Trojan.DownLoader45.22765

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-bcl82.tmp\is-126ao.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-abdkg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2d8fk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-noc4h.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iepf9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-93bg9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ujqdk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kvhpn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6p1ea.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gmkpg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ig1n0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-n14nf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1eok0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rds5s.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hrmfh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5kch4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8ofj8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-eagb5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kiut8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6kvb0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9gqqk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h1t9g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rnbpd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f3tp7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-41f9j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d84hk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m6b92.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-953ah.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-34t0i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dpjf2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kjr02.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3okgf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4umbo.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lkj2e.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4ebr4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rrtqp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ibeec.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bb3o1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iavf8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-49puv.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-7fad7.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-5of66.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-6s5rb.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-k2ivf.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-m87nb.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-cbmur.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-epglk.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-6napk.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-bis30.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-h5sts.tmp
%ProgramFiles(x86)%\universal extractor\is-t1toc.tmp
%ProgramFiles(x86)%\universal extractor\is-vvgmg.tmp
%ProgramFiles(x86)%\universal extractor\is-evr8f.tmp
%ProgramFiles(x86)%\universal extractor\is-n2jai.tmp
%ProgramFiles(x86)%\universal extractor\is-063u9.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-i6sm8.tmp
%ProgramFiles(x86)%\universal extractor\is-6ifsc.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-fmq2p.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m1mal.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bnu4g.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lvo1p.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4okh1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-jd06h.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-erl0a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0798f.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6sjlf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4r9bp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-36j6p.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-km65j.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-pk802.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6ugvo.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-66m4e.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-k5gr2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6l38h.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fi7p5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-45geg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4mfpv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kicgq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-21tl5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gpm8a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hha4m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-60phh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8j69d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-klsft.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6s3sl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nbapp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8cuth.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e8cfg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3pjnk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ur3bk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6o3pm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m7nve.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ahl0e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-iq6qj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jlb7k.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-711s3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-430qb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r10d6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ddjng.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mv9po.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3rqvf.tmp
%TEMP%\is-rc246.tmp\_isetup\_shfoldr.dll
%TEMP%\is-rc246.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-svevk.tmp
%ProgramFiles(x86)%\universal extractor\is-hfss4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-baear.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t19ll.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1nehv.tmp
%TEMP%\is-rc246.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s7run.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b3fki.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7k4nh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ar4hl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-njrce.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qscbm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-89365.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0p71l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o9fqq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rau2l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-839l2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vd3d8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c5v6a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-eqmli.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b8a2p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uei94.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-756u0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j8ggk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-35k12.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-khn8t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r6qdv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ehfje.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jc12t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nvuvm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bc6ss.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d9ih1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-67912.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b5f9i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0ojgm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a0h96.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-joo3b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vp6a9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0mctt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6bc27.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k9vjp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-58ams.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qdoug.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pdptv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-577pg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vb1qg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c6aoo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tkjjl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4c500.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2lahu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hngru.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i0cv2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-trg50.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uaphv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nlfv3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7h2ml.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g7nts.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-svevk.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2d8fk.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-noc4h.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-iepf9.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-93bg9.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ujqdk.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bb3o1.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-gmkpg.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-eagb5.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-ig1n0.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-n14nf.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-1eok0.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rds5s.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-hrmfh.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-kvhpn.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8ofj8.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-abdkg.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-6p1ea.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-kiut8.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-6kvb0.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-f3tp7.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-41f9j.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d84hk.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m6b92.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-953ah.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-5kch4.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-dpjf2.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-34t0i.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-kjr02.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4umbo.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-lkj2e.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4ebr4.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rrtqp.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ibeec.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-h1t9g.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-9gqqk.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3okgf.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-rnbpd.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-iavf8.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-36j6p.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-6napk.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-bis30.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-5of66.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-6s5rb.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-k2ivf.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-m87nb.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-45geg.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-cbmur.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-h5sts.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-i6sm8.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-6ifsc.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-t1toc.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-vvgmg.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-evr8f.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-m1mal.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-fmq2p.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-bnu4g.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-fi7p5.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-4c500.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-lvo1p.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4okh1.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-jd06h.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-erl0a.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-0798f.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-21tl5.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7fad7.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-49puv.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-6sjlf.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-pk802.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6ugvo.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-66m4e.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-k5gr2.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6l38h.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4r9bp.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-km65j.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4mfpv.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-kicgq.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gpm8a.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g7nts.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nbapp.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8cuth.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ur3bk.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-430qb.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r10d6.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6o3pm.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c5v6a.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m7nve.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-iq6qj.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jlb7k.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-711s3.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rau2l.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hha4m.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8j69d.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-60phh.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6s3sl.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3pjnk.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e8cfg.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-hfss4.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-t19ll.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1nehv.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s7run.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o9fqq.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-b3fki.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-839l2.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7k4nh.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ahl0e.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-njrce.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-89365.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0p71l.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3rqvf.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mv9po.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-ddjng.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ar4hl.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-baear.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qscbm.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-klsft.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c6aoo.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-eqmli.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uei94.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-756u0.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j8ggk.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-35k12.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ehfje.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r6qdv.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6bc27.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-b8a2p.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0ojgm.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bc6ss.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d9ih1.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-67912.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-b5f9i.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vd3d8.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a0h96.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jc12t.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nvuvm.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-epglk.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-n2jai.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-vp6a9.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-58ams.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qdoug.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-pdptv.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-577pg.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vb1qg.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tkjjl.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-joo3b.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-khn8t.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7h2ml.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hngru.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-i0cv2.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-trg50.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uaphv.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nlfv3.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0mctt.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k9vjp.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2lahu.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-063u9.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{95c19CF5-54FF-11D3-8BDA-8920306aB1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-bcl82.tmp\is-126ao.tmp' /SL4 $E0168 "<Full path to file>" 7451798 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' ea3d87fe187e2b0af5bef2dd102b701d

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial