Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\DeliveryStatusFields_61] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\DeliveryStatusFields_61] 'ImagePath' = '%ALLUSERSPROFILE%\DeliveryStatusFields_61\DeliveryStatusFields_61.exe'
Creates the following services
- 'DeliveryStatusFields_61' %ALLUSERSPROFILE%\DeliveryStatusFields_61\DeliveryStatusFields_61.exe
Modifies file system
Creates the following files
- %TEMP%\is-lrgdg.tmp\<File name>.tmp
- %LOCALAPPDATA%\deliverystatusfields\unins000.dat
- %LOCALAPPDATA%\deliverystatusfields\is-3k4bi.tmp
- %LOCALAPPDATA%\deliverystatusfields\languages\is-cb4eu.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-jjcve.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-pe5qd.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-2329l.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-obu9h.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-7s9a5.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-98p2o.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-rds2a.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-95acm.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-m6r6j.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-k4vo7.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-hgu0q.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-pqsqi.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-3951v.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-econ3.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-8pj4c.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-acfpg.tmp
- %TEMP%\is-lkgti.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-lkgti.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-lkgti.tmp\_isetup\_setup64.tmp
- %TEMP%\is-lkgti.tmp\_isetup\_regdll.tmp
- %LOCALAPPDATA%\deliverystatusfields\deliverystatusfields.exe
- %ALLUSERSPROFILE%\deliverystatusfields_61\deliverystatusfields_61.exe
Deletes the following files
- %LOCALAPPDATA%\deliverystatusfields\libgcc_s_dw2-1.dll
Moves the following files
- from %LOCALAPPDATA%\deliverystatusfields\is-acfpg.tmp to %LOCALAPPDATA%\deliverystatusfields\unins000.exe
- from %LOCALAPPDATA%\deliverystatusfields\is-jjcve.tmp to %LOCALAPPDATA%\deliverystatusfields\setting.ini
- from %LOCALAPPDATA%\deliverystatusfields\is-pe5qd.tmp to %LOCALAPPDATA%\deliverystatusfields\sdl2.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-2329l.tmp to %LOCALAPPDATA%\deliverystatusfields\swresample-3.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-obu9h.tmp to %LOCALAPPDATA%\deliverystatusfields\zlib1.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-7s9a5.tmp to %LOCALAPPDATA%\deliverystatusfields\libbz2-1.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-98p2o.tmp to %LOCALAPPDATA%\deliverystatusfields\libwinpthread-1.dll
- from %LOCALAPPDATA%\deliverystatusfields\languages\is-cb4eu.tmp to %LOCALAPPDATA%\deliverystatusfields\languages\turkish.ini
- from %LOCALAPPDATA%\deliverystatusfields\is-rds2a.tmp to %LOCALAPPDATA%\deliverystatusfields\libvorbisenc-2.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-m6r6j.tmp to %LOCALAPPDATA%\deliverystatusfields\libogg-0.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-k4vo7.tmp to %LOCALAPPDATA%\deliverystatusfields\libiconv-2.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-pqsqi.tmp to %LOCALAPPDATA%\deliverystatusfields\avutil-56.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-3951v.tmp to %LOCALAPPDATA%\deliverystatusfields\libgcc_s_dw2-1.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-econ3.tmp to %LOCALAPPDATA%\deliverystatusfields\avformat-58.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-8pj4c.tmp to %LOCALAPPDATA%\deliverystatusfields\avcodec-58.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-95acm.tmp to %LOCALAPPDATA%\deliverystatusfields\libvorbis-0.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-3k4bi.tmp to %LOCALAPPDATA%\deliverystatusfields\deliverystatusfields.exe
Substitutes the following files
- %LOCALAPPDATA%\deliverystatusfields\libgcc_s_dw2-1.dll
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'z3cd99_DSF1302FlashFixClass_z3cd99'
Creates and executes the following
- '%TEMP%\is-lrgdg.tmp\<File name>.tmp' /SL5="$50236,6332234,54272,<Full path to file>"
- '%LOCALAPPDATA%\deliverystatusfields\deliverystatusfields.exe' -i
- '%LOCALAPPDATA%\deliverystatusfields\deliverystatusfields.exe' -s
