Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\DeliveryStatusFields_64] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\DeliveryStatusFields_64] 'ImagePath' = '%ALLUSERSPROFILE%\DeliveryStatusFields_64\DeliveryStatusFields_64.exe'
Creates the following services
- 'DeliveryStatusFields_64' %ALLUSERSPROFILE%\DeliveryStatusFields_64\DeliveryStatusFields_64.exe
Modifies file system
Creates the following files
- %TEMP%\is-4dkc4.tmp\<File name>.tmp
- %LOCALAPPDATA%\deliverystatusfields\unins000.dat
- %LOCALAPPDATA%\deliverystatusfields\is-p14o7.tmp
- %LOCALAPPDATA%\deliverystatusfields\languages\is-vs1oa.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-v9e3v.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-71ldo.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-kav6v.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-1is3r.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-9b5m3.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-3s6oc.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-b3aag.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-jhggc.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-p9mbj.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-o8vq3.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-cbd91.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-a9hv2.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-90f4n.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-n1l63.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-94ncr.tmp
- %LOCALAPPDATA%\deliverystatusfields\is-38l57.tmp
- %TEMP%\is-a9c5o.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-a9c5o.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-a9c5o.tmp\_isetup\_setup64.tmp
- %TEMP%\is-a9c5o.tmp\_isetup\_regdll.tmp
- %LOCALAPPDATA%\deliverystatusfields\deliverystatusfields.exe
- %ALLUSERSPROFILE%\deliverystatusfields_64\deliverystatusfields_64.exe
Deletes the following files
- %LOCALAPPDATA%\deliverystatusfields\libgcc_s_dw2-1.dll
Moves the following files
- from %LOCALAPPDATA%\deliverystatusfields\is-38l57.tmp to %LOCALAPPDATA%\deliverystatusfields\unins000.exe
- from %LOCALAPPDATA%\deliverystatusfields\is-v9e3v.tmp to %LOCALAPPDATA%\deliverystatusfields\setting.ini
- from %LOCALAPPDATA%\deliverystatusfields\is-71ldo.tmp to %LOCALAPPDATA%\deliverystatusfields\sdl2.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-kav6v.tmp to %LOCALAPPDATA%\deliverystatusfields\swresample-3.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-1is3r.tmp to %LOCALAPPDATA%\deliverystatusfields\zlib1.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-9b5m3.tmp to %LOCALAPPDATA%\deliverystatusfields\libbz2-1.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-3s6oc.tmp to %LOCALAPPDATA%\deliverystatusfields\libwinpthread-1.dll
- from %LOCALAPPDATA%\deliverystatusfields\languages\is-vs1oa.tmp to %LOCALAPPDATA%\deliverystatusfields\languages\turkish.ini
- from %LOCALAPPDATA%\deliverystatusfields\is-b3aag.tmp to %LOCALAPPDATA%\deliverystatusfields\libvorbisenc-2.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-p9mbj.tmp to %LOCALAPPDATA%\deliverystatusfields\libogg-0.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-o8vq3.tmp to %LOCALAPPDATA%\deliverystatusfields\libiconv-2.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-a9hv2.tmp to %LOCALAPPDATA%\deliverystatusfields\avutil-56.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-90f4n.tmp to %LOCALAPPDATA%\deliverystatusfields\libgcc_s_dw2-1.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-n1l63.tmp to %LOCALAPPDATA%\deliverystatusfields\avformat-58.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-94ncr.tmp to %LOCALAPPDATA%\deliverystatusfields\avcodec-58.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-jhggc.tmp to %LOCALAPPDATA%\deliverystatusfields\libvorbis-0.dll
- from %LOCALAPPDATA%\deliverystatusfields\is-p14o7.tmp to %LOCALAPPDATA%\deliverystatusfields\deliverystatusfields.exe
Substitutes the following files
- %LOCALAPPDATA%\deliverystatusfields\libgcc_s_dw2-1.dll
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'fc2805_DSF1302FlashFixClass_fc2805'
Creates and executes the following
- '%TEMP%\is-4dkc4.tmp\<File name>.tmp' /SL5="$A024E,6149545,54272,<Full path to file>"
- '%LOCALAPPDATA%\deliverystatusfields\deliverystatusfields.exe' -i
- '%LOCALAPPDATA%\deliverystatusfields\deliverystatusfields.exe' -s
