Trojan.DownLoader45.22693

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-f1s41.tmp\is-qfcfp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-de8ih.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bag5p.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4lnja.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ppbp6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8f41q.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-u1659.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-11f90.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4atqn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bm4fp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-oaeo5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-krat8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-v0ggt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iggmd.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iqe26.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-v5ned.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q572l.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2mio6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hcjpt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-49cth.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vk4hh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6acqd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kvmdu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l33vs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p93as.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-18ho1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kbq93.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fhfam.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lseab.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sckfr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9hejj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-c17i4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tgak1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-he1br.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tk0a5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-do55u.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-goo65.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2k1ru.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-env1l.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-c8hb4.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-la4a0.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-nt3jb.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-llgt4.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-7c38c.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-udm3s.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-okftg.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-e92et.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-53gl1.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-r86c1.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-e5us9.tmp
%ProgramFiles(x86)%\universal extractor\is-bh0h5.tmp
%ProgramFiles(x86)%\universal extractor\is-gcnid.tmp
%ProgramFiles(x86)%\universal extractor\is-2aqk0.tmp
%ProgramFiles(x86)%\universal extractor\is-r6147.tmp
%ProgramFiles(x86)%\universal extractor\is-mltui.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-a2je9.tmp
%ProgramFiles(x86)%\universal extractor\is-d62kh.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-jtcl2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-okfea.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-eici1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8npha.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-c1cum.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-obfaq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vh9ln.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-k5tjg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qhqck.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nhfvi.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bidmm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9208g.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6qm8n.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-acdb1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-jgcsr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cbfl3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-otuam.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-alk3u.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fa74d.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m1f8g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5l25v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8i8h6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bd0pb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0oprv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vifqq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sdunq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-573nu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9b94q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jka2i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-abk9e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dljc1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cp769.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8db75.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tslb3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3csmf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ojdjj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nb6qc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6j46h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c1rmk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fqp40.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i6etf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2f2gd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d71bh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q6hsk.tmp
%TEMP%\is-u9l7v.tmp\_isetup\_shfoldr.dll
%TEMP%\is-u9l7v.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-v07ih.tmp
%ProgramFiles(x86)%\universal extractor\is-ljkql.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-usn3g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-aqagu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n8rqc.tmp
%TEMP%\is-u9l7v.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-44b8o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jpofb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-379te.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-udrf6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6fv03.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n1jdv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2ufhi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kchqm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pitcv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hag7a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fp19f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-va07h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-542cb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-peeiv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c5elq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b4a89.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g63pp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lhprh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hbvnj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5kkui.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ug3q8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-08r43.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bc84u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pk39r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4g1fl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4ogeu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lsrmj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q7tl7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0323v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t139j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fkdqs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mto26.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3e52m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o25p0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9rp5m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r07gd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lvpu5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ucjs8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qoigt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3m4fh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ijrmt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ri1sq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ops4t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jbraf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n1lmj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-miq4b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rlqvd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v5sm0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3i0j8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-72f4e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bbh19.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-v07ih.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bag5p.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4lnja.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-ppbp6.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8f41q.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-u1659.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2k1ru.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-bm4fp.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2mio6.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-oaeo5.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-krat8.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-v0ggt.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-iggmd.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-iqe26.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-11f90.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-q572l.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-de8ih.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-4atqn.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hcjpt.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-49cth.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-l33vs.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p93as.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-18ho1.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kbq93.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fhfam.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-v5ned.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-sckfr.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lseab.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-9hejj.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-tgak1.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-he1br.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-tk0a5.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-do55u.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-goo65.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-6acqd.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-vk4hh.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-c17i4.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-kvmdu.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-env1l.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bidmm.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-53gl1.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-r86c1.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-nt3jb.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-llgt4.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-7c38c.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-udm3s.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-fa74d.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-okftg.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-e5us9.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-a2je9.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-d62kh.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-bh0h5.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-gcnid.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-2aqk0.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-okfea.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-jtcl2.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-eici1.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-alk3u.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-ops4t.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-8npha.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-c1cum.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-obfaq.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vh9ln.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-k5tjg.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8i8h6.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-la4a0.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-c8hb4.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-qhqck.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6qm8n.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-acdb1.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-jgcsr.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-cbfl3.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-otuam.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-nhfvi.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9208g.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-m1f8g.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-5l25v.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bd0pb.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bbh19.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jka2i.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-abk9e.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8db75.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fqp40.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-i6etf.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tslb3.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-542cb.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3csmf.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nb6qc.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6j46h.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c1rmk.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hag7a.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0oprv.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sdunq.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vifqq.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9b94q.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cp769.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dljc1.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-ljkql.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-aqagu.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n8rqc.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-44b8o.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pitcv.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jpofb.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fp19f.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-379te.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ojdjj.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6fv03.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2ufhi.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kchqm.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q6hsk.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d71bh.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-2f2gd.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-udrf6.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-usn3g.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n1jdv.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-573nu.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ijrmt.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-peeiv.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-b4a89.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g63pp.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lhprh.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hbvnj.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-08r43.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ug3q8.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o25p0.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c5elq.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0323v.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4g1fl.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4ogeu.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-lsrmj.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-q7tl7.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-va07h.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t139j.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bc84u.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pk39r.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-e92et.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-r6147.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-mto26.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r07gd.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lvpu5.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-ucjs8.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qoigt.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3m4fh.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ri1sq.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fkdqs.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5kkui.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-72f4e.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n1lmj.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-miq4b.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rlqvd.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v5sm0.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3i0j8.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3e52m.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9rp5m.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jbraf.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-mltui.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{195c9CF5-54FF-11D3-8BDA-0892036aB1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-f1s41.tmp\is-qfcfp.tmp' /SL4 $A0214 "<Full path to file>" 7642713 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' e4f503391888d9c6cc19ab283d3b3a26

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial