Trojan.DownLoader45.48952

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-jto0f.tmp\is-fd9l9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-r2td9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-73vah.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rf661.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-km2tq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0ourv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-aofmv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-umm4n.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iits9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-do5j9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2h19i.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-e7vf8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0lehu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mcqui.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nd5q1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fc4gl.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-su3b3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8jhlf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cavgf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7heol.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-eeiso.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m7frq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bh5o0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rth14.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9b6s1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kkf4p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n57rp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4oo74.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-78u97.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uopp0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qrcul.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-p80og.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hafuv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fl0pg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-82l1c.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tf2p1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-deq0k.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-biogo.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-feg40.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3pe45.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-tn129.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-pbq5c.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-hvdi9.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-kqdp1.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-jciq5.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-l67rv.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-754ia.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ttln3.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-bp59e.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-2dt48.tmp
%ProgramFiles(x86)%\universal extractor\is-b088i.tmp
%ProgramFiles(x86)%\universal extractor\is-vh2ef.tmp
%ProgramFiles(x86)%\universal extractor\is-2063b.tmp
%ProgramFiles(x86)%\universal extractor\is-5i3vs.tmp
%ProgramFiles(x86)%\universal extractor\is-f7rjo.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-1bd97.tmp
%ProgramFiles(x86)%\universal extractor\is-1agq7.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-uh1tm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mp5ql.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3dlu9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ajamg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qu87m.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3aj2r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-f254v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-criir.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rnt8b.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3g054.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-b7tn4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-flqbc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-e7fds.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ccbfs.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9r5c0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2fijv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-jco42.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-42btp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-pigcl.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-djvpo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o2u6o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hacg0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jff6g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-avkld.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-eo2pn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4h199.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5h32c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nl2o0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6rqtf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0ssn0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0gj9q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1eva8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k4qe0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h7p5g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kkvde.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k195e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-namei.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9efig.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t76lf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9oul5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8o9u5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5p42i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-12ik6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-299c5.tmp
%TEMP%\is-ln111.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ln111.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-61rmt.tmp
%ProgramFiles(x86)%\universal extractor\is-2snjd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4hre5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cpgh9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8rbj1.tmp
%TEMP%\is-ln111.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r8in4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e50cm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-trjn6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f6niu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ig31u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-23t23.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ltad4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-eudnj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-51tjr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qn1gj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-aesvp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uv8ls.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-daper.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-56rf0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s5ikt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bmg2n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6nqp3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dndv4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7gaci.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dkhia.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v1682.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qaes1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h2ebi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8t59v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0uqb8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t4mvu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3cfek.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5lvs9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-olt6i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r04dh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4j0rq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g3mrc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d96co.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qssdf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6ogj2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-iarm9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uuqak.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b7v5g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vdpm4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6lhsi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p7e2d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hcksu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-56lmm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5876d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j0dh6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-afvkc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h3u6h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-igjci.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mfj32.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lpu06.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2be04.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-61rmt.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-73vah.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rf661.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-km2tq.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0ourv.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-aofmv.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-biogo.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-do5j9.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8jhlf.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-2h19i.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-e7vf8.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0lehu.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mcqui.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-nd5q1.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-umm4n.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-su3b3.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-r2td9.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-iits9.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-cavgf.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-7heol.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-rth14.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9b6s1.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kkf4p.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n57rp.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4oo74.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-fc4gl.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-uopp0.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-78u97.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-qrcul.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hafuv.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fl0pg.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-82l1c.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-tf2p1.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-deq0k.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-m7frq.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-eeiso.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-p80og.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-bh5o0.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-feg40.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-b7tn4.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ttln3.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-bp59e.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-pbq5c.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-hvdi9.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-kqdp1.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-jciq5.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-pigcl.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-l67rv.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-2dt48.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-1bd97.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-1agq7.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-b088i.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-vh2ef.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-2063b.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mp5ql.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-uh1tm.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-3dlu9.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-42btp.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-56lmm.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-ajamg.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-qu87m.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3aj2r.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-f254v.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-criir.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hacg0.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-tn129.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3pe45.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-rnt8b.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-e7fds.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ccbfs.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9r5c0.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-2fijv.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-jco42.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3g054.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-flqbc.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-djvpo.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-o2u6o.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jff6g.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2be04.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6rqtf.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0ssn0.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k4qe0.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9oul5.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8o9u5.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h7p5g.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-daper.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kkvde.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-namei.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9efig.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t76lf.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qn1gj.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-avkld.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4h199.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-eo2pn.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nl2o0.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1eva8.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0gj9q.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-2snjd.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-cpgh9.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8rbj1.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r8in4.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-51tjr.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e50cm.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-aesvp.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-trjn6.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k195e.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ig31u.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ltad4.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-eudnj.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-299c5.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-12ik6.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-5p42i.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f6niu.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4hre5.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-23t23.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5h32c.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p7e2d.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-56rf0.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bmg2n.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6nqp3.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dndv4.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7gaci.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qaes1.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v1682.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qssdf.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s5ikt.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-olt6i.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0uqb8.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t4mvu.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-3cfek.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-5lvs9.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uv8ls.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r04dh.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h2ebi.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8t59v.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-754ia.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-5i3vs.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-g3mrc.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-iarm9.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uuqak.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-b7v5g.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vdpm4.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6lhsi.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hcksu.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4j0rq.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dkhia.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lpu06.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j0dh6.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-afvkc.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h3u6h.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-igjci.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mfj32.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d96co.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6ogj2.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5876d.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-f7rjo.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{995C1CF5-54FF-11D3-8BDA-00600893B1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-jto0f.tmp\is-fd9l9.tmp' /SL4 $C013A "<Full path to file>" 7460196 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' 3ca4636300c5904bc49ef8499c4a89dd

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 29"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней