Trojan.DownLoader45.33611

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-a7a2m.tmp\is-ap05d.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-eqa73.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ccl3b.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ccnor.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1jadj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-o4a3k.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rvsp1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fsbbp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cird9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-uq789.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8cu9h.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-362ds.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rvf4q.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3ieto.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-e3mpk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lsj1b.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fs59r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6qjrt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-b1gnn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qvqsi.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-a34q6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7gc6p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rs7fk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g6lr2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ne3ge.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9nd8j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ig13j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a7rlr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fcoj2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j1t9e.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mirai.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bfkvn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6gatq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-o3cph.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hu2ua.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7eppe.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-o5shb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iit4i.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hagl7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-l3g22.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-db1uf.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-jtplg.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-3h21m.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-dvuvr.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-osmsr.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-hlqd7.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-o9fr9.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-3pvc8.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-daqvt.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-iumes.tmp
%ProgramFiles(x86)%\universal extractor\is-h9jch.tmp
%ProgramFiles(x86)%\universal extractor\is-knv44.tmp
%ProgramFiles(x86)%\universal extractor\is-rl6o9.tmp
%ProgramFiles(x86)%\universal extractor\is-polkd.tmp
%ProgramFiles(x86)%\universal extractor\is-dvjl6.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ks8j2.tmp
%ProgramFiles(x86)%\universal extractor\is-4s0j9.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-2tg3v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-amnjb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-k2oaf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3bh8u.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5h6fi.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7el50.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-13tld.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-a5c1p.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-52f2t.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2cdol.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0je5r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-agsmm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mdtgq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-02616.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4f6ge.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6rueq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-sga21.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-s0fac.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hl9tb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ptr36.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-auk2i.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-isuqq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d49ou.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oknrt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c0s9i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kqtm9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3dpo3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k9nce.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0saaa.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jsap1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cka6c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9mbss.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6cu0q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vbb8n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n3hqa.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ceklg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9bldo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rgto4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8962a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-noqv2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ug3af.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-okt1o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nbm8f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5s33l.tmp
%TEMP%\is-4e7he.tmp\_isetup\_shfoldr.dll
%TEMP%\is-4e7he.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-jrmij.tmp
%ProgramFiles(x86)%\universal extractor\is-sspen.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7l6af.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j571f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9nkhr.tmp
%TEMP%\is-4e7he.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-74hlr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f7pq5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8inc8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hhol0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hda80.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m82b8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-if3gl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5lslu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8jb56.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qmh4h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n9edv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8a4lj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3afqj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-22lak.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f2orq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4nvkv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4kj31.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bojql.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qet6u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1el4s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c9ovk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r7gjk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pr40b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-am69k.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vvv09.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9d4qq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qdtdo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-729jm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r7fvb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mkcn4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ot8t6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dq00a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8l9dc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b990n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jed51.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2pm8s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n0i3b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-aqcbu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-et3c2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5g0mu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-49hkt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-prf0k.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-daa5o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5g4ig.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-edbhf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1758g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lj08u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6pjdb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7tnek.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jg8h8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v7ake.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-jrmij.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ccl3b.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ccnor.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-1jadj.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-o4a3k.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rvsp1.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-iit4i.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-uq789.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6qjrt.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-8cu9h.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-362ds.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rvf4q.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3ieto.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-e3mpk.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-fsbbp.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fs59r.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-eqa73.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-cird9.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-b1gnn.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-qvqsi.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-g6lr2.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ne3ge.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9nd8j.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ig13j.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a7rlr.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-lsj1b.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-j1t9e.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fcoj2.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-mirai.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6gatq.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-o3cph.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hu2ua.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7eppe.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-o5shb.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-7gc6p.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-a34q6.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bfkvn.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-rs7fk.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-hagl7.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0je5r.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-3pvc8.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-daqvt.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-jtplg.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-3h21m.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-dvuvr.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-osmsr.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-hl9tb.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-hlqd7.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-iumes.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ks8j2.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-4s0j9.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-h9jch.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-knv44.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-rl6o9.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-amnjb.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-2tg3v.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-k2oaf.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-s0fac.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-daa5o.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-3bh8u.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-5h6fi.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7el50.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-13tld.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-a5c1p.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-isuqq.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-db1uf.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-l3g22.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-52f2t.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mdtgq.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-02616.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4f6ge.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-6rueq.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-sga21.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2cdol.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-agsmm.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ptr36.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-auk2i.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d49ou.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v7ake.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0saaa.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jsap1.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6cu0q.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-noqv2.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ug3af.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vbb8n.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3afqj.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n3hqa.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9bldo.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rgto4.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8962a.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qmh4h.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oknrt.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kqtm9.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c0s9i.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k9nce.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9mbss.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cka6c.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-sspen.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-j571f.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9nkhr.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-74hlr.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8jb56.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f7pq5.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n9edv.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8inc8.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ceklg.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hda80.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-if3gl.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5lslu.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5s33l.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nbm8f.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-okt1o.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hhol0.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7l6af.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m82b8.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3dpo3.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-49hkt.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-22lak.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4nvkv.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4kj31.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bojql.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qet6u.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r7gjk.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c9ovk.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-b990n.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f2orq.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r7fvb.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vvv09.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9d4qq.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-qdtdo.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-729jm.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8a4lj.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mkcn4.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pr40b.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-am69k.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-o9fr9.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-polkd.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-dq00a.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2pm8s.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n0i3b.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-aqcbu.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-et3c2.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5g0mu.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-prf0k.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ot8t6.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1el4s.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jg8h8.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-edbhf.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1758g.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lj08u.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6pjdb.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7tnek.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8l9dc.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jed51.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5g4ig.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-dvjl6.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{c1959CF5-54FF-11D3-8BDA-2030689aB1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-a7a2m.tmp\is-ap05d.tmp' /SL4 $F014E "<Full path to file>" 7643270 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' bb964264d1f9bcbfb640c2ff2079294d

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней