Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-8v8kn.tmp\<File name>.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-o1hrk.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-5be3h.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-3l2pb.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-vkndl.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-af8ne.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-ddptl.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-04t71.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-d2o91.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-c6sjd.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\powergold\is-7co1e.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\drv\is-l2df3.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-1eb8g.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-2ua79.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-ea9qq.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-rnmum.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-qsbta.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-letep.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-pk8v9.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-brdg5.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-732rm.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-psf9l.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-pqpo7.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-ab461.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-mplnb.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-9tcc6.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-3jssj.tmp
- %TEMP%\is-28p33.tmp\_isetup\_setup64.tmp
- %TEMP%\is-28p33.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-28p33.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-hk9tj.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-n5s3f.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-1ul73.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-bdhoe.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-eu3bb.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-8jhn5.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-91hke.tmp
- %TEMP%\is-28p33.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-9vhi3.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-302n1.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-7pdep.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-rfusr.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-fn8nf.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-o8v1r.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-iggft.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-33ope.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-1ivpc.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-51uac.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-ek8lh.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-80qun.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\iq player pro\iq player pro\iq player pro.lnk
- %ProgramFiles(x86)%\iq studio pro\iq player pro\unins000.dat
Moves the following files
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-hk9tj.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\unins000.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-o1hrk.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\license.txt
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-5be3h.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ppro.chm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-3l2pb.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\readme.txt
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-vkndl.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\whatsnew.txt
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-af8ne.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\deffades.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-ddptl.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\exploreset.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-04t71.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\filedefsetlist.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-d2o91.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\hotdefsetlist.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-c6sjd.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\jindefsetlist.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-1eb8g.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\musdefsetlist.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-pqpo7.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\newsdefsetlist.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-ab461.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\prgdefsetlist.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-2ua79.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\timeservers.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-ea9qq.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\timeserversdefault.ini
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-rnmum.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\currentfiles.htm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-qsbta.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\currentplaylists.htm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-letep.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\main.htm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-pk8v9.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\playedfiles.htm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-brdg5.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\playlists.htm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\drv\is-l2df3.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\drv\dinstall.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-732rm.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\status.htm
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\powergold\is-7co1e.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\powergold\automation.aut
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-9tcc6.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\rpprorus.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-n5s3f.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\dstest.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-1ul73.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\logview.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-bdhoe.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\mbase.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-eu3bb.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\mexplore.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-8jhn5.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\ppro.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-91hke.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\wmfdist.exe
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-9vhi3.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\sqlite3.dll
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-80qun.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\unzdll.dll
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\is-302n1.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\zipdll.dll
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-7pdep.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\logvieweng.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-rfusr.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\logviewrus.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-fn8nf.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\logviewrus_lat.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-o8v1r.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mbaseeng.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-iggft.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mbaserus.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-33ope.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mbaserus_lat.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-1ivpc.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mexploreeng.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-51uac.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mexplorerus.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-ek8lh.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mexplorerus_lat.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-3jssj.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\rpproeng.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-mplnb.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\language\rpprorus_lat.lng
- from %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-psf9l.tmp to %ProgramFiles(x86)%\iq studio pro\iq player pro\www\unplayedfiles.htm
Network activity
Connects to
- 'op###olad.com':80
TCP
HTTP POST requests
- http://op###olad.com/v2/events
UDP
- DNS ASK op###olad.com
Miscellaneous
Searches for the following windows
- ClassName: '025063D1-F16D-434d-82A2-7968BD33E31E' WindowName: ''
Creates and executes the following
- '%TEMP%\is-8v8kn.tmp\<File name>.tmp' /SL5="$B021C,9927027,51712,<Full path to file>"
- '%ProgramFiles(x86)%\iq studio pro\iq player pro\wmfdist.exe' /Q:A /R:N
- '%ProgramFiles(x86)%\iq studio pro\iq player pro\ppro.exe' <File name>.exe
