Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\E_MountLite_66] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\E_MountLite_66] 'ImagePath' = '%ALLUSERSPROFILE%\E_MountLite_66\E_MountLite_66.exe'
Creates the following services
- 'E_MountLite_66' %ALLUSERSPROFILE%\E_MountLite_66\E_MountLite_66.exe
Modifies file system
Creates the following files
- %TEMP%\is-64msv.tmp\<File name>.tmp
- %LOCALAPPDATA%\qt simple boot extension\unins000.dat
- %LOCALAPPDATA%\qt simple boot extension\is-serid.tmp
- %LOCALAPPDATA%\qt simple boot extension\languages\is-ekc0p.tmp
- %LOCALAPPDATA%\qt simple boot extension\is-ur46a.tmp
- %LOCALAPPDATA%\qt simple boot extension\is-gs56m.tmp
- %LOCALAPPDATA%\qt simple boot extension\is-euid0.tmp
- %LOCALAPPDATA%\qt simple boot extension\is-appsa.tmp
- %LOCALAPPDATA%\qt simple boot extension\is-3shp7.tmp
- %LOCALAPPDATA%\qt simple boot extension\is-b1bbr.tmp
- %LOCALAPPDATA%\qt simple boot extension\is-022d1.tmp
- %LOCALAPPDATA%\qt simple boot extension\qtsimplebootext.exe
- %LOCALAPPDATA%\qt simple boot extension\is-ifgln.tmp
- %LOCALAPPDATA%\qt simple boot extension\is-cu2ai.tmp
- %LOCALAPPDATA%\qt simple boot extension\is-bqqrp.tmp
- %LOCALAPPDATA%\qt simple boot extension\is-ioul9.tmp
- %LOCALAPPDATA%\qt simple boot extension\is-n3591.tmp
- %LOCALAPPDATA%\qt simple boot extension\is-b2ql1.tmp
- %LOCALAPPDATA%\qt simple boot extension\is-rhgmf.tmp
- %LOCALAPPDATA%\qt simple boot extension\is-k0j77.tmp
- %TEMP%\is-jc7gd.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-jc7gd.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-jc7gd.tmp\_isetup\_setup64.tmp
- %LOCALAPPDATA%\qt simple boot extension\is-i5jrn.tmp
- %ALLUSERSPROFILE%\e_mountlite_66\e_mountlite_66.exe
Deletes the following files
- %LOCALAPPDATA%\qt simple boot extension\libgcc_s_dw2-1.dll
Moves the following files
- from %LOCALAPPDATA%\qt simple boot extension\is-k0j77.tmp to %LOCALAPPDATA%\qt simple boot extension\unins000.exe
- from %LOCALAPPDATA%\qt simple boot extension\is-ur46a.tmp to %LOCALAPPDATA%\qt simple boot extension\setting.ini
- from %LOCALAPPDATA%\qt simple boot extension\is-gs56m.tmp to %LOCALAPPDATA%\qt simple boot extension\sdl2.dll
- from %LOCALAPPDATA%\qt simple boot extension\is-euid0.tmp to %LOCALAPPDATA%\qt simple boot extension\swresample-3.dll
- from %LOCALAPPDATA%\qt simple boot extension\is-appsa.tmp to %LOCALAPPDATA%\qt simple boot extension\zlib1.dll
- from %LOCALAPPDATA%\qt simple boot extension\is-3shp7.tmp to %LOCALAPPDATA%\qt simple boot extension\libbz2-1.dll
- from %LOCALAPPDATA%\qt simple boot extension\is-b1bbr.tmp to %LOCALAPPDATA%\qt simple boot extension\libwinpthread-1.dll
- from %LOCALAPPDATA%\qt simple boot extension\languages\is-ekc0p.tmp to %LOCALAPPDATA%\qt simple boot extension\languages\turkish.ini
- from %LOCALAPPDATA%\qt simple boot extension\is-022d1.tmp to %LOCALAPPDATA%\qt simple boot extension\libvorbisenc-2.dll
- from %LOCALAPPDATA%\qt simple boot extension\is-i5jrn.tmp to %LOCALAPPDATA%\qt simple boot extension\libogg-0.dll
- from %LOCALAPPDATA%\qt simple boot extension\is-cu2ai.tmp to %LOCALAPPDATA%\qt simple boot extension\libiconv-2.dll
- from %LOCALAPPDATA%\qt simple boot extension\is-ioul9.tmp to %LOCALAPPDATA%\qt simple boot extension\avutil-56.dll
- from %LOCALAPPDATA%\qt simple boot extension\is-n3591.tmp to %LOCALAPPDATA%\qt simple boot extension\libgcc_s_dw2-1.dll
- from %LOCALAPPDATA%\qt simple boot extension\is-b2ql1.tmp to %LOCALAPPDATA%\qt simple boot extension\avformat-58.dll
- from %LOCALAPPDATA%\qt simple boot extension\is-rhgmf.tmp to %LOCALAPPDATA%\qt simple boot extension\avcodec-58.dll
- from %LOCALAPPDATA%\qt simple boot extension\is-ifgln.tmp to %LOCALAPPDATA%\qt simple boot extension\libvorbis-0.dll
- from %LOCALAPPDATA%\qt simple boot extension\is-serid.tmp to %LOCALAPPDATA%\qt simple boot extension\qtsimplebootext.exe
Substitutes the following files
- %LOCALAPPDATA%\qt simple boot extension\libgcc_s_dw2-1.dll
Miscellaneous
Searches for the following windows
- ClassName: 'b6b075_QTBE2153FlashFixClass_b6b075' WindowName: ''
Creates and executes the following
- '%TEMP%\is-64msv.tmp\<File name>.tmp' /SL5="$A01AA,5929732,54272,<Full path to file>"
- '%LOCALAPPDATA%\qt simple boot extension\qtsimplebootext.exe' -i
- '%LOCALAPPDATA%\qt simple boot extension\qtsimplebootext.exe' -s
