Trojan.DownLoader45.23122

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-i60rq.tmp\is-b5v8m.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-n61n5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lsehd.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nr2k1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-j4itb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-va7p6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ja96k.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lcbha.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lflco.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-a7ll3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iccqr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-t1617.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8gvl8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-53huk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-evg7r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-88tp5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vvmlj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rhhhe.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gfe5f.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-see0i.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-e0c81.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p39d2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ml4tn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-adqbb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n88in.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3j77n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a3u20.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pibro.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j5i4c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6v3bk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4cseo.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vom6c.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-19inr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fekne.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mb6ul.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-urjh1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bbhk5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0ct78.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rno01.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q80bb.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-8alhm.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-s0bj7.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-a53j1.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-mt66d.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-njgch.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-m5t5b.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ei64k.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-1p4kl.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-2dh4n.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-6c8ha.tmp
%ProgramFiles(x86)%\universal extractor\is-4occp.tmp
%ProgramFiles(x86)%\universal extractor\is-i9vt4.tmp
%ProgramFiles(x86)%\universal extractor\is-k7lc1.tmp
%ProgramFiles(x86)%\universal extractor\is-ptc8s.tmp
%ProgramFiles(x86)%\universal extractor\is-4b0k9.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-sm822.tmp
%ProgramFiles(x86)%\universal extractor\is-17fbv.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-biv39.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6l4ns.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0panr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-pmems.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-71e74.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-a9qji.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-reaq0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-jpv3e.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ret0t.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hjkrg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0ritm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-d6v4n.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-asg2f.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-86cq9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-d5ihh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-se575.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-41oph.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ithkk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-jg8o9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-itq7v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gg9jg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gojjh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-aqtr5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a5kec.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1j7kp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pml23.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-73vlv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vd2fg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-aosue.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d37ld.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pjf2u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rp3lc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-un55e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qostb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r8sc4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hjt4a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q8q4g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mlh9l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8mboo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e187t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kedfe.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u7tnm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-11n9m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oo5no.tmp
%TEMP%\is-j3ds5.tmp\_isetup\_shfoldr.dll
%TEMP%\is-j3ds5.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-orh80.tmp
%ProgramFiles(x86)%\universal extractor\is-n0toc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ppekg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3q6ke.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dnoka.tmp
%TEMP%\is-j3ds5.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kksl2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jitg9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-orp2i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qm5b8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-clmot.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d7q8e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-srhee.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-csa5k.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0uav2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6tpeg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-klke4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rhkbs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9ppe3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b7pdt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3hkmt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-af7i6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cn21r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dgrkb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qrd65.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2f86l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-56t15.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6t59f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qsn44.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qe0qa.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ns28e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dv6bd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-83j7h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-umlmc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0p7db.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-71a0u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g0ijj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2f2pr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jc9qh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-iv4hs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-np72g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2312t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vee75.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-klf7l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9hp2g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8ta1s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gsjk6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5e5t4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-997ds.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jht9r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-10vfs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q0qh8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ahq8d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bnrdg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-24lt4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rsrsh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-olhfh.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-orh80.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-lsehd.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-nr2k1.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-j4itb.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-va7p6.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ja96k.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0ct78.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-a7ll3.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rhhhe.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-iccqr.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-t1617.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8gvl8.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-53huk.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-evg7r.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-lcbha.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vvmlj.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-n61n5.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-lflco.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-gfe5f.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-see0i.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-adqbb.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n88in.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3j77n.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a3u20.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pibro.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-88tp5.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-6v3bk.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j5i4c.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-4cseo.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-19inr.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fekne.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mb6ul.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-urjh1.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bbhk5.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-p39d2.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-e0c81.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vom6c.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-ml4tn.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-rno01.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0ritm.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-1p4kl.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-2dh4n.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-s0bj7.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-a53j1.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-mt66d.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-njgch.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-jg8o9.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-m5t5b.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-6c8ha.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-sm822.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-17fbv.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-4occp.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-i9vt4.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-k7lc1.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6l4ns.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-biv39.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-0panr.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-ithkk.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-997ds.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-pmems.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-71e74.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-a9qji.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-reaq0.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-jpv3e.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-gojjh.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8alhm.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-q80bb.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-ret0t.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-asg2f.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-86cq9.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-d5ihh.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-se575.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-41oph.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hjkrg.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-d6v4n.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-itq7v.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-gg9jg.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-aqtr5.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-olhfh.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-aosue.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d37ld.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-un55e.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e187t.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kedfe.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qostb.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9ppe3.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r8sc4.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q8q4g.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mlh9l.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8mboo.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6tpeg.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a5kec.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pml23.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1j7kp.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vd2fg.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rp3lc.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pjf2u.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-n0toc.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-3q6ke.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dnoka.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kksl2.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0uav2.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jitg9.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-klke4.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-orp2i.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hjt4a.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-clmot.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-srhee.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-csa5k.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oo5no.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-11n9m.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-u7tnm.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qm5b8.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ppekg.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d7q8e.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-73vlv.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gsjk6.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-b7pdt.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-af7i6.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cn21r.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dgrkb.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qrd65.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6t59f.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-56t15.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-iv4hs.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3hkmt.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0p7db.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ns28e.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dv6bd.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-83j7h.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-umlmc.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rhkbs.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-71a0u.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qsn44.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qe0qa.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ei64k.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-ptc8s.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-2f2pr.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2312t.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vee75.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-klf7l.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9hp2g.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8ta1s.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5e5t4.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g0ijj.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2f86l.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rsrsh.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-10vfs.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q0qh8.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ahq8d.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bnrdg.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-24lt4.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jc9qh.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-np72g.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jht9r.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-4b0k9.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{95c19CF5-54FF-11D3-8BDA-8920306aB1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-i60rq.tmp\is-b5v8m.tmp' /SL4 $E015E "<Full path to file>" 7448478 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' 138e5efa06437f05a2da491782b26451

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней