Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-du4dr.tmp\<File name>.tmp
- %ProgramFiles(x86)%\shampoo\is-4rfoa.tmp
- %ProgramFiles(x86)%\shampoo\is-e4ejo.tmp
- %ProgramFiles(x86)%\shampoo\is-ivke8.tmp
- %ProgramFiles(x86)%\shampoo\is-c8j8t.tmp
- %ProgramFiles(x86)%\shampoo\is-bottf.tmp
- %ProgramFiles(x86)%\shampoo\is-2jdgi.tmp
- %ProgramFiles(x86)%\shampoo\is-eaojn.tmp
- %ProgramFiles(x86)%\shampoo\is-a7c99.tmp
- %ProgramFiles(x86)%\shampoo\is-to7d7.tmp
- %ProgramFiles(x86)%\shampoo\is-298a0.tmp
- %ProgramFiles(x86)%\shampoo\is-3cabd.tmp
- %ProgramFiles(x86)%\shampoo\is-rtc0n.tmp
- %ProgramFiles(x86)%\shampoo\is-vhhih.tmp
- %ProgramFiles(x86)%\shampoo\is-n07fq.tmp
- %ProgramFiles(x86)%\shampoo\is-96vnh.tmp
- %ProgramFiles(x86)%\shampoo\is-fnceq.tmp
- %ProgramFiles(x86)%\shampoo\is-mgvhv.tmp
- %ProgramFiles(x86)%\shampoo\is-iuo7r.tmp
- %ProgramFiles(x86)%\shampoo\is-p62pn.tmp
- %ProgramFiles(x86)%\shampoo\is-4l5e5.tmp
- %TEMP%\is-erhe6.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-erhe6.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\shampoo\is-pn425.tmp
- %ProgramFiles(x86)%\shampoo\is-aq0r5.tmp
- %ProgramFiles(x86)%\shampoo\is-f2n2d.tmp
- %ProgramFiles(x86)%\shampoo\is-33dpv.tmp
- %ProgramFiles(x86)%\shampoo\is-fcdfv.tmp
- %TEMP%\is-erhe6.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\shampoo\is-7spvb.tmp
- %ProgramFiles(x86)%\shampoo\is-mpkha.tmp
- %ProgramFiles(x86)%\shampoo\is-hfd7n.tmp
- %ProgramFiles(x86)%\shampoo\is-1if51.tmp
- %ProgramFiles(x86)%\shampoo\is-f60pq.tmp
- %ProgramFiles(x86)%\shampoo\is-j79cv.tmp
- %ProgramFiles(x86)%\shampoo\is-mue53.tmp
- %ProgramFiles(x86)%\shampoo\is-d6emt.tmp
- %ProgramFiles(x86)%\shampoo\is-d96if.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\shampoo\shampoo burning studio 20\shampoo burning studio 20 .lnk
- %ProgramFiles(x86)%\shampoo\unins000.dat
Deletes the following files
- %ProgramFiles(x86)%\shampoo\ash_libcurl.dll
- %ProgramFiles(x86)%\shampoo\license-curl.txt
Moves the following files
- from %ProgramFiles(x86)%\shampoo\is-pn425.tmp to %ProgramFiles(x86)%\shampoo\unins000.exe
- from %ProgramFiles(x86)%\shampoo\is-vhhih.tmp to %ProgramFiles(x86)%\shampoo\startrescueexplorer.ico
- from %ProgramFiles(x86)%\shampoo\is-3cabd.tmp to %ProgramFiles(x86)%\shampoo\license-fi.txt
- from %ProgramFiles(x86)%\shampoo\is-mgvhv.tmp to %ProgramFiles(x86)%\shampoo\gdiplus.dll
- from %ProgramFiles(x86)%\shampoo\is-fnceq.tmp to %ProgramFiles(x86)%\shampoo\irrlicht.dll
- from %ProgramFiles(x86)%\shampoo\is-to7d7.tmp to %ProgramFiles(x86)%\shampoo\d3dx9_43.dll
- from %ProgramFiles(x86)%\shampoo\is-2jdgi.tmp to %ProgramFiles(x86)%\shampoo\avfilter_ash-6.dll
- from %ProgramFiles(x86)%\shampoo\is-bottf.tmp to %ProgramFiles(x86)%\shampoo\swresample_ash-2.dll
- from %ProgramFiles(x86)%\shampoo\is-c8j8t.tmp to %ProgramFiles(x86)%\shampoo\swscale_ash-4.dll
- from %ProgramFiles(x86)%\shampoo\is-ivke8.tmp to %ProgramFiles(x86)%\shampoo\avutil_ash-55.dll
- from %ProgramFiles(x86)%\shampoo\is-e4ejo.tmp to %ProgramFiles(x86)%\shampoo\mediainfo.dll
- from %ProgramFiles(x86)%\shampoo\is-4rfoa.tmp to %ProgramFiles(x86)%\shampoo\_startrescueexplorer.exe
- from %ProgramFiles(x86)%\shampoo\is-a7c99.tmp to %ProgramFiles(x86)%\shampoo\ashdriversetup.exe
- from %ProgramFiles(x86)%\shampoo\is-eaojn.tmp to %ProgramFiles(x86)%\shampoo\burningstudioprogress.exe
- from %ProgramFiles(x86)%\shampoo\is-iuo7r.tmp to %ProgramFiles(x86)%\shampoo\peru.interop.dll
- from %ProgramFiles(x86)%\shampoo\is-p62pn.tmp to %ProgramFiles(x86)%\shampoo\ash_m2tsmux.dll
- from %ProgramFiles(x86)%\shampoo\is-4l5e5.tmp to %ProgramFiles(x86)%\shampoo\ash_amf.dll
- from %ProgramFiles(x86)%\shampoo\is-d6emt.tmp to %ProgramFiles(x86)%\shampoo\bsnotify.exe
- from %ProgramFiles(x86)%\shampoo\is-mue53.tmp to %ProgramFiles(x86)%\shampoo\ash_spti.dll
- from %ProgramFiles(x86)%\shampoo\is-j79cv.tmp to %ProgramFiles(x86)%\shampoo\decmpa.dll
- from %ProgramFiles(x86)%\shampoo\is-f60pq.tmp to %ProgramFiles(x86)%\shampoo\audiotools.dll
- from %ProgramFiles(x86)%\shampoo\is-1if51.tmp to %ProgramFiles(x86)%\shampoo\burningstudio20.exe
- from %ProgramFiles(x86)%\shampoo\is-hfd7n.tmp to %ProgramFiles(x86)%\shampoo\info.xml
- from %ProgramFiles(x86)%\shampoo\is-mpkha.tmp to %ProgramFiles(x86)%\shampoo\version.info
- from %ProgramFiles(x86)%\shampoo\is-d96if.tmp to %ProgramFiles(x86)%\shampoo\product.xml
- from %ProgramFiles(x86)%\shampoo\is-7spvb.tmp to %ProgramFiles(x86)%\shampoo\license-en.txt
- from %ProgramFiles(x86)%\shampoo\is-fcdfv.tmp to %ProgramFiles(x86)%\shampoo\license-de.txt
- from %ProgramFiles(x86)%\shampoo\is-33dpv.tmp to %ProgramFiles(x86)%\shampoo\setupdownloader.exe
- from %ProgramFiles(x86)%\shampoo\is-f2n2d.tmp to %ProgramFiles(x86)%\shampoo\ash_libcurl.dll
- from %ProgramFiles(x86)%\shampoo\is-aq0r5.tmp to %ProgramFiles(x86)%\shampoo\license-curl.txt
- from %ProgramFiles(x86)%\shampoo\is-n07fq.tmp to %ProgramFiles(x86)%\shampoo\wmfdist.exe
- from %ProgramFiles(x86)%\shampoo\is-96vnh.tmp to %ProgramFiles(x86)%\shampoo\sqlite3.dll
Substitutes the following files
- %ProgramFiles(x86)%\shampoo\ash_libcurl.dll
- %ProgramFiles(x86)%\shampoo\license-curl.txt
Network activity
Connects to
- 'op###olad.com':80
TCP
HTTP POST requests
- http://op###olad.com/v2/events
UDP
- DNS ASK op###olad.com
Miscellaneous
Searches for the following windows
- ClassName: '1B339C97-155F-C10C-D4D6-ABA03C805EE4' WindowName: ''
Creates and executes the following
- '%TEMP%\is-du4dr.tmp\<File name>.tmp' /SL5="$D0210,13086055,346624,<Full path to file>"
- '%ProgramFiles(x86)%\shampoo\wmfdist.exe' /Q:A /R:N
- '%ProgramFiles(x86)%\shampoo\burningstudio20.exe' <File name>.exe
