Trojan.DownLoader45.22184

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-tcnmi.tmp\is-vq566.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bo9dj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-f22kt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-66j5o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tj9n5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q6m0g.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-155ad.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nuoju.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-h9cf6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-skj46.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-g8rrv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lc8v0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4od3f.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-apn43.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-a9rqb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-85o9v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-f56eb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4qmfd.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-49euo.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-eakgv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ftdrl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1tlv3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qmum3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ji9sd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-777s5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8l3s9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6tm35.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-26o4o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1eq9b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oid8t.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gotng.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gpg1d.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-crtb9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-j60lr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2ft8r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bsfv5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q2831.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-p8lav.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8h7pa.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-svhab.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-milsr.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-5r9ta.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-60htm.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ae7ks.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-9h0j2.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-c92ta.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-bfigp.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-3dpt4.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-op8h9.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-6usjb.tmp
%ProgramFiles(x86)%\universal extractor\is-20vpo.tmp
%ProgramFiles(x86)%\universal extractor\is-pltf8.tmp
%ProgramFiles(x86)%\universal extractor\is-40vsv.tmp
%ProgramFiles(x86)%\universal extractor\is-geqcr.tmp
%ProgramFiles(x86)%\universal extractor\is-nnekc.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-uv36d.tmp
%ProgramFiles(x86)%\universal extractor\is-ugh4t.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-jc88o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qbd04.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-s07j8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-v0epo.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-f554k.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gc5jb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lt3m3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nod27.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-l82m0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vpod7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-anm6k.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9ut6i.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iatv7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-l1ae8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-jm7an.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6gof7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vdpl0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gg0u6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-u4k9a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-p5lvf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mmpfk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nk2c9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uopuh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l1cab.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g8kbi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7vup8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-anb3u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n89oi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4gfs1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sumql.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lvgt3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5clff.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-flbm0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hmmc9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-eg894.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nevgg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a2g9m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p1rcr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e0emv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vuma0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gov65.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hg1t9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rsrov.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ge7lv.tmp
%TEMP%\is-ckgqg.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ckgqg.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-4b08v.tmp
%ProgramFiles(x86)%\universal extractor\is-91ibg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ajcrc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rspr1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uldak.tmp
%TEMP%\is-ckgqg.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1pjeo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9idif.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0tsen.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e0te9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lqr79.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4lkch.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-69fg1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u3hfq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qqhil.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-352cr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j1bf4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ehgok.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-imitc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h2lii.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l750f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-30itb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-he41s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-clrto.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fu63f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dgf37.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ptps7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ohv39.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-plgsv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1js9q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-05oma.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ulvi0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tu6eo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ml7pm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qj2il.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i7sgl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mugm8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-76esa.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qp9tv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3elfs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ui9ps.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d2su0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s88dv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-42562.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6fd7p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gtmul.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-79qjo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gnmo9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nfm7m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p0r93.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ar13e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-af57c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ki4s9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-322b1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-14pk5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k59sl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1sgsi.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-4b08v.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-f22kt.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-66j5o.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-tj9n5.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-q6m0g.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-155ad.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-p8lav.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-skj46.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4qmfd.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-g8rrv.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-lc8v0.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4od3f.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-apn43.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-a9rqb.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-nuoju.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-f56eb.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bo9dj.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-h9cf6.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-49euo.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-eakgv.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-ji9sd.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-777s5.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8l3s9.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6tm35.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-26o4o.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-85o9v.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-oid8t.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1eq9b.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-gotng.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-crtb9.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-j60lr.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2ft8r.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bsfv5.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-q2831.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-1tlv3.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-ftdrl.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-gpg1d.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-qmum3.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-8h7pa.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-anm6k.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-3dpt4.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-op8h9.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-5r9ta.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-60htm.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ae7ks.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-9h0j2.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-u4k9a.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-c92ta.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-6usjb.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-uv36d.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-ugh4t.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-20vpo.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-pltf8.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-40vsv.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-qbd04.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-jc88o.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-s07j8.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-gg0u6.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-nfm7m.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-v0epo.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-f554k.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-gc5jb.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-lt3m3.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-nod27.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-nk2c9.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-milsr.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-svhab.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-l82m0.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-iatv7.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-l1ae8.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-jm7an.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-6gof7.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vdpl0.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vpod7.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9ut6i.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-p5lvf.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-mmpfk.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uopuh.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1sgsi.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4gfs1.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sumql.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-flbm0.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vuma0.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gov65.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hmmc9.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-imitc.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-eg894.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a2g9m.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p1rcr.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e0emv.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-352cr.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l1cab.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7vup8.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g8kbi.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n89oi.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5clff.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lvgt3.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-91ibg.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-rspr1.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uldak.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1pjeo.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qqhil.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9idif.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j1bf4.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0tsen.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nevgg.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lqr79.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-69fg1.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u3hfq.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ge7lv.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rsrov.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-hg1t9.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e0te9.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ajcrc.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4lkch.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-anb3u.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-79qjo.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h2lii.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-30itb.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-he41s.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-clrto.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fu63f.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ohv39.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ptps7.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3elfs.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l750f.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qj2il.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-05oma.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ulvi0.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-tu6eo.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-ml7pm.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ehgok.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-i7sgl.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-plgsv.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1js9q.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-bfigp.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-geqcr.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-76esa.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d2su0.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s88dv.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-42562.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6fd7p.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gtmul.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gnmo9.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mugm8.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dgf37.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k59sl.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ar13e.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-af57c.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ki4s9.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-322b1.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-14pk5.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qp9tv.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ui9ps.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p0r93.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-nnekc.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{995C1CF5-54FF-11D3-8BDA-00600893B1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-tcnmi.tmp\is-vq566.tmp' /SL4 $B0218 "<Full path to file>" 7486369 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' b2dfe7d22dc59de2ff247426713a3532

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 29"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней