Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-7e4h1.tmp\<File name>.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-mh6li.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-sjshg.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-8misc.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-5lnf3.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-edupv.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-3atii.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-pp1oq.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-p5ig7.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-q1ouj.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\powergold\is-85qo9.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\drv\is-p98nk.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-i3v4m.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-3rb25.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-tv71h.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-ure1l.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-d00id.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-84ine.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-gp16u.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-ehk3i.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-dveuu.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-cnb56.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-kv3qa.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-8mvqo.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-v4ebl.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-o0c6j.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-21te1.tmp
- %TEMP%\is-fpkr6.tmp\_isetup\_setup64.tmp
- %TEMP%\is-fpkr6.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-fpkr6.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-7jata.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-i5o6a.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-a1taf.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-uecji.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-37d69.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-2msu2.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-h2jo6.tmp
- %TEMP%\is-fpkr6.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-cvmb3.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-mmg0a.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-aeiaf.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-d8b9h.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-p4j21.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-5voer.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-i7ka3.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-ribqj.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-v96mb.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-tiffc.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-4afjp.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-1ltqu.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\iq player pro\iq player pro\iq player pro.lnk
- %ProgramFiles(x86)%\iq studio pro\iq player pro\unins000.dat
Moves the following files
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-7jata.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\unins000.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-mh6li.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\license.txt
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-sjshg.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ppro.chm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-8misc.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\readme.txt
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-5lnf3.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\whatsnew.txt
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-edupv.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\deffades.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-3atii.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\exploreset.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-pp1oq.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\filedefsetlist.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-p5ig7.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\hotdefsetlist.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-q1ouj.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\jindefsetlist.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-i3v4m.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\musdefsetlist.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-kv3qa.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\newsdefsetlist.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-8mvqo.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\prgdefsetlist.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-3rb25.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\timeservers.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-tv71h.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\timeserversdefault.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-ure1l.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\currentfiles.htm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-d00id.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\currentplaylists.htm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-84ine.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\main.htm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-gp16u.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\playedfiles.htm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-ehk3i.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\playlists.htm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\drv\is-p98nk.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\drv\dinstall.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-dveuu.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\status.htm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\powergold\is-85qo9.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\powergold\automation.aut
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-o0c6j.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\rpprorus.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-i5o6a.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\dstest.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-a1taf.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\logview.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-uecji.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\mbase.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-37d69.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\mexplore.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-2msu2.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ppro.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-h2jo6.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\wmfdist.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-cvmb3.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\sqlite3.dll
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-1ltqu.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\unzdll.dll
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-mmg0a.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\zipdll.dll
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-aeiaf.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\logvieweng.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-d8b9h.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\logviewrus.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-p4j21.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\logviewrus_lat.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-5voer.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mbaseeng.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-i7ka3.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mbaserus.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-ribqj.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mbaserus_lat.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-v96mb.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mexploreeng.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-tiffc.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mexplorerus.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-4afjp.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mexplorerus_lat.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-21te1.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\rpproeng.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-v4ebl.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\rpprorus_lat.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-cnb56.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\unplayedfiles.htm
Network activity
Connects to
- 'op###olad.com':80
TCP
HTTP POST requests
- http://op###olad.com/v2/events
UDP
- DNS ASK op###olad.com
Miscellaneous
Searches for the following windows
- ClassName: '025063D1-F16D-434d-82A2-7968BD33E31E' WindowName: ''
Creates and executes the following
- '%TEMP%\is-7e4h1.tmp\<File name>.tmp' /SL5="$120228,9936372,51712,<Full path to file>"
- '%ProgramFiles(x86)%\iq studio pro\iq player pro\wmfdist.exe' /Q:A /R:N
- '%ProgramFiles(x86)%\iq studio pro\iq player pro\ppro.exe' <File name>.exe
