Trojan.Siggen9.19085

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\RDMAppweb] 'ImagePath' = '%ProgramFiles(x86)%\RDM Corporation\RDM Appweb\bin\rdmappman.exe'
[<HKLM>\System\CurrentControlSet\Services\RDMAppweb] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\RdmScannerService] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\RdmScannerService] 'ImagePath' = '"%ProgramFiles(x86)%\RDM Corporation\Check Imaging\SCI\Service\RdmScannerService.exe"'

Malicious functions

Executes the following

'%WINDIR%\syswow64\net.exe' stop RDMAppweb
'%WINDIR%\syswow64\net.exe' stop RdmScannerService

Modifies settings of Windows Internet Explorer

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1209' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1406' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1209' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1406' = '00000000'

Modifies file system

Creates the following files

%TEMP%\ixp000.tmp\rdm_adk.exe
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_support_sim\is-f3h0s.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-cad4j.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-uo60e.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-677pu.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-rrk0m.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_support_sim\unins000.msg
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_support_sim\unins000.dat
%TEMP%\is-l25sq.tmp\rdm_usb_driver_sim.tmp
%TEMP%\is-0t67p.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_usb_driver_sim\is-91uld.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-qoaro.tmp
%TEMP%\is-drrip.tmp\rdm_sci_support_sim.tmp
%TEMP%\is-9p01p.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-oba6o.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-4e7is.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-a6k18.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-p1ete.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-i8cfj.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-brs4n.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-fjthj.tmp
<DRIVERS>\is-v8c23.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_usb_driver_sim\unins000.msg
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_usb_driver_sim\unins000.dat
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\smartusb.log
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\devicestatus.log
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-7cqlt.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-a1nr1.tmp
%TEMP%\{663825ea-c6a3-2c72-f5b5-7831dac9c403}\set4d72.tmp
%TEMP%\{663825ea-c6a3-2c72-f5b5-7831dac9c403}\set4c87.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\cache\is-6vu32.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\ocr\is-80qa3.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-uquem.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-7tauq.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_utilities\unins000.msg
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_utilities\unins000.dat
%TEMP%\is-kvtcb.tmp\rdm_sci_appweb.tmp
%TEMP%\is-gt1rb.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_appweb\is-3737n.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\apps\is-3fm9r.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\web\is-gmq9k.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_appweb\unins000.msg
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-ilt6r.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_appweb\unins000.dat
%ProgramFiles(x86)%\rdm corporation\rdm appweb\web\is-s4dip.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\web\css\images\is-6u9hn.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\web\css\images\is-dejlj.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\web\css\images\is-apq55.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\web\css\images\is-1m608.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\web\js\is-lf29u.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\web\js\is-6ct5l.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\web\js\is-dse8d.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\web\js\is-oe1fg.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\web\js\is-hquh5.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-7a8gp.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\web\is-hcijs.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\web\css\is-k5api.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\web\css\is-vp6n7.tmp
%TEMP%\is-6pft4.tmp\is-qhsk4.tmp
%TEMP%\{663825ea-c6a3-2c72-f5b5-7831dac9c403}\set4e3e.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_support_tp2\unins000.msg
%TEMP%\is-0al29.tmp\rdm_usb_driver_tp2.tmp
%TEMP%\is-s7pha.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_usb_driver_tp2\is-sjcqe.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-e360d.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-8v7nd.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-heb8p.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-3ebmq.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-tjvh9.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-b82qs.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-uhs51.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-hlqme.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-hver1.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_support_tp2\unins000.dat
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-5hh21.tmp
<DRIVERS>\is-45grq.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_usb_driver_tp2\unins000.msg
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_usb_driver_tp2\unins000.dat
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\smartusb.log
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\devicestatus.log
%TEMP%\{43c66716-4a41-3eb5-00cb-0541f0025771}\set83b4.tmp
%TEMP%\{43c66716-4a41-3eb5-00cb-0541f0025771}\set8470.tmp
%TEMP%\{43c66716-4a41-3eb5-00cb-0541f0025771}\set853c.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat
%ProgramFiles(x86)%\internet explorer\images\uta.ico
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-stopa.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-7s3h0.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-lqj3p.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-un5ui.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_support_tp2\is-713m4.tmp
%TEMP%\is-m8kuv.tmp\rdm_root_certificate.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-bplub.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-md8g4.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-lb4j9.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-eulmc.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-lia62.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-qmjln.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-0vqa7.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-0ung3.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-ikt9l.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-oi5mo.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-61gqe.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-09lo5.tmp
%TEMP%\is-33pi7.tmp\_isetup\_setup64.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-2ep4t.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-u2epl.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-589r9.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-ggkni.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-9e5a6.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-si31l.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-lplq7.tmp
%ProgramFiles(x86)%\mozilla firefox\defaults\pref\is-9ei5b.tmp
%ProgramFiles(x86)%\mozilla firefox\defaults\pref\is-9q0e3.tmp
%ProgramFiles(x86)%\mozilla firefox\is-7rig5.tmp
%TEMP%\is-3bras.tmp\rdm_sci_support_tp2.tmp
%TEMP%\is-v8vps.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-c0o9m.tmp
%TEMP%\is-33pi7.tmp\rdmcert\is-em7u0.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-heoqr.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-aabja.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-ep3qs.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-2qg91.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-a4103.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-a5p5n.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-n2ev1.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-4qkft.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-qpivf.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-gm1lh.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-8t2d3.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-cd2h6.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\is-0jpct.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\is-4m2ro.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-8pdsi.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-neepk.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-updkk.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\is-jhdr4.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\is-su2bq.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\is-iqvgq.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\is-fbs91.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\is-79aua.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\redist\is-cdmm0.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\is-de5el.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_appweb\unins000.dat
%ProgramFiles(x86)%\rdm corporation\rdm appweb\install.conf
%ProgramFiles(x86)%\rdm corporation\rdm appweb\log\error.log
%ProgramFiles(x86)%\rdm corporation\rdm appweb\.port.log
%ProgramFiles(x86)%\rdm corporation\rdm appweb\is-76n28.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\is-p28p6.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\is-asrc2.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-vefi2.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-pm3rp.tmp
%TEMP%\is-6pft4.tmp\is-e0998.tmp
%TEMP%\ixp000.tmp\sci_setup.bat
%TEMP%\ixp000.tmp\sci_upgrade.bat
%TEMP%\ixp000.tmp\uta.ico
%TEMP%\ixp000.tmp\uta_payments_x32.lnk
%TEMP%\ixp000.tmp\uta_payments_x32_c.lnk
%TEMP%\ixp000.tmp\uta_payments_x64.lnk
%TEMP%\ixp000.tmp\uta_payments_x64_c - copy.lnk
%TEMP%\ixp000.tmp\uta_payments_x64_c.lnk
%TEMP%\is-ck3eh.tmp\rdm_adk.tmp
%TEMP%\is-6pft4.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_adk\is-jmbma.tmp
%TEMP%\is-6pft4.tmp\is-8v3fe.tmp
%TEMP%\ixp000.tmp\sci_install.bat
%TEMP%\is-6pft4.tmp\is-n82la.tmp
%TEMP%\is-6pft4.tmp\is-b2gbb.tmp
%TEMP%\is-6pft4.tmp\is-45ivk.tmp
%TEMP%\is-588l6.tmp\rdmappweb-4.6.0-ms-windows-x86.tmp
%TEMP%\is-do17c.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_appweb\is-t6gbb.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\is-5up1d.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-uhtr0.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-i5sj4.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-if053.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-1oat4.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-eo5ck.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-2c9e9.tmp
%TEMP%\is-6pft4.tmp\is-6nfru.tmp
C:\users\public\desktop\uta payments.lnk
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
%TEMP%\is-6pft4.tmp\is-eaeem.tmp
%TEMP%\is-6pft4.tmp\is-mi2o5.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\rdmscannerservice.installstate
%TEMP%\is-h4qr4.tmp\rdm_sci_utilities.tmp
%TEMP%\is-osvl4.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_utilities\is-09lgs.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-7rc0s.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-ssib2.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-6g717.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-52009.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-c0sct.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-qig26.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-ar9b8.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-tsmrs.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_service\unins000.dat
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-q8p5c.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-0idds.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-spalh.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-e9752.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-3ch10.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-emjju.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-snumr.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-klkqm.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-cq4o6.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-nj2uq.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-tnb0a.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-r1n8j.tmp
%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-cui26.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-ana7j.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_service\unins000.msg
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-9v794.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-hcvgb.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\is-4truf.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_adk\unins000.msg
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_adk\unins000.dat
%TEMP%\is-9dlfg.tmp\rdm_sci_prerequisite.tmp
%TEMP%\is-l8lqg.tmp\_isetup\_setup64.tmp
%TEMP%\is-qrgc5.tmp\rdm_sci_framework.tmp
%TEMP%\is-lsoqu.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_framework\is-372re.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\is-54bp4.tmp
%WINDIR%\assembly\tmp\clx0vhgd\rdmsci.dll
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-hailq.tmp
%TEMP%\is-6pft4.tmp\is-443bb.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-1t0eg.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-q2ag2.tmp
%PROGRAMDATA%\microsoft\windows\start menu\programs\rdm corporation\scannercare\scannercare.lnk
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_framework\unins000.msg
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_framework\unins000.dat
%TEMP%\is-jvgb7.tmp\rdm_sci_service.tmp
%TEMP%\is-v2su1.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_service\is-sq2vk.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-bluls.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-8v4cc.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-ghh14.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-og8u1.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-cl3oq.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-vb5o7.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-0n2i1.tmp
%TEMP%\is-6pft4.tmp\is-fgh2k.tmp
C:\users\public\desktop\uta payments chrome.lnk

Sets the 'hidden' attribute to the following files

<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat

Deletes the following files

%TEMP%\is-do17c.tmp\_isetup\_setup64.tmp
%TEMP%\is-33pi7.tmp\rdmcert\nssdbm3.dll
%TEMP%\is-33pi7.tmp\rdmcert\nssutil3.dll
%TEMP%\is-33pi7.tmp\rdmcert\rdm.ico
%TEMP%\is-33pi7.tmp\rdmcert\rdmroot.pem
%TEMP%\is-33pi7.tmp\rdmcert\smime3.dll
%TEMP%\is-33pi7.tmp\rdmcert\softokn3.dll
%TEMP%\is-33pi7.tmp\rdmcert\sqlite3.dll
%TEMP%\is-33pi7.tmp\rdmcert\ssl3.dll
%TEMP%\is-33pi7.tmp\rdmcert\umbrella.cfg
%TEMP%\is-33pi7.tmp\_isetup\_setup64.tmp
%TEMP%\is-m8kuv.tmp\rdm_root_certificate.tmp
%TEMP%\is-v8vps.tmp\_isetup\_setup64.tmp
%TEMP%\is-3bras.tmp\rdm_sci_support_tp2.tmp
%TEMP%\{43c66716-4a41-3eb5-00cb-0541f0025771}\ustp2x64.cat
%TEMP%\{43c66716-4a41-3eb5-00cb-0541f0025771}\ustp2x64.inf
%TEMP%\{43c66716-4a41-3eb5-00cb-0541f0025771}\ustp2x64.sys
%TEMP%\is-s7pha.tmp\_isetup\_setup64.tmp
%TEMP%\is-0al29.tmp\rdm_usb_driver_tp2.tmp
%TEMP%\is-6pft4.tmp\rdm_sci_prerequisite.exe
%TEMP%\is-6pft4.tmp\rdm_sci_framework.exe
%TEMP%\is-6pft4.tmp\rdm_sci_service.exe
%TEMP%\is-6pft4.tmp\rdm_sci_utilities.exe
%TEMP%\is-6pft4.tmp\rdmappweb-4.6.0-ms-windows-x86.exe
%TEMP%\is-6pft4.tmp\rdm_sci_appweb.exe
%TEMP%\is-6pft4.tmp\rdm_sci_support_sim.exe
%TEMP%\is-6pft4.tmp\rdm_usb_driver_sim.exe
%TEMP%\is-6pft4.tmp\rdm_sci_support_tp2.exe
%TEMP%\is-6pft4.tmp\rdm_usb_driver_tp2.exe
%TEMP%\is-6pft4.tmp\rdm_root_certificate.exe
%TEMP%\is-33pi7.tmp\rdmcert\nssckbi.dll
%TEMP%\is-6pft4.tmp\_isetup\_setup64.tmp
%TEMP%\is-33pi7.tmp\rdmcert\nss3.dll
%TEMP%\is-33pi7.tmp\rdmcert\libplds4.dll
%TEMP%\is-588l6.tmp\rdmappweb-4.6.0-ms-windows-x86.tmp
%TEMP%\is-l8lqg.tmp\_isetup\_setup64.tmp
%TEMP%\is-9dlfg.tmp\rdm_sci_prerequisite.tmp
%TEMP%\is-lsoqu.tmp\_isetup\_setup64.tmp
%TEMP%\is-qrgc5.tmp\rdm_sci_framework.tmp
%TEMP%\is-v2su1.tmp\_isetup\_setup64.tmp
%TEMP%\is-jvgb7.tmp\rdm_sci_service.tmp
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\scilogviewer.exe
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\scilogviewer.exe.config
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\rdmscixml.dll
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\rdmscilog.dll
%TEMP%\is-osvl4.tmp\_isetup\_setup64.tmp
%TEMP%\is-h4qr4.tmp\rdm_sci_utilities.tmp
%TEMP%\is-gt1rb.tmp\_isetup\_setup64.tmp
%TEMP%\is-kvtcb.tmp\rdm_sci_appweb.tmp
%TEMP%\is-9p01p.tmp\_isetup\_setup64.tmp
%TEMP%\is-drrip.tmp\rdm_sci_support_sim.tmp
%TEMP%\{663825ea-c6a3-2c72-f5b5-7831dac9c403}\cyusb_wlhx64.sys
%TEMP%\{663825ea-c6a3-2c72-f5b5-7831dac9c403}\simplicity.cat
%TEMP%\{663825ea-c6a3-2c72-f5b5-7831dac9c403}\simplicity.inf
%TEMP%\is-0t67p.tmp\_isetup\_setup64.tmp
%TEMP%\is-l25sq.tmp\rdm_usb_driver_sim.tmp
%TEMP%\is-33pi7.tmp\rdmcert\addcert.bat
%TEMP%\is-33pi7.tmp\rdmcert\certmgr.exe
%TEMP%\is-33pi7.tmp\rdmcert\certutil.exe
%TEMP%\is-33pi7.tmp\rdmcert\firefox-windows-truststore.js
%TEMP%\is-33pi7.tmp\rdmcert\freebl3.dll
%TEMP%\is-33pi7.tmp\rdmcert\libnspr4.dll
%TEMP%\is-33pi7.tmp\rdmcert\libplc4.dll
%TEMP%\is-33pi7.tmp\rdmcert\local-settings.js
%TEMP%\is-ck3eh.tmp\rdm_adk.tmp

Moves the following files

from %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_adk\is-jmbma.tmp to %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_adk\unins000.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-677pu.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\rdmsimusbscanner.dll.config
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-rrk0m.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\rdmsim_agentdll2.dll
from %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_usb_driver_sim\is-91uld.tmp to %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_usb_driver_sim\unins000.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-qoaro.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\cyusb_wlhx64.sys
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-oba6o.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\cyusb_wlhx86.sys
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-7cqlt.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\devconx64.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-a1nr1.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\devconx86.exe
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\css\images\is-6u9hn.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\css\images\footerlogo.png
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-4e7is.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\deviceidlist.txt
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-p1ete.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\simplicity.cat
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-i8cfj.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\simplicity.inf
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-brs4n.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\smartusb.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-fjthj.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\smartusb.log
from <DRIVERS>\is-v8c23.tmp to <DRIVERS>\rdmsim.sys
from %TEMP%\{663825ea-c6a3-2c72-f5b5-7831dac9c403}\set4c87.tmp to %TEMP%\{663825ea-c6a3-2c72-f5b5-7831dac9c403}\cyusb_wlhx64.sys
from %TEMP%\{663825ea-c6a3-2c72-f5b5-7831dac9c403}\set4d72.tmp to %TEMP%\{663825ea-c6a3-2c72-f5b5-7831dac9c403}\simplicity.cat
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-cad4j.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\rdmsimapi.dll
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-uo60e.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\rdmsimusbscanner.dll
from %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_support_sim\is-f3h0s.tmp to %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_support_sim\unins000.exe
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\cache\is-6vu32.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\cache\controller_8e2a71804042fa9a9af99cd4b8f9124e.dll
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-7a8gp.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\rdmsciproxy.dll
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\ocr\is-80qa3.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\ocr\sampleocr.xml
from %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_appweb\is-3737n.tmp to %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_appweb\unins000.exe
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\apps\is-3fm9r.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\apps\sci.conf
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\is-gmq9k.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\sci-sample.html
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\is-s4dip.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\sciindex.html
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\is-hcijs.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\favicon.ico
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\css\is-k5api.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\css\adksci-7.1.css
from %TEMP%\{663825ea-c6a3-2c72-f5b5-7831dac9c403}\set4e3e.tmp to %TEMP%\{663825ea-c6a3-2c72-f5b5-7831dac9c403}\simplicity.inf
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\is-a6k18.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\rdmsetup_inf.exe
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\css\is-vp6n7.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\css\rdmweb.css
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\css\images\is-apq55.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\css\images\mainmenugradient.png
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\css\images\is-1m608.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\css\images\rdmlogo.png
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\js\is-lf29u.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\js\base64-binary.js
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\js\is-6ct5l.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\js\jquery-1.10.2.js
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\js\is-dse8d.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\js\sci-async.js
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\js\is-oe1fg.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\js\scisample-main.js
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\js\is-hquh5.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\js\tiff.js
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-heoqr.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\rdmscannersettings.xml
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\css\images\is-dejlj.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\web\css\images\footertopborder.png
from %TEMP%\is-33pi7.tmp\rdmcert\is-2ep4t.tmp to %TEMP%\is-33pi7.tmp\rdmcert\nssutil3.dll
from %TEMP%\{43c66716-4a41-3eb5-00cb-0541f0025771}\set853c.tmp to %TEMP%\{43c66716-4a41-3eb5-00cb-0541f0025771}\ustp2x64.sys
from %TEMP%\is-33pi7.tmp\rdmcert\is-lb4j9.tmp to %TEMP%\is-33pi7.tmp\rdmcert\certutil.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-hlqme.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\rdmtp2usbscanner.dll.config
from %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_usb_driver_tp2\is-sjcqe.tmp to %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_usb_driver_tp2\unins000.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-e360d.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\devconx64.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-8v7nd.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\devconx86.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-heb8p.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\deviceidlist.txt
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-3ebmq.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\rdmsetup_inf.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-tjvh9.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\smartusb.exe
from %TEMP%\is-33pi7.tmp\rdmcert\is-bplub.tmp to %TEMP%\is-33pi7.tmp\rdmcert\addcert.bat
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-b82qs.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\ustp2.cat
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-hver1.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\ustp2.sys
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-stopa.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\ustp2x64.cat
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-5hh21.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\ustp2x64.inf
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-lqj3p.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\ustp2x64.sys
from <DRIVERS>\is-45grq.tmp to <DRIVERS>\ustp2x64.sys
from %TEMP%\{43c66716-4a41-3eb5-00cb-0541f0025771}\set83b4.tmp to %TEMP%\{43c66716-4a41-3eb5-00cb-0541f0025771}\ustp2x64.cat
from %TEMP%\{43c66716-4a41-3eb5-00cb-0541f0025771}\set8470.tmp to %TEMP%\{43c66716-4a41-3eb5-00cb-0541f0025771}\ustp2x64.inf
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-un5ui.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\rdmtp2api.dll
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-7s3h0.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\rdmtp2usbscanner.dll
from %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_support_tp2\is-713m4.tmp to %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_support_tp2\unins000.exe
from %ProgramFiles(x86)%\mozilla firefox\is-7rig5.tmp to %ProgramFiles(x86)%\mozilla firefox\umbrella.cfg
from %ProgramFiles(x86)%\mozilla firefox\defaults\pref\is-9q0e3.tmp to %ProgramFiles(x86)%\mozilla firefox\defaults\pref\local-settings.js
from %TEMP%\is-33pi7.tmp\rdmcert\is-lia62.tmp to %TEMP%\is-33pi7.tmp\rdmcert\freebl3.dll
from %TEMP%\is-33pi7.tmp\rdmcert\is-qmjln.tmp to %TEMP%\is-33pi7.tmp\rdmcert\libnspr4.dll
from %TEMP%\is-33pi7.tmp\rdmcert\is-0vqa7.tmp to %TEMP%\is-33pi7.tmp\rdmcert\libplc4.dll
from %TEMP%\is-33pi7.tmp\rdmcert\is-0ung3.tmp to %TEMP%\is-33pi7.tmp\rdmcert\libplds4.dll
from %TEMP%\is-33pi7.tmp\rdmcert\is-ikt9l.tmp to %TEMP%\is-33pi7.tmp\rdmcert\local-settings.js
from %TEMP%\is-33pi7.tmp\rdmcert\is-oi5mo.tmp to %TEMP%\is-33pi7.tmp\rdmcert\nss3.dll
from %TEMP%\is-33pi7.tmp\rdmcert\is-61gqe.tmp to %TEMP%\is-33pi7.tmp\rdmcert\nssckbi.dll
from %TEMP%\is-33pi7.tmp\rdmcert\is-md8g4.tmp to %TEMP%\is-33pi7.tmp\rdmcert\certmgr.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-ilt6r.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\scisettingsmanager.exe.config
from %TEMP%\is-33pi7.tmp\rdmcert\is-09lo5.tmp to %TEMP%\is-33pi7.tmp\rdmcert\nssdbm3.dll
from %TEMP%\is-33pi7.tmp\rdmcert\is-u2epl.tmp to %TEMP%\is-33pi7.tmp\rdmcert\rdmroot.pem
from %TEMP%\is-33pi7.tmp\rdmcert\is-589r9.tmp to %TEMP%\is-33pi7.tmp\rdmcert\smime3.dll
from %TEMP%\is-33pi7.tmp\rdmcert\is-ggkni.tmp to %TEMP%\is-33pi7.tmp\rdmcert\softokn3.dll
from %TEMP%\is-33pi7.tmp\rdmcert\is-9e5a6.tmp to %TEMP%\is-33pi7.tmp\rdmcert\sqlite3.dll
from %TEMP%\is-33pi7.tmp\rdmcert\is-si31l.tmp to %TEMP%\is-33pi7.tmp\rdmcert\ssl3.dll
from %TEMP%\is-33pi7.tmp\rdmcert\is-lplq7.tmp to %TEMP%\is-33pi7.tmp\rdmcert\umbrella.cfg
from %ProgramFiles(x86)%\mozilla firefox\defaults\pref\is-9ei5b.tmp to %ProgramFiles(x86)%\mozilla firefox\defaults\pref\firefox-windows-truststore.js
from %TEMP%\is-33pi7.tmp\rdmcert\is-eulmc.tmp to %TEMP%\is-33pi7.tmp\rdmcert\firefox-windows-truststore.js
from %TEMP%\is-33pi7.tmp\rdmcert\is-em7u0.tmp to %TEMP%\is-33pi7.tmp\rdmcert\rdm.ico
from %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\is-uhs51.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\ustp2.inf
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-c0o9m.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\scisettingsmanager.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-spalh.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\item_image_micr_frank.xml
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-qpivf.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\rdmappweb.exe
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-gm1lh.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\removefiles.exe
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-8t2d3.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\ssleay32.dll
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-cd2h6.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\uninstall
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\is-0jpct.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\certmgr.exe
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\is-4m2ro.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\files.log
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\is-jhdr4.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\install.conf
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-if053.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\install
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\is-76n28.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\license.txt
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\is-asrc2.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\rdm.crt
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\is-su2bq.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\rdm.ico
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\is-iqvgq.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\rdm.key
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\is-fbs91.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\rdmroot.pem
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\is-79aua.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\readme.txt
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\redist\is-cdmm0.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\redist\vcredist_x86.exe
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\is-de5el.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\sample.conf
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-n2ev1.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\msvcr100.dll
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-4qkft.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\rdmappman.exe
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-a5p5n.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\libslink.dll
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-a4103.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\libpcre.dll
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-updkk.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\libmprssl.lib
from %TEMP%\is-6pft4.tmp\is-n82la.tmp to %TEMP%\is-6pft4.tmp\rdm_sci_framework.exe
from %TEMP%\is-6pft4.tmp\is-6nfru.tmp to %TEMP%\is-6pft4.tmp\rdm_sci_service.exe
from %TEMP%\is-6pft4.tmp\is-b2gbb.tmp to %TEMP%\is-6pft4.tmp\rdm_sci_utilities.exe
from %TEMP%\is-6pft4.tmp\is-45ivk.tmp to %TEMP%\is-6pft4.tmp\rdmappweb-4.6.0-ms-windows-x86.exe
from %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_appweb\is-t6gbb.tmp to %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_appweb\unins000.exe
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\is-5up1d.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\appweb.conf
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-uhtr0.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\ca.crt
from %TEMP%\is-6pft4.tmp\is-e0998.tmp to %TEMP%\is-6pft4.tmp\rdm_sci_appweb.exe
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\is-p28p6.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\mime.types
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-i5sj4.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\esp.conf
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-eo5ck.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\libeay32.dll
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-2c9e9.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\libhttp.dll
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-pm3rp.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\libmod_cgi.dll
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-neepk.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\libmod_esp.dll
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-vefi2.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\libmod_ssl.dll
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-8pdsi.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\libmpr.dll
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-cui26.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\libmprssl.dll
from %TEMP%\is-6pft4.tmp\is-8v3fe.tmp to %TEMP%\is-6pft4.tmp\rdm_sci_prerequisite.exe
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\is-1oat4.tmp to %ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\libappweb.dll
from %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_service\is-sq2vk.tmp to %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_service\unins000.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-ep3qs.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\scisample x64.exe
from %TEMP%\is-6pft4.tmp\is-fgh2k.tmp to %TEMP%\is-6pft4.tmp\rdm_sci_support_tp2.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-52009.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\hold_image_micr.xml
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-c0sct.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\idcard_image.xml
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-qig26.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\idcard_image200.xml
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-tsmrs.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\item_auximage_micr.xml
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-r1n8j.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\item_image_micr.xml
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-q8p5c.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\item_image_micr_cmc7.xml
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-ana7j.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\item_image_micr_docdetect.xml
from %TEMP%\is-6pft4.tmp\is-eaeem.tmp to %TEMP%\is-6pft4.tmp\rdm_sci_support_sim.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-0idds.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\item_image_micr_endorsement.xml
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-e9752.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\item_image_micr_frank_endorse.xml
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-3ch10.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\item_image_micr_ve_logo.xml
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-emjju.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\item_image_micr_ve_text.xml
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-snumr.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\msr_creditcard.xml
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-klkqm.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\print_rdmreceipt.xml
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-tnb0a.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\scisample.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-2qg91.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\scisample.exe.config
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-ssib2.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\base_operations.xml
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-6g717.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\batch_image_micr.xml
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\is-7rc0s.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\settings\base_batch_operations.xml
from %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_utilities\is-09lgs.tmp to %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_utilities\unins000.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-ar9b8.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\rdmscilog.dll
from %TEMP%\is-6pft4.tmp\is-mi2o5.tmp to %TEMP%\is-6pft4.tmp\rdm_root_certificate.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\is-4truf.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\releaseversions - 7.0.3.135.ini
from %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_framework\is-372re.tmp to %ProgramFiles(x86)%\rdm corporation\uninstall\rdm_sci_framework\unins000.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\is-54bp4.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\rdmsci.dll
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-hailq.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\scannercare.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-1t0eg.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\scannercare.xml
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-vb5o7.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\scannercare.exe.config
from %TEMP%\is-6pft4.tmp\is-qhsk4.tmp to %TEMP%\is-6pft4.tmp\rdm_usb_driver_sim.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-aabja.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\scisample x64.exe.config
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-q2ag2.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\rdmscixml.dll
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-8v4cc.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\rdmscannerservice.exe.config
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-ghh14.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\rdmsciman.dll
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-og8u1.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\rdmscanutil.dll
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-cl3oq.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\rdmscixml.dll
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-0n2i1.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\rdmscilog.dll
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-hcvgb.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\scilogviewer.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\is-9v794.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\scilogviewer.exe.config
from %TEMP%\is-6pft4.tmp\is-443bb.tmp to %TEMP%\is-6pft4.tmp\rdm_usb_driver_tp2.exe
from %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\is-bluls.tmp to %ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\rdmscannerservice.exe
from %ProgramFiles(x86)%\rdm corporation\rdm appweb\log\error.log to %ProgramFiles(x86)%\rdm corporation\rdm appweb\log\error.log.0

Substitutes the following files

%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\scilogviewer.exe
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\scilogviewer.exe.config
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\rdmscixml.dll
%ProgramFiles(x86)%\rdm corporation\check imaging\sci\utils\rdmscilog.dll
%ProgramFiles(x86)%\rdm corporation\rdm appweb\log\error.log

Network activity

TCP

'localhost':8084
'localhost':49173

Miscellaneous

Adds a root certificate

Searches for the following windows

ClassName: 'RDMAppweb' WindowName: 'RDMAppweb'

Creates and executes the following

'%TEMP%\ixp000.tmp\rdm_adk.exe' /SILENT"
'%TEMP%\is-kvtcb.tmp\rdm_sci_appweb.tmp' /SL5="$B02A8,478541,66048,%TEMP%\is-6PFT4.tmp\RDM_SCI_APPWEB.exe" /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"
'%TEMP%\is-6pft4.tmp\rdm_sci_support_sim.exe' /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"
'%TEMP%\is-drrip.tmp\rdm_sci_support_sim.tmp' /SL5="$C02A8,877590,66048,%TEMP%\is-6PFT4.tmp\RDM_SCI_SUPPORT_SIM.exe" /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"
'%TEMP%\is-l25sq.tmp\rdm_usb_driver_sim.tmp' /SL5="$D02A8,236494,66048,%TEMP%\is-6PFT4.tmp\RDM_USB_DRIVER_SIM.exe" /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"
'%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\devconx64.exe' status "USB\VID_0E1A&PID_0005" devicestatus.log
'%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\devconx64.exe' status "USB\VID_0E1A&PID_0006" devicestatus.log
'%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\rdmsetup_inf.exe' "%ProgramFiles(x86)%\RDM Corporation\Check Imaging\Drivers\Simplicity\simplicity.inf"
'%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\smartusb.exe' rescan
'%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\smartusb.exe' remove
'%TEMP%\is-6pft4.tmp\rdm_sci_appweb.exe' /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"
'%TEMP%\is-33pi7.tmp\rdmcert\certutil.exe' -t "TCu,TCu,TCu" -d "%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\." -i "%TEMP%\is-33PI7.tmp\RdmCert\rdmroot.pem"
'%TEMP%\is-6pft4.tmp\rdm_sci_support_tp2.exe' /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"
'%TEMP%\is-3bras.tmp\rdm_sci_support_tp2.tmp' /SL5="$F02A8,110089,66048,%TEMP%\is-6PFT4.tmp\RDM_SCI_SUPPORT_TP2.exe" /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"
'%TEMP%\is-6pft4.tmp\rdm_usb_driver_tp2.exe' /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"
'%TEMP%\is-0al29.tmp\rdm_usb_driver_tp2.tmp' /SL5="$1002A8,219272,66048,%TEMP%\is-6PFT4.tmp\RDM_USB_DRIVER_TP2.exe" /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"
'%TEMP%\is-6pft4.tmp\rdm_root_certificate.exe' /VERYSILENT /NORESTART
'%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\smartusb.exe' remove
'%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\rdmsetup_inf.exe' "%ProgramFiles(x86)%\RDM Corporation\Check Imaging\Drivers\Tp2\ustp2x64.inf"
'%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\devconx64.exe' status "USB\VID_0E1A&PID_0004" devicestatus.log
'%TEMP%\is-m8kuv.tmp\rdm_root_certificate.tmp' /SL5="$E02A8,6221732,66048,%TEMP%\is-6PFT4.tmp\RDM_ROOT_CERTIFICATE.exe" /VERYSILENT /NORESTART
'%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\smartusb.exe' rescan
'%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\rdmappman.exe'
'%TEMP%\is-33pi7.tmp\rdmcert\certmgr.exe' -add -all -c rdmroot.pem -s -r localmachine Root
'%TEMP%\is-h4qr4.tmp\rdm_sci_utilities.tmp' /SL5="$A02A8,193479,66048,%TEMP%\is-6PFT4.tmp\RDM_SCI_UTILITIES.exe" /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"
'%TEMP%\is-6pft4.tmp\rdm_usb_driver_sim.exe' /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"
'%TEMP%\is-6pft4.tmp\rdm_sci_utilities.exe' /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"
'%TEMP%\is-6pft4.tmp\rdmappweb-4.6.0-ms-windows-x86.exe' /VERYSILENT /NORESTART
'%TEMP%\is-588l6.tmp\rdmappweb-4.6.0-ms-windows-x86.tmp' /SL5="$10268,6322833,66048,%TEMP%\is-6PFT4.tmp\rdmappweb-4.6.0-ms-windows-x86.exe" /VERYSILENT /NORESTART
'%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\rdmappman.exe' uninstall
'%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\rdmappman.exe' install enable
'%TEMP%\is-ck3eh.tmp\rdm_adk.tmp' /SL5="$D0220,25660893,66048,%TEMP%\IXP000.TMP\RDM_ADK.exe" /SILENT"
'%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\rdmappweb.exe'
'%TEMP%\is-9dlfg.tmp\rdm_sci_prerequisite.tmp' /SL5="$702A8,6189602,66048,%TEMP%\is-6PFT4.tmp\RDM_SCI_PREREQUISITE.exe" /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"
'%TEMP%\is-6pft4.tmp\rdm_sci_framework.exe' /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"
'%TEMP%\is-qrgc5.tmp\rdm_sci_framework.tmp' /SL5="$802A8,141412,66048,%TEMP%\is-6PFT4.tmp\RDM_SCI_FRAMEWORK.exe" /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"
'%TEMP%\is-6pft4.tmp\rdm_sci_prerequisite.exe' /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"
'%TEMP%\is-jvgb7.tmp\rdm_sci_service.tmp' /SL5="$902A8,544110,66048,%TEMP%\is-6PFT4.tmp\RDM_SCI_SERVICE.exe" /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"
'%TEMP%\is-6pft4.tmp\rdm_sci_service.exe' /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"
'%ProgramFiles(x86)%\rdm corporation\rdm appweb\bin\rdmappman.exe' start
'%ProgramFiles(x86)%\rdm corporation\check imaging\sci\service\rdmscannerservice.exe'
'%TEMP%\is-6pft4.tmp\rdm_sci_support_sim.exe' /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"' (with hidden window)
'%TEMP%\is-6pft4.tmp\rdm_sci_service.exe' /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"' (with hidden window)
'%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\smartusb.exe' remove' (with hidden window)
'%TEMP%\is-6pft4.tmp\rdmappweb-4.6.0-ms-windows-x86.exe' /VERYSILENT /NORESTART' (with hidden window)
'%TEMP%\is-6pft4.tmp\rdm_sci_appweb.exe' /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"' (with hidden window)
'%WINDIR%\syswow64\net.exe' start RDMAppweb' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe' /LogFile= /unattended "%ProgramFiles(x86)%\RDM Corporation\Check Imaging\SCI\Service\RdmScannerService.exe"' (with hidden window)
'%TEMP%\is-6pft4.tmp\rdm_sci_framework.exe' /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"' (with hidden window)
'%TEMP%\is-6pft4.tmp\rdm_usb_driver_tp2.exe' /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"' (with hidden window)
'%TEMP%\is-6pft4.tmp\rdm_sci_support_tp2.exe' /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"' (with hidden window)
'%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\tp2\smartusb.exe' rescan' (with hidden window)
'%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\smartusb.exe' remove' (with hidden window)
'%TEMP%\is-6pft4.tmp\rdm_sci_utilities.exe' /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop RDMAppweb' (with hidden window)
'%TEMP%\is-6pft4.tmp\rdm_sci_prerequisite.exe' /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' "%ProgramFiles(x86)%\RDM Corporation\Check Imaging\SCI\RdmSci.dll" /unregister' (with hidden window)
'%TEMP%\is-6pft4.tmp\rdm_usb_driver_sim.exe' /VERYSILENT /NORESTART /DIR="expand:%ProgramFiles(x86)%\RDM Corporation"' (with hidden window)
'%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\rdmsetup_inf.exe' "%ProgramFiles(x86)%\RDM Corporation\Check Imaging\Drivers\Simplicity\simplicity.inf"' (with hidden window)
'%ProgramFiles(x86)%\rdm corporation\check imaging\drivers\simplicity\smartusb.exe' rescan' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' "%ProgramFiles(x86)%\RDM Corporation\Check Imaging\SCI\RdmSci.dll" /codebase' (with hidden window)
'%TEMP%\is-6pft4.tmp\rdm_root_certificate.exe' /VERYSILENT /NORESTART' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop RdmScannerService' (with hidden window)
'%TEMP%\is-33pi7.tmp\rdmcert\certmgr.exe' -add -all -c rdmroot.pem -s -r localmachine Root' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\is-33PI7.tmp/RdmCert/AddCert.bat" "%TEMP%\is-33PI7.tmp\RdmCert\rdmroot.pem" "%TEMP%\is-33PI7.tmp\RdmCert""' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C Move /Y "%ProgramFiles(x86)%\RDM Corporation\Uninstall\unins000.exe" "%ProgramFiles(x86)%\RDM Corporation\Uninstall\RDM ADK.exe"' (with hidden window)
'%WINDIR%\syswow64\net.exe' start RdmScannerService' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C Move /Y "%ProgramFiles(x86)%\RDM Corporation\Uninstall\unins000.dat" "%ProgramFiles(x86)%\RDM Corporation\Uninstall\RDM ADK.dat"' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c sci_setup.bat
'<SYSTEM32>\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\nctinc.net" /v "*" /t REG_DWORD /d 00000002 /f
'<SYSTEM32>\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\unitedtranzactions.com" /v "*" /t REG_DWORD /d 00000002 /f
'<SYSTEM32>\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\unitedtranzactions.net" /v "*" /t REG_DWORD /d 00000002 /f
'<SYSTEM32>\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\snapengage.com" /v "*" /t REG_DWORD /d 00000002 /f
'<SYSTEM32>\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" /v "1209" /t REG_DWORD /d 00000000 /f
'<SYSTEM32>\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" /v "1406" /t REG_DWORD /d 00000000 /f
'<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\nctinc.net" /v "*" /t REG_DWORD /d 00000002 /f
'<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\unitedtranzactions.com" /v "*" /t REG_DWORD /d 00000002 /f
'<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\unitedtranzactions.net" /v "*" /t REG_DWORD /d 00000002 /f
'<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\snapengage.com" /v "*" /t REG_DWORD /d 00000002 /f
'<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" /v "1209" /t REG_DWORD /d 00000000 /f
'<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" /v "1406" /t REG_DWORD /d 00000000 /f
'%WINDIR%\microsoft.net\framework\v2.0.50727\caspol.exe' -q -m -ag All_Code -zone Trusted FullTrust
'%WINDIR%\microsoft.net\framework64\v2.0.50727\caspol.exe' -q -m -ag All_Code -zone Trusted FullTrust
'<SYSTEM32>\reg.exe' ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework /v EnableIEHosting /t REG_DWORD /d 1 /f
'<SYSTEM32>\sc.exe' failure RDMAppweb actions= restart/180000/restart/180000/restart/180000 reset= 86400
'<SYSTEM32>\reg.exe' ADD HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework /v EnableIEHosting /t REG_DWORD /d 1 /f
'<SYSTEM32>\sc.exe' failure RdmScannerService actions= restart/180000/restart/180000/restart/180000 reset= 86400
'%WINDIR%\syswow64\cmd.exe' /C Move /Y "%ProgramFiles(x86)%\RDM Corporation\Uninstall\unins000.exe" "%ProgramFiles(x86)%\RDM Corporation\Uninstall\RDM ADK.exe"
'<SYSTEM32>\powercfg.exe' /SETACVALUEINDEX SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
'%WINDIR%\syswow64\net1.exe' stop RDMAppweb
'%WINDIR%\syswow64\net1.exe' stop RdmScannerService
'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' "%ProgramFiles(x86)%\RDM Corporation\Check Imaging\SCI\RdmSci.dll" /unregister
'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' "%ProgramFiles(x86)%\RDM Corporation\Check Imaging\SCI\RdmSci.dll" /codebase
'%WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe' /LogFile= /unattended "%ProgramFiles(x86)%\RDM Corporation\Check Imaging\SCI\Service\RdmScannerService.exe"
'%WINDIR%\syswow64\cmd.exe' /c devconX64.exe status "USB\VID_0E1A&PID_0005" devicestatus.log
'%WINDIR%\syswow64\cmd.exe' /c devconX64.exe status "USB\VID_0E1A&PID_0006" devicestatus.log
'%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\is-33PI7.tmp/RdmCert/AddCert.bat" "%TEMP%\is-33PI7.tmp\RdmCert\rdmroot.pem" "%TEMP%\is-33PI7.tmp\RdmCert""
'%WINDIR%\syswow64\cmd.exe' /c dir /B "%APPDATA%\Mozilla\Firefox\Profiles\*.default*"
'%WINDIR%\syswow64\cmd.exe' /c devconX64.exe status "USB\VID_0E1A&PID_0004" devicestatus.log
'%WINDIR%\syswow64\net.exe' start RdmScannerService
'%WINDIR%\syswow64\net1.exe' start RdmScannerService
'%WINDIR%\syswow64\net.exe' start RDMAppweb
'%WINDIR%\syswow64\net1.exe' start RDMAppweb
'%WINDIR%\syswow64\cmd.exe' /C Move /Y "%ProgramFiles(x86)%\RDM Corporation\Uninstall\unins000.dat" "%ProgramFiles(x86)%\RDM Corporation\Uninstall\RDM ADK.dat"
'<SYSTEM32>\reg.exe' ADD HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OLEforRetail\ServiceOPOS\MICR\RDMPOS /v MaxReadBufferSz /t REG_DWORD /d 125 /f

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial