Trojan.MulDrop8.32927

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\RSUSBSTOR] 'ImagePath' = 'System32\Drivers\RTS5121.sys'
[<HKLM>\SYSTEM\ControlSet001\Services\RSUSBSTOR] 'Start' = '00000001'

Modifies file system:

Creates the following files:

%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Arabic.ini
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\difx82a3.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\isrt81d8.rra
%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Stri81a9.rra
%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\DIFx817a.rra
%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Font815b.rra
%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\dotn812c.rra
%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\core80fd.rra
%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Chec80af.rra
%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Copy8051.rra
%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\upda7fe4.rra
%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\upda7f96.rra
%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Chec7f57.rra
%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\devc7f19.rra
%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\_IsR8265.rra
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Russian.ini
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
%WINDIR%\system\MyMub154.rra
%ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\rts5b125.rra
%ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\RTS5b0e7.rra
%ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\Copyb0b8.rra
<SYSTEM32>\rts5aee3.rra
%ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\rts5ab49.rra
<SYSTEM32>\Rts5ab0b.rra
%ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\Rts5aadc.rra
<DRIVERS>\RTS5aaad.rra
%ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\RTS5aa7e.rra
%ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setup.ini
%ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setuaa21.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setua9f2.rra
%ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\ISSea9a4.rra
%ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\_Seta955.rra
%ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setua8f8.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
%ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\dataa790.rra
%ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\dataa771.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
%ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\layoa761.rra
%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\devc7eda.rra
%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\defa8226.rra
%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Copy7e7d.rra
%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\lice7e4e.rra
%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\setu7df0.rra
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\English.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Norwegian_.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Norwegian.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\layout.bin
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Korean.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Japanese.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Italian.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Hungarian.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Greek.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\German.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\French.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Finnish_.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Finnish.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Dutch.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Polish_.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\DriverBin_64bit\RTS5121.inf
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\DriverBin_64bit\rts5121.cat
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\DriverBin_32bit\RTS5121.inf
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\DriverBin_32bit\rts5121.cat
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\data2.cab
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\data1.hdr
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\data1.cab
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Danish_.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Danish.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Czech.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Brazil.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\AsusSetup.ini
%WINDIR%\inf\oem3.inf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Portuguese.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\setup.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Polish.ini
%TEMP%\7cd7.rra
%TEMP%\{6429760D-2D5F-4890-A1B8-6EF010ECF244}\_Setup.dll
%TEMP%\{6429760D-2D5F-4890-A1B8-6EF010ECF244}\setup.ini
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\4e628d3b377c25404b1958415f603fb5_23ef5514-3059-436f-a4a7-4cefaab20eb1
%APPDATA%\Microsoft\Protect\CREDHIST
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\_Setup.dll
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\setup.exe
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\ISSetup.dll
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\DriverBin_64bit\rts5121icon.dll
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\DriverBin_64bit\RTS5121.sys
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\DriverBin_64bit\Rts5121.dll
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\DriverBin_64bit\revcon.exe
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\DriverBin_32bit\rts5121icon.dll
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\DriverBin_32bit\RTS5121.sys
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\DriverBin_32bit\Rts5121.dll
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\DriverBin_32bit\revcon.exe
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\AsusSetup.exe
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Turkish.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Thai.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\TChinese.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Swedish_.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Swedish.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Spanish.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\Slovak.ini
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\setup.iss
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\setup.inx
%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\SChinese.ini
%WINDIR%\inf\oem3.PNF

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT

Moves the following files:

from %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\setu7df0.rra to %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\setup.inx
from %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setua8f8.rra to %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setup.exe
from %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\_Seta955.rra to %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\_Setup.dll
from %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\ISSea9a4.rra to %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\ISSetup.dll
from %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setua9f2.rra to %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setup.inx
from %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setuaa21.rra to %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setup.ini
from <DRIVERS>\RTS5aaad.rra to <DRIVERS>\RTS5121.sys
from %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Chec80af.rra to %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\CheckStatus64.exe
from <SYSTEM32>\Rts5ab0b.rra to <SYSTEM32>\Rts5121.dll
from <SYSTEM32>\rts5aee3.rra to <SYSTEM32>\rts5121icon.dll
from %ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\Copyb0b8.rra to %ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\CopyOEM.exe
from %ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\RTS5b0e7.rra to %ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\RTS5121.inf
from %ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\RTS5aa7e.rra to %ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\RTS5121.sys
from %ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\Rts5aadc.rra to %ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\Rts5121.dll
from %ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\rts5b125.rra to %ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\rts5121.cat
from %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\dataa771.rra to %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\data1.hdr
from %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\dataa790.rra to %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\data1.cab
from %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\layoa761.rra to %ProgramFiles%\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\layout.bin
from %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\difx82a3.rra to %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\difxapi.dll
from %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\_IsR8265.rra to %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\_IsRes.dll
from %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Copy7e7d.rra to %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\CopyOEM.exe
from %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\devc7eda.rra to %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\devcon64.exe
from %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\devc7f19.rra to %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\devcon.exe
from %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Chec7f57.rra to %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\CheckStatus.exe
from %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\upda7f96.rra to %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\update.exe
from %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\upda7fe4.rra to %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\update64.exe
from %ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\rts5ab3a.rra to %ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\rts5121icon.dll
from %ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\rts5ab49.rra to %ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\rts5ab3a.rra
from %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Copy8051.rra to %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\CopyOEM64.exe
from %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\dotn812c.rra to %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\dotnetinstaller.exe
from %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Font815b.rra to %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\FontData.ini
from %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\DIFx817a.rra to %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\DIFxData.ini
from %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\Stri81a9.rra to %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\StringTable-0009-English.ips
from %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\isrt81d8.rra to %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\isrt.dll
from %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\defa8226.rra to %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\default.pal
from %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\lice7e4e.rra to %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\license.txt
from %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\core80fd.rra to %TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\corecomp.ini
from %WINDIR%\system\MyMub154.rra to %WINDIR%\system\MyMulti.ico

Miscellaneous:

Creates and executes the following:

'%TEMP%\7zS85BF3D02\Realtek_V60600072_XP\setup.exe'
'%ProgramFiles%\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\CopyOEM.exe' 1 %ProgramFiles%\
'%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\update.exe' USB\VID_0BDA&PID_0111 %WINDIR%\INF\oem3.inf Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader
'%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\devcon.exe' remove USB\VID_0BDA&PID_0111
'%TEMP%\{42765336-2D0D-4C84-8E04-E75ED4452D17}\{DC24971E-1946-445D-8A82-CE685433FA7D}\update.exe' USB\VID_0BDA&PID_0113 %WINDIR%\INF\oem3.inf Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней