Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-0ekrc.tmp\<File name>.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-b0c0j.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-504ou.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-ue7is.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-u90lp.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-0ttah.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-8vghl.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-ecchf.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-n9btq.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-tuhto.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\powergold\is-3j805.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\drv\is-u8sp6.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-h858n.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-s58fv.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-gmkar.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-spr5c.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-o3vf8.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-m67qv.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-91nop.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-j7du5.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-s95a5.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-65csf.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-09onn.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-39vs2.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-6kj5p.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-pmpe5.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-8fah9.tmp
- %TEMP%\is-33ps5.tmp\_isetup\_setup64.tmp
- %TEMP%\is-33ps5.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-33ps5.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-b0atg.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-7d2fg.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-vmc1l.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-sl6lp.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-n29ok.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-b8mu0.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-a0ld6.tmp
- %TEMP%\is-33ps5.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-pc4ub.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-plh2b.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-1p5lr.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-fjq8k.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-1scss.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-4mch8.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-tqv3c.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-nj9rc.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-3pd5g.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-tg9jf.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-8vr1i.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-2leef.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\iq player pro\iq player pro\iq player pro.lnk
- %ProgramFiles(x86)%\iq studio pro\iq player pro\unins000.dat
Moves the following files
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-b0atg.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\unins000.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-b0c0j.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\license.txt
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-504ou.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ppro.chm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-ue7is.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\readme.txt
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-u90lp.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\whatsnew.txt
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-0ttah.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\deffades.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-8vghl.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\exploreset.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-ecchf.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\filedefsetlist.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-n9btq.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\hotdefsetlist.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-tuhto.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\jindefsetlist.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-h858n.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\musdefsetlist.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-09onn.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\newsdefsetlist.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-39vs2.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\prgdefsetlist.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-s58fv.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\timeservers.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-gmkar.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\timeserversdefault.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-spr5c.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\currentfiles.htm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-o3vf8.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\currentplaylists.htm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-m67qv.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\main.htm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-91nop.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\playedfiles.htm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-j7du5.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\playlists.htm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\drv\is-u8sp6.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\drv\dinstall.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-s95a5.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\status.htm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\powergold\is-3j805.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\powergold\automation.aut
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-pmpe5.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\rpprorus.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-7d2fg.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\dstest.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-vmc1l.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\logview.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-sl6lp.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\mbase.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-n29ok.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\mexplore.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-b8mu0.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ppro.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-a0ld6.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\wmfdist.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-pc4ub.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\sqlite3.dll
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-2leef.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\unzdll.dll
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-plh2b.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\zipdll.dll
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-1p5lr.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\logvieweng.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-fjq8k.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\logviewrus.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-1scss.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\logviewrus_lat.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-4mch8.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mbaseeng.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-tqv3c.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mbaserus.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-nj9rc.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mbaserus_lat.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-3pd5g.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mexploreeng.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-tg9jf.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mexplorerus.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-8vr1i.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mexplorerus_lat.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-8fah9.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\rpproeng.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-6kj5p.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\rpprorus_lat.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-65csf.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\unplayedfiles.htm
Network activity
Connects to
- 'op###olad.com':80
TCP
HTTP POST requests
- http://op###olad.com/v2/events
UDP
- DNS ASK op###olad.com
Miscellaneous
Searches for the following windows
- ClassName: '025063D1-F16D-434d-82A2-7968BD33E31E' WindowName: ''
Creates and executes the following
- '%TEMP%\is-0ekrc.tmp\<File name>.tmp' /SL5="$130212,9931275,51712,<Full path to file>"
- '%ProgramFiles(x86)%\iq studio pro\iq player pro\wmfdist.exe' /Q:A /R:N
- '%ProgramFiles(x86)%\iq studio pro\iq player pro\ppro.exe' <File name>.exe
