Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\USpaceRaces] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\USpaceRaces] 'ImagePath' = '%ALLUSERSPROFILE%\USpaceRaces\USpaceRaces.exe'
Creates the following services
- 'USpaceRaces' %ALLUSERSPROFILE%\USpaceRaces\USpaceRaces.exe
Modifies file system
Creates the following files
- %TEMP%\is-qpg3c.tmp\<File name>.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-k1dnd.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-klqi8.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-1rull.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-b0ep0.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-eeh4t.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-ddu8m.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-qoe4r.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-51cvt.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-0asef.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-0orrg.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-l3rhv.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-1hfcj.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-4p54r.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-8cmuf.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-4ogvq.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-sf0cp.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-rmncr.tmp
- %ProgramFiles(x86)%\mdeliverylib\uninstall\unins000.dat
- %ProgramFiles(x86)%\mdeliverylib\is-gh02o.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-9li9n.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-p2t7v.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-8bel2.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-66i9n.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\plugins\internal\is-682in.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\plugins\internal\is-bmu8g.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-6uucj.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-tl7nr.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-j4rv4.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-aumi8.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\lessmsi\is-0ke54.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-0p49b.tmp
- %ProgramFiles(x86)%\mdeliverylib\mdeliverylib.exe
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-4r8e3.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-ev2lm.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-3f08e.tmp
- %TEMP%\is-nsi2q.tmp\_isetup\_regdll.tmp
- %TEMP%\is-nsi2q.tmp\_isetup\_setup64.tmp
- %TEMP%\is-nsi2q.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-nsi2q.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-nsi2q.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\mdeliverylib\uninstall\is-34egg.tmp
- %ProgramFiles(x86)%\mdeliverylib\stuff\is-9l178.tmp
- %ProgramFiles(x86)%\mdeliverylib\stuff\is-cftk6.tmp
- %ProgramFiles(x86)%\mdeliverylib\stuff\is-k1dt4.tmp
- %ProgramFiles(x86)%\mdeliverylib\stuff\is-70ij2.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-ojif1.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-8t424.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-1gv5r.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-bkudj.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-a9ouj.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-c8t6t.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-8iogl.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-8utpf.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-81pa5.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-20jvh.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-jrlhl.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-qfkpb.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-k4lcb.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-imgrt.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-pnhfp.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-lg7g0.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-rn79f.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-ksdld.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-lo878.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-sam3l.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-sj72p.tmp
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-37d98.tmp
- %ALLUSERSPROFILE%\uspaceraces\uspaceraces.exe
Deletes the following files
- %ProgramFiles(x86)%\mdeliverylib\stuff\date.txt
- %ProgramFiles(x86)%\mdeliverylib\stuff\tagsreplace.txt
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\tak_deco_lib.dll
Moves the following files
- from %ProgramFiles(x86)%\mdeliverylib\uninstall\is-34egg.tmp to %ProgramFiles(x86)%\mdeliverylib\uninstall\unins000.exe
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-1rull.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\rg_ebur128.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-b0ep0.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\wavpackdll.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-eeh4t.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\libsoxr.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-ddu8m.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\libsox-3.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-qoe4r.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\uchardet.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-51cvt.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\utils.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-0asef.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\libdtsdec.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-0orrg.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\dsd2.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-l3rhv.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\libvorbis.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-1hfcj.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\sqlite3.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-4p54r.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\lame_enc.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-8cmuf.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\da.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-4ogvq.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\daiso.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-sf0cp.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\dstt.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-rmncr.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\dsd2pcmt.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-0p49b.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\pcm2dsd.exe
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\lessmsi\is-0ke54.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\lessmsi\lessmsi-v1.6.91.zip
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-aumi8.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\d_writer.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-j4rv4.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\libwebp.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-tl7nr.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\libwinpthread-1.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-6uucj.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\sd.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\plugins\internal\is-682in.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\plugins\internal\peak_scanner_plugin_c.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\plugins\internal\is-bmu8g.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\plugins\internal\raw_decode_plugin_c.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-66i9n.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\copying
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-8bel2.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\7z.exe
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-klqi8.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\mp3gain.exe
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-p2t7v.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\takdec.exe
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-k1dnd.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\optimfrog.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-ev2lm.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\opusenc.exe
- from %ProgramFiles(x86)%\mdeliverylib\stuff\is-9l178.tmp to %ProgramFiles(x86)%\mdeliverylib\stuff\date.txt
- from %ProgramFiles(x86)%\mdeliverylib\stuff\is-cftk6.tmp to %ProgramFiles(x86)%\mdeliverylib\stuff\tagsreplace.txt
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-ojif1.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\tak_deco_lib.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-8t424.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\avutil-58.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-1gv5r.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\avfilter-9.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-bkudj.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\swresample-4.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-a9ouj.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\bass.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-c8t6t.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\bass_aac.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-8iogl.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\bassalac.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-sj72p.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\bassape.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-sam3l.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\bassdsd.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-lo878.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\basscd.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-ksdld.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\bassflac.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-rn79f.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\bassmix.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-lg7g0.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\bassopus.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-imgrt.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\basswma.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-pnhfp.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\basswv.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-k4lcb.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\bass_fx.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-qfkpb.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\bassmidi.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-jrlhl.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\bass_tta.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-20jvh.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\copying.lgplv2.1
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-81pa5.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\ff_helper.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-8utpf.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\gain_analysis.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-37d98.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\libflac_dynamic.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-3f08e.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\libmp4v2.dll
- from %ProgramFiles(x86)%\mdeliverylib\bin\x86\is-4r8e3.tmp to %ProgramFiles(x86)%\mdeliverylib\bin\x86\bass_ofr.dll
- from %ProgramFiles(x86)%\mdeliverylib\is-gh02o.tmp to %ProgramFiles(x86)%\mdeliverylib\mdeliverylib.exe
Substitutes the following files
- %ProgramFiles(x86)%\mdeliverylib\stuff\date.txt
- %ProgramFiles(x86)%\mdeliverylib\stuff\tagsreplace.txt
- %ProgramFiles(x86)%\mdeliverylib\bin\x86\tak_deco_lib.dll
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'f56e05_MDL12083FlashFixClass_f56e05'
Creates and executes the following
- '%TEMP%\is-qpg3c.tmp\<File name>.tmp' /SL5="$A024E,7941725,54272,<Full path to file>"
- '%ProgramFiles(x86)%\mdeliverylib\mdeliverylib.exe' -i
- '%ProgramFiles(x86)%\mdeliverylib\mdeliverylib.exe' -s
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Query
- '%WINDIR%\syswow64\net.exe' helpmsg 8
- '%WINDIR%\syswow64\net1.exe' helpmsg 8
