Trojan.DownLoader45.24812

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-vhe4c.tmp\is-u4cfs.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iemhp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rr3vj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fug7s.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-el31i.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kqkja.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bmm27.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-js8a9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ng5ql.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q2ls1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lk4r4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tn3fh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0ndtq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-i10ef.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-f9sg1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-l9dv3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9kn9c.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ghi99.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5a4hf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-p8qtv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vbbct.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mk228.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v6rcm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e0if5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m282o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hv78v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r3at7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dlbcn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-maaeq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vktdh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-t9k8d.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ckbvp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-r8pjs.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ofokh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9r253.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cj1q4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cioeh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q9dhp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lm7ek.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nmpan.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-tlqrf.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-8jrts.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-2c6l8.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-s9cic.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-nt3d8.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-qps1t.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-u2vge.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-cb6hq.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-sk4be.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-pu1ta.tmp
%ProgramFiles(x86)%\universal extractor\is-3gdee.tmp
%ProgramFiles(x86)%\universal extractor\is-d9b6d.tmp
%ProgramFiles(x86)%\universal extractor\is-o9bvf.tmp
%ProgramFiles(x86)%\universal extractor\is-j3k31.tmp
%ProgramFiles(x86)%\universal extractor\is-qnpk1.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-nlbj0.tmp
%ProgramFiles(x86)%\universal extractor\is-fmo9m.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-l10c4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-im2jr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mieur.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6fnle.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rclot.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-pr69f.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-d02of.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-taago.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-sbocc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8491o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-r6nfj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-08t4v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ov1qr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iluh4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ru7kr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7gtcm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-l9qu3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ciaob.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-g3ebs.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8ide7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hffpc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-edphj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r50k4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h8grk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d5f93.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o85oj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2s7rd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-iuijn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oii0j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fr716.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-smr05.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bqf0e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-86g5c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kro7l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-smkkp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8b4ok.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-127n4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6rq7p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mqhkd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b860i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rd47m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f5im5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7c6sd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dnrot.tmp
%TEMP%\is-osfit.tmp\_isetup\_shfoldr.dll
%TEMP%\is-osfit.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-u82qo.tmp
%ProgramFiles(x86)%\universal extractor\is-md2r4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-eu9rc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hjnjp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sqq24.tmp
%TEMP%\is-osfit.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-062f3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dtbkg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mbnol.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ohmuo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2v7jc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3fa9p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mld63.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fkegr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uj1a4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dfkho.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-phb1a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1js0u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-inl2v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m0jpj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-eqk6e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ehf8s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uls0b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bpudr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ql0am.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-50qnl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pv7j9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9uup3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b8d3s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-25023.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m6ksd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fnjg9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4g54p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jn01j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-747of.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7vg9g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hulod.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kchd0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k694i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rbclv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-je3nv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a2kj8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l54i0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3r6qs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ngmjg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1k3c0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-07j5j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a20ok.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0ucvm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ia87t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-981v9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-001rd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0m5c9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r7jlq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-paifn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lifj3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-90r9u.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-u82qo.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rr3vj.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fug7s.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-el31i.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-kqkja.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bmm27.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-q9dhp.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-q2ls1.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ghi99.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-lk4r4.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-tn3fh.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0ndtq.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-i10ef.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-f9sg1.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-js8a9.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9kn9c.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-iemhp.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-ng5ql.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-5a4hf.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-p8qtv.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-e0if5.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m282o.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hv78v.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r3at7.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dlbcn.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-l9dv3.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-vktdh.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-maaeq.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-t9k8d.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-r8pjs.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ofokh.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9r253.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-cj1q4.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-cioeh.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-mk228.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-vbbct.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ckbvp.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-v6rcm.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-lm7ek.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-r6nfj.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-cb6hq.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-sk4be.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-8jrts.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-2c6l8.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-s9cic.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-nt3d8.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-g3ebs.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-qps1t.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-pu1ta.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-nlbj0.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-fmo9m.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-3gdee.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-d9b6d.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-o9bvf.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-im2jr.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-l10c4.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-mieur.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-ciaob.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-0ucvm.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-6fnle.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rclot.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-pr69f.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-d02of.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-taago.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-edphj.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-tlqrf.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-nmpan.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-sbocc.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ov1qr.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-iluh4.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ru7kr.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-7gtcm.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-l9qu3.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8491o.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-08t4v.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8ide7.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-hffpc.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r50k4.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-90r9u.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oii0j.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fr716.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-86g5c.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-b860i.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rd47m.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kro7l.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-inl2v.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-smkkp.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-127n4.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6rq7p.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mqhkd.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dfkho.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h8grk.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o85oj.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d5f93.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-iuijn.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bqf0e.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-smr05.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-md2r4.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-hjnjp.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sqq24.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-062f3.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uj1a4.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dtbkg.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-phb1a.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mbnol.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8b4ok.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2v7jc.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mld63.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fkegr.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dnrot.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7c6sd.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-f5im5.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ohmuo.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-eu9rc.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3fa9p.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2s7rd.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-07j5j.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m0jpj.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ehf8s.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uls0b.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bpudr.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ql0am.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9uup3.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pv7j9.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rbclv.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-eqk6e.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-747of.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m6ksd.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fnjg9.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-4g54p.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-jn01j.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1js0u.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7vg9g.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-b8d3s.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-25023.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-u2vge.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-j3k31.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-kchd0.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a2kj8.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l54i0.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-3r6qs.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ngmjg.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1k3c0.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a20ok.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hulod.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-50qnl.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lifj3.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-981v9.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-001rd.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0m5c9.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r7jlq.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-paifn.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k694i.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-je3nv.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ia87t.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-qnpk1.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{c1959CF5-54FF-11D3-8BDA-a0892036B1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-vhe4c.tmp\is-u4cfs.tmp' /SL4 $11022C "<Full path to file>" 7598909 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' 32d53566f3627e7582451ca1dd372178

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней