Trojan.DownLoader45.23121

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-2a7r8.tmp\is-1mb00.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lluji.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ge501.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lf0vj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-s413l.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-veen5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qgrl0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nmv54.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nku4a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-v8gng.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4fdrk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-frenk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ued1r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-g5ec3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9hdjl.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-t5cum.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ve867.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-v2br3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9pl0u.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hclni.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-r0fmh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nbunf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e7308.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b720f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jsl6q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-72m0n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d565f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dirdg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9hoqb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-il46v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gsrn8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-g5j9e.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-e3o1i.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bs2cg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hnquc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ogm00.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m36hc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ufgsf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3f1g6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fg80q.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-h14vf.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-lcmlm.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-85kht.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-sgat6.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-li7cu.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-botfr.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-n8q3j.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-olgaf.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-dek8a.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-6do0m.tmp
%ProgramFiles(x86)%\universal extractor\is-rd8l0.tmp
%ProgramFiles(x86)%\universal extractor\is-tfoim.tmp
%ProgramFiles(x86)%\universal extractor\is-djpmd.tmp
%ProgramFiles(x86)%\universal extractor\is-fkul9.tmp
%ProgramFiles(x86)%\universal extractor\is-0fscr.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-bjvlc.tmp
%ProgramFiles(x86)%\universal extractor\is-e28d4.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-2i9d5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kvlqu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-11o6o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-pm6cb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-d83ar.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7re0n.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-k2d07.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kuvp2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-jhsth.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qkit4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-o0tf3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-67u9c.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7m78k.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1v83h.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-olfka.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-s4drh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-797vr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7c1mk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-toteo.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-osids.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2q1qj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-du7au.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d3fis.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e0ffb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-phlu0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ehg4n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-grp9h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oidht.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6brct.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tdja7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-eg57j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-be7l4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o1gc2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v6b80.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ev7nu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a9ofs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vkvgq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qfb3p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bkn9s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ak51i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uh5a8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-su0ln.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5ucmq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qjg3f.tmp
%TEMP%\is-4vcs1.tmp\_isetup\_shfoldr.dll
%TEMP%\is-4vcs1.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-19t3t.tmp
%ProgramFiles(x86)%\universal extractor\is-21tih.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fqjvt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-35gnu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-267qb.tmp
%TEMP%\is-4vcs1.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-af7pm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sps8h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jsv89.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3gi6d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lecp7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uj54i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ee7vg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ngbhf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9iemk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-66ncj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4t67b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a4aes.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-janil.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8elpo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lec8l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b8tre.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ea42j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mfikl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tugm7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4eih0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jeefd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cqp28.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-taggj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m77p7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1ft5i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q1l9h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d8nsj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4quo3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1c5jn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6kplb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uedn5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i9mqr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-foqbe.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q6a8h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l7u0d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2v7n0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-27345.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ejaj7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sug0o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t6jfl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dvkbd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0jmih.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4r3u3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7hp9d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ruum9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n86rt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g8pi7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-89g50.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nd6j6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ac6q3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sfs30.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-19t3t.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ge501.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-lf0vj.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-s413l.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-veen5.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-qgrl0.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ufgsf.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-v8gng.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-v2br3.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-4fdrk.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-frenk.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ued1r.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-g5ec3.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-9hdjl.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-nmv54.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ve867.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-lluji.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-nku4a.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9pl0u.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-hclni.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-b720f.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jsl6q.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-72m0n.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d565f.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dirdg.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-t5cum.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-il46v.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9hoqb.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-gsrn8.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-e3o1i.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bs2cg.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hnquc.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ogm00.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-m36hc.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-nbunf.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-r0fmh.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-g5j9e.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-e7308.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-3f1g6.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-o0tf3.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-olgaf.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-dek8a.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-lcmlm.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-85kht.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-sgat6.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-li7cu.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-toteo.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-botfr.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-6do0m.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-bjvlc.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-e28d4.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-rd8l0.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-tfoim.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-djpmd.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-kvlqu.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-2i9d5.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-11o6o.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-7c1mk.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-4r3u3.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-pm6cb.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-d83ar.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7re0n.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-k2d07.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-kuvp2.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-du7au.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-h14vf.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fg80q.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-jhsth.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7m78k.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-1v83h.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-olfka.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-s4drh.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-797vr.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-qkit4.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-67u9c.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-osids.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-2q1qj.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d3fis.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sfs30.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6brct.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tdja7.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o1gc2.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ak51i.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uh5a8.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v6b80.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-janil.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ev7nu.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vkvgq.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qfb3p.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bkn9s.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-66ncj.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e0ffb.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ehg4n.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-phlu0.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oidht.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-be7l4.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-eg57j.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-21tih.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-35gnu.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-267qb.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-af7pm.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9iemk.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sps8h.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4t67b.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jsv89.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a9ofs.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lecp7.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ee7vg.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ngbhf.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qjg3f.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5ucmq.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-su0ln.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3gi6d.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fqjvt.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uj54i.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-grp9h.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dvkbd.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8elpo.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-b8tre.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ea42j.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mfikl.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tugm7.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cqp28.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jeefd.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q6a8h.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lec8l.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1c5jn.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1ft5i.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q1l9h.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-d8nsj.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-4quo3.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a4aes.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6kplb.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-taggj.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m77p7.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-n8q3j.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-fkul9.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-i9mqr.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2v7n0.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-27345.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-ejaj7.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sug0o.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t6jfl.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0jmih.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uedn5.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4eih0.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ac6q3.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ruum9.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n86rt.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g8pi7.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-89g50.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nd6j6.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-foqbe.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l7u0d.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7hp9d.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-0fscr.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{95C19CF5-54FF-11D3-8BDA-06008903B1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-2a7r8.tmp\is-1mb00.tmp' /SL4 $120162 "<Full path to file>" 7449322 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' a469b9026ca2b443c541c18957f9db39

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial