Trojan.DownLoader45.21826

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-vqo68.tmp\is-98a95.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-sfbo3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3d94c.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lgpq4.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-n8a02.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-dsiru.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-v1uuk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-pn318.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ijd4m.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vs20c.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-s5fin.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3dqnp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-e3i2d.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-85cdm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-1mklc.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-tcs83.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-pmqec.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-a3aei.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-lej37.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-q7198.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4bntg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-87qvs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8rg92.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qgs69.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0i74l.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2tipn.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9itlb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o6eql.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-cqg2g.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dnitf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ietnk.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-7hfd3.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0gmsm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2lfvq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-4lnpm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-riqec.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hapm0.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iamkp.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-2g22s.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-efcfc.tmp
%ProgramFiles(x86)%\universal extractor\uniextract.exe
%ProgramFiles(x86)%\universal extractor\bin\is-qrlt1.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-9din6.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-klh63.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-du41u.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-h6f3a.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-11dpf.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-olkkh.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-ks2t9.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-nl9h2.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-mi1p1.tmp
%ProgramFiles(x86)%\universal extractor\is-m1rlj.tmp
%ProgramFiles(x86)%\universal extractor\is-uhltb.tmp
%ProgramFiles(x86)%\universal extractor\is-03ric.tmp
%ProgramFiles(x86)%\universal extractor\is-g4c2p.tmp
%ProgramFiles(x86)%\universal extractor\is-oibp1.tmp
%ProgramFiles(x86)%\universal extractor\unins000.dat
%ProgramFiles(x86)%\universal extractor\bin\unp\is-eq21r.tmp
%ProgramFiles(x86)%\universal extractor\is-au493.tmp
%ProgramFiles(x86)%\universal extractor\bin\unp\is-23gui.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-osnpf.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-dna9a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-ei9sg.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-iuvte.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-vrc6b.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-p6886.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-salrm.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hp8ga.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fnmnq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-fcfai.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-o3quh.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-0amcq.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-mbu96.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-3tb4b.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-b1eeb.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-91mbj.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-pgqm6.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-9284a.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-hd96c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-06rj8.tmp
%ProgramFiles(x86)%\universal extractor\bin\is-i96r3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8ped2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dsgcc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2rmoq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kdlee.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3mhcs.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-u8i08.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e259c.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-gfv08.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hlrir.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-nut74.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-kb60t.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0u9m0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-f6eom.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mdtpe.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-n7std.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2p4if.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-35f21.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mohbe.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-i4r4a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2rdhr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4de2s.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-moh3b.tmp
%TEMP%\is-0o56j.tmp\_isetup\_shfoldr.dll
%TEMP%\is-0o56j.tmp\_iscrypt.dll
%ProgramFiles(x86)%\universal extractor\is-mts8e.tmp
%ProgramFiles(x86)%\universal extractor\is-l6cnt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0qp4f.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-dp0vf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-me1jo.tmp
%TEMP%\is-0o56j.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-41brc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-or3rv.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-h4f17.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8c9pr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-mn6c4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2verr.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8u1fm.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jefd3.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0vaco.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-l00f1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-264cc.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2dfb7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-4j6ej.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hsv4d.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-e6uom.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-1c5hd.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-d1qd7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-q09pg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-jt1t4.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3eeho.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-qffs0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-8gqek.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3jt2r.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fb026.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2gdn2.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-o5jop.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0j2vi.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-aeboq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-2et2a.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-ahpi1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-s3r3o.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-07vs0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-vkmmt.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-fmqd0.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rtpeg.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-acuk7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-lsi7v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-3ssv1.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-hm5ni.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-9npci.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-5ff4v.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7iaoq.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-6qiqb.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-rmulf.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-pmoc7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-t6pa7.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-307tj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-0jagj.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-7fvau.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-uul66.tmp
%ProgramFiles(x86)%\universal extractor\docs\is-bmvcf.tmp
%TEMP%\jdegg.txt

Moves the following files

from %ProgramFiles(x86)%\universal extractor\is-mts8e.tmp to %ProgramFiles(x86)%\universal extractor\unins000.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3d94c.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise_w.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-lgpq4.tmp to %ProgramFiles(x86)%\universal extractor\bin\forcelibrary.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-n8a02.tmp to %ProgramFiles(x86)%\universal extractor\bin\helpdeco.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-dsiru.tmp to %ProgramFiles(x86)%\universal extractor\bin\i3comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-v1uuk.tmp to %ProgramFiles(x86)%\universal extractor\bin\i5comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-iamkp.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-vs20c.tmp to %ProgramFiles(x86)%\universal extractor\bin\i6comp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-a3aei.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-s5fin.tmp to %ProgramFiles(x86)%\universal extractor\bin\instexpl.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-3dqnp.tmp to %ProgramFiles(x86)%\universal extractor\bin\isxunpack.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-e3i2d.tmp to %ProgramFiles(x86)%\universal extractor\bin\lzop.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-85cdm.tmp to %ProgramFiles(x86)%\universal extractor\bin\mhtunp.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-1mklc.tmp to %ProgramFiles(x86)%\universal extractor\bin\msi.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-pn318.tmp to %ProgramFiles(x86)%\universal extractor\bin\extract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-pmqec.tmp to %ProgramFiles(x86)%\universal extractor\bin\innounp.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-sfbo3.tmp to %ProgramFiles(x86)%\universal extractor\bin\e_wise.ini
from %ProgramFiles(x86)%\universal extractor\bin\is-ijd4m.tmp to %ProgramFiles(x86)%\universal extractor\bin\extractmht.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-lej37.tmp to %ProgramFiles(x86)%\universal extractor\bin\dbxplug.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-q7198.tmp to %ProgramFiles(x86)%\universal extractor\bin\cmdtotal.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-qgs69.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0i74l.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2tipn.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9itlb.tmp to %ProgramFiles(x86)%\universal extractor\docs\upx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o6eql.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-tcs83.tmp to %ProgramFiles(x86)%\universal extractor\bin\msix.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-dnitf.tmp to %ProgramFiles(x86)%\universal extractor\docs\uudeview_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-cqg2g.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-ietnk.tmp to %ProgramFiles(x86)%\universal extractor\bin\7z.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0gmsm.tmp to %ProgramFiles(x86)%\universal extractor\bin\arj.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-2lfvq.tmp to %ProgramFiles(x86)%\universal extractor\bin\aspackdie.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-4lnpm.tmp to %ProgramFiles(x86)%\universal extractor\bin\bin2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-riqec.tmp to %ProgramFiles(x86)%\universal extractor\bin\booz.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hapm0.tmp to %ProgramFiles(x86)%\universal extractor\bin\cdirip.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-87qvs.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_man.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-4bntg.tmp to %ProgramFiles(x86)%\universal extractor\bin\clit.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-7hfd3.tmp to %ProgramFiles(x86)%\universal extractor\bin\arc.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-8rg92.tmp to %ProgramFiles(x86)%\universal extractor\docs\unzip_readme.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-2g22s.tmp to %ProgramFiles(x86)%\universal extractor\bin\nbhextract.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fcfai.tmp to %ProgramFiles(x86)%\universal extractor\bin\raiu.exe
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-ks2t9.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_2.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-nl9h2.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-9din6.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\eschalon.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-klh63.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\gentee.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-du41u.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate1.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-h6f3a.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate2.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-9284a.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd50149.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-11dpf.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\inflate3.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-mi1p1.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\pkware.unp
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-eq21r.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\vise.unp
from %ProgramFiles(x86)%\universal extractor\is-au493.tmp to %ProgramFiles(x86)%\universal extractor\changelog.txt
from %ProgramFiles(x86)%\universal extractor\is-m1rlj.tmp to %ProgramFiles(x86)%\universal extractor\license.txt
from %ProgramFiles(x86)%\universal extractor\is-uhltb.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ico
from %ProgramFiles(x86)%\universal extractor\is-03ric.tmp to %ProgramFiles(x86)%\universal extractor\turbosearch.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-osnpf.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd55131.dll
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-23gui.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\bzip2_1.unp
from %ProgramFiles(x86)%\universal extractor\bin\is-dna9a.tmp to %ProgramFiles(x86)%\universal extractor\bin\zd51145.dll
from %ProgramFiles(x86)%\universal extractor\bin\is-pgqm6.tmp to %ProgramFiles(x86)%\universal extractor\bin\wun.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-6qiqb.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_license.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-ei9sg.tmp to %ProgramFiles(x86)%\universal extractor\bin\stix_d.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-iuvte.tmp to %ProgramFiles(x86)%\universal extractor\bin\tee.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-vrc6b.tmp to %ProgramFiles(x86)%\universal extractor\bin\trid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-p6886.tmp to %ProgramFiles(x86)%\universal extractor\bin\triddefs.trd
from %ProgramFiles(x86)%\universal extractor\bin\is-salrm.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc02.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-i96r3.tmp to %ProgramFiles(x86)%\universal extractor\bin\nrg2iso.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-qrlt1.tmp to %ProgramFiles(x86)%\universal extractor\bin\peid.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-efcfc.tmp to %ProgramFiles(x86)%\universal extractor\bin\pdunsis.wcx
from %ProgramFiles(x86)%\universal extractor\bin\is-hp8ga.tmp to %ProgramFiles(x86)%\universal extractor\bin\uharc04.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-0amcq.tmp to %ProgramFiles(x86)%\universal extractor\bin\unzip.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-mbu96.tmp to %ProgramFiles(x86)%\universal extractor\bin\upx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-3tb4b.tmp to %ProgramFiles(x86)%\universal extractor\bin\userdb.txt
from %ProgramFiles(x86)%\universal extractor\bin\is-b1eeb.tmp to %ProgramFiles(x86)%\universal extractor\bin\uudeview.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-91mbj.tmp to %ProgramFiles(x86)%\universal extractor\bin\wdosxle.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-fnmnq.tmp to %ProgramFiles(x86)%\universal extractor\bin\unlzx.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-o3quh.tmp to %ProgramFiles(x86)%\universal extractor\bin\unrar.exe
from %ProgramFiles(x86)%\universal extractor\bin\is-hd96c.tmp to %ProgramFiles(x86)%\universal extractor\bin\unuharc06.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-06rj8.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8ped2.tmp to %ProgramFiles(x86)%\universal extractor\docs\unrar_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-bmvcf.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e259c.tmp to %ProgramFiles(x86)%\universal extractor\docs\dbxplug_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-gfv08.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_author.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kb60t.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mohbe.tmp to %ProgramFiles(x86)%\universal extractor\docs\ewise_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-i4r4a.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0u9m0.tmp to %ProgramFiles(x86)%\universal extractor\docs\extractmht_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4j6ej.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-f6eom.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-n7std.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2p4if.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-35f21.tmp to %ProgramFiles(x86)%\universal extractor\docs\helpdeco_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-l00f1.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-dsgcc.tmp to %ProgramFiles(x86)%\universal extractor\docs\hwun_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-kdlee.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2rmoq.tmp to %ProgramFiles(x86)%\universal extractor\docs\cmdtotal_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-u8i08.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-nut74.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdrip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hlrir.tmp to %ProgramFiles(x86)%\universal extractor\docs\cdirip_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-l6cnt.tmp to %ProgramFiles(x86)%\universal extractor\english.ini
from %ProgramFiles(x86)%\universal extractor\docs\is-dp0vf.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-me1jo.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-41brc.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0vaco.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-or3rv.tmp to %ProgramFiles(x86)%\universal extractor\docs\arc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-264cc.tmp to %ProgramFiles(x86)%\universal extractor\docs\i3comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-h4f17.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mdtpe.tmp to %ProgramFiles(x86)%\universal extractor\docs\extract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-mn6c4.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8u1fm.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jefd3.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-moh3b.tmp to %ProgramFiles(x86)%\universal extractor\docs\bin2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-4de2s.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-2rdhr.tmp to %ProgramFiles(x86)%\universal extractor\docs\booz_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8c9pr.tmp to %ProgramFiles(x86)%\universal extractor\docs\arj_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0qp4f.tmp to %ProgramFiles(x86)%\universal extractor\docs\7zip_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2verr.tmp to %ProgramFiles(x86)%\universal extractor\docs\aspackdie_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3mhcs.tmp to %ProgramFiles(x86)%\universal extractor\docs\convertlit_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-5ff4v.tmp to %ProgramFiles(x86)%\universal extractor\docs\i5comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hsv4d.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-1c5hd.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-d1qd7.tmp to %ProgramFiles(x86)%\universal extractor\docs\pdunsis_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-q09pg.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-jt1t4.tmp to %ProgramFiles(x86)%\universal extractor\docs\peid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-8gqek.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-qffs0.tmp to %ProgramFiles(x86)%\universal extractor\docs\nbgextract_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fmqd0.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-e6uom.tmp to %ProgramFiles(x86)%\universal extractor\docs\nrg2iso_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2et2a.tmp to %ProgramFiles(x86)%\universal extractor\docs\stix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2gdn2.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-o5jop.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_license.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-0j2vi.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_readme.doc
from %ProgramFiles(x86)%\universal extractor\docs\is-aeboq.tmp to %ProgramFiles(x86)%\universal extractor\docs\uharc_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-2dfb7.tmp to %ProgramFiles(x86)%\universal extractor\docs\unlzx_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-ahpi1.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3jt2r.tmp to %ProgramFiles(x86)%\universal extractor\docs\tee_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-fb026.tmp to %ProgramFiles(x86)%\universal extractor\docs\trid_readme_e.txt
from %ProgramFiles(x86)%\universal extractor\bin\unp\is-olkkh.tmp to %ProgramFiles(x86)%\universal extractor\bin\unp\lzma.unp
from %ProgramFiles(x86)%\universal extractor\is-g4c2p.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.exe
from %ProgramFiles(x86)%\universal extractor\docs\is-07vs0.tmp to %ProgramFiles(x86)%\universal extractor\docs\msix_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-acuk7.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-lsi7v.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_readme.htm
from %ProgramFiles(x86)%\universal extractor\docs\is-3ssv1.tmp to %ProgramFiles(x86)%\universal extractor\docs\innounp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-hm5ni.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_readme_en.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-9npci.tmp to %ProgramFiles(x86)%\universal extractor\docs\installexplorer_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7iaoq.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-s3r3o.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-3eeho.tmp to %ProgramFiles(x86)%\universal extractor\docs\msi_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-uul66.tmp to %ProgramFiles(x86)%\universal extractor\docs\isxunpack_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-pmoc7.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-t6pa7.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_license.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-307tj.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-0jagj.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzop_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-7fvau.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_readme.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-vkmmt.tmp to %ProgramFiles(x86)%\universal extractor\docs\mhtunp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rtpeg.tmp to %ProgramFiles(x86)%\universal extractor\docs\i6comp_url.txt
from %ProgramFiles(x86)%\universal extractor\docs\is-rmulf.tmp to %ProgramFiles(x86)%\universal extractor\docs\lzma_readme.txt
from %ProgramFiles(x86)%\universal extractor\is-oibp1.tmp to %ProgramFiles(x86)%\universal extractor\uniextract.ini

Network activity

Connects to

'os##etxi.ga':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########

HTTP POST requests

http://os##etxi.ga/new/net_api

UDP

DNS ASK os##etxi.ga

Miscellaneous

Searches for the following windows

ClassName: '{195c9CF5-54FF-11D3-8BDA-0892036aB1B6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-vqo68.tmp\is-98a95.tmp' /SL4 $140174 "<Full path to file>" 7670362 52224
'%ProgramFiles(x86)%\universal extractor\uniextract.exe'
'%ProgramFiles(x86)%\universal extractor\uniextract.exe' 76161b7ed585dfdc0a46621197ce1b54

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "UniExtract 31"

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial