Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-mtkjg.tmp\<File name>.tmp
- %ProgramFiles(x86)%\urning studio\is-rrvtr.tmp
- %ProgramFiles(x86)%\urning studio\is-9mqcr.tmp
- %ProgramFiles(x86)%\urning studio\is-q0kam.tmp
- %ProgramFiles(x86)%\urning studio\is-3ftag.tmp
- %ProgramFiles(x86)%\urning studio\is-ju8gt.tmp
- %ProgramFiles(x86)%\urning studio\is-4hl98.tmp
- %ProgramFiles(x86)%\urning studio\is-omqsv.tmp
- %ProgramFiles(x86)%\urning studio\is-gqpob.tmp
- %ProgramFiles(x86)%\urning studio\is-cmibf.tmp
- %ProgramFiles(x86)%\urning studio\is-bt2ab.tmp
- %ProgramFiles(x86)%\urning studio\is-6pqjc.tmp
- %ProgramFiles(x86)%\urning studio\is-8nin1.tmp
- %ProgramFiles(x86)%\urning studio\is-j0cvq.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\urning studio\urning studio .lnk
- %ProgramFiles(x86)%\urning studio\is-ta9de.tmp
- %ProgramFiles(x86)%\urning studio\is-1tklq.tmp
- %ProgramFiles(x86)%\urning studio\is-g7646.tmp
- %ProgramFiles(x86)%\urning studio\is-hmi3m.tmp
- %ProgramFiles(x86)%\urning studio\is-aoi1l.tmp
- %ProgramFiles(x86)%\urning studio\is-sjsnt.tmp
- %ProgramFiles(x86)%\urning studio\is-obrip.tmp
- %ProgramFiles(x86)%\urning studio\is-avdid.tmp
- %ProgramFiles(x86)%\urning studio\is-elhu0.tmp
- %ProgramFiles(x86)%\urning studio\is-jhiki.tmp
- %TEMP%\is-gbd9u.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-gbd9u.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-gbd9u.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-gbd9u.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\urning studio\is-5lpq6.tmp
- %ProgramFiles(x86)%\urning studio\unins000.dat
Moves the following files
- from %ProgramFiles(x86)%\urning studio\is-jhiki.tmp to %ProgramFiles(x86)%\urning studio\unins000.exe
- from %ProgramFiles(x86)%\urning studio\is-q0kam.tmp to %ProgramFiles(x86)%\urning studio\wmfdist.exe
- from %ProgramFiles(x86)%\urning studio\is-3ftag.tmp to %ProgramFiles(x86)%\urning studio\startrescueexplorer.ico
- from %ProgramFiles(x86)%\urning studio\is-ju8gt.tmp to %ProgramFiles(x86)%\urning studio\license-curl.txt
- from %ProgramFiles(x86)%\urning studio\is-4hl98.tmp to %ProgramFiles(x86)%\urning studio\license-fi.txt
- from %ProgramFiles(x86)%\urning studio\is-omqsv.tmp to %ProgramFiles(x86)%\urning studio\ash_libcurl.dll
- from %ProgramFiles(x86)%\urning studio\is-gqpob.tmp to %ProgramFiles(x86)%\urning studio\gdiplus.dll
- from %ProgramFiles(x86)%\urning studio\is-cmibf.tmp to %ProgramFiles(x86)%\urning studio\irrlicht.dll
- from %ProgramFiles(x86)%\urning studio\is-bt2ab.tmp to %ProgramFiles(x86)%\urning studio\d3dx9_43.dll
- from %ProgramFiles(x86)%\urning studio\is-6pqjc.tmp to %ProgramFiles(x86)%\urning studio\avfilter_ash-6.dll
- from %ProgramFiles(x86)%\urning studio\is-8nin1.tmp to %ProgramFiles(x86)%\urning studio\swresample_ash-2.dll
- from %ProgramFiles(x86)%\urning studio\is-j0cvq.tmp to %ProgramFiles(x86)%\urning studio\swscale_ash-4.dll
- from %ProgramFiles(x86)%\urning studio\is-ta9de.tmp to %ProgramFiles(x86)%\urning studio\avutil_ash-55.dll
- from %ProgramFiles(x86)%\urning studio\is-5lpq6.tmp to %ProgramFiles(x86)%\urning studio\ash_amf.dll
- from %ProgramFiles(x86)%\urning studio\is-1tklq.tmp to %ProgramFiles(x86)%\urning studio\bsnotify.exe
- from %ProgramFiles(x86)%\urning studio\is-g7646.tmp to %ProgramFiles(x86)%\urning studio\ash_spti.dll
- from %ProgramFiles(x86)%\urning studio\is-hmi3m.tmp to %ProgramFiles(x86)%\urning studio\decmpa.dll
- from %ProgramFiles(x86)%\urning studio\is-aoi1l.tmp to %ProgramFiles(x86)%\urning studio\audiotools.dll
- from %ProgramFiles(x86)%\urning studio\is-sjsnt.tmp to %ProgramFiles(x86)%\urning studio\info.xml
- from %ProgramFiles(x86)%\urning studio\is-obrip.tmp to %ProgramFiles(x86)%\urning studio\version.info
- from %ProgramFiles(x86)%\urning studio\is-avdid.tmp to %ProgramFiles(x86)%\urning studio\product.xml
- from %ProgramFiles(x86)%\urning studio\is-elhu0.tmp to %ProgramFiles(x86)%\urning studio\license-en.txt
- from %ProgramFiles(x86)%\urning studio\is-9mqcr.tmp to %ProgramFiles(x86)%\urning studio\urningstudio.exe
- from %ProgramFiles(x86)%\urning studio\is-rrvtr.tmp to %ProgramFiles(x86)%\urning studio\sqlite3.dll
Network activity
Connects to
- 'op###olad.com':80
TCP
HTTP POST requests
- http://op###olad.com/v2/events
UDP
- DNS ASK op###olad.com
Miscellaneous
Searches for the following windows
- ClassName: 'B9339C17-155F-C10C-D4D6-BA0C805EA3E4' WindowName: ''
Creates and executes the following
- '%TEMP%\is-mtkjg.tmp\<File name>.tmp' /SL5="$150214,11800573,214016,<Full path to file>"
- '%ProgramFiles(x86)%\urning studio\wmfdist.exe' /Q:A /R:N
- '%ProgramFiles(x86)%\urning studio\urningstudio.exe' <File name>.exe
