Trojan.DownLoader45.45153

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-hgano.tmp\is-uq3gu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cflog.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5gkmn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-82r6v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-91umj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-no6rs.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kc9aj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cdblg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-pnm44.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-l4tpe.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-td85k.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8l7vj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-isnnj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-au1us.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q76fi.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rls06.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iiktr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-km4n3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mn5s0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-s9a5k.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-snicl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dre74.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m8su1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tli2s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mttm9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bo8vi.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ctdc7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-akq5v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-25u67.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1uvn7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2kjeb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vdiqf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9fia7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8e4pb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rmi66.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j0grp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3ubpr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3hkkc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fgun3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-jv0k4.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-qqfci.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-brm83.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-227q7.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-jbu3v.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-n0e0v.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-rf7fb.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-7arta.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-8809b.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-jj48u.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-0171l.tmp
%ProgramFiles(x86)%\universal extractor\is-4o3gg.tmp
%ProgramFiles(x86)%\universal extractor\is-foghg.tmp
%ProgramFiles(x86)%\universal extractor\is-lphqo.tmp
%ProgramFiles(x86)%\universal extractor\is-760u5.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-8846m.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5cr1a.tmp
%ProgramFiles(x86)%\universal extractor\is-999ho.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fcsdp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-f4jnn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ko1dl.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tlo32.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-29ifo.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kgipe.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1p9t6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rshg5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-db3g7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gl1mp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ctib6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bqlmp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-eu7e4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-55dnb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4bbgn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-e607o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0sek8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q40gv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p8gk2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-p1ij4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ol2ep.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b13ra.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f956k.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tusvb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-akvpr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d9m1e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-msdgl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q3kb1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-edlm5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t0rh8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v66lo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ufc0c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3d0i1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5gcmo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8jm95.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jilbd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d44m1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1jt7b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5njii.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mf9vf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-95mja.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ns9dk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-samk0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s0rb6.tmp
%TEMP%\is-37fka.tmp\_isetup\_shfoldr.dll
%TEMP%\is-37fka.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-clcae.tmp
%ProgramFiles(x86)%\universal extractor\is-1vold.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8geph.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e8vgc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d75ds.tmp
%TEMP%\is-37fka.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-436ph.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-79udg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jvq6c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-78hn2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fpefn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3la5b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v7nkn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-siihn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-398d5.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-02vm0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8db0k.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5apkr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-311rh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-31hp5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3knjh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9mbmk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1eb29.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v8npv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ipm9r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-obfs9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lg059.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-onbmn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o3gd7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lerl1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9fugd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mr9uh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u8uhs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rqk0o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mc9ul.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o53sf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4qben.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9tgtg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2j637.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6cvv8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4pjgk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0vo1r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-444r5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g1ra1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-edk3e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3l45h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q7jjm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qe97m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ptu8s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9os14.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vovli.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ds440.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j8tle.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r8j5b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9blqt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5g3vj.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-clcae.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-cflog.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-5gkmn.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-82r6v.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-91umj.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-no6rs.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-kc9aj.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-j0grp.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-l4tpe.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-km4n3.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-td85k.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-8l7vj.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-isnnj.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-au1us.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-q76fi.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-cdblg.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-pnm44.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-25u67.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ctdc7.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-snicl.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-ol2ep.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dre74.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m8su1.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tli2s.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mttm9.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bo8vi.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-rls06.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-iiktr.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-1uvn7.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-3hkkc.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2kjeb.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vdiqf.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9fia7.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8e4pb.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rmi66.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-akq5v.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-3ubpr.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-db3g7.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\is-lphqo.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-jv0k4.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-7arta.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-qqfci.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-jj48u.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-brm83.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-227q7.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-jbu3v.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-s9a5k.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-n0e0v.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-8809b.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-8846m.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-0171l.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-999ho.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-4o3gg.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-foghg.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\bin\is-fcsdp.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-5cr1a.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-f4jnn.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-q40gv.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0sek8.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ko1dl.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ctib6.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-tlo32.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-29ifo.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-kgipe.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-1p9t6.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-mn5s0.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-p8gk2.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-rshg5.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bqlmp.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-p1ij4.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-eu7e4.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-55dnb.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4bbgn.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-e607o.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-02vm0.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-gl1mp.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-rf7fb.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\docs\is-b13ra.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lg059.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-msdgl.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q3kb1.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-edlm5.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3d0i1.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5njii.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mf9vf.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-78hn2.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-95mja.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8jm95.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jilbd.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d44m1.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1jt7b.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s0rb6.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8db0k.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-akvpr.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d9m1e.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ufc0c.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rqk0o.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t0rh8.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8geph.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e8vgc.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d75ds.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-436ph.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-398d5.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-79udg.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fgun3.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5gcmo.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jvq6c.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3la5b.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v7nkn.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-siihn.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-samk0.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v66lo.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-ns9dk.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\is-1vold.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-fpefn.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q7jjm.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tusvb.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5apkr.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-311rh.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-31hp5.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3knjh.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9mbmk.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1eb29.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ipm9r.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5g3vj.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u8uhs.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mc9ul.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-onbmn.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o3gd7.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lerl1.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-9fugd.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-mr9uh.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o53sf.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-obfs9.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v8npv.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4qben.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9tgtg.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6cvv8.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4pjgk.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-0vo1r.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-444r5.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g1ra1.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3l45h.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-edk3e.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f956k.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r8j5b.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ptu8s.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9os14.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vovli.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ds440.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j8tle.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9blqt.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2j637.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qe97m.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-760u5.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{995C1CF5-54FF-11D3-8BDA-00600893B1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-hgano.tmp\is-uq3gu.tmp' /SL4 $11022C "<Full path to file>" 6697124 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' 29f543de1c201b40e71b6525f442fed4

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 29"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней