Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\is-0ekrc.tmp\<Имя файла>.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-b0c0j.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-504ou.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-ue7is.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-u90lp.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-0ttah.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-8vghl.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-ecchf.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-n9btq.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-tuhto.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\powergold\is-3j805.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\drv\is-u8sp6.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-h858n.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-s58fv.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-gmkar.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-spr5c.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-o3vf8.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-m67qv.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-91nop.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-j7du5.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-s95a5.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-65csf.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-09onn.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-39vs2.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-6kj5p.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-pmpe5.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-8fah9.tmp
- %TEMP%\is-33ps5.tmp\_isetup\_setup64.tmp
- %TEMP%\is-33ps5.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-33ps5.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-b0atg.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-7d2fg.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-vmc1l.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-sl6lp.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-n29ok.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-b8mu0.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-a0ld6.tmp
- %TEMP%\is-33ps5.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-pc4ub.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-plh2b.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-1p5lr.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-fjq8k.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-1scss.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-4mch8.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-tqv3c.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-nj9rc.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-3pd5g.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-tg9jf.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-8vr1i.tmp
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-2leef.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\iq player pro\iq player pro\iq player pro.lnk
- %ProgramFiles(x86)%\iq studio pro\iq player pro\unins000.dat
Перемещает следующие файлы
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-b0atg.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\unins000.exe
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-b0c0j.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\license.txt
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-504ou.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\ppro.chm
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-ue7is.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\readme.txt
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-u90lp.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\whatsnew.txt
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-0ttah.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\deffades.ini
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-8vghl.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\exploreset.ini
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-ecchf.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\filedefsetlist.ini
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-n9btq.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\hotdefsetlist.ini
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-tuhto.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\jindefsetlist.ini
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-h858n.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\musdefsetlist.ini
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-09onn.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\newsdefsetlist.ini
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-39vs2.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\prgdefsetlist.ini
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-s58fv.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\timeservers.ini
- %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\is-gmkar.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\ini_def\timeserversdefault.ini
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-spr5c.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\www\currentfiles.htm
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-o3vf8.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\www\currentplaylists.htm
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-m67qv.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\www\main.htm
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-91nop.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\www\playedfiles.htm
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-j7du5.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\www\playlists.htm
- %ProgramFiles(x86)%\iq studio pro\iq player pro\drv\is-u8sp6.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\drv\dinstall.exe
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-s95a5.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\www\status.htm
- %ProgramFiles(x86)%\iq studio pro\iq player pro\powergold\is-3j805.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\powergold\automation.aut
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-pmpe5.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\language\rpprorus.lng
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-7d2fg.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\dstest.exe
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-vmc1l.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\logview.exe
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-sl6lp.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\mbase.exe
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-n29ok.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\mexplore.exe
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-b8mu0.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\ppro.exe
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-a0ld6.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\wmfdist.exe
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-pc4ub.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\sqlite3.dll
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-2leef.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\unzdll.dll
- %ProgramFiles(x86)%\iq studio pro\iq player pro\is-plh2b.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\zipdll.dll
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-1p5lr.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\language\logvieweng.lng
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-fjq8k.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\language\logviewrus.lng
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-1scss.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\language\logviewrus_lat.lng
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-4mch8.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mbaseeng.lng
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-tqv3c.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mbaserus.lng
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-nj9rc.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mbaserus_lat.lng
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-3pd5g.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mexploreeng.lng
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-tg9jf.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mexplorerus.lng
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-8vr1i.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\language\mexplorerus_lat.lng
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-8fah9.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\language\rpproeng.lng
- %ProgramFiles(x86)%\iq studio pro\iq player pro\language\is-6kj5p.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\language\rpprorus_lat.lng
- %ProgramFiles(x86)%\iq studio pro\iq player pro\www\is-65csf.tmp в %ProgramFiles(x86)%\iq studio pro\iq player pro\www\unplayedfiles.htm
Сетевая активность
Подключается к
- 'op###olad.com':80
TCP
Запросы HTTP POST
- http://op###olad.com/v2/events
UDP
- DNS ASK op###olad.com
Другое
Ищет следующие окна
- ClassName: '025063D1-F16D-434d-82A2-7968BD33E31E' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\is-0ekrc.tmp\<Имя файла>.tmp' /SL5="$130212,9931275,51712,<Полный путь к файлу>"
- '%ProgramFiles(x86)%\iq studio pro\iq player pro\wmfdist.exe' /Q:A /R:N
- '%ProgramFiles(x86)%\iq studio pro\iq player pro\ppro.exe' <Имя файла>.exe
