Trojan.KillFiles.25465

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ISUSScheduler' = '"%CommonProgramFiles%\InstallShield\UpdateService\issch.exe" -start'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ISUSPM Startup' = '%CommonProgramFiles%\InstallShield\UpdateService\isuspm.exe -startup'

Malicious functions:

Creates and executes the following:

'%CommonProgramFiles%\InstallShield\UpdateService\isuspm.exe' -bootstrap
'%CommonProgramFiles%\InstallShield\UpdateService\agent.exe' /ssi{2669AB9B-99D0-401B-B802-3FE4828286F9},30:CECB90E899DCC7BF9EAC20D89E9C978F69ECD78F799B90D8CEBB072F8EEB67E8E9ACE78FFEAC Default
'%CommonProgramFiles%\InstallShield\UpdateService\agent.exe' -Embedding
'%CommonProgramFiles%\InstallShield\UpdateService\issch.exe' -start
'%CommonProgramFiles%\InstallShield\UpdateService\issch.exe' -set "%CommonProgramFiles%\InstallShield\UpdateService\isuspm.exe /scheduler" -wk 1
'%WINDIR%\Downloaded Program Files\dwusplay.EXE' /REGSTUB"%WINDIR%\Downloaded Program Files\dwusplay.dll"
'%TEMP%\RarSFX0\Setup.exe'
'%TEMP%\RarSFX0\Setup.exe' RE /r /s
'%CommonProgramFiles%\InstallShield\UpdateService\agent.exe' /REGSERVER
'%WINDIR%\Downloaded Program Files\dwusplay.exe' /REGSERVER
'%CommonProgramFiles%\InstallShield\UpdateService\ISDM.exe' /REGSERVER

Executes the following:

'<SYSTEM32>\taskhost.exe' /l{2669AB9B-99D0-401B-B802-3FE4828286F9} /1033
'<SYSTEM32>\svchost.exe' -k swprv
'<SYSTEM32>\vssvc.exe'

Modifies file system :

Creates the following files:

%WINDIR%\Downloaded Program Files\dwus9dc4.rra
%CommonProgramFiles%\InstallShield\UpdateService\issc9de3.rra
%WINDIR%\Downloaded Program Files\dwus9da5.rra
%CommonProgramFiles%\InstallShield\UpdateService\ISDM9cda.rra
%WINDIR%\Downloaded Program Files\isus9d47.rra
%CommonProgramFiles%\InstallShield\UpdateService\pm9f98.rra
%CommonProgramFiles%\InstallShield\UpdateService\_isp9fe6.rra
%CommonProgramFiles%\InstallShield\UpdateService\pm9eae.rra
%CommonProgramFiles%\InstallShield\UpdateService\_isu9e31.rra
%CommonProgramFiles%\InstallShield\UpdateService\ISUS9e51.rra
%PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\data99de.rra
%PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setu9a89.rra
%PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\data99bf.rra
%BOOT_VOL%\Boot\BCD
%PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\layo9923.rra
%PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setup.ibt
%CommonProgramFiles%\InstallShield\UpdateService\agen9cab.rra
%PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setup.ini
%PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setu9ab8.rra
%PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setu9af7.rra
%CommonProgramFiles%\InstallShield\UpdateService\ISUSa005.rra
%PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\Humsa331.rra
C:\ProgramData\InstallShield\UpdateService\Database\{2669AB9B-99D0-401B-B802-3FE4828286F9}.ini
%PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\Humsa2e3.rra
%PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\cidca16c.rra
%PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\HUMSa295.rra
C:\ProgramData\InstallShield\UpdateService\Database\{4D2778E5-AD01-4e75-A6DA-1D5831514609}.ini
C:\ProgramData\InstallShield\UpdateService\Database\isuspm.ini
%TEMP%\_isdelet.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Program Updates.lnk
%PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\_setup.dll
%CommonProgramFiles%\InstallShield\UpdateService\images\lefta044.rra
%CommonProgramFiles%\InstallShield\UpdateService\images\lefta053.rra
%CommonProgramFiles%\InstallShield\UpdateService\images\Helpa034.rra
%CommonProgramFiles%\InstallShield\UpdateService\images\backa015.rra
%CommonProgramFiles%\InstallShield\UpdateService\images\Filea025.rra
%PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\CIDCa10f.rra
%PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\WdfCa11e.rra
%PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\CIDCa0ff.rra
%TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\ISUSa0d0.rra
<SYSTEM32>\ISUSa0e0.rra
%BOOT_VOL%\Boot\BCD.LOG
%APPDATA%\Roaming\Microsoft\Protect\S-1-5-21-2832440558-3064306045-1455513625-1000\cef410db-6006-4aab-9175-05458f999631
%APPDATA%\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2832440558-3064306045-1455513625-1000\4b59e9b7ab1c32cbcdfcf3111f25c0e0_97c09787-6498-4b10-8f65-9471d842c55e
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp8F45.tmp\temp.000
%TEMP%\iss8DBE.tmp\setup.ini
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\set8FA4.tmp
%TEMP%\isp9BD5.tmp\temp.000
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iKeA03C.tmp
%TEMP%\_se9E29.tmp
%TEMP%\igd9C92.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp9C34.tmp\temp.000
%TEMP%\bye8A15.tmp\Disk1\setup.ibt
%TEMP%\bye8A15.tmp\Disk1\data1.hdr
%TEMP%\bye8A15.tmp\Disk1\engine32.cab
%TEMP%\RarSFX0\Setup.exe
%TEMP%\ISPackFiles.ini
%TEMP%\bye8A15.tmp\Disk1\setup.ini
%TEMP%\bye8A15.tmp\Disk1\layout.bin
%TEMP%\bye8A15.tmp\Disk1\setup.inx
%TEMP%\bye8A15.tmp\Disk1\data1.cab
%TEMP%\bye8A15.tmp\Disk1\setup.exe
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\DotA25F.tmp
%TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\Stric11c.rra
%TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\isrtc17a.rra
%TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\Fontc004.rra
%TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\HsInbcf8.rra
%TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\corebedb.rra
C:\System Volume Information\Syscache.hve.LOG1
C:\System Volume Information\Syscache.hve
%WINDIR%\setup.iss
%TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\defac1b8.rra
%TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\_IsRc206.rra
%CommonProgramFiles%\InstallShield\Professional\RunTime\IsPA908.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\IsProBE.tlb
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iusA771.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\ctoA425.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iscA5CB.tmp
%TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setubb52.rra
%TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\licebc8a.rra
%TEMP%\b579.rra
%CommonProgramFiles%\InstallShield\Professional\RunTime\iKernel.rgs
%CommonProgramFiles%\InstallShield\Professional\RunTime\ObjAB69.tmp

Deletes the following files:

%TEMP%\bye8A15.tmp\Disk1\data1.cab
%TEMP%\bye8A15.tmp\Disk1\setup.exe
%TEMP%\bye8A15.tmp\Disk1\setup.inx
%TEMP%\bye8A15.tmp\Disk1\engine32.cab
%TEMP%\bye8A15.tmp\Disk1\setup.ibt
%TEMP%\bye8A15.tmp\Disk1\data1.hdr
%TEMP%\bye8A15.tmp\Disk1\setup.ini
%TEMP%\isp9BD5.tmp\_Setup.dll
%TEMP%\_isdelet.ini
%TEMP%\RarSFX0\Setup.exe
%TEMP%\bye8A15.tmp\Disk1\layout.bin
%TEMP%\ISPackFiles.ini
%TEMP%\iss8DBE.tmp\setup.ini
%APPDATA%\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2832440558-3064306045-1455513625-1000\4b59e9b7ab1c32cbcdfcf3111f25c0e0_97c09787-6498-4b10-8f65-9471d842c55e
%CommonProgramFiles%\InstallShield\Professional\RunTime\IsPA908.tmp
%TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\_IsRes.dll
%TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\default.pal
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\set8FA4.tmp
%TEMP%\igd9C92.tmp
%TEMP%\_se9E29.tmp
%TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\isrt.dll
%TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\HsInst.dll
%TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\license.rtf
%TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setup.inx
%TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\StringTable-0804-Chinese (Simplified).ips
%TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\FontData.ini
%TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\corecomp.ini

Moves the following files:

from %CommonProgramFiles%\InstallShield\UpdateService\_isp9fe6.rra to %CommonProgramFiles%\InstallShield\UpdateService\_ispmres.dll
from %CommonProgramFiles%\InstallShield\UpdateService\pm9f98.rra to %CommonProgramFiles%\InstallShield\UpdateService\pm.html
from %CommonProgramFiles%\InstallShield\UpdateService\pm9eae.rra to %CommonProgramFiles%\InstallShield\UpdateService\pm.css
from %CommonProgramFiles%\InstallShield\UpdateService\images\Filea025.rra to %CommonProgramFiles%\InstallShield\UpdateService\images\File16.gif
from %CommonProgramFiles%\InstallShield\UpdateService\images\backa015.rra to %CommonProgramFiles%\InstallShield\UpdateService\images\background.jpg
from %CommonProgramFiles%\InstallShield\UpdateService\ISUSa005.rra to %CommonProgramFiles%\InstallShield\UpdateService\ISUSPM.exe.manifest
from %CommonProgramFiles%\InstallShield\UpdateService\ISUS9e51.rra to %CommonProgramFiles%\InstallShield\UpdateService\ISUSPM.exe
from %WINDIR%\Downloaded Program Files\dwus9da5.rra to %WINDIR%\Downloaded Program Files\dwusplay.exe
from %WINDIR%\Downloaded Program Files\isus9d47.rra to %WINDIR%\Downloaded Program Files\isusweb.dll
from %CommonProgramFiles%\InstallShield\UpdateService\ISDM9cda.rra to %CommonProgramFiles%\InstallShield\UpdateService\ISDM.exe
from %CommonProgramFiles%\InstallShield\UpdateService\_isu9e31.rra to %CommonProgramFiles%\InstallShield\UpdateService\_isusres.dll
from %CommonProgramFiles%\InstallShield\UpdateService\issc9de3.rra to %CommonProgramFiles%\InstallShield\UpdateService\issch.exe
from %WINDIR%\Downloaded Program Files\dwus9dc4.rra to %WINDIR%\Downloaded Program Files\dwusplay.dll
from %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\HUMSa295.rra to %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\HUMS.SYS
from %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\cidca16c.rra to %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\cidcusb.cat
from %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\WdfCa11e.rra to %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\WdfCoinstaller.dll
from %TEMP%\b579.rra to %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setup.ilg
from %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\Humsa331.rra to %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\Humspdr.pdr
from %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\Humsa2e3.rra to %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\Hums.inf
from %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\CIDCa10f.rra to %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\CIDCUSB.sys
from %CommonProgramFiles%\InstallShield\UpdateService\images\lefta053.rra to %CommonProgramFiles%\InstallShield\UpdateService\images\left_task2.gif
from %CommonProgramFiles%\InstallShield\UpdateService\images\lefta044.rra to %CommonProgramFiles%\InstallShield\UpdateService\images\left_task.gif
from %CommonProgramFiles%\InstallShield\UpdateService\images\Helpa034.rra to %CommonProgramFiles%\InstallShield\UpdateService\images\HelpDoc16.gif
from %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\CIDCa0ff.rra to %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\CIDCUSB.inf
from <SYSTEM32>\ISUSa0e0.rra to <SYSTEM32>\ISUSPM.cpl
from %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\ISUSa0d0.rra to %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\ISUSRT.ini
from %CommonProgramFiles%\InstallShield\UpdateService\agen9cab.rra to %CommonProgramFiles%\InstallShield\UpdateService\agent.exe
from %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iusA771.tmp to %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iuser.dll
from %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iscA5CB.tmp to %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iscript.dll
from %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\ctoA425.tmp to %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\ctor.dll
from %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\licebc8a.rra to %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\license.rtf
from %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setubb52.rra to %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setup.inx
from %CommonProgramFiles%\InstallShield\Professional\RunTime\ObjAB69.tmp to %CommonProgramFiles%\InstallShield\Professional\RunTime\Objectps.dll
from %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\DotA25F.tmp to %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\DotNetInstaller.exe
from %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp9C34.tmp\temp.000 to %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp9C34.tmp\IGdi.dll
from %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp8F45.tmp\setup.dll to %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\setup.dll
from %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp8F45.tmp\temp.000 to %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp8F45.tmp\setup.dll
from %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iKeA03C.tmp to %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iKernel.dll
from %TEMP%\isp9BD5.tmp\temp.000 to %TEMP%\isp9BD5.tmp\_Setup.dll
from %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp9C34.tmp\IGdi.dll to %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iGdi.dll
from %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\data99de.rra to %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\data1.cab
from %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\data99bf.rra to %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\data1.hdr
from %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\layo9923.rra to %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\layout.bin
from %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setu9af7.rra to %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setup.ini
from %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setu9ab8.rra to %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setup.inx
from %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setu9a89.rra to %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setup.exe
from %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\_IsRc206.rra to %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\_IsRes.dll
from %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\Fontc004.rra to %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\FontData.ini
from %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\corebedb.rra to %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\corecomp.ini
from %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\HsInbcf8.rra to %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\HsInst.dll
from %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\defac1b8.rra to %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\default.pal
from %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\isrtc17a.rra to %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\isrt.dll
from %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\Stric11c.rra to %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\StringTable-0804-Chinese (Simplified).ips

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: ''
ClassName: 'OleMainThreadWndClass' WindowName: ''
ClassName: 'EDIT' WindowName: ''

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial