l1m1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-n931v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bml3o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-pvfhv.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-0ljp9.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-oralf.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-pplkq.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-nf1vq.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-g4iu2.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-fkfpi.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-i5go7.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-de6ll.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-pte48.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-hvgro.tmp
%ProgramFiles(x86)%\universal extractor\is-sqloa.tmp
%ProgramFiles(x86)%\universal extractor\is-ppnn6.tmp
%ProgramFiles(x86)%\universal extractor\is-ms9gu.tmp
%ProgramFiles(x86)%\universal extractor\is-0kids.tmp
%ProgramFiles(x86)%\universal extractor\is-rbmbr.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-qc20n.tmp
%ProgramFiles(x86)%\universal extractor\is-aqipp.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-9n8bd.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-n4lpp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5fs2h.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-og0pb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-f0rvu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-01ge6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4nsnl.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mi0i9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-oqrfi.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m6gra.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rkl43.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-uvdk9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8v80j.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-glevc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-im1jk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kils4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3dmmo.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-o8cd5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-c8ojh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cqv89.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gor3c.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7bvgo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-eu43r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1m86m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-274ck.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gp01p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a2eus.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6togi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-iaba7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b70gn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9b12n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-aubgr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8p6gj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c3lou.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a2ugl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-slkvd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g332g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cn6g5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4mgbp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h9oc5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nct38.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7h7qb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-shajn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u4ml8.tmp
%TEMP%\is-eprk7.tmp\_isetup\_shfoldr.dll
%TEMP%\is-eprk7.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-c60gq.tmp
%ProgramFiles(x86)%\universal extractor\is-6pemu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jba9s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4k3dp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vqkrl.tmp
%TEMP%\is-eprk7.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i2n49.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lstp2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s8cf2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tagc6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6oga2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-73lsq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lqncm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s42nd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2r1vh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-co5a2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t71g5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-avea3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e0u2n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bp026.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fqhmr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m4jmf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m2mdp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tl80h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h4rlj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-iqav3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jcfpt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tggj7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a0o66.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s8kp4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r5v94.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8v5f9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ps4tb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dvcfu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-squcj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vd55l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nnr96.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6d5gr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pdqi7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f4f2j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dkbml.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ktoa8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-45iog.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ht7su.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0be5e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c44b4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rbbfr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-urdfq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1k427.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dp222.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mqj5h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4qoc1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7j8mp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9mhvr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-odudb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qb6gg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3kav6.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-c60gq.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-1fpre.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-1hqcl.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-vqlot.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vv25e.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-j4pgc.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-n931v.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-p4l48.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-75e1i.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-ctrfu.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-gj012.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3l54v.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7gevo.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-sqp9s.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-18hvg.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-dp9pu.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-m1hel.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-acrs5.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-lf85d.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-j9ske.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-pdp36.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ga3od.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v56cp.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j1u5p.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oni35.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-j3ihq.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-19en8.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dvka9.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-ckamp.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-07sti.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-n6ece.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-5bp22.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7on6h.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2l1m1.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-7opr3.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-ke11t.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hl2r1.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-912md.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-bml3o.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rkl43.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-de6ll.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-pte48.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-oralf.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-pplkq.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-nf1vq.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-g4iu2.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-c8ojh.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-fkfpi.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-hvgro.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-qc20n.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-aqipp.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-sqloa.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-ppnn6.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-ms9gu.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-n4lpp.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-9n8bd.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-5fs2h.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-o8cd5.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-1k427.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-og0pb.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-f0rvu.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-01ge6.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4nsnl.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-mi0i9.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7bvgo.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0ljp9.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-pvfhv.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-oqrfi.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8v80j.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-glevc.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-im1jk.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-kils4.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3dmmo.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-m6gra.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-uvdk9.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-cqv89.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-gor3c.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-eu43r.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3kav6.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-iaba7.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-b70gn.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8p6gj.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h9oc5.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nct38.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c3lou.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e0u2n.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a2ugl.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g332g.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cn6g5.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4mgbp.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-co5a2.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1m86m.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gp01p.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-274ck.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6togi.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-aubgr.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9b12n.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-6pemu.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-4k3dp.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vqkrl.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-i2n49.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2r1vh.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lstp2.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t71g5.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s8cf2.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-slkvd.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6oga2.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lqncm.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s42nd.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u4ml8.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-shajn.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-7h7qb.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tagc6.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jba9s.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-73lsq.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a2eus.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rbbfr.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bp026.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m4jmf.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m2mdp.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tl80h.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h4rlj.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tggj7.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jcfpt.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f4f2j.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fqhmr.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-squcj.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r5v94.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8v5f9.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-ps4tb.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-dvcfu.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-avea3.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vd55l.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a0o66.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s8kp4.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-i5go7.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-0kids.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-6d5gr.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ktoa8.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-45iog.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-ht7su.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0be5e.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c44b4.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-urdfq.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nnr96.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-iqav3.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qb6gg.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mqj5h.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4qoc1.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7j8mp.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9mhvr.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-odudb.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pdqi7.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dkbml.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dp222.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-rbmbr.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{95c19CF5-54FF-11D3-8BDA-8920306aB1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-i3ics.tmp\is-poscs.tmp' /SL4 $A0214 "<Full path to file>" 7474720 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' e038bf77a92a88ffc1305d8143d034ca

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней