Technical Information
Modifies file system
Creates the following files
- %TEMP%\qs_1332133ad0\<File name>.log
- %TEMP%\qs_1332133ad0\yahoo_hpds_startpage.vi.zip
- %TEMP%\qs_1332133ad0\yahoo_hpds_defaultsearch.vi.zip
- %TEMP%\qs_1332133ad0\desktoptemperaturemonitor.vi.zip
- %TEMP%\qs_1332133ad0\yahoo_keepmysettingsx.vi.zip
- %TEMP%\qs_1332133ad0\savepathdeals.vi.zip
- %TEMP%\qs_1332133ad0\optimizerpro.vi.zip
- %TEMP%\qs_1332133ad0\lookthisup.vi.zip
- %TEMP%\qs_1332133ad0\yahoo_hpds_startpage.test.vi.zip
- %TEMP%\symccis2.zip
- %TEMP%\qs_1332133ad0\websearches.vi.zip
- %TEMP%\qs_1332133ad0\smartweb.vi.zip
- %TEMP%\qs_1332133ad0\converterfreeonline.vi.zip
- %TEMP%\qs_1332133ad0\smartdriverupdater.vi.zip
- %TEMP%\qs_1332133ad0\knctr.vi.zip
- %TEMP%\qs_1332133ad0\contentexplorer.vi.zip
- %TEMP%\qs_1332133ad0\spyhunter.vi.zip
- %TEMP%\qs_1332133ad0\yahoosuite.vi.zip
- %TEMP%\symccis.dll
- %TEMP%\ccdc81f.tmp-wal
- %TEMP%\ccdc81f.tmp-shm
- %TEMP%\ccdc81f.tmp
- %LOCALAPPDATA%low\cookie.ini
- %APPDATA%\microsoft\windows\ietldcache\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %TEMP%\qs_1332133ad0\driversupport.vi.zip
- %TEMP%\qs_1332133ad0\java_13232.txt
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\q3cg8mea\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\nlfowi84\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\kvl6mgbq\desktop.ini
- %LOCALAPPDATA%low\cookieman.exe
- %TEMP%\qs_1332133ad0\jenkatgamesarcadeplus.vi.zip
- %TEMP%\qs_1332133ad0\speedupmypc_sales_r2_v2.vi.zip
- %TEMP%\qs_1332133ad0\mypcbackup.vi.zip
- %TEMP%\qs_1332133ad0\registryhelper.vi.zip
- %TEMP%\qs_1332133ad0\vebasearch.vi.zip
- %TEMP%\qs_1332133ad0\nortonsecurityscan.vi.zip
- %TEMP%\qs_1332133ad0\weatherbug.vi.zip
- %TEMP%\qs_1332133ad0\snapdo.vi.zip
- %TEMP%\qs_1332133ad0\smartpccleaner.vi.zip
- %TEMP%\qs_1332133ad0\fulldiskfighter.vi.zip
- %TEMP%\ccdc8ea.tmp
- %TEMP%\qs_1332133ad0\maxthon.vi.zip
- %TEMP%\qs_1332133ad0\pcspeedup.vi.zip
- %TEMP%\qs_1332133ad0\pcoptimizerpro_offer.vi.zip
- %TEMP%\qs_1332133ad0\offerbox.vi.zip
- %TEMP%\qs_1332133ad0\rockettab.vi.zip
- %TEMP%\qs_1332133ad0\java.vi.zip
- %TEMP%\qs_1332133ad0\petite_oo_v5.vi.zip
- %TEMP%\qs_1332133ad0\config.xml
- %TEMP%\qs_1332133ad0\driverscanner.vi.zip
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\h57jetjt\desktop.ini
- %TEMP%\qs_1332133ad0\winferno.vi.zip
- %TEMP%\qs_1332133ad0\kaspersky.vi.zip
- %TEMP%\qs_1332133ad0\uninstallhelper.vi.zip
- %TEMP%\qs_1332133ad0\blitzmediaplayeroffer.vi.zip
- %TEMP%\qs_1332133ad0\resultsbay.vi.zip
- %TEMP%\qs_1332133ad0\yahoo_hpds_defaultsearch.test.vi.zip
- %TEMP%\qs_1332133ad0\pricegong.vi.zip
- %TEMP%\qs_1332133ad0\nortonantivirus.vi.zip
- %TEMP%\qs_1332133ad0\stormwatch.vi.zip
- %TEMP%\qs_1332133ad0\driverfighter.vi.zip
- %TEMP%\qs_1332133ad0\blasteroids.vi.zip
- %TEMP%\qs_1332133ad0\chocolatebar.vi.zip
- %TEMP%\qs_1332133ad0\webbar.vi.zip
- %TEMP%\qs_1332133ad0\defaulttab.vi.zip
- %TEMP%\qs_1332133ad0\nortoninternetsecurity.vi.zip
- %TEMP%\qs_1332133ad0\astroarcade.vi.zip
- %TEMP%\qs_1332133ad0\genieo.vi.zip
- %TEMP%\qs_1332133ad0\slowpcfighter.vi.zip
- %TEMP%\qs_1332133ad0\arcadeparlor.vi.zip
- %TEMP%\qs_1332133ad0\ping.response.json
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\nlfowi84\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\q3cg8mea\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\kvl6mgbq\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\h57jetjt\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
Deletes the following files
- %LOCALAPPDATA%low\cookie.ini
- %TEMP%\ccdc81f.tmp
- %TEMP%\ccdc81f.tmp-shm
- %TEMP%\ccdc81f.tmp-wal
- %TEMP%\ccdc8ea.tmp
- %LOCALAPPDATA%low\cookieman.exe
Network activity
Connects to
- '1-####taller.com':80
TCP
HTTP POST requests
- http://1-####taller.com/api/productsession
UDP
- DNS ASK 1-####taller.com
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%low\cookieman.exe' /mode=read 1-vinstaller.com
