Trojan.DownLoader45.23216

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-q820f.tmp\is-fvlb1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ln38k.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-b4ht9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-96dls.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m1t70.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-64abt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-84hgn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-k6v87.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-akl7o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vuo5v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-e9m6p.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mg0j9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nff02.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-12377.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fpdf7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0t2ch.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-g4g2h.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-b90ch.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1af0o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0r7pt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hq930.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f3c26.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-og0ps.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vqukh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-soaf4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-69uuc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qebto.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2slr0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qq9og.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d5sef.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-h97r8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-i13hc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ulbd9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-90dr1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lv9b1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3i7jc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ocem8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-b5em2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6nr9b.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5j7tq.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-sf8kg.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ttu0a.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ushb1.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-6ajet.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-cgd9h.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-qq2it.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-blpmu.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-k2ui8.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-p4oj7.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-4mklb.tmp
%ProgramFiles(x86)%\universal extractor\is-j51nh.tmp
%ProgramFiles(x86)%\universal extractor\is-83qj9.tmp
%ProgramFiles(x86)%\universal extractor\is-utqtd.tmp
%ProgramFiles(x86)%\universal extractor\is-e7oc7.tmp
%ProgramFiles(x86)%\universal extractor\is-94v3i.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-es80m.tmp
%ProgramFiles(x86)%\universal extractor\is-mqfpk.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-tv8h4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-dg0e4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-93ed0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q7g1q.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mtna9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-in41t.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4ulq8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-spgv8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4scgd.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hq0vh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-a74c6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0s59c.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9ulfu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7stc3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-df0j7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ii3q3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4nrcj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mruqc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-oerlk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kioho.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ird67.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-jqhcn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2deaq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u537d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-318rb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jhdbc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-894er.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2u30d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m6qpe.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-grksq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6r2u6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j93q6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6vfd2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g0hvh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9suhk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c7k48.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fcpqn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rmv98.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j1f98.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l4jqg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pshav.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pgqpe.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1hppu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6t7g3.tmp
%TEMP%\is-phv8e.tmp\_isetup\_shfoldr.dll
%TEMP%\is-phv8e.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-t9plt.tmp
%ProgramFiles(x86)%\universal extractor\is-c4fgd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vqt97.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-asdag.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h7tb8.tmp
%TEMP%\is-phv8e.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qnki8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q9jm9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-os115.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-khq6l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6mged.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gp1ih.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-328p9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5pcmc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p0k5c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8betd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-iovjo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2747q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l17km.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7flsp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k9hrq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-13jfa.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j1ga0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-82gdk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c78n2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vr11e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-id95k.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-at0qi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dbts5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-85g6v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tf3eb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h919c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qqivq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ap1s9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-crqha.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rt8t8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6hm9l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-aktgu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e0h5e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-blk3q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m2bso.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6ss8n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7ulgr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5e0ml.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g0161.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-neme3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pdq9m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s26ul.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h0ela.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9sq1h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ibq2s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-895uo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4l3kc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d0bjq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m1th6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-270qn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6vfjp.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-t9plt.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-b4ht9.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-96dls.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-m1t70.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-64abt.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-84hgn.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-b5em2.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-vuo5v.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-b90ch.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-e9m6p.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-mg0j9.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-nff02.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-12377.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-fpdf7.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-k6v87.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-g4g2h.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ln38k.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-akl7o.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-1af0o.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-0r7pt.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-vqukh.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-soaf4.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-69uuc.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qebto.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2slr0.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-0t2ch.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-d5sef.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qq9og.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-h97r8.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ulbd9.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-90dr1.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-lv9b1.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3i7jc.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ocem8.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-f3c26.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-hq930.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-i13hc.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-og0ps.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-6nr9b.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-a74c6.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-k2ui8.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-p4oj7.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ttu0a.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ushb1.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-6ajet.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-cgd9h.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-oerlk.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-qq2it.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-4mklb.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-es80m.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-mqfpk.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-j51nh.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-83qj9.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-utqtd.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-dg0e4.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-tv8h4.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-93ed0.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-mruqc.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-h0ela.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-q7g1q.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mtna9.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-in41t.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4ulq8.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-spgv8.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-jqhcn.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-sf8kg.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-5j7tq.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-4scgd.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9ulfu.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7stc3.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-df0j7.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-ii3q3.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4nrcj.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hq0vh.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0s59c.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-kioho.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-ird67.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2deaq.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6vfjp.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m6qpe.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-grksq.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6vfd2.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l4jqg.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pshav.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g0hvh.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l17km.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9suhk.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fcpqn.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rmv98.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j1f98.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8betd.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u537d.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jhdbc.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-318rb.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2u30d.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j93q6.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6r2u6.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-c4fgd.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-asdag.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h7tb8.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qnki8.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p0k5c.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q9jm9.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-iovjo.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-os115.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c7k48.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6mged.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-328p9.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5pcmc.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6t7g3.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1hppu.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-pgqpe.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-khq6l.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vqt97.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gp1ih.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-894er.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pdq9m.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7flsp.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-13jfa.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j1ga0.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-82gdk.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c78n2.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-at0qi.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-id95k.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-blk3q.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k9hrq.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-crqha.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tf3eb.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h919c.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-qqivq.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-ap1s9.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2747q.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rt8t8.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dbts5.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-85g6v.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-blpmu.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-e7oc7.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-aktgu.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6ss8n.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7ulgr.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-5e0ml.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g0161.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-neme3.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s26ul.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6hm9l.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vr11e.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-270qn.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ibq2s.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-895uo.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4l3kc.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d0bjq.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m1th6.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e0h5e.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m2bso.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9sq1h.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-94v3i.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{95c19CF5-54FF-11D3-8BDA-8920306aB1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-q820f.tmp\is-fvlb1.tmp' /SL4 $C0142 "<Full path to file>" 7485222 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' 1dbd37ca4a4fcd71d122ec5a753ff557

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней