Technical Information
Modifies file system
Creates the following files
- D:\windows\system32\config\software.log1
- D:\program files (x86)\qlitesort\is-asjn1.tmp
- D:\program files (x86)\qlitesort\unins000.dat
- D:\program files (x86)\qlitesort\qlitesort318.exe
- D:\windows\appcompat\programs\recentfilecache.bcf
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\8221a41daafa532836d3e8eded1aac94d3955d16
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\windows\system32\winevt\logs\system.evtx
- D:\windows\system32\winevt\logs\security.evtx
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\system volume information\syscache.hve.log1
- D:\system volume information\syscache.hve
- D:\windows\system32\winevt\logs\application.evtx
- D:\program files (x86)\qlitesort\is-o239q.tmp
- D:\program files (x86)\qlitesort\is-pd46q.tmp
- D:\program files (x86)\qlitesort\is-f2ri2.tmp
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
- D:\program files (x86)\qlitesort\is-fdf76.tmp
- D:\users\user\appdata\local\temp\is-th4ov.tmp\is-qkcr9.tmp
- D:\windows\system32\config\system.log1
- D:\windows\system32\config\system
- D:\users\user\appdata\local\temp\is-tilp4.tmp\_isetup\_regdll.tmp
- D:\users\user\appdata\local\temp\is-tilp4.tmp\_isetup\_setup64.tmp
- D:\users\user\appdata\local\temp\is-tilp4.tmp\_isetup\_shfoldr.dll
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\sitesecurityservicestate.txt
- D:\users\user\appdata\local\temp\license.txt
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\2895d329d9cde4eec4507c923e0791bb67db775c
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\d02765262ff82856f6b6d6bfe3a3c0adfde1f378
- D:\users\user\appdata\local\temp\is-tilp4.tmp\_isetup\_iscrypt.dll
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- D:\users\user\ntuser.dat.log1
- D:\users\user\ntuser.dat
- D:\program files (x86)\qlitesort\is-vauo8.tmp
- D:\windows\system32\config\software
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\026a91c419276cf4863cd88d801b264a6313a475
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive0.dat
Deletes the following files
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
Moves the following files
- from D:\program files (x86)\qlitesort\is-vauo8.tmp to D:\program files (x86)\qlitesort\unins000.exe
- from D:\program files (x86)\qlitesort\is-fdf76.tmp to D:\program files (x86)\qlitesort\qlitesort318.exe
- from D:\program files (x86)\qlitesort\is-f2ri2.tmp to D:\program files (x86)\qlitesort\settings.ini
- from D:\program files (x86)\qlitesort\is-o239q.tmp to D:\program files (x86)\qlitesort\langs.ini
- from D:\program files (x86)\qlitesort\is-pd46q.tmp to D:\program files (x86)\qlitesort\help.html
- from D:\program files (x86)\qlitesort\is-asjn1.tmp to D:\program files (x86)\qlitesort\license.txt
Network activity
Connects to
- 'jo####rdmust.sbs':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?64########
HTTP POST requests
- http://jo####rdmust.sbs/new/net_api
Other
- 'localhost':49158
- '35.##1.9.150':443
- '34.##1.73.144':443
UDP
- DNS ASK jo####rdmust.sbs
Miscellaneous
Searches for the following windows
- ClassName: 'L89865_qLiteSort318Class_L89865' WindowName: ''
Creates and executes the following
- 'D:\users\user\appdata\local\temp\is-th4ov.tmp\is-qkcr9.tmp' /SL4 $8022A "<Full path to file>" 3377200 52736
- 'D:\program files (x86)\qlitesort\qlitesort318.exe'
- 'D:\program files (x86)\qlitesort\qlitesort318.exe' b5cb14bfea92199c071eab2c6e71cd82
