Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\IMAP List Mailboxes 64] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\IMAP List Mailboxes 64] 'ImagePath' = '%ALLUSERSPROFILE%\IMAP List Mailboxes 64\IMAP List Mailboxes 64.exe'
Creates the following services
- 'IMAP List Mailboxes 64' %ALLUSERSPROFILE%\IMAP List Mailboxes 64\IMAP List Mailboxes 64.exe
Modifies file system
Creates the following files
- %TEMP%\is-ih1qm.tmp\<File name>.tmp
- %ALLUSERSPROFILE%\ts64.dat
- %ALLUSERSPROFILE%\imap list mailboxes 64\imap list mailboxes 64.exe
- %LOCALAPPDATA%\any burn free\anyburnfree.exe
- %LOCALAPPDATA%\any burn free\unins000.dat
- %LOCALAPPDATA%\any burn free\is-9a94h.tmp
- %LOCALAPPDATA%\any burn free\languages\is-ccrm5.tmp
- %LOCALAPPDATA%\any burn free\is-6hgkh.tmp
- %LOCALAPPDATA%\any burn free\is-3k619.tmp
- %LOCALAPPDATA%\any burn free\is-nd1tf.tmp
- %LOCALAPPDATA%\any burn free\is-ge46v.tmp
- %LOCALAPPDATA%\any burn free\is-jcqnn.tmp
- %LOCALAPPDATA%\any burn free\is-63dig.tmp
- %ALLUSERSPROFILE%\resource-a.dat
- %LOCALAPPDATA%\any burn free\is-4m8bt.tmp
- %LOCALAPPDATA%\any burn free\is-mart0.tmp
- %LOCALAPPDATA%\any burn free\is-r1aqi.tmp
- %LOCALAPPDATA%\any burn free\is-8qb24.tmp
- %LOCALAPPDATA%\any burn free\is-bl7ls.tmp
- %LOCALAPPDATA%\any burn free\is-tnhgm.tmp
- %LOCALAPPDATA%\any burn free\is-6bl8m.tmp
- %LOCALAPPDATA%\any burn free\is-cp6mb.tmp
- %LOCALAPPDATA%\any burn free\is-tc82h.tmp
- %TEMP%\is-j7s31.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-j7s31.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-j7s31.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-j7s31.tmp\_isetup\_setup64.tmp
- %LOCALAPPDATA%\any burn free\is-ubkie.tmp
- %ALLUSERSPROFILE%\resource-b.dat
Deletes the following files
- %LOCALAPPDATA%\any burn free\libgcc_s_dw2-1.dll
Moves the following files
- from %LOCALAPPDATA%\any burn free\is-tc82h.tmp to %LOCALAPPDATA%\any burn free\unins000.exe
- from %LOCALAPPDATA%\any burn free\is-6hgkh.tmp to %LOCALAPPDATA%\any burn free\setting.ini
- from %LOCALAPPDATA%\any burn free\is-3k619.tmp to %LOCALAPPDATA%\any burn free\sdl2.dll
- from %LOCALAPPDATA%\any burn free\is-nd1tf.tmp to %LOCALAPPDATA%\any burn free\swresample-3.dll
- from %LOCALAPPDATA%\any burn free\is-ge46v.tmp to %LOCALAPPDATA%\any burn free\zlib1.dll
- from %LOCALAPPDATA%\any burn free\is-jcqnn.tmp to %LOCALAPPDATA%\any burn free\libbz2-1.dll
- from %LOCALAPPDATA%\any burn free\is-63dig.tmp to %LOCALAPPDATA%\any burn free\libwinpthread-1.dll
- from %LOCALAPPDATA%\any burn free\languages\is-ccrm5.tmp to %LOCALAPPDATA%\any burn free\languages\turkish.ini
- from %LOCALAPPDATA%\any burn free\is-4m8bt.tmp to %LOCALAPPDATA%\any burn free\libvorbisenc-2.dll
- from %LOCALAPPDATA%\any burn free\is-mart0.tmp to %LOCALAPPDATA%\any burn free\libogg-0.dll
- from %LOCALAPPDATA%\any burn free\is-r1aqi.tmp to %LOCALAPPDATA%\any burn free\libiconv-2.dll
- from %LOCALAPPDATA%\any burn free\is-bl7ls.tmp to %LOCALAPPDATA%\any burn free\avutil-56.dll
- from %LOCALAPPDATA%\any burn free\is-tnhgm.tmp to %LOCALAPPDATA%\any burn free\libgcc_s_dw2-1.dll
- from %LOCALAPPDATA%\any burn free\is-6bl8m.tmp to %LOCALAPPDATA%\any burn free\avformat-58.dll
- from %LOCALAPPDATA%\any burn free\is-cp6mb.tmp to %LOCALAPPDATA%\any burn free\avcodec-58.dll
- from %LOCALAPPDATA%\any burn free\is-ubkie.tmp to %LOCALAPPDATA%\any burn free\libvorbis-0.dll
- from %LOCALAPPDATA%\any burn free\is-9a94h.tmp to %LOCALAPPDATA%\any burn free\anyburnfree.exe
Substitutes the following files
- %LOCALAPPDATA%\any burn free\libgcc_s_dw2-1.dll
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'z6c799_SA283FlashFixClass_z6c799'
Creates and executes the following
- '%TEMP%\is-ih1qm.tmp\<File name>.tmp' /SL5="$90256,8085261,54272,<Full path to file>"
- '%LOCALAPPDATA%\any burn free\anyburnfree.exe' -i
- '%LOCALAPPDATA%\any burn free\anyburnfree.exe' -s
