Trojan.DownLoader45.45558

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-7at0j.tmp\is-vbo7r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-aqqoe.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-46of5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-jprsu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4ivf4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q5lc9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-omv9a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-u5s4m.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0nq6u.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-a46iq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-b8dci.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-o8862.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qffaq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-690so.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gm5pl.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m67qf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-envrg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bke54.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-sueha.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-o4qjs.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qado8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-npu0t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-valj8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-195i6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a2vt6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g305a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hmo48.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sq9e7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-la48t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-077cb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-k8vlh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iqurj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-it125.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-a0jc7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-k1rcq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lb9n1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8poec.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-44a05.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6m9fr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cta5a.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-ps5np.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-v3mfd.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-kq8c8.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ihe1n.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-2if78.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-url64.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-08rgp.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-meo7o.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-r78qg.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-7vdnc.tmp
%ProgramFiles(x86)%\universal extractor\is-rq7c7.tmp
%ProgramFiles(x86)%\universal extractor\is-bmlff.tmp
%ProgramFiles(x86)%\universal extractor\is-9lii1.tmp
%ProgramFiles(x86)%\universal extractor\is-ktsq1.tmp
%ProgramFiles(x86)%\universal extractor\is-0fka9.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-9gdeg.tmp
%ProgramFiles(x86)%\universal extractor\is-n4bhd.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-m8cms.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-dh0oh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iafah.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q0g39.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9i0oa.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-efp9n.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cjma0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-u3qpm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1pqfc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lhf01.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-527ha.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-t4c8k.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kqor8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-986eg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-92vfv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-j8dti.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ofk0o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vmgcs.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3brmp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rfnts.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dj9uo.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-uufgs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-55r0o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2p4s3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gn3di.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bce79.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9ecu1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uapv2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-md4gg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mig4s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9vo39.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9b2i9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6j4t2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a877m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rpt63.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bdb5c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c4q60.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ulque.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4ij2s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jdph6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vb8u2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kajk4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pe19h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-am422.tmp
%TEMP%\is-1hqfa.tmp\_isetup\_shfoldr.dll
%TEMP%\is-1hqfa.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-8eel1.tmp
%ProgramFiles(x86)%\universal extractor\is-9bgrt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hkmhd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fkvt9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tqnps.tmp
%TEMP%\is-1hqfa.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rm4f3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-96e35.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bap66.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-thfni.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3i3pm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r40sl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-57m4l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-edrb1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-36lod.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-iqpcc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e42bt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dal7o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a3i17.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o3ibe.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cb5gu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v68jm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-06g5m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jfmkr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-532as.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c5b3s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-amfjj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cgtcb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-csg4a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dr7ii.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d4sm0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e9dkf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jqff1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1u1v4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6ifjt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0g9qu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gb58p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g2gs1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lsg9t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l0mo2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-isq6q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fd1ip.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tqspt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r2slm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-aoqpu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-odjdd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-crlav.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sv05t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dae40.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fnhao.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ul8fo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m27os.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-al5np.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m7b8l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h1tc5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i50kn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hffc7.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-8eel1.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-46of5.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-jprsu.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-4ivf4.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-q5lc9.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-omv9a.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-44a05.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-a46iq.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bke54.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-b8dci.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-o8862.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-qffaq.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-690so.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-gm5pl.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-u5s4m.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-envrg.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-aqqoe.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-0nq6u.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-sueha.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-o4qjs.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-195i6.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a2vt6.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g305a.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hmo48.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sq9e7.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-m67qf.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-077cb.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-la48t.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-k8vlh.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-it125.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-a0jc7.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-k1rcq.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-lb9n1.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8poec.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-npu0t.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-qado8.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-iqurj.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-valj8.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-6m9fr.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-527ha.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-meo7o.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-r78qg.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-v3mfd.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-kq8c8.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ihe1n.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-2if78.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-3brmp.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-url64.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-7vdnc.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-9gdeg.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-n4bhd.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-rq7c7.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-bmlff.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-9lii1.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-dh0oh.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-m8cms.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-iafah.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-vmgcs.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-dae40.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-q0g39.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9i0oa.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-efp9n.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-cjma0.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-u3qpm.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-uufgs.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ps5np.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-cta5a.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-1pqfc.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-kqor8.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-986eg.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-92vfv.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-j8dti.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ofk0o.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-lhf01.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-t4c8k.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rfnts.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-dj9uo.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-55r0o.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hffc7.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-md4gg.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mig4s.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6j4t2.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jdph6.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vb8u2.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a877m.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a3i17.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rpt63.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c4q60.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ulque.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4ij2s.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-iqpcc.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2p4s3.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bce79.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gn3di.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uapv2.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9b2i9.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9vo39.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-9bgrt.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-fkvt9.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tqnps.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rm4f3.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-36lod.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-96e35.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e42bt.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bap66.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bdb5c.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3i3pm.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-57m4l.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-edrb1.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-am422.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pe19h.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-kajk4.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-thfni.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hkmhd.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r40sl.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9ecu1.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-crlav.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o3ibe.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v68jm.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-06g5m.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jfmkr.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-532as.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cgtcb.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-amfjj.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l0mo2.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cb5gu.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6ifjt.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d4sm0.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e9dkf.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-jqff1.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-1u1v4.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dal7o.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0g9qu.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-csg4a.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dr7ii.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-08rgp.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-ktsq1.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-g2gs1.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fd1ip.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tqspt.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-r2slm.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-aoqpu.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-odjdd.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sv05t.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gb58p.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c5b3s.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-i50kn.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ul8fo.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m27os.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-al5np.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m7b8l.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h1tc5.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lsg9t.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-isq6q.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fnhao.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-0fka9.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{195c9CF5-54FF-11D3-8BDA-0892036aB1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-7at0j.tmp\is-vbo7r.tmp' /SL4 $11022E "<Full path to file>" 7585949 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' 72384c0573c6ff1c835fa0d577a92a86

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней