Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-dh7k4.tmp\<File name>.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\powergold\is-pgnmg.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\drv\is-aonlo.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\is-928f6.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\is-aup0m.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\is-r82jc.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\is-kvcp2.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-5gauo.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-g429f.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-fo16a.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-81mqp.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-7rim9.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-v9ka1.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-j1k03.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-ddgej.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-9ksof.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-3uog3.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\www\is-hn25e.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\www\is-rqlcb.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\www\is-c3bs5.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\www\is-9lkde.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\www\is-osvf3.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\www\is-dh0fn.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\www\is-51uc1.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-gpt5t.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ip player pro\ip player pro\ip player pro.lnk
- %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-15tor.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-km0iv.tmp
- %TEMP%\is-l5463.tmp\_isetup\_regdll.tmp
- %TEMP%\is-l5463.tmp\_isetup\_setup64.tmp
- %TEMP%\is-l5463.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-l5463.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-l5463.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\ip studio pro\ip player pro\is-n67ms.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\is-b6ol1.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\is-e2hv4.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\is-26fhq.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\is-6v6gf.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\is-ntgfv.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\is-bgucr.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\is-n4npd.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\is-l925g.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\is-cqn46.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-e9d8t.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-sm6ol.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-f740o.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-bhj7d.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-mpo01.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-74jfa.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-d1n0u.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-32jjd.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-jd013.tmp
- %ProgramFiles(x86)%\ip studio pro\ip player pro\unins000.dat
Moves the following files
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\is-n67ms.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\unins000.exe
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\is-928f6.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\license.txt
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\is-aup0m.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\ppro.chm
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\is-r82jc.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\readme.txt
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\is-kvcp2.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\whatsnew.txt
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-5gauo.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\deffades.ini
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-g429f.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\exploreset.ini
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-fo16a.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\filedefsetlist.ini
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-81mqp.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\hotdefsetlist.ini
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-7rim9.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\jindefsetlist.ini
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-v9ka1.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\musdefsetlist.ini
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-j1k03.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\newsdefsetlist.ini
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-ddgej.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\prgdefsetlist.ini
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-9ksof.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\timeservers.ini
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\is-3uog3.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\ini_def\timeserversdefault.ini
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\www\is-hn25e.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\www\currentfiles.htm
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\www\is-rqlcb.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\www\currentplaylists.htm
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\www\is-c3bs5.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\www\main.htm
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\www\is-9lkde.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\www\playedfiles.htm
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\www\is-osvf3.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\www\playlists.htm
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\drv\is-aonlo.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\drv\dinstall.exe
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\www\is-dh0fn.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\www\status.htm
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\powergold\is-pgnmg.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\powergold\automation.aut
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-15tor.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\language\rpprorus.lng
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\is-b6ol1.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\dstest.exe
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\is-e2hv4.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\logview.exe
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\is-26fhq.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\mbase.exe
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\is-6v6gf.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\mexplore.exe
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\is-ntgfv.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\ppro.exe
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\is-bgucr.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\wmfdist.exe
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\is-n4npd.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\sqlite3.dll
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\is-l925g.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\unzdll.dll
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\is-cqn46.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\zipdll.dll
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-e9d8t.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\language\logvieweng.lng
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-sm6ol.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\language\logviewrus.lng
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-f740o.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\language\logviewrus_lat.lng
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-bhj7d.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\language\mbaseeng.lng
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-mpo01.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\language\mbaserus.lng
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-74jfa.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\language\mbaserus_lat.lng
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-d1n0u.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\language\mexploreeng.lng
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-32jjd.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\language\mexplorerus.lng
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-km0iv.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\language\mexplorerus_lat.lng
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-jd013.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\language\rpproeng.lng
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\language\is-gpt5t.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\language\rpprorus_lat.lng
- from %ProgramFiles(x86)%\ip studio pro\ip player pro\www\is-51uc1.tmp to %ProgramFiles(x86)%\ip studio pro\ip player pro\www\unplayedfiles.htm
Network activity
Connects to
- 'op###olad.com':80
TCP
HTTP POST requests
- http://op###olad.com/v2/events
UDP
- DNS ASK op###olad.com
Miscellaneous
Searches for the following windows
- ClassName: '1025063D-F16D-434d-82A2-7968BD33E31E' WindowName: ''
Creates and executes the following
- '%TEMP%\is-dh7k4.tmp\<File name>.tmp' /SL5="$120224,10809266,54272,<Full path to file>"
- '%ProgramFiles(x86)%\ip studio pro\ip player pro\wmfdist.exe' /Q:A /R:N
- '%ProgramFiles(x86)%\ip studio pro\ip player pro\ppro.exe' <File name>.exe
