Trojan.DownLoader45.23244

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-l1i4q.tmp\is-imd9e.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-k9tvf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4d77r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-l6f3r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qaub6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-13po5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vsn28.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-845sn.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q84gf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rpn30.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ob06l.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lnc3u.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-jhg9l.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-eso6f.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-e86no.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-oaqkc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-h32e0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iqr98.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0ic8j.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kj5fe.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tj612.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jb9hm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fqvml.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dpqgn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-if4p9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2fl39.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u6vhk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s7o6k.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sl93u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-othhr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-b9vu8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gmt4o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-g8p3f.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-guuk7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7t2s9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ssb9q.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tgt7q.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-deel7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2ku2s.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mj4c9.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-8sr63.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ce822.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-jro4u.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-7446k.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-h1if8.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-8urro.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-nct0g.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-8ti9b.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ahd9u.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-eb5nf.tmp
%ProgramFiles(x86)%\universal extractor\is-casrb.tmp
%ProgramFiles(x86)%\universal extractor\is-r26kk.tmp
%ProgramFiles(x86)%\universal extractor\is-thlbc.tmp
%ProgramFiles(x86)%\universal extractor\is-05rma.tmp
%ProgramFiles(x86)%\universal extractor\is-6ejb6.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-1286g.tmp
%ProgramFiles(x86)%\universal extractor\is-loeuu.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-lfsms.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-u1kr1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vdgun.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-40e8a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5euf1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-800eq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-g6752.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ap08f.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nlrun.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ne58a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-v2uie.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fhlrg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gore4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-66qga.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ionah.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-t5mpt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-as93v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lul8j.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kscqt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-00rbo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d5jo8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0vn7i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7erhi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1jc8f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fjem1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-72f34.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c7c0p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g5b2b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6bmcc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o879p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qt421.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b4cpl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nptl5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-csahh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hvout.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i8u71.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bri9r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sivr4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4mp1q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i1u77.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1osvn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mmjgp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-58e6v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-aat2f.tmp
%TEMP%\is-ijncb.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ijncb.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-e2hfl.tmp
%ProgramFiles(x86)%\universal extractor\is-auagh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7q061.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-khf7r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v6g06.tmp
%TEMP%\is-ijncb.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-45766.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p78rk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sbfq2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pd4qg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c4h5u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hm7dd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vkoq0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tr2t7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ev41c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tbaki.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-80cr9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-89v05.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pgi5k.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-583oc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p89p3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4fg1u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2008b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vjdbj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p43c4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0hbnf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cb193.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-su003.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n2ge2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sctom.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-25304.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fci0g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7udak.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f6f6g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oovq3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qtqbc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v5ed7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h9at0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h13uk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pmktc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8drqp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dsfm2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hqh7n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-caoe9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4k1mb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1ai2s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r10mh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bfmmr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sa3un.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kncvr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-frb6m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2vvf5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3puon.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qh54n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jjue0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vdj4v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6pm7m.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-e2hfl.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4d77r.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-l6f3r.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-qaub6.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-13po5.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vsn28.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-deel7.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-rpn30.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-iqr98.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-ob06l.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-lnc3u.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-jhg9l.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-eso6f.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-e86no.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-845sn.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-h32e0.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-k9tvf.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-q84gf.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0ic8j.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-kj5fe.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-dpqgn.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-if4p9.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2fl39.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u6vhk.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s7o6k.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-oaqkc.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-othhr.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sl93u.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-b9vu8.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-g8p3f.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-guuk7.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7t2s9.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ssb9q.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-tgt7q.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-jb9hm.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-tj612.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-gmt4o.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-fqvml.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-2ku2s.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-v2uie.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-8ti9b.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ahd9u.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ce822.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-jro4u.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-7446k.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-h1if8.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-kscqt.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-8urro.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-eb5nf.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-1286g.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-loeuu.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-casrb.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-r26kk.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-thlbc.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-u1kr1.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-lfsms.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-vdgun.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-lul8j.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-sa3un.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-40e8a.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-5euf1.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-800eq.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-g6752.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-ap08f.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0vn7i.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8sr63.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mj4c9.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-nlrun.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-gore4.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-66qga.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ionah.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-t5mpt.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-as93v.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ne58a.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fhlrg.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-00rbo.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-d5jo8.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7erhi.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6pm7m.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6bmcc.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o879p.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nptl5.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-i1u77.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1osvn.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-csahh.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pgi5k.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hvout.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bri9r.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sivr4.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4mp1q.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tbaki.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1jc8f.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-72f34.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fjem1.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g5b2b.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-b4cpl.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qt421.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-auagh.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-khf7r.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v6g06.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-45766.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ev41c.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p78rk.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-80cr9.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sbfq2.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-i8u71.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c4h5u.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vkoq0.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tr2t7.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-aat2f.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-58e6v.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-mmjgp.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pd4qg.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7q061.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hm7dd.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c7c0p.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r10mh.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-583oc.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4fg1u.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2008b.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vjdbj.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p43c4.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-su003.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cb193.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pmktc.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p89p3.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oovq3.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-25304.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fci0g.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-7udak.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-f6f6g.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-89v05.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qtqbc.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n2ge2.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sctom.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-nct0g.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-05rma.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-h9at0.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dsfm2.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hqh7n.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-caoe9.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4k1mb.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1ai2s.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bfmmr.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v5ed7.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0hbnf.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vdj4v.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-frb6m.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2vvf5.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3puon.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qh54n.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jjue0.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h13uk.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8drqp.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kncvr.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-6ejb6.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{5c199CF5-54FF-11D3-8BDA-9203068aB1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-l1i4q.tmp\is-imd9e.tmp' /SL4 $11001C "<Full path to file>" 7440663 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' 50e2389a3ca6cb2aaf01ca30884904b2

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial