Trojan.DownLoader45.24173

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-ntcro.tmp\is-kta0u.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-j6o9g.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fhecu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6j4sa.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iv50g.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9bs9o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2r9t8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hf9ef.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6f9k8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-44jou.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0j3j9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-l0022.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fs2r8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m9v5f.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-laslo.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bu7pf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-o2a6j.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rdrr5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hodfi.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hb0mk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fdd13.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d0hs5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6ifi1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-co8sj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1n83n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fmf2h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9bg4r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n1kpl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-685de.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r2gg0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-f63u2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gdt6m.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bils2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4hsq8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ae1hc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-r3b6c.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m1tlk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3np6v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-k2t78.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-pr9ve.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-0db4s.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-a822q.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-bl17m.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-1qkfb.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-n5i1t.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-fr0rt.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-t5pg7.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-akdr2.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-nnkpf.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-uj5gv.tmp
%ProgramFiles(x86)%\universal extractor\is-jcbao.tmp
%ProgramFiles(x86)%\universal extractor\is-uj6sl.tmp
%ProgramFiles(x86)%\universal extractor\is-jidqd.tmp
%ProgramFiles(x86)%\universal extractor\is-iba4f.tmp
%ProgramFiles(x86)%\universal extractor\is-sl011.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-vetsv.tmp
%ProgramFiles(x86)%\universal extractor\is-d6d27.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-7rpbe.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-eb6s5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-solnu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6b3nn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-oi9v2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vpqe2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-03bc6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-k2136.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-peqnd.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-up42o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rqi7a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0e8qm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hpfv7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-u52kn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-967bf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-93bli.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ta916.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-uoapm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4u6bb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-l7mei.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tb00o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-th5kd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-feels.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-itn4v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-iber8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pbh84.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qktgo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-51454.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j1rp9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4ea5a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r4a66.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4i2ha.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-77j5m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qgv5a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-muvop.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ljurb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-igeed.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jf9ct.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b2p1o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ppdss.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4gvr2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nt1t0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-aojn7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2fpin.tmp
%TEMP%\is-pidk9.tmp\_isetup\_shfoldr.dll
%TEMP%\is-pidk9.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-pv9ib.tmp
%ProgramFiles(x86)%\universal extractor\is-7pf4r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-21kek.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pq61o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kdpck.tmp
%TEMP%\is-pidk9.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6varb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h7ga7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vriu0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d39l7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5mjei.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2457f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mba77.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tb7m8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k4tu3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-86rn8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q6ekr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5rh7e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4ljsc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uu7d9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sjvoj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-eigic.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8cvpg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f8rsg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hh07m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lfnr9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tnmb2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kdlct.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pvpme.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-etrll.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-556fu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r59am.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3dv4j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fuqbb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pm497.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h8g22.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-60idc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3tfrk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-blvc4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n0jkj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gb79r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t428d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kfc6e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r0lmu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-al4cm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-psh9i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3j4rc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2vbb7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-veli3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r077j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p8pgf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2cuev.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8qf2q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bt1e9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ll1gs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vrl9r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-knln4.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-pv9ib.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fhecu.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6j4sa.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-iv50g.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9bs9o.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2r9t8.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3np6v.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-44jou.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rdrr5.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-0j3j9.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-l0022.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fs2r8.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-m9v5f.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-laslo.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-hf9ef.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-o2a6j.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-j6o9g.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-6f9k8.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hodfi.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-hb0mk.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-co8sj.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1n83n.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fmf2h.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9bg4r.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n1kpl.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-bu7pf.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-r2gg0.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-685de.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-f63u2.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bils2.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4hsq8.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ae1hc.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-r3b6c.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-m1tlk.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-d0hs5.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-fdd13.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-gdt6m.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-6ifi1.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-k2t78.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rqi7a.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-akdr2.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-nnkpf.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-a822q.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-bl17m.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-1qkfb.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-n5i1t.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-4u6bb.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-fr0rt.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-uj5gv.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-vetsv.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-d6d27.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-jcbao.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-uj6sl.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-jidqd.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-eb6s5.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-7rpbe.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-solnu.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-uoapm.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-veli3.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-6b3nn.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-oi9v2.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vpqe2.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-03bc6.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-k2136.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-th5kd.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0db4s.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-pr9ve.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-peqnd.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hpfv7.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-u52kn.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-967bf.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-93bli.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ta916.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-up42o.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0e8qm.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-l7mei.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-tb00o.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-feels.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-knln4.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j1rp9.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4ea5a.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-77j5m.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ppdss.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4gvr2.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qgv5a.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4ljsc.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-muvop.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-igeed.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jf9ct.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-b2p1o.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-86rn8.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-itn4v.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pbh84.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-iber8.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-51454.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4i2ha.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r4a66.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-7pf4r.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-pq61o.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kdpck.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6varb.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k4tu3.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h7ga7.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q6ekr.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vriu0.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ljurb.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5mjei.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mba77.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tb7m8.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2fpin.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-aojn7.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-nt1t0.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d39l7.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-21kek.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2457f.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qktgo.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3j4rc.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uu7d9.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-eigic.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8cvpg.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f8rsg.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hh07m.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kdlct.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tnmb2.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n0jkj.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sjvoj.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pm497.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-556fu.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r59am.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-3dv4j.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-fuqbb.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5rh7e.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h8g22.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pvpme.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-etrll.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-t5pg7.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-iba4f.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-3tfrk.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t428d.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kfc6e.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-r0lmu.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-al4cm.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-psh9i.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2vbb7.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-60idc.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lfnr9.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vrl9r.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p8pgf.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2cuev.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8qf2q.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bt1e9.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ll1gs.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-blvc4.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gb79r.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r077j.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-sl011.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{5c199CF5-54FF-11D3-8BDA-9203068aB1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-ntcro.tmp\is-kta0u.tmp' /SL4 $E0160 "<Full path to file>" 7442265 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' 02af223c5a752c4750897bc4718732d5

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней