Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-3tgnb.tmp\<File name>.tmp
- %ProgramFiles(x86)%\hampoo\is-ldn8j.tmp
- %ProgramFiles(x86)%\hampoo\is-r4cck.tmp
- %ProgramFiles(x86)%\hampoo\is-eeig2.tmp
- %ProgramFiles(x86)%\hampoo\is-0l7dh.tmp
- %ProgramFiles(x86)%\hampoo\is-qd7u2.tmp
- %ProgramFiles(x86)%\hampoo\is-tsa31.tmp
- %ProgramFiles(x86)%\hampoo\is-0kj3f.tmp
- %ProgramFiles(x86)%\hampoo\is-3fmo2.tmp
- %ProgramFiles(x86)%\hampoo\is-mtfao.tmp
- %ProgramFiles(x86)%\hampoo\is-ndfte.tmp
- %ProgramFiles(x86)%\hampoo\is-l5s24.tmp
- %ProgramFiles(x86)%\hampoo\is-moetp.tmp
- %ProgramFiles(x86)%\hampoo\is-st3tc.tmp
- %ProgramFiles(x86)%\hampoo\is-io65k.tmp
- %ProgramFiles(x86)%\hampoo\is-b8vc7.tmp
- %ProgramFiles(x86)%\hampoo\is-50igd.tmp
- %ProgramFiles(x86)%\hampoo\is-d7ukg.tmp
- %ProgramFiles(x86)%\hampoo\is-o9gfi.tmp
- %ProgramFiles(x86)%\hampoo\is-mp3jq.tmp
- %ProgramFiles(x86)%\hampoo\is-ppkfa.tmp
- %ProgramFiles(x86)%\hampoo\is-c2aos.tmp
- %ProgramFiles(x86)%\hampoo\is-a5qc8.tmp
- %ProgramFiles(x86)%\hampoo\is-i6jsi.tmp
- %ProgramFiles(x86)%\hampoo\is-ikqn2.tmp
- %ProgramFiles(x86)%\hampoo\is-efes1.tmp
- %ProgramFiles(x86)%\hampoo\is-egpbs.tmp
- %ProgramFiles(x86)%\hampoo\is-6092m.tmp
- %TEMP%\is-dam9t.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-dam9t.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-dam9t.tmp\_isetup\_setup64.tmp
- %TEMP%\is-dam9t.tmp\_isetup\_regdll.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\hampoo\hampoo burning studio 20\hampoo burning studio 20 .lnk
- %ProgramFiles(x86)%\hampoo\unins000.dat
Deletes the following files
- %ProgramFiles(x86)%\hampoo\ash_libcurl.dll
- %ProgramFiles(x86)%\hampoo\license-curl.txt
Moves the following files
- from %ProgramFiles(x86)%\hampoo\is-6092m.tmp to %ProgramFiles(x86)%\hampoo\unins000.exe
- from %ProgramFiles(x86)%\hampoo\is-moetp.tmp to %ProgramFiles(x86)%\hampoo\startrescueexplorer.ico
- from %ProgramFiles(x86)%\hampoo\is-ndfte.tmp to %ProgramFiles(x86)%\hampoo\license-fi.txt
- from %ProgramFiles(x86)%\hampoo\is-0kj3f.tmp to %ProgramFiles(x86)%\hampoo\gdiplus.dll
- from %ProgramFiles(x86)%\hampoo\is-ikqn2.tmp to %ProgramFiles(x86)%\hampoo\irrlicht.dll
- from %ProgramFiles(x86)%\hampoo\is-tsa31.tmp to %ProgramFiles(x86)%\hampoo\d3dx9_43.dll
- from %ProgramFiles(x86)%\hampoo\is-qd7u2.tmp to %ProgramFiles(x86)%\hampoo\avfilter_ash-6.dll
- from %ProgramFiles(x86)%\hampoo\is-0l7dh.tmp to %ProgramFiles(x86)%\hampoo\swresample_ash-2.dll
- from %ProgramFiles(x86)%\hampoo\is-eeig2.tmp to %ProgramFiles(x86)%\hampoo\swscale_ash-4.dll
- from %ProgramFiles(x86)%\hampoo\is-r4cck.tmp to %ProgramFiles(x86)%\hampoo\avutil_ash-55.dll
- from %ProgramFiles(x86)%\hampoo\is-ldn8j.tmp to %ProgramFiles(x86)%\hampoo\bsnotify.exe
- from %ProgramFiles(x86)%\hampoo\is-st3tc.tmp to %ProgramFiles(x86)%\hampoo\wmfdist.exe
- from %ProgramFiles(x86)%\hampoo\is-b8vc7.tmp to %ProgramFiles(x86)%\hampoo\ash_spti.dll
- from %ProgramFiles(x86)%\hampoo\is-d7ukg.tmp to %ProgramFiles(x86)%\hampoo\audiotools.dll
- from %ProgramFiles(x86)%\hampoo\is-o9gfi.tmp to %ProgramFiles(x86)%\hampoo\burningstudio20.exe
- from %ProgramFiles(x86)%\hampoo\is-mp3jq.tmp to %ProgramFiles(x86)%\hampoo\info.xml
- from %ProgramFiles(x86)%\hampoo\is-ppkfa.tmp to %ProgramFiles(x86)%\hampoo\version.info
- from %ProgramFiles(x86)%\hampoo\is-c2aos.tmp to %ProgramFiles(x86)%\hampoo\product.xml
- from %ProgramFiles(x86)%\hampoo\is-a5qc8.tmp to %ProgramFiles(x86)%\hampoo\license-en.txt
- from %ProgramFiles(x86)%\hampoo\is-i6jsi.tmp to %ProgramFiles(x86)%\hampoo\license-de.txt
- from %ProgramFiles(x86)%\hampoo\is-3fmo2.tmp to %ProgramFiles(x86)%\hampoo\setupdownloader.exe
- from %ProgramFiles(x86)%\hampoo\is-efes1.tmp to %ProgramFiles(x86)%\hampoo\ash_libcurl.dll
- from %ProgramFiles(x86)%\hampoo\is-egpbs.tmp to %ProgramFiles(x86)%\hampoo\license-curl.txt
- from %ProgramFiles(x86)%\hampoo\is-50igd.tmp to %ProgramFiles(x86)%\hampoo\decmpa.dll
- from %ProgramFiles(x86)%\hampoo\is-io65k.tmp to %ProgramFiles(x86)%\hampoo\sqlite3.dll
Substitutes the following files
- %ProgramFiles(x86)%\hampoo\ash_libcurl.dll
- %ProgramFiles(x86)%\hampoo\license-curl.txt
Network activity
Connects to
- 'op###olad.com':80
TCP
HTTP POST requests
- http://op###olad.com/v2/events
UDP
- DNS ASK op###olad.com
Miscellaneous
Searches for the following windows
- ClassName: '339C1B97-155F-C10C-D4D6-BA03C805EAE4' WindowName: ''
Creates and executes the following
- '%TEMP%\is-3tgnb.tmp\<File name>.tmp' /SL5="$12022A,10698960,54272,<Full path to file>"
- '%ProgramFiles(x86)%\hampoo\wmfdist.exe' /Q:A /R:N
- '%ProgramFiles(x86)%\hampoo\burningstudio20.exe' <File name>.exe
