Technical Information
Malicious functions:
Executes the following:
- '%TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\CopyOEM.exe' 1 %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\rtusbstor.inf
- '%TEMP%\7zS80B757F1\setup.exe' -deleter
- '%TEMP%\7zS80B757F1\setup.exe'
Modifies file system:
Creates the following files:
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\core62f6.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Font6334.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\DIFx6363.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Driv5e52.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Chec622b.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\upda6269.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\_IsR644e.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\difx64cb.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Stri6392.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\isrt63c1.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\defa641f.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setup.ibt
- %WINDIR%\system\cf9ef5.rra
- %WINDIR%\system\ms9f14.rra
- %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setu9e59.rra
- %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setup.ini
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\system\MyMu9fb1.rra
- %WINDIR%\system\Driv9fd0.rra
- %ALLUSERSPROFILE%\Start Menu\Programs\Realtek USB 2.0 Card Reader Software\Uninstall Realtek USB 2.0 Card Reader Software.lnk
- %WINDIR%\system\sd9f34.rra
- %WINDIR%\system\sm9f63.rra
- <DRIVERS>\RTST9f82.rra
- %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\layo9c75.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\data9ca3.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setu9ddc.rra
- %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setu9e0b.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\data9cc3.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Copy5db6.rra
- %TEMP%\7zS80B757F1\RTSTOR64.sys
- %TEMP%\7zS80B757F1\setup.exe
- %TEMP%\iss1.tmp\setup.ini
- %TEMP%\7zS80B757F1\setup.iss
- %TEMP%\7zS80B757F1\DriveIcon.dll
- %TEMP%\7zS80B757F1\RTSTOR.sys
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\0192c2ccdbdd9111c66a13f82b433711_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %TEMP%\igd6.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\isp5.tmp\temp.000
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\set3.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\isp2.tmp\temp.000
- %APPDATA%\Microsoft\Protect\CREDHIST
- %TEMP%\7zS80B757F1\engine32.cab
- %TEMP%\7zS80B757F1\layout.bin
- %TEMP%\7zS80B757F1\rtcrdriver.cat
- %TEMP%\7zS80B757F1\data1.cab
- %TEMP%\7zS80B757F1\data1.hdr
- %TEMP%\7zS80B757F1\data2.cab
- %TEMP%\7zS80B757F1\setup.ibt
- %TEMP%\7zS80B757F1\setup.ini
- %TEMP%\7zS80B757F1\setup.inx
- %TEMP%\7zS80B757F1\rtcrdriver64.cat
- %TEMP%\7zS80B757F1\rtusbstor.inf
- %TEMP%\7zS80B757F1\rtusbstor64.inf
- %TEMP%\_se7.tmp
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\RTST5b16.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\RTST5b64.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\rtcr5ba3.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\lice5a4b.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\devc5a7a.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\rtus5ad8.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\rtus5ceb.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\rtcr5d29.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\upda5d58.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Copy5be1.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\devc5c4f.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Chec5c9d.rra
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\ctoA.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\iscB.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\iusC.tmp
- %TEMP%\isp4.tmp\temp.000
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\iKe8.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\Dot9.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\ObjE.tmp
- %TEMP%\5431.rra
- %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\setu59ce.rra
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsPD.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsProBE.tlb
- %CommonProgramFiles%\InstallShield\Professional\RunTime\iKernel.rgs
Deletes the following files:
- %TEMP%\_se7.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsPD.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\set3.tmp
- %TEMP%\igd6.tmp
Moves the following files:
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\defa641f.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\default.pal
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\isrt63c1.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\isrt.dll
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Stri6392.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\StringTable-0009-English.ips
- from %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\layo9c75.rra to %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\layout.bin
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\difx64cb.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\difxapi.dll
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\_IsR644e.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\_IsRes.dll
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\upda6269.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\update64.exe
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Chec622b.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\CheckStatus64.exe
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Driv5e52.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\DriveIcon.dll
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\DIFx6363.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\DIFxData.ini
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Font6334.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\FontData.ini
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\core62f6.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\corecomp.ini
- from %WINDIR%\system\sm9f63.rra to %WINDIR%\system\sm.ico
- from %WINDIR%\system\sd9f34.rra to %WINDIR%\system\sd.ico
- from %WINDIR%\system\ms9f14.rra to %WINDIR%\system\ms.ico
- from %WINDIR%\system\Driv9fd0.rra to %WINDIR%\system\DriveIcon.dll
- from %WINDIR%\system\MyMu9fb1.rra to %WINDIR%\system\MyMulti.ico
- from <DRIVERS>\RTST9f82.rra to <DRIVERS>\RTSTOR.sys
- from %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setu9ddc.rra to %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setup.exe
- from %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\data9cc3.rra to %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\data1.cab
- from %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\data9ca3.rra to %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\data1.hdr
- from %WINDIR%\system\cf9ef5.rra to %WINDIR%\system\cf.ico
- from %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setu9e59.rra to %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setup.ini
- from %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setu9e0b.rra to %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setup.inx
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Copy5db6.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\CopyOEM.exe
- from %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\iscB.tmp to %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\iscript.dll
- from %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\ctoA.tmp to %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\ctor.dll
- from %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\Dot9.tmp to %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\DotNetInstaller.exe
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\setu59ce.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\setup.inx
- from %CommonProgramFiles%\InstallShield\Professional\RunTime\ObjE.tmp to %CommonProgramFiles%\InstallShield\Professional\RunTime\Objectps.dll
- from %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\iusC.tmp to %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\iuser.dll
- from %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\isp5.tmp\temp.000 to %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\isp5.tmp\IGdi.dll
- from %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\isp2.tmp\setup.dll to %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\setup.dll
- from %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\isp2.tmp\temp.000 to %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\isp2.tmp\setup.dll
- from %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\iKe8.tmp to %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\iKernel.dll
- from %TEMP%\isp4.tmp\temp.000 to %TEMP%\isp4.tmp\_Setup.dll
- from %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\isp5.tmp\IGdi.dll to %CommonProgramFiles%\InstallShield\Professional\RunTime\11\50\Intel32\iGdi.dll
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Chec5c9d.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\CheckStatus.exe
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\devc5c4f.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\devcon.exe
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Copy5be1.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\CopyOEM64.exe
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\upda5d58.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\update.exe
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\rtcr5d29.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\rtcrdriver.cat
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\rtus5ceb.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\rtusbstor64.inf
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\rtus5ad8.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\rtusbstor.inf
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\devc5a7a.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\devcon64.exe
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\lice5a4b.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\license.txt
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\rtcr5ba3.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\rtcrdriver64.cat
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\RTST5b64.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\RTSTOR64.sys
- from %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\RTST5b16.rra to %TEMP%\{D44C3423-5841-49AF-94ED-50509D4FBE9B}\{DC24971E-1946-445D-8A82-CE685433FA7D}\RTSTOR.sys
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
