Trojan.DownLoader45.23115

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-l81rp.tmp\is-a134a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3l0kk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-r691h.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-trukc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-dvcdp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-t72l2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0eg2n.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6ctff.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-872u9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-v9il9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-p941r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cnlrv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8jhhn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2pgur.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-94v1m.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0b2m5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kl4pb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7j1hs.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q4kfi.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q8r0q.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lvje4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jid3p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7r411.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qpckl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8ndt1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qtb64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ugofp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n39db.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g9ctv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2ce3c.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7iek5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0rj27.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bk56n.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tbjkh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0f6dt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-751i1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ij30r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-32tsp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-goern.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mcgp0.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-c6vlk.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ctl38.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-nofqu.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-8ib4m.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-uh7ll.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-e82bn.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-7hc09.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-r2dam.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-mtf0i.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-a1p69.tmp
%ProgramFiles(x86)%\universal extractor\is-eoh8r.tmp
%ProgramFiles(x86)%\universal extractor\is-1cd87.tmp
%ProgramFiles(x86)%\universal extractor\is-giot8.tmp
%ProgramFiles(x86)%\universal extractor\is-j1pvo.tmp
%ProgramFiles(x86)%\universal extractor\is-3q9af.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-r4k0k.tmp
%ProgramFiles(x86)%\universal extractor\is-0auhk.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-83t75.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fj21g.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q149k.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1u3c7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ibkif.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-p9dg3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-970rc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-t5r83.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8i7cu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8okvb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rtlg0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-t5kuj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-a3tr3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3hl13.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-t04ec.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-uh2t2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-j4q3m.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-b7gn4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hfmjg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ni9b4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rlmdf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ucljn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-idec7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vclv8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9ghtq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fs7pu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l1i2t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6mtt1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fsr1s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qbv5c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o6nge.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5nahk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f2nf1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o0e5s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6r5ki.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n4237.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7ds6r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tk1s7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u7ln7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ocbol.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nkv70.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7rjmr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-iku4v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f8lbl.tmp
%TEMP%\is-iufbc.tmp\_isetup\_shfoldr.dll
%TEMP%\is-iufbc.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-mvpqo.tmp
%ProgramFiles(x86)%\universal extractor\is-s66nt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nt9r0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ite0k.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qric1.tmp
%TEMP%\is-iufbc.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-psthb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2k4i5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5qqql.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tkudd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s2tkd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3j45m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ie13b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2l6rr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fd893.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-59mfg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9m5t4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r9tkd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q1puo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gls2n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q9tso.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rnp44.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4q43b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sph2l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n48fh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q59eu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oskeb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hmm11.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ofhl6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u1occ.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jveik.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ercd2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lfjpg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mfs0u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6rser.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v1i36.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-66ul3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-70qej.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6t0i4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-be4hs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dgahb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lprmu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kips5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uf24h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3gall.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p9pfh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gss48.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1l062.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-47hqq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7h4s8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8cv4l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-eshkt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jf25h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6a0kr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-scsem.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q5p0v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-su7t0.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-mvpqo.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-r691h.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-trukc.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-dvcdp.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-t72l2.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0eg2n.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-32tsp.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-v9il9.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7j1hs.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-p941r.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-cnlrv.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8jhhn.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2pgur.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-94v1m.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-6ctff.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-kl4pb.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3l0kk.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-872u9.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-q4kfi.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-q8r0q.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-qpckl.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8ndt1.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qtb64.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ugofp.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n39db.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-0b2m5.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-2ce3c.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g9ctv.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-7iek5.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bk56n.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-tbjkh.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0f6dt.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-751i1.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ij30r.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-jid3p.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-lvje4.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0rj27.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-7r411.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-goern.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rtlg0.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-r2dam.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-mtf0i.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ctl38.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-nofqu.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-8ib4m.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-uh7ll.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-hfmjg.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-e82bn.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-a1p69.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-r4k0k.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-0auhk.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-eoh8r.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-1cd87.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-giot8.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fj21g.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-83t75.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-q149k.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-b7gn4.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-47hqq.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-1u3c7.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ibkif.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-p9dg3.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-970rc.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-t5r83.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ucljn.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-c6vlk.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mcgp0.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-8i7cu.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-a3tr3.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3hl13.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-t04ec.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-uh2t2.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-j4q3m.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8okvb.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-t5kuj.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ni9b4.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-rlmdf.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-idec7.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-su7t0.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fsr1s.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qbv5c.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f2nf1.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ocbol.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nkv70.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o0e5s.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q1puo.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6r5ki.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7ds6r.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tk1s7.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u7ln7.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-59mfg.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vclv8.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fs7pu.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9ghtq.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6mtt1.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5nahk.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o6nge.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-s66nt.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-ite0k.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qric1.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-psthb.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fd893.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2k4i5.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9m5t4.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5qqql.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n4237.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s2tkd.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ie13b.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2l6rr.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f8lbl.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-iku4v.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-7rjmr.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tkudd.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nt9r0.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3j45m.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l1i2t.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gss48.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gls2n.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rnp44.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4q43b.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sph2l.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n48fh.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hmm11.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oskeb.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-be4hs.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q9tso.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6rser.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jveik.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ercd2.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-lfjpg.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-mfs0u.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r9tkd.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v1i36.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ofhl6.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u1occ.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-7hc09.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-j1pvo.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-70qej.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lprmu.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kips5.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-uf24h.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3gall.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p9pfh.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1l062.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-66ul3.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q59eu.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q5p0v.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8cv4l.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-eshkt.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jf25h.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6a0kr.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-scsem.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6t0i4.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dgahb.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7h4s8.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-3q9af.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{95c19CF5-54FF-11D3-8BDA-8920306aB1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-l81rp.tmp\is-a134a.tmp' /SL4 $C001A "<Full path to file>" 7300550 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' 5ed6cf2a8a868d1977a550cc7e9d7707

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней