Trojan.DownLoader35.56054

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-ol25q.tmp\<File name>.tmp
%ProgramFiles(x86)%\hampoo\is-4kp3b.tmp
%ProgramFiles(x86)%\hampoo\is-snslj.tmp
%ProgramFiles(x86)%\hampoo\is-0cfd6.tmp
%ProgramFiles(x86)%\hampoo\is-bgpge.tmp
%ProgramFiles(x86)%\hampoo\is-dei2t.tmp
%ProgramFiles(x86)%\hampoo\is-mmjah.tmp
%ProgramFiles(x86)%\hampoo\is-1iqj7.tmp
%ProgramFiles(x86)%\hampoo\is-6vivh.tmp
%ProgramFiles(x86)%\hampoo\is-8i18q.tmp
%ProgramFiles(x86)%\hampoo\is-6aash.tmp
%ProgramFiles(x86)%\hampoo\is-c8a5r.tmp
%ProgramFiles(x86)%\hampoo\is-sg1pk.tmp
%ProgramFiles(x86)%\hampoo\is-ut7ms.tmp
%ProgramFiles(x86)%\hampoo\is-f1scc.tmp
%ProgramFiles(x86)%\hampoo\is-2hv80.tmp
%ProgramFiles(x86)%\hampoo\is-nrlpi.tmp
%ProgramFiles(x86)%\hampoo\is-efebh.tmp
%ProgramFiles(x86)%\hampoo\is-je6h0.tmp
%ProgramFiles(x86)%\hampoo\is-3o1n0.tmp
%ProgramFiles(x86)%\hampoo\is-6pps2.tmp
%TEMP%\is-ulevd.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ulevd.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\hampoo\is-5nout.tmp
%ProgramFiles(x86)%\hampoo\is-bn7cm.tmp
%ProgramFiles(x86)%\hampoo\is-7g62t.tmp
%ProgramFiles(x86)%\hampoo\is-3go85.tmp
%ProgramFiles(x86)%\hampoo\is-o4mhm.tmp
%TEMP%\is-ulevd.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\hampoo\is-gl7dk.tmp
%ProgramFiles(x86)%\hampoo\is-f8ll6.tmp
%ProgramFiles(x86)%\hampoo\is-9lh9q.tmp
%ProgramFiles(x86)%\hampoo\is-8ujp6.tmp
%ProgramFiles(x86)%\hampoo\is-i81fa.tmp
%ProgramFiles(x86)%\hampoo\is-vkkc7.tmp
%ProgramFiles(x86)%\hampoo\is-tt340.tmp
%ProgramFiles(x86)%\hampoo\is-965v4.tmp
%ProgramFiles(x86)%\hampoo\is-bs2mg.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\hampoo\hampoo burning studio 20\hampoo burning studio 20 .lnk
%ProgramFiles(x86)%\hampoo\unins000.dat

Deletes the following files

%ProgramFiles(x86)%\hampoo\ash_libcurl.dll
%ProgramFiles(x86)%\hampoo\license-curl.txt

Moves the following files

from %ProgramFiles(x86)%\hampoo\is-5nout.tmp to %ProgramFiles(x86)%\hampoo\unins000.exe
from %ProgramFiles(x86)%\hampoo\is-ut7ms.tmp to %ProgramFiles(x86)%\hampoo\startrescueexplorer.ico
from %ProgramFiles(x86)%\hampoo\is-c8a5r.tmp to %ProgramFiles(x86)%\hampoo\license-fi.txt
from %ProgramFiles(x86)%\hampoo\is-efebh.tmp to %ProgramFiles(x86)%\hampoo\gdiplus.dll
from %ProgramFiles(x86)%\hampoo\is-nrlpi.tmp to %ProgramFiles(x86)%\hampoo\irrlicht.dll
from %ProgramFiles(x86)%\hampoo\is-8i18q.tmp to %ProgramFiles(x86)%\hampoo\d3dx9_43.dll
from %ProgramFiles(x86)%\hampoo\is-mmjah.tmp to %ProgramFiles(x86)%\hampoo\avfilter_ash-6.dll
from %ProgramFiles(x86)%\hampoo\is-dei2t.tmp to %ProgramFiles(x86)%\hampoo\swresample_ash-2.dll
from %ProgramFiles(x86)%\hampoo\is-bgpge.tmp to %ProgramFiles(x86)%\hampoo\swscale_ash-4.dll
from %ProgramFiles(x86)%\hampoo\is-0cfd6.tmp to %ProgramFiles(x86)%\hampoo\avutil_ash-55.dll
from %ProgramFiles(x86)%\hampoo\is-snslj.tmp to %ProgramFiles(x86)%\hampoo\mediainfo.dll
from %ProgramFiles(x86)%\hampoo\is-4kp3b.tmp to %ProgramFiles(x86)%\hampoo\_startrescueexplorer.exe
from %ProgramFiles(x86)%\hampoo\is-6vivh.tmp to %ProgramFiles(x86)%\hampoo\ashdriversetup.exe
from %ProgramFiles(x86)%\hampoo\is-1iqj7.tmp to %ProgramFiles(x86)%\hampoo\burningstudioprogress.exe
from %ProgramFiles(x86)%\hampoo\is-je6h0.tmp to %ProgramFiles(x86)%\hampoo\peru.interop.dll
from %ProgramFiles(x86)%\hampoo\is-3o1n0.tmp to %ProgramFiles(x86)%\hampoo\ash_m2tsmux.dll
from %ProgramFiles(x86)%\hampoo\is-6pps2.tmp to %ProgramFiles(x86)%\hampoo\ash_amf.dll
from %ProgramFiles(x86)%\hampoo\is-965v4.tmp to %ProgramFiles(x86)%\hampoo\bsnotify.exe
from %ProgramFiles(x86)%\hampoo\is-tt340.tmp to %ProgramFiles(x86)%\hampoo\ash_spti.dll
from %ProgramFiles(x86)%\hampoo\is-vkkc7.tmp to %ProgramFiles(x86)%\hampoo\decmpa.dll
from %ProgramFiles(x86)%\hampoo\is-i81fa.tmp to %ProgramFiles(x86)%\hampoo\audiotools.dll
from %ProgramFiles(x86)%\hampoo\is-8ujp6.tmp to %ProgramFiles(x86)%\hampoo\burningstudio20.exe
from %ProgramFiles(x86)%\hampoo\is-9lh9q.tmp to %ProgramFiles(x86)%\hampoo\info.xml
from %ProgramFiles(x86)%\hampoo\is-f8ll6.tmp to %ProgramFiles(x86)%\hampoo\version.info
from %ProgramFiles(x86)%\hampoo\is-bs2mg.tmp to %ProgramFiles(x86)%\hampoo\product.xml
from %ProgramFiles(x86)%\hampoo\is-gl7dk.tmp to %ProgramFiles(x86)%\hampoo\license-en.txt
from %ProgramFiles(x86)%\hampoo\is-o4mhm.tmp to %ProgramFiles(x86)%\hampoo\license-de.txt
from %ProgramFiles(x86)%\hampoo\is-3go85.tmp to %ProgramFiles(x86)%\hampoo\setupdownloader.exe
from %ProgramFiles(x86)%\hampoo\is-7g62t.tmp to %ProgramFiles(x86)%\hampoo\ash_libcurl.dll
from %ProgramFiles(x86)%\hampoo\is-bn7cm.tmp to %ProgramFiles(x86)%\hampoo\license-curl.txt
from %ProgramFiles(x86)%\hampoo\is-f1scc.tmp to %ProgramFiles(x86)%\hampoo\wmfdist.exe
from %ProgramFiles(x86)%\hampoo\is-2hv80.tmp to %ProgramFiles(x86)%\hampoo\sqlite3.dll

Substitutes the following files

%ProgramFiles(x86)%\hampoo\ash_libcurl.dll
%ProgramFiles(x86)%\hampoo\license-curl.txt

Network activity

Connects to

'op###olad.com':80

TCP

HTTP POST requests

http://op###olad.com/v2/events

UDP

DNS ASK op###olad.com

Miscellaneous

Searches for the following windows

ClassName: '339C1B97-155F-C10C-D4D6-BA03C805EAE4' WindowName: ''

Creates and executes the following

'%TEMP%\is-ol25q.tmp\<File name>.tmp' /SL5="$140212,13045887,346624,<Full path to file>"
'%ProgramFiles(x86)%\hampoo\wmfdist.exe' /Q:A /R:N
'%ProgramFiles(x86)%\hampoo\burningstudio20.exe' <File name>.exe