Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\IMAP List Mailboxes 65] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\IMAP List Mailboxes 65] 'ImagePath' = '%ALLUSERSPROFILE%\IMAP List Mailboxes 65\IMAP List Mailboxes 65.exe'
Creates the following services
- 'IMAP List Mailboxes 65' %ALLUSERSPROFILE%\IMAP List Mailboxes 65\IMAP List Mailboxes 65.exe
Modifies file system
Creates the following files
- %TEMP%\is-8es4u.tmp\<File name>.tmp
- %ALLUSERSPROFILE%\ts65.dat
- %ALLUSERSPROFILE%\imap list mailboxes 65\imap list mailboxes 65.exe
- %LOCALAPPDATA%\array bisection algorithm\arraybisect.exe
- %LOCALAPPDATA%\array bisection algorithm\unins000.dat
- %LOCALAPPDATA%\array bisection algorithm\is-s1qt3.tmp
- %LOCALAPPDATA%\array bisection algorithm\languages\is-u4uf6.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-26iur.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-jkt87.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-sm5bb.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-pn05r.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-2a54p.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-nqu21.tmp
- %ALLUSERSPROFILE%\resource-a.dat
- %LOCALAPPDATA%\array bisection algorithm\is-hr13h.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-sbvg7.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-9hv6g.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-e3idq.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-mnoh4.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-3voje.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-lg3iu.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-2sumg.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-a17g8.tmp
- %TEMP%\is-6ol4l.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-6ol4l.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-6ol4l.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-6ol4l.tmp\_isetup\_setup64.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-sub82.tmp
- %ALLUSERSPROFILE%\resource-b.dat
Deletes the following files
- %LOCALAPPDATA%\array bisection algorithm\libgcc_s_dw2-1.dll
Moves the following files
- from %LOCALAPPDATA%\array bisection algorithm\is-a17g8.tmp to %LOCALAPPDATA%\array bisection algorithm\unins000.exe
- from %LOCALAPPDATA%\array bisection algorithm\is-26iur.tmp to %LOCALAPPDATA%\array bisection algorithm\setting.ini
- from %LOCALAPPDATA%\array bisection algorithm\is-jkt87.tmp to %LOCALAPPDATA%\array bisection algorithm\sdl2.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-sm5bb.tmp to %LOCALAPPDATA%\array bisection algorithm\swresample-3.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-pn05r.tmp to %LOCALAPPDATA%\array bisection algorithm\zlib1.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-2a54p.tmp to %LOCALAPPDATA%\array bisection algorithm\libbz2-1.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-nqu21.tmp to %LOCALAPPDATA%\array bisection algorithm\libwinpthread-1.dll
- from %LOCALAPPDATA%\array bisection algorithm\languages\is-u4uf6.tmp to %LOCALAPPDATA%\array bisection algorithm\languages\turkish.ini
- from %LOCALAPPDATA%\array bisection algorithm\is-hr13h.tmp to %LOCALAPPDATA%\array bisection algorithm\libvorbisenc-2.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-sbvg7.tmp to %LOCALAPPDATA%\array bisection algorithm\libogg-0.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-9hv6g.tmp to %LOCALAPPDATA%\array bisection algorithm\libiconv-2.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-mnoh4.tmp to %LOCALAPPDATA%\array bisection algorithm\avutil-56.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-3voje.tmp to %LOCALAPPDATA%\array bisection algorithm\libgcc_s_dw2-1.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-lg3iu.tmp to %LOCALAPPDATA%\array bisection algorithm\avformat-58.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-2sumg.tmp to %LOCALAPPDATA%\array bisection algorithm\avcodec-58.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-sub82.tmp to %LOCALAPPDATA%\array bisection algorithm\libvorbis-0.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-s1qt3.tmp to %LOCALAPPDATA%\array bisection algorithm\arraybisect.exe
Substitutes the following files
- %LOCALAPPDATA%\array bisection algorithm\libgcc_s_dw2-1.dll
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Pe93e9_ABSA281FlashFixClass_Pe93e9'
Creates and executes the following
- '%TEMP%\is-8es4u.tmp\<File name>.tmp' /SL5="$50252,7239579,54272,<Full path to file>"
- '%LOCALAPPDATA%\array bisection algorithm\arraybisect.exe' -i
- '%LOCALAPPDATA%\array bisection algorithm\arraybisect.exe' -s
