Trojan.DownLoader45.22658

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-ld2vj.tmp\is-eob7s.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tiipb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rdq86.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-dj50m.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-glu2e.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7rjfe.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2qv5j.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vtvkh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-s76uk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-n44uk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-o8ovm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3jjs2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mui9a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-84a7o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gg9d7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vdiap.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-p22f3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-p311l.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-viu4p.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m11bl.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-eslit.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i8r1n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ohb9q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6povi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mejeh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ame4l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3fbbe.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l4s6m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pskov.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6eid5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kanef.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4oo4o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rnreg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4ij2g.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-svkmk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-jtuch.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tvugd.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-trj4l.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mh89s.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fatov.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-1jr0g.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-b8mbm.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-cbvg6.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-4c85t.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-742em.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-pfo7s.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-06981.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-jo8k2.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-p1mie.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-2dqk2.tmp
%ProgramFiles(x86)%\universal extractor\is-ubf4s.tmp
%ProgramFiles(x86)%\universal extractor\is-5jaba.tmp
%ProgramFiles(x86)%\universal extractor\is-3lgvq.tmp
%ProgramFiles(x86)%\universal extractor\is-i3jbi.tmp
%ProgramFiles(x86)%\universal extractor\is-d6d0g.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-cp78i.tmp
%ProgramFiles(x86)%\universal extractor\is-eer88.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-lke7k.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-voj90.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-32ko4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9lk2l.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3551l.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-brgn0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qp54u.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7tlqu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ku5q2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gbcc0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nh1tg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-e16kv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-a4k8t.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hbb19.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nafmb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0td7t.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-u088v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lkrsi.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9i45p.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-68he3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dg4gl.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hdctg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bqd9r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u4qu2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-eudp2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i8i97.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r92ib.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ogsp5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hjjpd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7hihv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j698v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-re3b9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6of13.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n78ci.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qrhp0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f0c8g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-eeic5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d21dn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0p71q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lcihv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9mm0h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lfohi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-grc5n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g369j.tmp
%TEMP%\is-4ks3h.tmp\_isetup\_shfoldr.dll
%TEMP%\is-4ks3h.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-j96ak.tmp
%ProgramFiles(x86)%\universal extractor\is-gb4qc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0mu6a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-019ka.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2s9lg.tmp
%TEMP%\is-4ks3h.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6ak3m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-df1j3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5chme.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-msdbd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-35n9d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hjf9l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-36eu7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p7r57.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o73js.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jef3f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gbfu7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t14mk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-42278.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d1o51.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nj7ba.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-beps1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m6v5p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k5d5q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9gsi8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-080ks.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vbh71.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bv0dk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hv33q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3924e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sirlr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-phrk4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u24fo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8a6f6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mie8q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ke0bu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u9v39.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pti0q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5tpap.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vu3rv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qogqp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ajbp2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cnt5p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a3hfl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5ohk5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u2vb1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ndjtl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f6cuk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-89mf5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-649kt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-59quu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5tgja.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6204e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qm6id.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qgahd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-od66r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ef9f4.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-j96ak.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rdq86.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-dj50m.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-glu2e.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7rjfe.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2qv5j.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-trj4l.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-n44uk.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-p311l.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-o8ovm.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-3jjs2.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mui9a.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-84a7o.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-gg9d7.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-vtvkh.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-p22f3.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-tiipb.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-s76uk.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-viu4p.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-m11bl.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-6povi.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mejeh.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ame4l.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3fbbe.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l4s6m.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-vdiap.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-6eid5.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pskov.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-kanef.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rnreg.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4ij2g.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-svkmk.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-jtuch.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-tvugd.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-i8r1n.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-eslit.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4oo4o.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-ohb9q.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-mh89s.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-nh1tg.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-jo8k2.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-p1mie.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-b8mbm.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-cbvg6.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-4c85t.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-742em.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-9i45p.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-pfo7s.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-2dqk2.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-cp78i.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-eer88.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-ubf4s.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-5jaba.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-3lgvq.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-voj90.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-lke7k.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-32ko4.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-lkrsi.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-89mf5.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-9lk2l.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3551l.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-brgn0.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-qp54u.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-7tlqu.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hdctg.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-1jr0g.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fatov.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-ku5q2.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-a4k8t.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hbb19.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-nafmb.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-0td7t.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-u088v.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-gbcc0.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-e16kv.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-68he3.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-dg4gl.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bqd9r.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ef9f4.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hjjpd.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7hihv.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6of13.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lcihv.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9mm0h.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n78ci.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-42278.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qrhp0.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-eeic5.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d21dn.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0p71q.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jef3f.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u4qu2.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-i8i97.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-eudp2.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ogsp5.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-re3b9.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j698v.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-gb4qc.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-019ka.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2s9lg.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6ak3m.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o73js.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-df1j3.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gbfu7.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5chme.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f0c8g.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-35n9d.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-36eu7.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p7r57.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g369j.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-grc5n.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-lfohi.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-msdbd.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0mu6a.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hjf9l.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r92ib.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ndjtl.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d1o51.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-beps1.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m6v5p.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k5d5q.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9gsi8.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bv0dk.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vbh71.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vu3rv.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nj7ba.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mie8q.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sirlr.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-phrk4.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-u24fo.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-8a6f6.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t14mk.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ke0bu.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hv33q.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3924e.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-06981.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-i3jbi.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-pti0q.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ajbp2.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cnt5p.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-a3hfl.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5ohk5.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u2vb1.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f6cuk.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u9v39.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-080ks.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-od66r.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-59quu.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5tgja.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6204e.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qm6id.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qgahd.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5tpap.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qogqp.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-649kt.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-d6d0g.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{c1959CF5-54FF-11D3-8BDA-a0892036B1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-ld2vj.tmp\is-eob7s.tmp' /SL4 $110226 "<Full path to file>" 7571159 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' fe4d6469d7bc24c150978b16f19ed182

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial