Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-5t22u.tmp\<File name>.tmp
- %ProgramFiles(x86)%\hampoo\is-sp0l3.tmp
- %ProgramFiles(x86)%\hampoo\is-m5217.tmp
- %ProgramFiles(x86)%\hampoo\is-1h053.tmp
- %ProgramFiles(x86)%\hampoo\is-baisn.tmp
- %ProgramFiles(x86)%\hampoo\is-lc580.tmp
- %ProgramFiles(x86)%\hampoo\is-2pgal.tmp
- %ProgramFiles(x86)%\hampoo\is-cr7ee.tmp
- %ProgramFiles(x86)%\hampoo\is-5tt8l.tmp
- %ProgramFiles(x86)%\hampoo\is-qnhvj.tmp
- %ProgramFiles(x86)%\hampoo\is-7adrj.tmp
- %ProgramFiles(x86)%\hampoo\is-rh56v.tmp
- %ProgramFiles(x86)%\hampoo\is-a3ts1.tmp
- %ProgramFiles(x86)%\hampoo\is-6rkik.tmp
- %ProgramFiles(x86)%\hampoo\is-m8n5q.tmp
- %ProgramFiles(x86)%\hampoo\is-6elf4.tmp
- %ProgramFiles(x86)%\hampoo\is-a56fp.tmp
- %ProgramFiles(x86)%\hampoo\is-s7ihi.tmp
- %ProgramFiles(x86)%\hampoo\is-u2c46.tmp
- %ProgramFiles(x86)%\hampoo\is-salhu.tmp
- %ProgramFiles(x86)%\hampoo\is-r8rqi.tmp
- %ProgramFiles(x86)%\hampoo\is-nrfhu.tmp
- %ProgramFiles(x86)%\hampoo\is-n8f6e.tmp
- %ProgramFiles(x86)%\hampoo\is-mjcld.tmp
- %ProgramFiles(x86)%\hampoo\is-b9sb8.tmp
- %ProgramFiles(x86)%\hampoo\is-q0msh.tmp
- %ProgramFiles(x86)%\hampoo\is-srr15.tmp
- %ProgramFiles(x86)%\hampoo\is-hj9do.tmp
- %TEMP%\is-v6iha.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-v6iha.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-v6iha.tmp\_isetup\_setup64.tmp
- %TEMP%\is-v6iha.tmp\_isetup\_regdll.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\hampoo\hampoo burning studio 20\hampoo burning studio 20 .lnk
- %ProgramFiles(x86)%\hampoo\unins000.dat
Deletes the following files
- %ProgramFiles(x86)%\hampoo\ash_libcurl.dll
- %ProgramFiles(x86)%\hampoo\license-curl.txt
Moves the following files
- from %ProgramFiles(x86)%\hampoo\is-hj9do.tmp to %ProgramFiles(x86)%\hampoo\unins000.exe
- from %ProgramFiles(x86)%\hampoo\is-a3ts1.tmp to %ProgramFiles(x86)%\hampoo\startrescueexplorer.ico
- from %ProgramFiles(x86)%\hampoo\is-7adrj.tmp to %ProgramFiles(x86)%\hampoo\license-fi.txt
- from %ProgramFiles(x86)%\hampoo\is-cr7ee.tmp to %ProgramFiles(x86)%\hampoo\gdiplus.dll
- from %ProgramFiles(x86)%\hampoo\is-b9sb8.tmp to %ProgramFiles(x86)%\hampoo\irrlicht.dll
- from %ProgramFiles(x86)%\hampoo\is-2pgal.tmp to %ProgramFiles(x86)%\hampoo\d3dx9_43.dll
- from %ProgramFiles(x86)%\hampoo\is-lc580.tmp to %ProgramFiles(x86)%\hampoo\avfilter_ash-6.dll
- from %ProgramFiles(x86)%\hampoo\is-baisn.tmp to %ProgramFiles(x86)%\hampoo\swresample_ash-2.dll
- from %ProgramFiles(x86)%\hampoo\is-1h053.tmp to %ProgramFiles(x86)%\hampoo\swscale_ash-4.dll
- from %ProgramFiles(x86)%\hampoo\is-m5217.tmp to %ProgramFiles(x86)%\hampoo\avutil_ash-55.dll
- from %ProgramFiles(x86)%\hampoo\is-sp0l3.tmp to %ProgramFiles(x86)%\hampoo\bsnotify.exe
- from %ProgramFiles(x86)%\hampoo\is-6rkik.tmp to %ProgramFiles(x86)%\hampoo\wmfdist.exe
- from %ProgramFiles(x86)%\hampoo\is-6elf4.tmp to %ProgramFiles(x86)%\hampoo\ash_spti.dll
- from %ProgramFiles(x86)%\hampoo\is-s7ihi.tmp to %ProgramFiles(x86)%\hampoo\audiotools.dll
- from %ProgramFiles(x86)%\hampoo\is-u2c46.tmp to %ProgramFiles(x86)%\hampoo\burningstudio20.exe
- from %ProgramFiles(x86)%\hampoo\is-salhu.tmp to %ProgramFiles(x86)%\hampoo\info.xml
- from %ProgramFiles(x86)%\hampoo\is-r8rqi.tmp to %ProgramFiles(x86)%\hampoo\version.info
- from %ProgramFiles(x86)%\hampoo\is-nrfhu.tmp to %ProgramFiles(x86)%\hampoo\product.xml
- from %ProgramFiles(x86)%\hampoo\is-n8f6e.tmp to %ProgramFiles(x86)%\hampoo\license-en.txt
- from %ProgramFiles(x86)%\hampoo\is-mjcld.tmp to %ProgramFiles(x86)%\hampoo\license-de.txt
- from %ProgramFiles(x86)%\hampoo\is-5tt8l.tmp to %ProgramFiles(x86)%\hampoo\setupdownloader.exe
- from %ProgramFiles(x86)%\hampoo\is-q0msh.tmp to %ProgramFiles(x86)%\hampoo\ash_libcurl.dll
- from %ProgramFiles(x86)%\hampoo\is-srr15.tmp to %ProgramFiles(x86)%\hampoo\license-curl.txt
- from %ProgramFiles(x86)%\hampoo\is-a56fp.tmp to %ProgramFiles(x86)%\hampoo\decmpa.dll
- from %ProgramFiles(x86)%\hampoo\is-m8n5q.tmp to %ProgramFiles(x86)%\hampoo\sqlite3.dll
Substitutes the following files
- %ProgramFiles(x86)%\hampoo\ash_libcurl.dll
- %ProgramFiles(x86)%\hampoo\license-curl.txt
Network activity
Connects to
- 'op###olad.com':80
TCP
HTTP POST requests
- http://op###olad.com/v2/events
UDP
- DNS ASK op###olad.com
Miscellaneous
Searches for the following windows
- ClassName: '339C1B97-155F-C10C-D4D6-BA03C805EAE4' WindowName: ''
Creates and executes the following
- '%TEMP%\is-5t22u.tmp\<File name>.tmp' /SL5="$A01F2,10700466,54272,<Full path to file>"
- '%ProgramFiles(x86)%\hampoo\wmfdist.exe' /Q:A /R:N
- '%ProgramFiles(x86)%\hampoo\burningstudio20.exe' <File name>.exe
