Trojan.DownLoader45.23241

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-434qr.tmp\is-4dfet.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bvtca.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3gmrp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ufiab.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-h9fpd.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9ng3t.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-82qko.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vp4rs.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-8eim2.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tq3m8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-bgnvc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-stpac.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-94pvj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-cb70r.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fr0rd.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-jl55e.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lsuvv.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-rtlrr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q3nom.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tlnsa.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-pqo49.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-612l7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l6el0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qgk87.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mc8di.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pfe2f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uume7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bj4p8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8ded3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pqb1n.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3qmk0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ifhp6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3t8ga.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-42cm8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qp6f4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-e07jo.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2smk4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fsb27.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-usihu.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-942ci.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-j80q7.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ouhpe.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-kqk4l.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-q40qu.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-pad1m.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-4uhnj.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-d4nab.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ta047.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-a6r92.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-3o22e.tmp
%ProgramFiles(x86)%\universal extractor\is-u1pfo.tmp
%ProgramFiles(x86)%\universal extractor\is-294oe.tmp
%ProgramFiles(x86)%\universal extractor\is-jgej5.tmp
%ProgramFiles(x86)%\universal extractor\is-aov51.tmp
%ProgramFiles(x86)%\universal extractor\is-kbmrj.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-619u4.tmp
%ProgramFiles(x86)%\universal extractor\is-h5jos.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-m51bt.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-culqm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-aq6jg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2te93.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-c12qj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-d03ff.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-u0g9v.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fn89q.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ujvh9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4anvs.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5m0kr.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ahfn4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qub0c.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-pniq9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-stt62.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-co9k9.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-qtarj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4481c.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-akl4g.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9i1ik.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n6qub.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-5rkjm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-idsjk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gqb63.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-m4v4o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pgm6f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bhfi9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8vktl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7ho7l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6trfv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-26msb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0bnss.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hgh8q.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ah3ho.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5mp8m.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a883k.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-up5ji.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-av1hh.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u8vek.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jk1ha.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jobp0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o4ijf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sgo9i.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7b777.tmp
%TEMP%\is-jatup.tmp\_isetup\_shfoldr.dll
%TEMP%\is-jatup.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-8uahl.tmp
%ProgramFiles(x86)%\universal extractor\is-vdon9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-eijnl.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gd7em.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-trhc3.tmp
%TEMP%\is-jatup.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-c3fie.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qrej9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j7iu1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5jcj5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-j18ov.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-a993a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-njjp8.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6sui7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u8dic.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s8o4b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hd8p3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-b0odk.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-24sbd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rp73g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d4qpd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d1uf6.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7iv5b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-umi2d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-g75qv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q5g0o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-98pu5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e2qq0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dmi9b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ek8kv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-k4pga.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-acqv9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mec9b.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vrsnr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t46af.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-krl73.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-herjt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ia80j.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h8c66.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3rhj9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3kqm5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pdf3o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ij03t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-p6jhv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5lkqg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3c3gd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1j475.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s7um9.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uaurr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rmnu5.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-04fu1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-13l2l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2gojv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0b3do.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nluuu.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-sd7cr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pkpso.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-8uahl.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3gmrp.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ufiab.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-h9fpd.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9ng3t.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-82qko.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fsb27.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-tq3m8.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-rtlrr.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-bgnvc.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-stpac.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-94pvj.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-cb70r.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-fr0rd.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-vp4rs.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-lsuvv.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-bvtca.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-8eim2.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-q3nom.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-tlnsa.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-qgk87.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mc8di.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pfe2f.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uume7.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bj4p8.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-jl55e.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-pqb1n.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8ded3.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-3qmk0.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3t8ga.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-42cm8.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-qp6f4.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-e07jo.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2smk4.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-612l7.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-pqo49.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ifhp6.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-l6el0.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-usihu.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-5m0kr.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ta047.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-a6r92.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ouhpe.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-kqk4l.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-q40qu.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-pad1m.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-akl4g.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-4uhnj.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-3o22e.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-619u4.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-h5jos.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-u1pfo.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-294oe.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-jgej5.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-culqm.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-m51bt.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-aq6jg.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-4481c.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-uaurr.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-2te93.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-c12qj.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-d03ff.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-u0g9v.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-fn89q.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-5rkjm.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-j80q7.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-942ci.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-ujvh9.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-qub0c.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-pniq9.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-stt62.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-co9k9.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-qtarj.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4anvs.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-ahfn4.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-9i1ik.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-n6qub.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-idsjk.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pkpso.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7ho7l.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6trfv.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hgh8q.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jk1ha.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jobp0.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ah3ho.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-24sbd.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5mp8m.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-up5ji.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-av1hh.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u8vek.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s8o4b.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gqb63.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pgm6f.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-m4v4o.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8vktl.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0bnss.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-26msb.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-vdon9.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-gd7em.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-trhc3.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-c3fie.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u8dic.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qrej9.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hd8p3.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j7iu1.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a883k.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-j18ov.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-njjp8.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-6sui7.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7b777.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sgo9i.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-o4ijf.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5jcj5.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-eijnl.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-a993a.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bhfi9.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1j475.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rp73g.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d1uf6.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7iv5b.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-umi2d.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-g75qv.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e2qq0.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-98pu5.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3rhj9.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d4qpd.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t46af.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-k4pga.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-acqv9.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-mec9b.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-vrsnr.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-b0odk.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-krl73.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dmi9b.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ek8kv.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-d4nab.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-aov51.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-ia80j.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pdf3o.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ij03t.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-p6jhv.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5lkqg.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3c3gd.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s7um9.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-herjt.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q5g0o.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-sd7cr.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-04fu1.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-13l2l.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2gojv.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0b3do.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nluuu.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h8c66.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3kqm5.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rmnu5.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-kbmrj.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{5c199CF5-54FF-11D3-8BDA-9203068aB1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-434qr.tmp\is-4dfet.tmp' /SL4 $11022C "<Full path to file>" 7276840 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' e736f4aae5245c14d66170b319f01ac2

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial