Trojan.DownLoader45.23159

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-k4jnp.tmp\is-l8111.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1104b.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ara4l.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-s76ae.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6odsl.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1p121.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-42bg1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mp4uk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-54dih.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9bsmd.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-utft1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-sh4q9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-brepq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3cfpm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4v84a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-r4ahp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6abng.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hls37.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-e5nm3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0r6se.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hsomb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l4im5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nlmfe.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2v9p3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k6k1n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c0061.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h80pp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p3vjr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2n9ub.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bicaf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ckaat.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ahq0e.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-v05sc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-h6spc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8s10h.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q5mjj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rdcv6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-a3h0r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m2ae9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-io7im.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-vt6sl.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-d3cvj.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-cg0v6.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-bkhae.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-vr94t.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-bo6kh.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-f41qq.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-vpfph.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ng95b.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-b7oji.tmp
%ProgramFiles(x86)%\universal extractor\is-jd9nr.tmp
%ProgramFiles(x86)%\universal extractor\is-hqvjk.tmp
%ProgramFiles(x86)%\universal extractor\is-1dsos.tmp
%ProgramFiles(x86)%\universal extractor\is-in5mc.tmp
%ProgramFiles(x86)%\universal extractor\is-86dq0.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-c5sdh.tmp
%ProgramFiles(x86)%\universal extractor\is-ash6h.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-5kd57.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-p63r0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-p2qp0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-r2c1d.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iqa8t.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8dtum.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vjmst.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6sca5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-v0qrm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1bsvk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vdjjo.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6vegg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9dojq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-p1ob6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-p9o9a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-jn6e7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mbte0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7q9h4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lgbm2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-sjgn6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-iqpfe.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qgkr5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7v3i3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8pqgg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-stpcj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m37cf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ol3a2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l64l6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jh014.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6fo21.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pgjtu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0cthm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m140t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s7t9a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fni0a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9fk2e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1gapa.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ai292.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3mt9u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9gauh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a1d2p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-13tlr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1781f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-79gj8.tmp
%TEMP%\is-440jt.tmp\_isetup\_shfoldr.dll
%TEMP%\is-440jt.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-h59lt.tmp
%ProgramFiles(x86)%\universal extractor\is-6j5i7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ro1qv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nhbev.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-54gs7.tmp
%TEMP%\is-440jt.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8suco.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-05acd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vrouf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-91a31.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2phd5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nsm00.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b6kve.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q502s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v866l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-om89l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4u5rv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-flm0j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p1o3j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d8dir.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n0c7t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9j30g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-geg7o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g1396.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2iv2m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7e8sv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3g9j3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pf0tc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0mfbf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hm2ga.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t1tcp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9ejg9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-22oc1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-718a3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kc4b2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c20oo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hjrld.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-06bqu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i1u1a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g7io3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v4ggs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lo4n1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gre94.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mct3q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bhaaf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ci3hv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-eeqgv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7ptmr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ldgvg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mb166.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9svit.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-322al.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-skdqo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ie49d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cada1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-drkbd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cfoif.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-h59lt.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ara4l.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-s76ae.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-6odsl.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-1p121.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-42bg1.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-a3h0r.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-9bsmd.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hls37.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-utft1.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-sh4q9.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-brepq.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3cfpm.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-4v84a.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-mp4uk.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6abng.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-1104b.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-54dih.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-e5nm3.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-0r6se.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-2v9p3.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k6k1n.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c0061.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h80pp.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p3vjr.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-r4ahp.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-bicaf.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2n9ub.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-ckaat.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-v05sc.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-h6spc.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8s10h.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-q5mjj.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rdcv6.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-l4im5.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-hsomb.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ahq0e.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-nlmfe.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-m2ae9.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vdjjo.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-vpfph.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ng95b.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-d3cvj.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-cg0v6.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-bkhae.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-vr94t.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-lgbm2.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-bo6kh.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-b7oji.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-c5sdh.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-ash6h.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-jd9nr.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-hqvjk.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-1dsos.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-p63r0.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-5kd57.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-p2qp0.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-7q9h4.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-ldgvg.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-r2c1d.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-iqa8t.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8dtum.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vjmst.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-6sca5.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-qgkr5.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vt6sl.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-io7im.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-v0qrm.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9dojq.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-p1ob6.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-p9o9a.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-jn6e7.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mbte0.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-1bsvk.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6vegg.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-sjgn6.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-iqpfe.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7v3i3.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cfoif.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jh014.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6fo21.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m140t.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9gauh.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a1d2p.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s7t9a.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p1o3j.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fni0a.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1gapa.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ai292.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3mt9u.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-om89l.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8pqgg.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m37cf.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-stpcj.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l64l6.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0cthm.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pgjtu.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-6j5i7.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-nhbev.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-54gs7.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8suco.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v866l.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-05acd.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4u5rv.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vrouf.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9fk2e.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2phd5.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-b6kve.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q502s.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-79gj8.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1781f.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-13tlr.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-91a31.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ro1qv.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nsm00.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ol3a2.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-eeqgv.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d8dir.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9j30g.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-geg7o.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g1396.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2iv2m.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pf0tc.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3g9j3.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g7io3.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n0c7t.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kc4b2.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t1tcp.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9ejg9.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-22oc1.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-718a3.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-flm0j.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c20oo.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0mfbf.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hm2ga.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-f41qq.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-in5mc.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-06bqu.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lo4n1.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gre94.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-mct3q.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bhaaf.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ci3hv.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7ptmr.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hjrld.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7e8sv.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-drkbd.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9svit.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-322al.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-skdqo.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ie49d.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cada1.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-i1u1a.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v4ggs.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mb166.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-86dq0.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{5c199CF5-54FF-11D3-8BDA-6a089203B1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-k4jnp.tmp\is-l8111.tmp' /SL4 $B0216 "<Full path to file>" 7442093 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' 086edeb8d8579ab131480cd14e4a080d

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней