Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\vrvd5] 'Start' = '00000001'
- [<HKLM>\System\CurrentControlSet\Services\vrvd5] 'ImagePath' = 'system32\DRIVERS\vrvd5.sys'
Creates the following services
- 'vrvd5' system32\DRIVERS\vrvd5.sys
Modifies file system
Creates the following files
- <Current directory>\languages\rcu_default.lng
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-convert-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-environment-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-filesystem-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-heap-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-locale-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-math-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-multibyte-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-memory-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-runtime-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-string-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-time-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-utility-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\ucrtbase.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-console-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-datetime-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-debug-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-timezone-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-util-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-sysinfo-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-synch-l1-2-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-synch-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-file-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-file-l1-2-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-file-l2-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-handle-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-heap-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-interlocked-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-libraryloader-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-errorhandling-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-stdio-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-localization-l1-2-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-namedpipe-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-processenvironment-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-processthreads-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-processthreads-l1-1-1.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-profile-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-rtlsupport-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-string-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-errorhandling-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-memory-l1-1-1.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-file-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-file-l1-2-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-file-l2-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-heap-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-locale-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-math-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-multibyte-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-runtime-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-stdio-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-string-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-time-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\ucrtbase.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-debug-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\drvi32.log
- %TEMP%\~rstemp\vrvd5-amd64.cat
- %TEMP%\~rstemp\vrvd5-damd64.dll
- %TEMP%\~rstemp\vrvd5-mamd64.sys
- %TEMP%\~rstemp\vrvd5.inf
- %TEMP%\~rstemp\drvi64.dll
- %TEMP%\~rstemp\drvi64.log.log
- <DRIVERS>\set29fc.tmp
- C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-filesystem-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-processthreads-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-environment-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-processenvironment-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-handle-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-heap-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-interlocked-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-libraryloader-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-localization-l1-2-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-memory-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-memory-l1-1-1.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-namedpipe-l1-1-0.dll
- <SYSTEM32>\set2a3c.tmp
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-util-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-processthreads-l1-1-1.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-profile-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-rtlsupport-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-string-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-synch-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-synch-l1-2-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-sysinfo-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-core-timezone-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-convert-l1-1-0.dll
- C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-utility-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-datetime-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_base\rs_eng_proxy.024
- C:\users\public\documents\rsupport\common\update\grp_base\file014.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file015.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file016.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file017.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file018.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file019.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file020.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file000.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file021.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file023.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file024.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file025.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file026.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file027.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file028.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file029.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file012.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file013.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file011.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file010.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file009.rsz
- <Current directory>\info.ini
- C:\users\public\documents\rsupport\common\update\provs.zip
- C:\users\public\documents\rsupport\common\temp\rsupportupdater\20220610113204\update\zip\dunzip\20220610113240\update.ini
- C:\users\public\documents\rsupport\common\temp\rsupportupdater\20220610113204\update\zip\dunzip\20220610113240\rsup.key
- C:\users\public\documents\rsupport\common\update\rsup.key
- C:\users\public\documents\rsupport\common\update\update.ini
- C:\users\public\documents\rsupport\common\update\rccmodule.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file030.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file022.rsz
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file002.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file003.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file004.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file005.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file006.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file007.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file008.rsz
- C:\users\public\documents\rsupport\common\rclog\updater\updater_20220610113205.log
- C:\users\public\documents\rsupport\common\update\grp_base\file001.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file031.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file032.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file033.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\rch_eng.016
- C:\users\public\documents\rsupport\common\update\grp_base\rch_jpn.017
- C:\users\public\documents\rsupport\common\update\grp_base\rch_chi_sim.018
- C:\users\public\documents\rsupport\common\update\grp_base\rch_chi_tra.019
- C:\users\public\documents\rsupport\common\update\grp_base\rch_fre.020
- C:\users\public\documents\rsupport\common\update\grp_base\rch_por.021
- C:\users\public\documents\rsupport\common\update\grp_base\rch_spa.022
- C:\users\public\documents\rsupport\common\update\grp_base\rs_kor_proxy.023
- C:\users\public\documents\rsupport\common\update\grp_base\rs_jpn_proxy.025
- C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-console-l1-1-0.dll
- C:\users\public\documents\rsupport\common\update\grp_base\rs_chi_sim_proxy.026
- C:\users\public\documents\rsupport\common\update\grp_base\rs_chi_tra_proxy.027
- C:\users\public\documents\rsupport\common\update\grp_base\rs_fre_proxy.028
- C:\users\public\documents\rsupport\common\update\grp_base\rs_por_proxy.029
- C:\users\public\documents\rsupport\common\update\grp_base\rs_spa_proxy.030
- C:\users\public\documents\rsupport\common\update\grp_base\rssasnt.031
- C:\users\public\documents\rsupport\common\update\grp_base\rsdrvnt.033
- C:\users\public\documents\rsupport\common\update\grp_base\rssas64.034
- C:\users\public\documents\rsupport\common\update\grp_base\rch_kor.015
- C:\users\public\documents\rsupport\common\update\grp_base\rshosthelper.003
- C:\users\public\documents\rsupport\common\update\grp_base\rcdndu.014
- C:\users\public\documents\rsupport\common\update\grp_base\rsuimgr.002
- C:\users\public\documents\rsupport\common\update\grp_base\file034.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file035.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file036.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\provs.zip
- C:\users\public\documents\rsupport\common\update\grp_base\update.ini
- C:\users\public\documents\rsupport\common\update\grp_base\update.zip
- C:\users\public\documents\rsupport\common\update\grp_base\rssemgr.000
- C:\users\public\documents\rsupport\common\update\grp_base\rsengmgr.001
- C:\users\public\documents\rsupport\common\update\grp_base\rsprinter.035
- C:\users\public\documents\rsupport\common\update\grp_base\cr5.012
- C:\users\public\documents\rsupport\common\update\grp_base\postevent.004
- C:\users\public\documents\rsupport\common\update\grp_base\bldinfo.005
- C:\users\public\documents\rsupport\common\update\grp_base\rc45.006
- C:\users\public\documents\rsupport\common\update\grp_base\rspxauth.007
- C:\users\public\documents\rsupport\common\update\grp_base\rspxscan.008
- C:\users\public\documents\rsupport\common\update\grp_base\rszip.009
- C:\users\public\documents\rsupport\common\update\grp_base\scapenc.010
- C:\users\public\documents\rsupport\common\update\grp_base\drvi.011
- C:\users\public\documents\rsupport\common\update\grp_base\crrpt.013
- %WINDIR%\temp\udd2c1e.tmp
Deletes the following files
- C:\users\public\documents\rsupport\common\temp\rsupportupdater\20220610113204\update\zip\dunzip\20220610113240\rsup.key
- C:\users\public\documents\rsupport\common\update\grp_base\file018.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file019.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file020.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file021.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file022.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file023.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file024.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file025.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file026.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file028.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\update.ini
- C:\users\public\documents\rsupport\common\update\grp_base\file029.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file030.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file031.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file032.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file033.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file034.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file035.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file036.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\provs.zip
- C:\users\public\documents\rsupport\common\update\grp_base\file017.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file027.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file016.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file003.rsz
- C:\users\public\documents\rsupport\common\temp\rsupportupdater\20220610113204\update\zip\dunzip\20220610113240\update.ini
- C:\users\public\documents\rsupport\common\update\update.ini
- C:\users\public\documents\rsupport\common\update\provs.zip
- C:\users\public\documents\rsupport\common\update\rsup.key
- C:\users\public\documents\rsupport\common\update\rccmodule.rsz
- %WINDIR%\temp\udd2c1e.tmp
- C:\users\public\documents\rsupport\common\update\grp_base\file000.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file001.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file002.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file004.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file014.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file005.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file006.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file007.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file008.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file009.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file010.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file011.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file012.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file013.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\file015.rsz
- C:\users\public\documents\rsupport\common\update\grp_base\update.zip
Moves the following files
- from C:\users\public\documents\rsupport\common\update\grp_base\rssemgr.000 to C:\users\public\documents\rsupport\rcc50\rssemgr.exe
- from C:\users\public\documents\rsupport\common\update\grp_base\rch_fre.020 to C:\users\public\documents\rsupport\rcc50\languages\rch_fre.lng
- from C:\users\public\documents\rsupport\common\update\grp_base\rch_por.021 to C:\users\public\documents\rsupport\rcc50\languages\rch_por.lng
- from C:\users\public\documents\rsupport\common\update\grp_base\rch_spa.022 to C:\users\public\documents\rsupport\rcc50\languages\rch_spa.lng
- from C:\users\public\documents\rsupport\common\update\grp_base\rs_kor_proxy.023 to C:\users\public\documents\rsupport\rcc50\languages\rs_kor_proxy.lng
- from C:\users\public\documents\rsupport\common\update\grp_base\rs_eng_proxy.024 to C:\users\public\documents\rsupport\rcc50\languages\rs_eng_proxy.lng
- from C:\users\public\documents\rsupport\common\update\grp_base\rs_jpn_proxy.025 to C:\users\public\documents\rsupport\rcc50\languages\rs_jpn_proxy.lng
- from C:\users\public\documents\rsupport\common\update\grp_base\rs_chi_sim_proxy.026 to C:\users\public\documents\rsupport\rcc50\languages\rs_chi_sim_proxy.lng
- from C:\users\public\documents\rsupport\common\update\grp_base\rs_chi_tra_proxy.027 to C:\users\public\documents\rsupport\rcc50\languages\rs_chi_tra_proxy.lng
- from C:\users\public\documents\rsupport\common\update\grp_base\rs_fre_proxy.028 to C:\users\public\documents\rsupport\rcc50\languages\rs_fre_proxy.lng
- from C:\users\public\documents\rsupport\common\update\grp_base\rs_por_proxy.029 to C:\users\public\documents\rsupport\rcc50\languages\rs_por_proxy.lng
- from C:\users\public\documents\rsupport\common\update\grp_base\rs_spa_proxy.030 to C:\users\public\documents\rsupport\rcc50\languages\rs_spa_proxy.lng
- from C:\users\public\documents\rsupport\common\update\grp_base\rssasnt.031 to C:\users\public\documents\rsupport\rcc50\rssasnt.sys
- from C:\users\public\documents\rsupport\common\update\grp_base\rsdrvnt.033 to C:\users\public\documents\rsupport\rcc50\rsdrvnt.sys
- from C:\users\public\documents\rsupport\common\update\grp_base\rssas64.034 to C:\users\public\documents\rsupport\rcc50\rssas64.sys
- from C:\users\public\documents\rsupport\common\update\grp_base\rsprinter.035 to C:\users\public\documents\rsupport\rcc50\rsprinter.dll
- from C:\users\public\documents\rsupport\common\update\grp_base\rch_chi_tra.019 to C:\users\public\documents\rsupport\rcc50\languages\rch_chi_tra.lng
- from <DRIVERS>\set29fc.tmp to <DRIVERS>\vrvd5.sys
- from C:\users\public\documents\rsupport\common\update\grp_base\rch_chi_sim.018 to C:\users\public\documents\rsupport\rcc50\languages\rch_chi_sim.lng
- from C:\users\public\documents\rsupport\common\update\grp_base\rch_eng.016 to C:\users\public\documents\rsupport\rcc50\languages\rch_eng.lng
- from C:\users\public\documents\rsupport\common\update\grp_base\rsengmgr.001 to C:\users\public\documents\rsupport\rcc50\rsengmgr.exe
- from C:\users\public\documents\rsupport\common\update\grp_base\rsuimgr.002 to C:\users\public\documents\rsupport\rcc50\rsuimgr.exe
- from C:\users\public\documents\rsupport\common\update\grp_base\rshosthelper.003 to C:\users\public\documents\rsupport\rcc50\rshosthelper.exe
- from C:\users\public\documents\rsupport\common\update\grp_base\postevent.004 to C:\users\public\documents\rsupport\rcc50\postevent.exe
- from C:\users\public\documents\rsupport\common\update\grp_base\bldinfo.005 to C:\users\public\documents\rsupport\rcc50\bldinfo.ini
- from C:\users\public\documents\rsupport\common\update\grp_base\rc45.006 to C:\users\public\documents\rsupport\rcc50\rc45.dll
- from C:\users\public\documents\rsupport\common\update\grp_base\rspxauth.007 to C:\users\public\documents\rsupport\rcc50\rspxauth.dll
- from C:\users\public\documents\rsupport\common\update\grp_base\rspxscan.008 to C:\users\public\documents\rsupport\rcc50\rspxscan.dll
- from C:\users\public\documents\rsupport\common\update\grp_base\rszip.009 to C:\users\public\documents\rsupport\rcc50\rszip.dll
- from C:\users\public\documents\rsupport\common\update\grp_base\scapenc.010 to C:\users\public\documents\rsupport\rcc50\scapenc.dll
- from C:\users\public\documents\rsupport\common\update\grp_base\drvi.011 to C:\users\public\documents\rsupport\rcc50\drvi.dll
- from C:\users\public\documents\rsupport\common\update\grp_base\cr5.012 to C:\users\public\documents\rsupport\rcc50\cr5.dll
- from C:\users\public\documents\rsupport\common\update\grp_base\crrpt.013 to C:\users\public\documents\rsupport\rcc50\crrpt.dll
- from C:\users\public\documents\rsupport\common\update\grp_base\rcdndu.014 to C:\users\public\documents\rsupport\rcc50\rcdndu.dll
- from C:\users\public\documents\rsupport\common\update\grp_base\rch_kor.015 to C:\users\public\documents\rsupport\rcc50\languages\rch_kor.lng
- from C:\users\public\documents\rsupport\common\update\grp_base\rch_jpn.017 to C:\users\public\documents\rsupport\rcc50\languages\rch_jpn.lng
- from <SYSTEM32>\set2a3c.tmp to <SYSTEM32>\vrvd5.dll
Network activity
Connects to
- 'st####.startsupport.com':443
- 'st####.thawte.com':80
- 'cd#.#hawte.com':80
- 'microsoft.com':80
- 'st######.startsupport.com':443
TCP
HTTP GET requests
- http://st####.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFvn094QJ%2BcWGTwWWEy%2BBXPZkW8AQUo8heZVTlMHjBBeoHCmpZzLn%2B3loCEAPqCJGiuwinhgkUJtt38HI%3D
- http://cd#.#hawte.com/ThawteRSACA2018.crl
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'st####.startsupport.com':443
UDP
- DNS ASK st####.startsupport.com
- DNS ASK st####.thawte.com
- DNS ASK cd#.#hawte.com
- DNS ASK microsoft.com
- DNS ASK st######.startsupport.com
- DNS ASK public-trust.com
Miscellaneous
Executes the following
- '<SYSTEM32>\rundll32.exe' %TEMP%\~RSTEMP\drvi64.dll,Vrvd5_Install
