Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-3safj.tmp\<File name>.tmp
- %ProgramFiles(x86)%\mpoo\is-binlf.tmp
- %ProgramFiles(x86)%\mpoo\is-efkd2.tmp
- %ProgramFiles(x86)%\mpoo\is-62p9q.tmp
- %ProgramFiles(x86)%\mpoo\is-7b2o7.tmp
- %ProgramFiles(x86)%\mpoo\is-9eg8b.tmp
- %ProgramFiles(x86)%\mpoo\is-l1skk.tmp
- %ProgramFiles(x86)%\mpoo\is-ibsso.tmp
- %ProgramFiles(x86)%\mpoo\is-1junq.tmp
- %ProgramFiles(x86)%\mpoo\is-gbv4s.tmp
- %ProgramFiles(x86)%\mpoo\is-vbtkh.tmp
- %ProgramFiles(x86)%\mpoo\is-pndat.tmp
- %ProgramFiles(x86)%\mpoo\is-21acr.tmp
- %ProgramFiles(x86)%\mpoo\is-pprf9.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mpoo\mpoo burning studio\mpoo burning studio .lnk
- %ProgramFiles(x86)%\mpoo\is-rqdk1.tmp
- %ProgramFiles(x86)%\mpoo\is-iht0j.tmp
- %ProgramFiles(x86)%\mpoo\is-77rfr.tmp
- %ProgramFiles(x86)%\mpoo\is-q9feb.tmp
- %ProgramFiles(x86)%\mpoo\is-ct2m3.tmp
- %ProgramFiles(x86)%\mpoo\is-9vjg9.tmp
- %ProgramFiles(x86)%\mpoo\is-8gmip.tmp
- %ProgramFiles(x86)%\mpoo\is-ejcin.tmp
- %ProgramFiles(x86)%\mpoo\is-ft6ri.tmp
- %ProgramFiles(x86)%\mpoo\is-2uqd6.tmp
- %TEMP%\is-6d78b.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-6d78b.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-6d78b.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-6d78b.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\mpoo\is-2g72k.tmp
- %ProgramFiles(x86)%\mpoo\unins000.dat
Moves the following files
- from %ProgramFiles(x86)%\mpoo\is-2uqd6.tmp to %ProgramFiles(x86)%\mpoo\unins000.exe
- from %ProgramFiles(x86)%\mpoo\is-62p9q.tmp to %ProgramFiles(x86)%\mpoo\wmfdist.exe
- from %ProgramFiles(x86)%\mpoo\is-7b2o7.tmp to %ProgramFiles(x86)%\mpoo\startrescueexplorer.ico
- from %ProgramFiles(x86)%\mpoo\is-9eg8b.tmp to %ProgramFiles(x86)%\mpoo\license-curl.txt
- from %ProgramFiles(x86)%\mpoo\is-l1skk.tmp to %ProgramFiles(x86)%\mpoo\license-fi.txt
- from %ProgramFiles(x86)%\mpoo\is-ibsso.tmp to %ProgramFiles(x86)%\mpoo\ash_libcurl.dll
- from %ProgramFiles(x86)%\mpoo\is-1junq.tmp to %ProgramFiles(x86)%\mpoo\gdiplus.dll
- from %ProgramFiles(x86)%\mpoo\is-gbv4s.tmp to %ProgramFiles(x86)%\mpoo\irrlicht.dll
- from %ProgramFiles(x86)%\mpoo\is-vbtkh.tmp to %ProgramFiles(x86)%\mpoo\d3dx9_43.dll
- from %ProgramFiles(x86)%\mpoo\is-pndat.tmp to %ProgramFiles(x86)%\mpoo\avfilter_ash-6.dll
- from %ProgramFiles(x86)%\mpoo\is-21acr.tmp to %ProgramFiles(x86)%\mpoo\swresample_ash-2.dll
- from %ProgramFiles(x86)%\mpoo\is-pprf9.tmp to %ProgramFiles(x86)%\mpoo\swscale_ash-4.dll
- from %ProgramFiles(x86)%\mpoo\is-rqdk1.tmp to %ProgramFiles(x86)%\mpoo\avutil_ash-55.dll
- from %ProgramFiles(x86)%\mpoo\is-2g72k.tmp to %ProgramFiles(x86)%\mpoo\ash_amf.dll
- from %ProgramFiles(x86)%\mpoo\is-iht0j.tmp to %ProgramFiles(x86)%\mpoo\bsnotify.exe
- from %ProgramFiles(x86)%\mpoo\is-77rfr.tmp to %ProgramFiles(x86)%\mpoo\ash_spti.dll
- from %ProgramFiles(x86)%\mpoo\is-q9feb.tmp to %ProgramFiles(x86)%\mpoo\decmpa.dll
- from %ProgramFiles(x86)%\mpoo\is-ct2m3.tmp to %ProgramFiles(x86)%\mpoo\audiotools.dll
- from %ProgramFiles(x86)%\mpoo\is-9vjg9.tmp to %ProgramFiles(x86)%\mpoo\info.xml
- from %ProgramFiles(x86)%\mpoo\is-8gmip.tmp to %ProgramFiles(x86)%\mpoo\version.info
- from %ProgramFiles(x86)%\mpoo\is-ejcin.tmp to %ProgramFiles(x86)%\mpoo\product.xml
- from %ProgramFiles(x86)%\mpoo\is-ft6ri.tmp to %ProgramFiles(x86)%\mpoo\license-en.txt
- from %ProgramFiles(x86)%\mpoo\is-efkd2.tmp to %ProgramFiles(x86)%\mpoo\burningstudio.exe
- from %ProgramFiles(x86)%\mpoo\is-binlf.tmp to %ProgramFiles(x86)%\mpoo\sqlite3.dll
Network activity
Connects to
- 'op###olad.com':80
TCP
HTTP POST requests
- http://op###olad.com/v2/events
UDP
- DNS ASK op###olad.com
Miscellaneous
Searches for the following windows
- ClassName: '339C1B97-155F-C10C-D4D6-BA03C805EAE4' WindowName: ''
Creates and executes the following
- '%TEMP%\is-3safj.tmp\<File name>.tmp' /SL5="$B022C,12030682,211456,<Full path to file>"
- '%ProgramFiles(x86)%\mpoo\wmfdist.exe' /Q:A /R:N
- '%ProgramFiles(x86)%\mpoo\burningstudio.exe' <File name>.exe
