Trojan.DownLoader45.21859

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-m68e8.tmp\is-dhr07.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gegqe.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-f5o6r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-g99o6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-f38f4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-imd31.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-km3cp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-53gp1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0p40d.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-o2mst.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-pi3s0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fg6vv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4h9bv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1br1a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6roa7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-k9be3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vfk9n.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gpqn2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-s2tod.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-p5g6h.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iek5q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8tdlt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4kmr1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8d2is.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p0r18.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a4hte.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-anrfj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l974n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dl16o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9mkhj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bo15s.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6mnf4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tk9cg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6jnbk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7vb4k.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-k6rjo.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-g9pqn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-olv23.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-t2mlk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2m7h7.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-1fu81.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ggpt8.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-deku5.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-9qdr1.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-06b4j.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-8o9ij.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-t85ft.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-so8kl.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-h9m5n.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-35bmp.tmp
%ProgramFiles(x86)%\universal extractor\is-9vr3g.tmp
%ProgramFiles(x86)%\universal extractor\is-hbdbm.tmp
%ProgramFiles(x86)%\universal extractor\is-ooc5u.tmp
%ProgramFiles(x86)%\universal extractor\is-jhvvb.tmp
%ProgramFiles(x86)%\universal extractor\is-qcbdl.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-gonud.tmp
%ProgramFiles(x86)%\universal extractor\is-bduun.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-pkidg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0eg4t.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-k5h31.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8kn7d.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-74een.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-g882i.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-psbi2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9qlso.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2oe4g.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8666e.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-n5mad.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tb0oc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-u3po9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8vggc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0j5d3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8f5hr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9p4jr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-uivh5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-knc3t.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-njora.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g0lro.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-98h0g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tgdld.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4309c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3d76i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4q982.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sbkkq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uvreo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oqajl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tkvsf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-if25g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ahpn4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-621pr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o84pp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u02ra.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rvol9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e0bia.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9hfbn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bu4k0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u392s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k79va.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i20kq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lau3a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-061u9.tmp
%TEMP%\is-ishlj.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ishlj.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-vuv45.tmp
%ProgramFiles(x86)%\universal extractor\is-bc9m7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r6auq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qjnh1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-attgc.tmp
%TEMP%\is-ishlj.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c1728.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-os7ba.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sko6m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n46gu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h2oae.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j0c95.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bjuuu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0nep4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k0p5s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j22bm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0pc21.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a2a1a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kdtik.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s1ue7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5v8pf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-aaj41.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-aovk1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ah2c9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dadep.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d6v0g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d73bd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9uv9i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e87g1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a34qr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nkh47.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7smja.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-44200.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-daj5m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f94mn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vs4sn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t1u1c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qfbip.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p4i04.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cd9l8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9uqgg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2m3pv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1i3fi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7hvqo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gsbes.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mb30p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b9efs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2gjsh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cluos.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qkiho.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-keccg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ip89d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-301e8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kgbbn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jn1p8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l1nih.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nj97p.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-vuv45.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-f5o6r.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-g99o6.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-f38f4.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-imd31.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-km3cp.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-olv23.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-o2mst.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-gpqn2.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-pi3s0.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-fg6vv.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4h9bv.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-1br1a.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-6roa7.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-53gp1.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vfk9n.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-gegqe.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-0p40d.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-s2tod.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-p5g6h.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-8d2is.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p0r18.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a4hte.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-anrfj.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l974n.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-k9be3.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-9mkhj.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dl16o.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-bo15s.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-tk9cg.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6jnbk.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7vb4k.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-k6rjo.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-g9pqn.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-8tdlt.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-iek5q.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6mnf4.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-4kmr1.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-t2mlk.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-n5mad.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-so8kl.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-h9m5n.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ggpt8.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-deku5.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-9qdr1.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-06b4j.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-knc3t.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-8o9ij.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-35bmp.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-gonud.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-bduun.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-9vr3g.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-hbdbm.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-ooc5u.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0eg4t.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-pkidg.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-k5h31.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-uivh5.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-cluos.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-8kn7d.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-74een.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-g882i.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-psbi2.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-9qlso.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-98h0g.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-1fu81.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2m7h7.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-2oe4g.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-u3po9.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8vggc.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0j5d3.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-8f5hr.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9p4jr.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8666e.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-tb0oc.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-njora.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-g0lro.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tgdld.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nj97p.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oqajl.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tkvsf.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-621pr.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u392s.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k79va.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o84pp.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kdtik.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u02ra.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e0bia.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9hfbn.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bu4k0.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j22bm.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4309c.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4q982.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3d76i.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uvreo.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ahpn4.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-if25g.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-bc9m7.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-qjnh1.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-attgc.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c1728.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k0p5s.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-os7ba.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0pc21.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sko6m.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rvol9.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h2oae.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bjuuu.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0nep4.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-061u9.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lau3a.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-i20kq.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n46gu.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r6auq.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j0c95.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sbkkq.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-b9efs.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s1ue7.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-aaj41.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-aovk1.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ah2c9.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dadep.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9uv9i.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d73bd.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cd9l8.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5v8pf.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f94mn.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nkh47.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7smja.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-44200.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-daj5m.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a2a1a.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vs4sn.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e87g1.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a34qr.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-t85ft.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-jhvvb.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-qfbip.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2m3pv.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1i3fi.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-7hvqo.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gsbes.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mb30p.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2gjsh.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t1u1c.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d6v0g.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l1nih.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-keccg.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ip89d.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-301e8.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kgbbn.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jn1p8.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p4i04.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9uqgg.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qkiho.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-qcbdl.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{95C19CF5-54FF-11D3-8BDA-06008903B1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-m68e8.tmp\is-dhr07.tmp' /SL4 $B0238 "<Full path to file>" 7445820 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' 36104fb9c0c4224f780ca928c5350abb

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial