Trojan.DownLoader45.25155

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-1ga08.tmp\is-jcool.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-dpjpv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-12hdi.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8sr6m.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m40ok.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3mbnh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-97mcd.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-s2ar6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m2bs3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vcmo1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4q4jq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-h013u.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-djs0q.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nr8ei.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9qc5e.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-pj2j5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-koo29.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kc46q.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-d5ppe.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-eterb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4188v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-iifrd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-855rd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j82dn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bc24f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7esuf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dno9n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0qjg8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k4gqr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7fvo5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-sdnjv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-40jeh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mhg6l.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-atvvg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bsmsu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-l0pmc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-io0ko.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cdq3t.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-93e00.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ucv73.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-bqe2f.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-vqgrd.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-5pa20.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-tv3f8.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-6bjem.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-vsvu6.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-0cl6s.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-1dmij.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-7augb.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-cppqi.tmp
%ProgramFiles(x86)%\universal extractor\is-ctg1q.tmp
%ProgramFiles(x86)%\universal extractor\is-s8h49.tmp
%ProgramFiles(x86)%\universal extractor\is-8n65p.tmp
%ProgramFiles(x86)%\universal extractor\is-uj5nh.tmp
%ProgramFiles(x86)%\universal extractor\is-6er3j.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-35s68.tmp
%ProgramFiles(x86)%\universal extractor\is-l78ev.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-f5emf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hj00t.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ao9ge.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-flp6c.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-uk02h.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-s272k.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-oo93a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qpm7v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q9f5f.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3i7ob.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-034fj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-s6mit.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-uap1m.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-t76sd.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cemq5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7j488.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-554ct.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5gtrh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-a40oq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-usc50.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l2mt6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1dn9f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a2sqa.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tpr7o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4o7m1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mnr6b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ugs15.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-764lg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hve2f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uns7i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4e9s3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gkt17.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o06m6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6nj2s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3kits.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nvkb4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t7ecj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r8ng4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bmff2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2dl9i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rm9to.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p1pbh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hha7l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tn72u.tmp
%TEMP%\is-vub80.tmp\_isetup\_shfoldr.dll
%TEMP%\is-vub80.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-nnt16.tmp
%ProgramFiles(x86)%\universal extractor\is-1plcd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k1k6n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qffli.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j67nu.tmp
%TEMP%\is-vub80.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kfht5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fal66.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7kae3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ho2qr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-upbku.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ha9qk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dv37c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jvmo8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ml5le.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cl3bv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4v0b0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k25ui.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9s6ke.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ufckm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2j4et.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5m4o8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h4s66.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vk782.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-81jun.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bh3ri.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9lafm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8t6i7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0638m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6qtv6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u0m6r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tgl1e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-isjbl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ii7ou.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ocauv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-45dn2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tglei.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g5m17.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ogp2q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2n2s0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9f1j8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a4kco.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qio6e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i6ga3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vmacl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dusap.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-20e1q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-02bni.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ms2uv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-devl8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v26mv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-847qo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nralt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rvj6u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jq9ac.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0dd6o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qftav.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-nnt16.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-12hdi.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8sr6m.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-m40ok.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3mbnh.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-97mcd.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-cdq3t.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-vcmo1.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-kc46q.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-4q4jq.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-h013u.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-djs0q.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-nr8ei.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-9qc5e.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-s2ar6.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-koo29.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-dpjpv.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-m2bs3.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-d5ppe.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-eterb.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-j82dn.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bc24f.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7esuf.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dno9n.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0qjg8.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-pj2j5.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-7fvo5.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k4gqr.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-sdnjv.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mhg6l.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-atvvg.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bsmsu.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-l0pmc.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-io0ko.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-iifrd.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-4188v.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-40jeh.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-855rd.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-93e00.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-034fj.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-1dmij.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-7augb.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-vqgrd.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-5pa20.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-tv3f8.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-6bjem.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-a40oq.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-vsvu6.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-cppqi.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-35s68.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-l78ev.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-ctg1q.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-s8h49.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-8n65p.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hj00t.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-f5emf.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-ao9ge.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-5gtrh.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-ms2uv.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-flp6c.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-uk02h.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-s272k.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-oo93a.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-qpm7v.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-1dn9f.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bqe2f.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ucv73.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-q9f5f.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-uap1m.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-t76sd.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-cemq5.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-7j488.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-554ct.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3i7ob.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-s6mit.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-usc50.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-l2mt6.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a2sqa.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qftav.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hve2f.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uns7i.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o06m6.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2dl9i.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rm9to.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6nj2s.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9s6ke.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3kits.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t7ecj.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r8ng4.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bmff2.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cl3bv.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tpr7o.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mnr6b.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4o7m1.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-764lg.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gkt17.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4e9s3.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-1plcd.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-qffli.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j67nu.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kfht5.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ml5le.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fal66.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4v0b0.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7kae3.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nvkb4.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-upbku.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dv37c.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jvmo8.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tn72u.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hha7l.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-p1pbh.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ho2qr.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k1k6n.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ha9qk.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ugs15.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-20e1q.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ufckm.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5m4o8.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h4s66.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vk782.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-81jun.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8t6i7.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9lafm.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2n2s0.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2j4et.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ocauv.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u0m6r.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tgl1e.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-isjbl.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-ii7ou.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k25ui.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-45dn2.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0638m.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6qtv6.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-0cl6s.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-uj5nh.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-g5m17.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a4kco.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qio6e.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-i6ga3.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vmacl.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dusap.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-02bni.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tglei.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bh3ri.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0dd6o.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v26mv.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-847qo.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nralt.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rvj6u.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jq9ac.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ogp2q.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9f1j8.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-devl8.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-6er3j.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{c1959CF5-54FF-11D3-8BDA-a0892036B1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-1ga08.tmp\is-jcool.tmp' /SL4 $130112 "<Full path to file>" 7593704 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' b238bde58b07beb274c661ad9149d9d7

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней