Trojan.DownLoader45.23231

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-32h0k.tmp\is-2je90.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ivkee.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2ha6k.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-a4r1p.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-robkq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-96kca.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9dkr0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iqp5u.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-g40il.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tg72k.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tkaia.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gop28.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qqel5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5743v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fk6vb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gjiuc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-j0q02.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-n5n7i.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-r4mme.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-03be6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-68ecq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t6sdm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0326m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1srkq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dnhho.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7rohn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-222tr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ic3nl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lp3oo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4ngb1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bv1rl.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-pk7bn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-djfaa.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ugtah.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lpafs.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6pnvo.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-08tpc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-39273.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-e4b8q.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hl38q.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-46aop.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-9rb97.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-jrhco.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-kug1k.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-t2hq9.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-fpd6s.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-nhqs0.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-rbl2t.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-c5hdo.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-g8ukt.tmp
%ProgramFiles(x86)%\universal extractor\is-8an7h.tmp
%ProgramFiles(x86)%\universal extractor\is-0d45h.tmp
%ProgramFiles(x86)%\universal extractor\is-4n93p.tmp
%ProgramFiles(x86)%\universal extractor\is-6gv49.tmp
%ProgramFiles(x86)%\universal extractor\is-757l2.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-84mtn.tmp
%ProgramFiles(x86)%\universal extractor\is-2cj6v.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-8pbo0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-32f78.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6tkgc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-eok37.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q9c9g.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fvon6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ej02s.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6ir1h.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nsog4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-d153c.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4km3q.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-n7amo.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-aftvf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-08mb2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7ee48.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-042uc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1h8e9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5cv01.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-a2v41.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qifo0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ahn8d.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-sir99.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-shpad.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-casen.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-eeibh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2952i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-goc20.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bc5sc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jr1ii.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vqosm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ithn2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-665mp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-07lni.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ajqos.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-38o7g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9r15u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2428c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j7l7s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k505j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cvn76.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gut3j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-23ldp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gji8p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hg8rk.tmp
%TEMP%\is-5nm1d.tmp\_isetup\_shfoldr.dll
%TEMP%\is-5nm1d.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-270ct.tmp
%ProgramFiles(x86)%\universal extractor\is-vs16p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hne9c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t54sj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gf7rt.tmp
%TEMP%\is-5nm1d.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p4okl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4mnd2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-shq56.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hu0m5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8j545.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5mm8h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ffqli.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ji2b1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f3ttm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1oqrd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7tpef.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q39u8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rur9i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ega76.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ps876.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5dusb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6hrgc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-agb7r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tr4td.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pd4au.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-safee.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bl4ae.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3qr7g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7ombv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-beb4h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-16sak.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7i918.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pv2bn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6k4hq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8etm2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p9md3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nmsfc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1qbu9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pdj89.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f355d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t7mf6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0qbpe.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f4oat.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-908pd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2erm7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3l0ua.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jd5bg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a4db8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7pg2c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d2v79.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3bqm5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7lqfl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vjhrd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bn8jh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4slg8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qk4i8.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-270ct.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2ha6k.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-a4r1p.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-robkq.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-96kca.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9dkr0.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-39273.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-tg72k.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-n5n7i.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-tkaia.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-gop28.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-qqel5.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-5743v.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-fk6vb.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-iqp5u.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-j0q02.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ivkee.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-g40il.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-r4mme.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-03be6.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-1srkq.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dnhho.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7rohn.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-222tr.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ic3nl.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-gjiuc.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-4ngb1.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lp3oo.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-bv1rl.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-djfaa.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ugtah.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-lpafs.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-6pnvo.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-08tpc.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-t6sdm.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-68ecq.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-pk7bn.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-0326m.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-e4b8q.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4km3q.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-rbl2t.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-c5hdo.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-9rb97.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-jrhco.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-kug1k.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-t2hq9.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-a2v41.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-fpd6s.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-g8ukt.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-84mtn.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-2cj6v.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-8an7h.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-0d45h.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-4n93p.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-32f78.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-8pbo0.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-6tkgc.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-5cv01.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-a4db8.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-eok37.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-q9c9g.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fvon6.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ej02s.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-6ir1h.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-sir99.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-46aop.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hl38q.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-nsog4.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-aftvf.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-08mb2.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7ee48.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-042uc.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-1h8e9.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-d153c.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-n7amo.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-qifo0.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-ahn8d.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-shpad.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qk4i8.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jr1ii.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vqosm.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-07lni.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cvn76.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gut3j.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ajqos.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rur9i.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-38o7g.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2428c.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j7l7s.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k505j.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1oqrd.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-casen.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2952i.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-eeibh.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bc5sc.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-665mp.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ithn2.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-vs16p.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-t54sj.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gf7rt.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p4okl.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f3ttm.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4mnd2.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7tpef.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-shq56.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9r15u.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8j545.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ffqli.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ji2b1.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hg8rk.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gji8p.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-23ldp.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hu0m5.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hne9c.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5mm8h.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-goc20.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3l0ua.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ega76.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5dusb.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6hrgc.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-agb7r.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tr4td.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bl4ae.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-safee.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pdj89.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ps876.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6k4hq.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-beb4h.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-16sak.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-7i918.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-pv2bn.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q39u8.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8etm2.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3qr7g.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7ombv.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-nhqs0.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-6gv49.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-nmsfc.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t7mf6.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0qbpe.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-f4oat.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-908pd.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2erm7.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jd5bg.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p9md3.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pd4au.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4slg8.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d2v79.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3bqm5.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7lqfl.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vjhrd.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bn8jh.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1qbu9.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f355d.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7pg2c.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-757l2.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{5c199CF5-54FF-11D3-8BDA-9203068aB1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-32h0k.tmp\is-2je90.tmp' /SL4 $F0106 "<Full path to file>" 7285767 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' 0bf9e482926a49c2c3c5a8c31ddaca30

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial