Trojan.DownLoader45.23106

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-n702o.tmp\is-irk9o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8hb4r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bqb14.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-durqq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iveoe.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vpfus.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-r9aq8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-luc4s.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qi3rr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-i01bc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-h555e.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3tu6a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-utp00.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-udram.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-14sje.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5kmvd.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-27ba8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3a3it.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-at3tb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-muvv3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-dc4pm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8fquj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oe0bn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pau0f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tl78j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bh6ie.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gh09t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f1quf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lr7nk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gma1f.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rhedc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-b1n6o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-i13tv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-h4fb7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-imbbr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tre64.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8eltr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-g2eto.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6r6sf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lnq91.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-5dhec.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-i3qbo.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-9kau0.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-qn6ed.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-bk3am.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-avsbd.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ducf7.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-96460.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-n4glo.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ih43g.tmp
%ProgramFiles(x86)%\universal extractor\is-vjm4a.tmp
%ProgramFiles(x86)%\universal extractor\is-nbms1.tmp
%ProgramFiles(x86)%\universal extractor\is-avfkr.tmp
%ProgramFiles(x86)%\universal extractor\is-omss6.tmp
%ProgramFiles(x86)%\universal extractor\is-85tp2.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ir5f4.tmp
%ProgramFiles(x86)%\universal extractor\is-opc8k.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-9qaot.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-k5g4u.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kk12j.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fh10j.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8mjuv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ukif0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0khog.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-48o67.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2pi1v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-u7s11.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qt9mc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mf11i.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-k3liq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2fb86.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gg14b.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4c67f.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-uiu67.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ldmc7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-r4p7j.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6u1ui.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f67k3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3pqk1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oc811.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-iop99.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0h960.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ffcld.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-shd8l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-33489.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5932j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3e0je.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fi1gn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3ck9i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uvd9s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8ea7m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5qga3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4uvdf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pq6ig.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jmsgs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oqd33.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vsi5b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t0d6r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uct2q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qldl9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n23gd.tmp
%TEMP%\is-kp5aa.tmp\_isetup\_shfoldr.dll
%TEMP%\is-kp5aa.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-e7ofv.tmp
%ProgramFiles(x86)%\universal extractor\is-a546j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f01qv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vqdgv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qp5g8.tmp
%TEMP%\is-kp5aa.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6ip30.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2fnsg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-io9p0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-340pk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3tfo3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tqdom.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cfc4t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sulg9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ggdfs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5im1d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2f21p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1l6mq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jegij.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-56gqv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3ri2f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r4bv9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4do3l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ubhup.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fod0j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tcqjh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-aim5t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dhtcs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-282j7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oakh1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4hgic.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9agm9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ctss4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r8rkh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4r4qi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ehtga.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k4rr4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q8qi3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7n3th.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hmoiu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-srj14.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9dbqc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r0mjq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f8ur8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-08b9m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g5205.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hqelu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h9lno.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uf0a7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gsmdn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bqkih.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3b1ap.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7an5d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-emqgp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l628s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cpbhv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oesbf.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-e7ofv.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bqb14.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-durqq.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-iveoe.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vpfus.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-r9aq8.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-g2eto.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-i01bc.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3a3it.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-h555e.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-3tu6a.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-utp00.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-udram.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-14sje.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-luc4s.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-27ba8.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8hb4r.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-qi3rr.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-at3tb.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-muvv3.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-pau0f.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tl78j.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bh6ie.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gh09t.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f1quf.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-5kmvd.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-gma1f.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lr7nk.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-rhedc.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-i13tv.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-h4fb7.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-imbbr.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-tre64.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8eltr.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-8fquj.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-dc4pm.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-b1n6o.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-oe0bn.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-6r6sf.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-qt9mc.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-96460.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-n4glo.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-i3qbo.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-9kau0.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-qn6ed.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-bk3am.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-r4p7j.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-avsbd.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ih43g.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ir5f4.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-opc8k.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-vjm4a.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-nbms1.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-avfkr.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-k5g4u.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-9qaot.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-kk12j.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-ldmc7.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-uf0a7.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-fh10j.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8mjuv.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ukif0.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0khog.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-48o67.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3pqk1.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-5dhec.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-lnq91.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-2pi1v.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-k3liq.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2fb86.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-gg14b.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-4c67f.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-uiu67.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-u7s11.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mf11i.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6u1ui.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-f67k3.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oc811.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oesbf.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5932j.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3e0je.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uvd9s.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vsi5b.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t0d6r.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8ea7m.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jegij.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5qga3.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pq6ig.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jmsgs.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oqd33.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5im1d.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-iop99.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ffcld.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0h960.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-33489.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3ck9i.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fi1gn.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-a546j.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-vqdgv.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qp5g8.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6ip30.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ggdfs.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2fnsg.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2f21p.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-io9p0.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4uvdf.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3tfo3.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cfc4t.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sulg9.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n23gd.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qldl9.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-uct2q.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-340pk.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f01qv.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tqdom.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-shd8l.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hqelu.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-56gqv.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r4bv9.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4do3l.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ubhup.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fod0j.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dhtcs.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-aim5t.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hmoiu.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3ri2f.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4r4qi.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4hgic.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9agm9.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-ctss4.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-r8rkh.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1l6mq.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ehtga.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-282j7.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oakh1.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ducf7.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-omss6.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-q8qi3.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9dbqc.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r0mjq.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-f8ur8.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-08b9m.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g5205.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h9lno.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k4rr4.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tcqjh.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cpbhv.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bqkih.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3b1ap.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7an5d.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-emqgp.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l628s.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7n3th.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-srj14.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gsmdn.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-85tp2.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{95c19CF5-54FF-11D3-8BDA-8920306aB1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-n702o.tmp\is-irk9o.tmp' /SL4 $E0148 "<Full path to file>" 7462740 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' c2b202f87108122063bad8bb3b5a98fd

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней