Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-dh6u9.tmp\<File name>.tmp
- %ProgramFiles(x86)%\shampoo\is-jbg0b.tmp
- %ProgramFiles(x86)%\shampoo\is-cjgf7.tmp
- %ProgramFiles(x86)%\shampoo\is-118nq.tmp
- %ProgramFiles(x86)%\shampoo\is-e8npu.tmp
- %ProgramFiles(x86)%\shampoo\is-kqnos.tmp
- %ProgramFiles(x86)%\shampoo\is-og6op.tmp
- %ProgramFiles(x86)%\shampoo\is-pbb7m.tmp
- %ProgramFiles(x86)%\shampoo\is-ska2e.tmp
- %ProgramFiles(x86)%\shampoo\is-1i5il.tmp
- %ProgramFiles(x86)%\shampoo\is-1m7k2.tmp
- %ProgramFiles(x86)%\shampoo\is-c1tm2.tmp
- %ProgramFiles(x86)%\shampoo\is-kh6f6.tmp
- %ProgramFiles(x86)%\shampoo\is-3sup2.tmp
- %ProgramFiles(x86)%\shampoo\is-68u7q.tmp
- %ProgramFiles(x86)%\shampoo\is-l013m.tmp
- %ProgramFiles(x86)%\shampoo\is-ifan9.tmp
- %ProgramFiles(x86)%\shampoo\is-rd3uh.tmp
- %ProgramFiles(x86)%\shampoo\is-mkn4j.tmp
- %ProgramFiles(x86)%\shampoo\is-5lrh7.tmp
- %ProgramFiles(x86)%\shampoo\is-41sg0.tmp
- %TEMP%\is-2jjjl.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-2jjjl.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\shampoo\is-ob0kl.tmp
- %ProgramFiles(x86)%\shampoo\is-c6gbv.tmp
- %ProgramFiles(x86)%\shampoo\is-oafrn.tmp
- %ProgramFiles(x86)%\shampoo\is-169in.tmp
- %ProgramFiles(x86)%\shampoo\is-j8vev.tmp
- %TEMP%\is-2jjjl.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\shampoo\is-stvag.tmp
- %ProgramFiles(x86)%\shampoo\is-nohk5.tmp
- %ProgramFiles(x86)%\shampoo\is-0rl57.tmp
- %ProgramFiles(x86)%\shampoo\is-svf4p.tmp
- %ProgramFiles(x86)%\shampoo\is-9a2lt.tmp
- %ProgramFiles(x86)%\shampoo\is-ug4bo.tmp
- %ProgramFiles(x86)%\shampoo\is-2bkq6.tmp
- %ProgramFiles(x86)%\shampoo\is-kgn8k.tmp
- %ProgramFiles(x86)%\shampoo\is-u32rd.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\shampoo\shampoo burning studio 20\shampoo burning studio 20 .lnk
- %ProgramFiles(x86)%\shampoo\unins000.dat
Deletes the following files
- %ProgramFiles(x86)%\shampoo\ash_libcurl.dll
- %ProgramFiles(x86)%\shampoo\license-curl.txt
Moves the following files
- from %ProgramFiles(x86)%\shampoo\is-ob0kl.tmp to %ProgramFiles(x86)%\shampoo\unins000.exe
- from %ProgramFiles(x86)%\shampoo\is-3sup2.tmp to %ProgramFiles(x86)%\shampoo\startrescueexplorer.ico
- from %ProgramFiles(x86)%\shampoo\is-c1tm2.tmp to %ProgramFiles(x86)%\shampoo\license-fi.txt
- from %ProgramFiles(x86)%\shampoo\is-rd3uh.tmp to %ProgramFiles(x86)%\shampoo\gdiplus.dll
- from %ProgramFiles(x86)%\shampoo\is-ifan9.tmp to %ProgramFiles(x86)%\shampoo\irrlicht.dll
- from %ProgramFiles(x86)%\shampoo\is-1i5il.tmp to %ProgramFiles(x86)%\shampoo\d3dx9_43.dll
- from %ProgramFiles(x86)%\shampoo\is-og6op.tmp to %ProgramFiles(x86)%\shampoo\avfilter_ash-6.dll
- from %ProgramFiles(x86)%\shampoo\is-kqnos.tmp to %ProgramFiles(x86)%\shampoo\swresample_ash-2.dll
- from %ProgramFiles(x86)%\shampoo\is-e8npu.tmp to %ProgramFiles(x86)%\shampoo\swscale_ash-4.dll
- from %ProgramFiles(x86)%\shampoo\is-118nq.tmp to %ProgramFiles(x86)%\shampoo\avutil_ash-55.dll
- from %ProgramFiles(x86)%\shampoo\is-cjgf7.tmp to %ProgramFiles(x86)%\shampoo\mediainfo.dll
- from %ProgramFiles(x86)%\shampoo\is-jbg0b.tmp to %ProgramFiles(x86)%\shampoo\_startrescueexplorer.exe
- from %ProgramFiles(x86)%\shampoo\is-ska2e.tmp to %ProgramFiles(x86)%\shampoo\ashdriversetup.exe
- from %ProgramFiles(x86)%\shampoo\is-pbb7m.tmp to %ProgramFiles(x86)%\shampoo\burningstudioprogress.exe
- from %ProgramFiles(x86)%\shampoo\is-mkn4j.tmp to %ProgramFiles(x86)%\shampoo\peru.interop.dll
- from %ProgramFiles(x86)%\shampoo\is-5lrh7.tmp to %ProgramFiles(x86)%\shampoo\ash_m2tsmux.dll
- from %ProgramFiles(x86)%\shampoo\is-41sg0.tmp to %ProgramFiles(x86)%\shampoo\ash_amf.dll
- from %ProgramFiles(x86)%\shampoo\is-kgn8k.tmp to %ProgramFiles(x86)%\shampoo\bsnotify.exe
- from %ProgramFiles(x86)%\shampoo\is-2bkq6.tmp to %ProgramFiles(x86)%\shampoo\ash_spti.dll
- from %ProgramFiles(x86)%\shampoo\is-ug4bo.tmp to %ProgramFiles(x86)%\shampoo\decmpa.dll
- from %ProgramFiles(x86)%\shampoo\is-9a2lt.tmp to %ProgramFiles(x86)%\shampoo\audiotools.dll
- from %ProgramFiles(x86)%\shampoo\is-svf4p.tmp to %ProgramFiles(x86)%\shampoo\burningstudio20.exe
- from %ProgramFiles(x86)%\shampoo\is-0rl57.tmp to %ProgramFiles(x86)%\shampoo\info.xml
- from %ProgramFiles(x86)%\shampoo\is-nohk5.tmp to %ProgramFiles(x86)%\shampoo\version.info
- from %ProgramFiles(x86)%\shampoo\is-u32rd.tmp to %ProgramFiles(x86)%\shampoo\product.xml
- from %ProgramFiles(x86)%\shampoo\is-stvag.tmp to %ProgramFiles(x86)%\shampoo\license-en.txt
- from %ProgramFiles(x86)%\shampoo\is-j8vev.tmp to %ProgramFiles(x86)%\shampoo\license-de.txt
- from %ProgramFiles(x86)%\shampoo\is-169in.tmp to %ProgramFiles(x86)%\shampoo\setupdownloader.exe
- from %ProgramFiles(x86)%\shampoo\is-oafrn.tmp to %ProgramFiles(x86)%\shampoo\ash_libcurl.dll
- from %ProgramFiles(x86)%\shampoo\is-c6gbv.tmp to %ProgramFiles(x86)%\shampoo\license-curl.txt
- from %ProgramFiles(x86)%\shampoo\is-68u7q.tmp to %ProgramFiles(x86)%\shampoo\wmfdist.exe
- from %ProgramFiles(x86)%\shampoo\is-l013m.tmp to %ProgramFiles(x86)%\shampoo\sqlite3.dll
Substitutes the following files
- %ProgramFiles(x86)%\shampoo\ash_libcurl.dll
- %ProgramFiles(x86)%\shampoo\license-curl.txt
Network activity
Connects to
- 'op###olad.com':80
TCP
HTTP POST requests
- http://op###olad.com/v2/events
UDP
- DNS ASK op###olad.com
Miscellaneous
Searches for the following windows
- ClassName: '1B339C97-155F-C10C-D4D6-ABA03C805EE4' WindowName: ''
Creates and executes the following
- '%TEMP%\is-dh6u9.tmp\<File name>.tmp' /SL5="$B001E,13080372,346624,<Full path to file>"
- '%ProgramFiles(x86)%\shampoo\wmfdist.exe' /Q:A /R:N
- '%ProgramFiles(x86)%\shampoo\burningstudio20.exe' <File name>.exe
