Trojan.DownLoader45.26354

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-npvlp.tmp\is-jh57h.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-p5olq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-d0dlv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ot431.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tlv1h.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-064cb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mkvtj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9p9sj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-enfie.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8ols3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-g07f9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7q4nh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tj0m3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-n14p5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-riqrp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ltp94.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4q8tr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qvaks.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-33qrm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-84ebi.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bn0lp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u8n0m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4vfm6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pbpkq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j8sea.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e07f1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3rnos.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5lf9a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rov4r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-eeanm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ie5or.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nrr03.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4o1sm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mss4q.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fcubq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vrc5v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-dp6t2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-v7pcr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vp9d2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mbn7s.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-hqt8j.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ub99j.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-h2gj7.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ea9og.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-sgmt5.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-d0d7o.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-aobsu.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-0p7dj.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-hejrn.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-b7o83.tmp
%ProgramFiles(x86)%\universal extractor\is-kpt2h.tmp
%ProgramFiles(x86)%\universal extractor\is-a00j4.tmp
%ProgramFiles(x86)%\universal extractor\is-qf38a.tmp
%ProgramFiles(x86)%\universal extractor\is-4ndth.tmp
%ProgramFiles(x86)%\universal extractor\is-c4tvp.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-gjt63.tmp
%ProgramFiles(x86)%\universal extractor\is-br1rf.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-mv0dk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1sbs9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-l23k2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cbeg2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-d96ca.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-apphn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ioc63.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0cfa6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9v4lq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-62k48.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2hbpf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cf0hl.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-82755.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fle3t.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ch6eu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9vjse.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-co1f2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lr1oe.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-oap4m.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-612f1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uid9u.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-t3q70.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3c2v0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sfsp0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-eck3n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-osqa0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nc4fk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-munb4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c0tgq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-habqh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0mcj6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e3qlt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-878db.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4sbp9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0lb22.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tc45a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dup9n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ls14v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tr77i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-468mm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ft8ti.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uhhst.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dgmqg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p8vu8.tmp
%TEMP%\is-m80th.tmp\_isetup\_shfoldr.dll
%TEMP%\is-m80th.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-ns9g2.tmp
%ProgramFiles(x86)%\universal extractor\is-cus72.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t08ta.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-korsm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p44ar.tmp
%TEMP%\is-m80th.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1767v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-blmon.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v9b63.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1par3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-08gve.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9jutd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8qosg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8i868.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nae8n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4q7no.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1pagc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nda3h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gjdri.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cd00i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m4gue.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gs5b4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jrhus.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k2q6s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e7p92.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o3vos.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g6r0k.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-269n7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rd006.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fv6hs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r45mj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n31bc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-90j5j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uuq3s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-86de9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n4vit.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-frd2j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9gtd6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ut9fo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-31aj5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-97k27.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qtjvr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nmef5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7c13v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f7dl9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2f0q4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pb02p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-54epj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-td0oa.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rjrk6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kjtis.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u4pcg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2k6e0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ohpro.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-06tvn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8c3r6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0r4b2.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-ns9g2.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-d0dlv.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ot431.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-tlv1h.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-064cb.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mkvtj.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-v7pcr.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-8ols3.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-qvaks.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-g07f9.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-7q4nh.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-tj0m3.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-n14p5.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-riqrp.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-9p9sj.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4q8tr.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-p5olq.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-enfie.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-33qrm.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-84ebi.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-pbpkq.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j8sea.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e07f1.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3rnos.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5lf9a.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-ltp94.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-eeanm.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rov4r.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-ie5or.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4o1sm.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mss4q.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fcubq.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vrc5v.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-dp6t2.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-u8n0m.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-bn0lp.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-nrr03.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-4vfm6.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-vp9d2.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2hbpf.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-0p7dj.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-hejrn.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ub99j.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-h2gj7.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ea9og.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-sgmt5.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-oap4m.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-d0d7o.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-b7o83.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-gjt63.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-br1rf.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-kpt2h.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-a00j4.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-qf38a.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-1sbs9.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-mv0dk.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-l23k2.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-lr1oe.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-td0oa.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-cbeg2.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-d96ca.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-apphn.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ioc63.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-0cfa6.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-t3q70.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hqt8j.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mbn7s.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-9v4lq.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-82755.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fle3t.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ch6eu.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-9vjse.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-co1f2.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-62k48.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-cf0hl.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-612f1.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-uid9u.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3c2v0.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0r4b2.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c0tgq.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-habqh.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-878db.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-468mm.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ft8ti.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4sbp9.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gjdri.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0lb22.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dup9n.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ls14v.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tr77i.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4q7no.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sfsp0.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-osqa0.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-eck3n.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-munb4.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e3qlt.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0mcj6.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-cus72.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-korsm.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p44ar.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1767v.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nae8n.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-blmon.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1pagc.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v9b63.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tc45a.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-08gve.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8qosg.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8i868.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p8vu8.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dgmqg.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-uhhst.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1par3.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t08ta.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9jutd.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nc4fk.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pb02p.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cd00i.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gs5b4.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jrhus.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k2q6s.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e7p92.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-269n7.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g6r0k.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-31aj5.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m4gue.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-86de9.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r45mj.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n31bc.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-90j5j.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-uuq3s.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nda3h.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n4vit.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rd006.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fv6hs.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-aobsu.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-4ndth.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-9gtd6.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qtjvr.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nmef5.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-7c13v.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f7dl9.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2f0q4.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-54epj.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-frd2j.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o3vos.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8c3r6.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kjtis.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u4pcg.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2k6e0.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ohpro.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-06tvn.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ut9fo.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-97k27.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rjrk6.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-c4tvp.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{c1959CF5-54FF-11D3-8BDA-2030689aB1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-npvlp.tmp\is-jh57h.tmp' /SL4 $11022E "<Full path to file>" 7450628 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' 560a1302df46c43fe1520f4184886888

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней