Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-ebins.tmp\<File name>.tmp
- %ProgramFiles(x86)%\hampoo\is-cdkrk.tmp
- %ProgramFiles(x86)%\hampoo\is-nhjts.tmp
- %ProgramFiles(x86)%\hampoo\is-h6q09.tmp
- %ProgramFiles(x86)%\hampoo\is-hmm0k.tmp
- %ProgramFiles(x86)%\hampoo\is-avu7j.tmp
- %ProgramFiles(x86)%\hampoo\is-gss4k.tmp
- %ProgramFiles(x86)%\hampoo\is-lamf5.tmp
- %ProgramFiles(x86)%\hampoo\is-u6b64.tmp
- %ProgramFiles(x86)%\hampoo\is-gj0f8.tmp
- %ProgramFiles(x86)%\hampoo\is-t675s.tmp
- %ProgramFiles(x86)%\hampoo\is-0ko69.tmp
- %ProgramFiles(x86)%\hampoo\is-qt2kj.tmp
- %ProgramFiles(x86)%\hampoo\is-gp9pb.tmp
- %ProgramFiles(x86)%\hampoo\is-v8k3d.tmp
- %ProgramFiles(x86)%\hampoo\is-3gg18.tmp
- %ProgramFiles(x86)%\hampoo\is-ta27d.tmp
- %ProgramFiles(x86)%\hampoo\is-1hjjt.tmp
- %ProgramFiles(x86)%\hampoo\is-hk3ol.tmp
- %ProgramFiles(x86)%\hampoo\is-58sd8.tmp
- %ProgramFiles(x86)%\hampoo\is-2uadk.tmp
- %ProgramFiles(x86)%\hampoo\is-iimcu.tmp
- %ProgramFiles(x86)%\hampoo\is-v91vr.tmp
- %ProgramFiles(x86)%\hampoo\is-38u4s.tmp
- %ProgramFiles(x86)%\hampoo\is-6p1p0.tmp
- %ProgramFiles(x86)%\hampoo\is-j4vj8.tmp
- %ProgramFiles(x86)%\hampoo\is-3g86g.tmp
- %ProgramFiles(x86)%\hampoo\is-l25cd.tmp
- %TEMP%\is-f8vo8.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-f8vo8.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-f8vo8.tmp\_isetup\_setup64.tmp
- %TEMP%\is-f8vo8.tmp\_isetup\_regdll.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\hampoo\hampoo burning studio 20\hampoo burning studio 20 .lnk
- %ProgramFiles(x86)%\hampoo\unins000.dat
Deletes the following files
- %ProgramFiles(x86)%\hampoo\ash_libcurl.dll
- %ProgramFiles(x86)%\hampoo\license-curl.txt
Moves the following files
- from %ProgramFiles(x86)%\hampoo\is-l25cd.tmp to %ProgramFiles(x86)%\hampoo\unins000.exe
- from %ProgramFiles(x86)%\hampoo\is-qt2kj.tmp to %ProgramFiles(x86)%\hampoo\startrescueexplorer.ico
- from %ProgramFiles(x86)%\hampoo\is-t675s.tmp to %ProgramFiles(x86)%\hampoo\license-fi.txt
- from %ProgramFiles(x86)%\hampoo\is-lamf5.tmp to %ProgramFiles(x86)%\hampoo\gdiplus.dll
- from %ProgramFiles(x86)%\hampoo\is-6p1p0.tmp to %ProgramFiles(x86)%\hampoo\irrlicht.dll
- from %ProgramFiles(x86)%\hampoo\is-gss4k.tmp to %ProgramFiles(x86)%\hampoo\d3dx9_43.dll
- from %ProgramFiles(x86)%\hampoo\is-avu7j.tmp to %ProgramFiles(x86)%\hampoo\avfilter_ash-6.dll
- from %ProgramFiles(x86)%\hampoo\is-hmm0k.tmp to %ProgramFiles(x86)%\hampoo\swresample_ash-2.dll
- from %ProgramFiles(x86)%\hampoo\is-h6q09.tmp to %ProgramFiles(x86)%\hampoo\swscale_ash-4.dll
- from %ProgramFiles(x86)%\hampoo\is-nhjts.tmp to %ProgramFiles(x86)%\hampoo\avutil_ash-55.dll
- from %ProgramFiles(x86)%\hampoo\is-cdkrk.tmp to %ProgramFiles(x86)%\hampoo\bsnotify.exe
- from %ProgramFiles(x86)%\hampoo\is-gp9pb.tmp to %ProgramFiles(x86)%\hampoo\wmfdist.exe
- from %ProgramFiles(x86)%\hampoo\is-3gg18.tmp to %ProgramFiles(x86)%\hampoo\ash_spti.dll
- from %ProgramFiles(x86)%\hampoo\is-1hjjt.tmp to %ProgramFiles(x86)%\hampoo\audiotools.dll
- from %ProgramFiles(x86)%\hampoo\is-hk3ol.tmp to %ProgramFiles(x86)%\hampoo\burningstudio20.exe
- from %ProgramFiles(x86)%\hampoo\is-58sd8.tmp to %ProgramFiles(x86)%\hampoo\info.xml
- from %ProgramFiles(x86)%\hampoo\is-2uadk.tmp to %ProgramFiles(x86)%\hampoo\version.info
- from %ProgramFiles(x86)%\hampoo\is-iimcu.tmp to %ProgramFiles(x86)%\hampoo\product.xml
- from %ProgramFiles(x86)%\hampoo\is-v91vr.tmp to %ProgramFiles(x86)%\hampoo\license-en.txt
- from %ProgramFiles(x86)%\hampoo\is-38u4s.tmp to %ProgramFiles(x86)%\hampoo\license-de.txt
- from %ProgramFiles(x86)%\hampoo\is-u6b64.tmp to %ProgramFiles(x86)%\hampoo\setupdownloader.exe
- from %ProgramFiles(x86)%\hampoo\is-j4vj8.tmp to %ProgramFiles(x86)%\hampoo\ash_libcurl.dll
- from %ProgramFiles(x86)%\hampoo\is-3g86g.tmp to %ProgramFiles(x86)%\hampoo\license-curl.txt
- from %ProgramFiles(x86)%\hampoo\is-ta27d.tmp to %ProgramFiles(x86)%\hampoo\decmpa.dll
- from %ProgramFiles(x86)%\hampoo\is-v8k3d.tmp to %ProgramFiles(x86)%\hampoo\sqlite3.dll
Substitutes the following files
- %ProgramFiles(x86)%\hampoo\ash_libcurl.dll
- %ProgramFiles(x86)%\hampoo\license-curl.txt
Network activity
Connects to
- 'op###olad.com':80
TCP
HTTP POST requests
- http://op###olad.com/v2/events
UDP
- DNS ASK op###olad.com
Miscellaneous
Searches for the following windows
- ClassName: '339C1B97-155F-C10C-D4D6-BA03C805EAE4' WindowName: ''
Creates and executes the following
- '%TEMP%\is-ebins.tmp\<File name>.tmp' /SL5="$B0216,10699621,54272,<Full path to file>"
- '%ProgramFiles(x86)%\hampoo\wmfdist.exe' /Q:A /R:N
- '%ProgramFiles(x86)%\hampoo\burningstudio20.exe' <File name>.exe
