Trojan.DownLoader45.24171

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-san8m.tmp\is-ijgpu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-c014v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fjs8b.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-f5hvf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8kdia.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kmacn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3q0u1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mnsvd.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-sabav.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-l4pmq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hcnvt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rtjr5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-otaqn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ak0cr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1q1cn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tco69.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mu5tv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-71sq3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-birk5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bkm75.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-pqrf6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tm40t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4fbjm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-27rmq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5j70p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o2dlr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-29tff.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tgt0n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-incqp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3kld9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5nde4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-40192.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-29h22.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vb6q8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2htre.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2rcak.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-e354r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-d9src.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tjb9a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qu4n8.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-ta4lt.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-mcao5.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-48ich.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-8d79i.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-gp1f1.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-6n4fk.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-a9scp.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-6u0p6.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-0f1q5.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-gn81p.tmp
%ProgramFiles(x86)%\universal extractor\is-1qafh.tmp
%ProgramFiles(x86)%\universal extractor\is-v7tmi.tmp
%ProgramFiles(x86)%\universal extractor\is-e6760.tmp
%ProgramFiles(x86)%\universal extractor\is-tldgc.tmp
%ProgramFiles(x86)%\universal extractor\is-at7mi.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-2jer2.tmp
%ProgramFiles(x86)%\universal extractor\is-lnnap.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-355h2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qsdhm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-d8rol.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ss0li.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-98767.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-i0bbq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-dqq2v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ibcv0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tc1kd.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-e50dn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fdkuf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-c4njh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-agmgh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-f285d.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6vr0t.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6c6ap.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rc7tc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-r150j.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9v8ft.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-d15kq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o1t4k.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6co8o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jjsj1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dg9md.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lrdoq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8bvtu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fcb7r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b9uam.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j2af2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dgek7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tbmsa.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sqoi1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ujgq9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tcenr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ng7vb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nrbe3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gsv64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ndm5h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lrm6p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i56lp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6eihj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1s7c7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0hld2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v8v52.tmp
%TEMP%\is-pssg8.tmp\_isetup\_shfoldr.dll
%TEMP%\is-pssg8.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-dvl06.tmp
%ProgramFiles(x86)%\universal extractor\is-apdk3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r27cu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lj9je.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nk372.tmp
%TEMP%\is-pssg8.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ack9i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kps24.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rtcni.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dc5uu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gc9h3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0gue3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-06uab.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-01qfu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8m6n9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oi02b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-23re1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-96hti.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dd44c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n7hmh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5p5gs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-778tr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7d3cv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0suvr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dp52f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f2fou.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lkspa.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lio4o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-879o6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bllgb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s9nfb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tpd9n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c7u9p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rlenc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vf6qd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-su4q0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1phfm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d39da.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b80lm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l3pg8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-asrm4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f6rfr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-esatn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hei5a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jm0mi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jc54v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f97la.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gfe6b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ni6s2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mg73g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4q7dt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6tcs9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o537d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2e2f5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tvk76.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r81be.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-69v7p.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-dvl06.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fjs8b.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-f5hvf.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-8kdia.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-kmacn.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3q0u1.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-d9src.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-l4pmq.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-71sq3.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-hcnvt.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-rtjr5.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-otaqn.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ak0cr.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-1q1cn.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-mnsvd.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mu5tv.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-c014v.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-sabav.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-birk5.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-bkm75.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-27rmq.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5j70p.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o2dlr.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-29tff.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tgt0n.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-tco69.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-3kld9.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-incqp.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-5nde4.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-29h22.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vb6q8.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2htre.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2rcak.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-e354r.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-tm40t.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-pqrf6.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-40192.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-4fbjm.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-tjb9a.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fdkuf.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-6u0p6.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-0f1q5.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-mcao5.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-48ich.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-8d79i.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-gp1f1.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-9v8ft.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-6n4fk.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-gn81p.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-2jer2.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-lnnap.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-1qafh.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-v7tmi.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-e6760.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-qsdhm.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-355h2.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-d8rol.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-r150j.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-ni6s2.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-ss0li.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-98767.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-i0bbq.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-dqq2v.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-ibcv0.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6co8o.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ta4lt.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-qu4n8.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-tc1kd.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-agmgh.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-f285d.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6vr0t.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-6c6ap.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rc7tc.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-e50dn.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-c4njh.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-d15kq.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-o1t4k.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jjsj1.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-69v7p.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j2af2.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dgek7.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ujgq9.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-i56lp.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6eihj.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tcenr.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dd44c.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ng7vb.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gsv64.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ndm5h.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lrm6p.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oi02b.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dg9md.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8bvtu.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lrdoq.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-b9uam.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sqoi1.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tbmsa.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-apdk3.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-lj9je.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nk372.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ack9i.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8m6n9.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kps24.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-23re1.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rtcni.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nrbe3.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gc9h3.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-06uab.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-01qfu.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v8v52.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0hld2.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-1s7c7.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dc5uu.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r27cu.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0gue3.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fcb7r.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f97la.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n7hmh.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-778tr.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7d3cv.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0suvr.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dp52f.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lio4o.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lkspa.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l3pg8.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5p5gs.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vf6qd.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s9nfb.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tpd9n.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-c7u9p.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-rlenc.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-96hti.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-su4q0.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-879o6.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bllgb.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-a9scp.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-tldgc.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-d39da.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f6rfr.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-esatn.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-hei5a.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jm0mi.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jc54v.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gfe6b.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1phfm.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f2fou.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r81be.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4q7dt.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6tcs9.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o537d.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2e2f5.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tvk76.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-b80lm.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-asrm4.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mg73g.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-at7mi.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{95c19CF5-54FF-11D3-8BDA-8920306aB1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-san8m.tmp\is-ijgpu.tmp' /SL4 $1400C0 "<Full path to file>" 7429898 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' c0b4c8e4c681ccd251b1e041345b2372

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней