Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\ObjectSerialization66] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\ObjectSerialization66] 'ImagePath' = '%ALLUSERSPROFILE%\ObjectSerialization66\ObjectSerialization66.exe'
Creates the following services
- 'ObjectSerialization66' %ALLUSERSPROFILE%\ObjectSerialization66\ObjectSerialization66.exe
Modifies file system
Creates the following files
- %TEMP%\is-vful5.tmp\<File name>.tmp
- %LOCALAPPDATA%\array bisection algorithm\unins000.dat
- %LOCALAPPDATA%\array bisection algorithm\is-192ea.tmp
- %LOCALAPPDATA%\array bisection algorithm\languages\is-gir1v.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-3lhjo.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-jihkv.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-ffvpr.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-rnpk3.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-83tuc.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-ierog.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-os76c.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-bp19j.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-ju203.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-26dn1.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-unbl2.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-ga12n.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-4lic3.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-fimqr.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-n71r7.tmp
- %LOCALAPPDATA%\array bisection algorithm\is-csl3o.tmp
- %TEMP%\is-gu69n.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-gu69n.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-gu69n.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-gu69n.tmp\_isetup\_setup64.tmp
- %LOCALAPPDATA%\array bisection algorithm\arraybisect.exe
- %ALLUSERSPROFILE%\objectserialization66\objectserialization66.exe
Deletes the following files
- %LOCALAPPDATA%\array bisection algorithm\libgcc_s_dw2-1.dll
Moves the following files
- from %LOCALAPPDATA%\array bisection algorithm\is-csl3o.tmp to %LOCALAPPDATA%\array bisection algorithm\unins000.exe
- from %LOCALAPPDATA%\array bisection algorithm\is-3lhjo.tmp to %LOCALAPPDATA%\array bisection algorithm\setting.ini
- from %LOCALAPPDATA%\array bisection algorithm\is-jihkv.tmp to %LOCALAPPDATA%\array bisection algorithm\sdl2.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-ffvpr.tmp to %LOCALAPPDATA%\array bisection algorithm\swresample-3.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-rnpk3.tmp to %LOCALAPPDATA%\array bisection algorithm\zlib1.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-83tuc.tmp to %LOCALAPPDATA%\array bisection algorithm\libbz2-1.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-ierog.tmp to %LOCALAPPDATA%\array bisection algorithm\libwinpthread-1.dll
- from %LOCALAPPDATA%\array bisection algorithm\languages\is-gir1v.tmp to %LOCALAPPDATA%\array bisection algorithm\languages\turkish.ini
- from %LOCALAPPDATA%\array bisection algorithm\is-os76c.tmp to %LOCALAPPDATA%\array bisection algorithm\libvorbisenc-2.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-ju203.tmp to %LOCALAPPDATA%\array bisection algorithm\libogg-0.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-26dn1.tmp to %LOCALAPPDATA%\array bisection algorithm\libiconv-2.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-ga12n.tmp to %LOCALAPPDATA%\array bisection algorithm\avutil-56.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-4lic3.tmp to %LOCALAPPDATA%\array bisection algorithm\libgcc_s_dw2-1.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-fimqr.tmp to %LOCALAPPDATA%\array bisection algorithm\avformat-58.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-n71r7.tmp to %LOCALAPPDATA%\array bisection algorithm\avcodec-58.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-bp19j.tmp to %LOCALAPPDATA%\array bisection algorithm\libvorbis-0.dll
- from %LOCALAPPDATA%\array bisection algorithm\is-192ea.tmp to %LOCALAPPDATA%\array bisection algorithm\arraybisect.exe
Substitutes the following files
- %LOCALAPPDATA%\array bisection algorithm\libgcc_s_dw2-1.dll
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'fc8585_ABSA281FlashFixClass_fc8585'
Creates and executes the following
- '%TEMP%\is-vful5.tmp\<File name>.tmp' /SL5="$C017A,7127779,54272,<Full path to file>"
- '%LOCALAPPDATA%\array bisection algorithm\arraybisect.exe' -i
- '%LOCALAPPDATA%\array bisection algorithm\arraybisect.exe' -s
