Trojan.DownLoader45.22919

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-cbs4f.tmp\is-nt02r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-55fia.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hhfnp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ha4c9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qlmh5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-b7g0m.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gnh2l.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mgvnq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7m4fm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3n6ho.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-o6t4m.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-jmiqt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-58o05.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-okl9m.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9t15k.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rr3eg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1gand.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7m3mt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-jql09.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2m6b1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-99jp7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8f4mh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hr91j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i7956.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-645kb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gu7ie.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lar43.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c0m4k.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dhgnc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6g3gh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kbeil.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-u5sge.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cnsql.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ckbo1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-r10u1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vj7sd.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6l3lg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rpdqb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nrpd6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lchh6.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-65m7a.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-1al00.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-9abrd.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-j8tqp.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-8vu6p.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-j18f1.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-h3dll.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-f93es.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-kl74c.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-5t98t.tmp
%ProgramFiles(x86)%\universal extractor\is-7iir2.tmp
%ProgramFiles(x86)%\universal extractor\is-3prv2.tmp
%ProgramFiles(x86)%\universal extractor\is-r1sqa.tmp
%ProgramFiles(x86)%\universal extractor\is-gb96q.tmp
%ProgramFiles(x86)%\universal extractor\is-gcnqf.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-u434g.tmp
%ProgramFiles(x86)%\universal extractor\is-74rmn.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-m0qhk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-s6rtr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6i1kh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fi9s0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-087n4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-js2k2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5rdf0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1n190.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rn0b7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7cfnh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-g0s47.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rd8rb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-70p56.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-eea8e.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4q5qt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-n8m2h.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-64f0q.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hfqhi.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bc63h.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mabdj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-odt2c.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gd41q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9bbee.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sqhtg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-agv72.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ufdvu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-56rnl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8qrmg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c9bpv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1nlpj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i8mge.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-trmva.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dieuv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tovd1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9ljn4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5to9q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qbi8f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sjb7v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lm44r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e7ou3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1bfes.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2o5ma.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6217a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fok8p.tmp
%TEMP%\is-fokte.tmp\_isetup\_shfoldr.dll
%TEMP%\is-fokte.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-esvos.tmp
%ProgramFiles(x86)%\universal extractor\is-4nf18.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0r07f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tcmjr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tqgju.tmp
%TEMP%\is-fokte.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8kcvm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-aa9af.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tmd02.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e2l36.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-edi74.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-54j01.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-87amt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-15cch.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3h6ij.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7mkhd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qa5s6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tgrur.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oen0t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m0r21.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3dlo3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p1p6j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4i8gf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e9j83.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o57te.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bhbip.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-61qe9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ppi4b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-er973.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t0h7n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r7i41.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dbqfp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ld01r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7degf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mlrk5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6a35e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ifuua.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ktl1f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0temo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-urnoo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5glvd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jd5o1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rto7a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hneou.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a7abd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-75iav.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h8ngl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-piop3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-iq7tt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6adeg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oh4do.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ik876.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ignom.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-npsbc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lgdh2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gqpgr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ml10t.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-esvos.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hhfnp.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ha4c9.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-qlmh5.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-b7g0m.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-gnh2l.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rpdqb.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-3n6ho.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7m3mt.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-o6t4m.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-jmiqt.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-58o05.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-okl9m.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-9t15k.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-mgvnq.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-1gand.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-55fia.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-7m4fm.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-jql09.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-2m6b1.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-i7956.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-645kb.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gu7ie.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lar43.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c0m4k.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-rr3eg.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-6g3gh.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dhgnc.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-kbeil.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-cnsql.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ckbo1.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-r10u1.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vj7sd.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6l3lg.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-8f4mh.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-99jp7.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-u5sge.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-hr91j.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-nrpd6.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-g0s47.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-f93es.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-kl74c.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-1al00.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-9abrd.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-j8tqp.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-8vu6p.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-bc63h.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-j18f1.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-5t98t.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-u434g.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-74rmn.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-7iir2.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-3prv2.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-r1sqa.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-s6rtr.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-m0qhk.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-6i1kh.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-hfqhi.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-iq7tt.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-fi9s0.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-087n4.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-js2k2.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-5rdf0.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-1n190.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-gd41q.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-65m7a.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-lchh6.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-rn0b7.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-70p56.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-eea8e.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4q5qt.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-n8m2h.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-64f0q.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7cfnh.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rd8rb.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mabdj.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-odt2c.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9bbee.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ml10t.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c9bpv.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1nlpj.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dieuv.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e7ou3.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1bfes.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tovd1.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oen0t.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9ljn4.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qbi8f.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sjb7v.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lm44r.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7mkhd.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sqhtg.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ufdvu.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-agv72.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8qrmg.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-trmva.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-i8mge.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-4nf18.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-tcmjr.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tqgju.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8kcvm.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3h6ij.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-aa9af.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qa5s6.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tmd02.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5to9q.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-edi74.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-87amt.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-15cch.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fok8p.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6217a.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-2o5ma.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e2l36.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0r07f.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-54j01.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-56rnl.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h8ngl.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m0r21.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p1p6j.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4i8gf.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e9j83.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o57te.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ppi4b.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-61qe9.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-urnoo.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3dlo3.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mlrk5.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r7i41.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dbqfp.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-ld01r.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-7degf.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tgrur.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6a35e.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-er973.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t0h7n.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-h3dll.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-gb96q.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-ktl1f.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jd5o1.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rto7a.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-hneou.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a7abd.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-75iav.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-piop3.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ifuua.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bhbip.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gqpgr.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oh4do.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ik876.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ignom.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-npsbc.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lgdh2.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0temo.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5glvd.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6adeg.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-gcnqf.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{95c19CF5-54FF-11D3-8BDA-8920306aB1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-cbs4f.tmp\is-nt02r.tmp' /SL4 $11022C "<Full path to file>" 7460160 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' e8533d9ddf84c01b4a17aaf6ca086e7c

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней