Trojan.DownLoader45.23120

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-rg1c1.tmp\is-l4erj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ti7ht.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0ojup.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-crmsb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-c062f.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bpss9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ped5j.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-e2gsg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2hho6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-h8ttd.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ulviq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q9vee.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2up2q.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fd4s0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-6g1q4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-se4i4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-72m2o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-43d4n.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-r30ek.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-od18s.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fg1u6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-efkhq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3kmf1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0u31b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s5ou4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sh1k8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sft28.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mhu4e.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u7p31.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k72sl.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0hhbq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-deo76.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bhc9d.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-kihim.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-22ooe.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-v749b.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gpc33.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hsvnv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-trkgc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-k9bjc.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-k4rva.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-91ccf.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-fed6q.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-p62kq.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-pvcdu.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-k7ubu.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-cd535.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-8k5nk.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-u7f52.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-fkftg.tmp
%ProgramFiles(x86)%\universal extractor\is-6kvev.tmp
%ProgramFiles(x86)%\universal extractor\is-1m83f.tmp
%ProgramFiles(x86)%\universal extractor\is-r2ql7.tmp
%ProgramFiles(x86)%\universal extractor\is-rk46a.tmp
%ProgramFiles(x86)%\universal extractor\is-f6rku.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-79s0e.tmp
%ProgramFiles(x86)%\universal extractor\is-cfeba.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-sn436.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-34vl5.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fg410.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0k3u0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m0jq8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lrg0m.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nh4v2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mfte8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-t5eeg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8nsl0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nl9t7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-839fm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-b0ajt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-205f1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ll1cq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-b81h0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fjgi7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tvblg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1sao7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4aeob.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4m124.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-k0n6r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-93qpc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3g8ef.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-07gd2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6f5f1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p1oo3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k3j1j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c8vuc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-46ngg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-83l43.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s8eqn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kj8mc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pnhcv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q6gbo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nvkpv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o136a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-18bu7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rf3ov.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ssfc3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2vchr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kaair.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g0ij7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nsuro.tmp
%TEMP%\is-oaird.tmp\_isetup\_shfoldr.dll
%TEMP%\is-oaird.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-p45fn.tmp
%ProgramFiles(x86)%\universal extractor\is-lvrog.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j0gkm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tasiu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nri0b.tmp
%TEMP%\is-oaird.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-it5il.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ki2ut.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a0c78.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p4cc5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-paecu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ej6q3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a4ga5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bcl1n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m3pqg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u7vf0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mem1v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-13pkk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-be5io.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u99nb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-phdnj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r8qd5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k3su6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tn1dm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6jmue.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p5ld4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8c4f4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5v62a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8227r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4eukb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-on6g7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8cndn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ag3si.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ur1f1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-otb6v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-55ckj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rfmuj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-shdjn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-59870.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-r7eh2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-be2q0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lfd1s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oq0hg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bjb8s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qonc1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5bc32.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i7kiu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7ekqe.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q0p1q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hul72.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vt61h.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tbm73.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oar95.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-461il.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oi9ug.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t9e4k.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-srfus.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-p45fn.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0ojup.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-crmsb.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-c062f.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bpss9.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ped5j.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hsvnv.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-h8ttd.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-43d4n.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-ulviq.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-q9vee.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2up2q.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fd4s0.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-6g1q4.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-e2gsg.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-72m2o.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ti7ht.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-2hho6.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-r30ek.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-od18s.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-0u31b.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s5ou4.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sh1k8.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sft28.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mhu4e.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-se4i4.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-k72sl.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u7p31.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-0hhbq.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bhc9d.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-kihim.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-22ooe.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-v749b.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-gpc33.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-efkhq.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-fg1u6.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-deo76.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-3kmf1.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-trkgc.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-nl9t7.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-8k5nk.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-u7f52.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-91ccf.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-fed6q.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-p62kq.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-pvcdu.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-1sao7.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-k7ubu.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-fkftg.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-79s0e.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-cfeba.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-6kvev.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-1m83f.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-r2ql7.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-34vl5.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-sn436.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-fg410.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-tvblg.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-q0p1q.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-0k3u0.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-m0jq8.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-lrg0m.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-nh4v2.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-mfte8.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-k0n6r.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-k4rva.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-k9bjc.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-t5eeg.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-b0ajt.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-205f1.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ll1cq.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-b81h0.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fjgi7.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8nsl0.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-839fm.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4aeob.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-4m124.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-93qpc.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-srfus.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c8vuc.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-46ngg.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kj8mc.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ssfc3.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2vchr.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pnhcv.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-be5io.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q6gbo.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o136a.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-18bu7.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rf3ov.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u7vf0.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3g8ef.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6f5f1.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-07gd2.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k3j1j.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s8eqn.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-83l43.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-lvrog.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-tasiu.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nri0b.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-it5il.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m3pqg.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ki2ut.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mem1v.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a0c78.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nvkpv.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-paecu.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a4ga5.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bcl1n.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nsuro.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g0ij7.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-kaair.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p4cc5.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j0gkm.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ej6q3.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p1oo3.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-i7kiu.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u99nb.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r8qd5.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k3su6.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tn1dm.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6jmue.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5v62a.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8c4f4.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-r7eh2.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-phdnj.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-otb6v.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-on6g7.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8cndn.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-ag3si.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-ur1f1.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-13pkk.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-55ckj.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8227r.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4eukb.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-cd535.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-rk46a.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-shdjn.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lfd1s.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oq0hg.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-bjb8s.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qonc1.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5bc32.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7ekqe.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rfmuj.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-p5ld4.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t9e4k.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vt61h.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tbm73.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oar95.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-461il.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oi9ug.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-59870.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-be2q0.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hul72.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-f6rku.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{95c19CF5-54FF-11D3-8BDA-8920306aB1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-rg1c1.tmp\is-l4erj.tmp' /SL4 $B0236 "<Full path to file>" 7488047 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' 6f09ac45c781532f91a1370f106bcd0c

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial