Trojan.DownLoader45.23123

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-rcpkg.tmp\is-6t1oe.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nl6mt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-o43fv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q4fbf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0puc9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-g6k4l.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-68u3p.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q91k4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-aqngh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-og9pj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5gb5a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7l6s7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gl9u1.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gjrjc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1n7r9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-j2gl4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-v2d9s.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-pakbi.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3rrn3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-t7guh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gjhls.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5uo2u.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sp7ju.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k8u64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ul3jc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-60dgq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a4hc8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q37um.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-40orj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j0h95.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-729iv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-gsmf7.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-o656n.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-82ufh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7hirp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-eseqd.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-h4gpp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7s24o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mouhh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7350f.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-f6ja1.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-k5tgr.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-79bdr.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-urce4.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-bh2rq.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-urhte.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-javns.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-5pvqb.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-5bnls.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-lppn8.tmp
%ProgramFiles(x86)%\universal extractor\is-2jart.tmp
%ProgramFiles(x86)%\universal extractor\is-ds9ie.tmp
%ProgramFiles(x86)%\universal extractor\is-kuk7a.tmp
%ProgramFiles(x86)%\universal extractor\is-r2750.tmp
%ProgramFiles(x86)%\universal extractor\is-e923m.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ifbsc.tmp
%ProgramFiles(x86)%\universal extractor\is-g4vv8.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-rvoo3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-i4sum.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7jdur.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-r81ok.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-egt3j.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-dob4n.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nnjtf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ohkpj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0ga7e.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-21iit.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5j013.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-htmbf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bss2o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8qg6c.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-o803o.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9tgev.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-m3e07.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-f64kr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ujcj4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-nej2f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h83mp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-r2l7q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4qcq9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ffkik.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hbvit.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-napud.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k0i05.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u7ni5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-20tqe.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4vpb3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j09g3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3ks2r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rdo2j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gp32j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rtsb6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3tqnc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ieqqi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e8c9m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t60hl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f23dd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-tdsdn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6ambp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2vgdc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oe5go.tmp
%TEMP%\is-qieke.tmp\_isetup\_shfoldr.dll
%TEMP%\is-qieke.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-2kjj4.tmp
%ProgramFiles(x86)%\universal extractor\is-adq8o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-so925.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vvu3d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7h6kt.tmp
%TEMP%\is-qieke.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0hm4o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-diclc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7i5lp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ql0c4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5j213.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b5v44.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4m0mg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v912l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-v73d4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-oju6p.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-eimp4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hpds3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rg5hp.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s0i6i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6hun0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-43oad.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kc7hl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-di7l9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q1k3j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vn77q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lak9n.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d9loe.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7p1nr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jqgsm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-achj3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m25qf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-in6jg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-18sls.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qen2s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s232b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-aafm9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ka3td.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0b8p9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6gfbo.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-36mtk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ra9ba.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3uckv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vr8vj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-97pnv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7u51v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jaa6d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rsr58.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-muass.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t2atg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rm8u0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3usik.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-csql3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2k49m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s0spt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6q5c0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c6pud.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-2kjj4.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-o43fv.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-q4fbf.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-0puc9.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-g6k4l.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-68u3p.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7s24o.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-og9pj.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-pakbi.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-5gb5a.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-7l6s7.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-gl9u1.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-gjrjc.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-1n7r9.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-q91k4.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-v2d9s.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-nl6mt.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-aqngh.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3rrn3.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-t7guh.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-k8u64.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ul3jc.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-60dgq.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a4hc8.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q37um.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-j2gl4.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-j0h95.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-40orj.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-729iv.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-o656n.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-82ufh.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7hirp.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-eseqd.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-h4gpp.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-5uo2u.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-gjhls.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-gsmf7.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-sp7ju.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-mouhh.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-5j013.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-5pvqb.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-5bnls.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-k5tgr.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-79bdr.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-urce4.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-bh2rq.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-ujcj4.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-urhte.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-lppn8.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ifbsc.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-g4vv8.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-2jart.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-ds9ie.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-kuk7a.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-i4sum.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-rvoo3.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-7jdur.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-f64kr.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-muass.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-r81ok.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-egt3j.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-dob4n.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-nnjtf.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-ohkpj.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-r2l7q.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-f6ja1.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7350f.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-0ga7e.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bss2o.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-8qg6c.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-o803o.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-9tgev.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-m3e07.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-21iit.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-htmbf.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-nej2f.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-h83mp.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4qcq9.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c6pud.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-20tqe.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4vpb3.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rdo2j.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f23dd.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-tdsdn.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gp32j.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rg5hp.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rtsb6.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ieqqi.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e8c9m.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t60hl.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oju6p.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ffkik.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-napud.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hbvit.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u7ni5.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3ks2r.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j09g3.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-adq8o.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-vvu3d.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7h6kt.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0hm4o.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v73d4.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-diclc.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-eimp4.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7i5lp.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3tqnc.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5j213.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4m0mg.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-v912l.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-oe5go.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2vgdc.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-6ambp.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ql0c4.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-so925.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-b5v44.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k0i05.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jaa6d.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s0i6i.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-43oad.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kc7hl.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-di7l9.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q1k3j.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d9loe.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lak9n.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6gfbo.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6hun0.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qen2s.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-achj3.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m25qf.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-in6jg.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-18sls.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hpds3.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s232b.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7p1nr.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jqgsm.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-javns.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-r2750.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-ka3td.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ra9ba.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3uckv.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-vr8vj.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-97pnv.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7u51v.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rsr58.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-aafm9.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vn77q.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6q5c0.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rm8u0.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3usik.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-csql3.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2k49m.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s0spt.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0b8p9.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-36mtk.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t2atg.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-e923m.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{5c199CF5-54FF-11D3-8BDA-9203068aB1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-rcpkg.tmp\is-6t1oe.tmp' /SL4 $120226 "<Full path to file>" 7464644 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' 50c764f4605c15d31f1f993d07c84f10

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial