Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ISUSScheduler' = '"%CommonProgramFiles%\InstallShield\UpdateService\issch.exe" -start'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ISUSPM Startup' = '%CommonProgramFiles%\InstallShield\UpdateService\isuspm.exe -startup'
Вредоносные функции:
Создает и запускает на исполнение:
- '%CommonProgramFiles%\InstallShield\UpdateService\isuspm.exe' -bootstrap
- '%CommonProgramFiles%\InstallShield\UpdateService\agent.exe' /ssi{2669AB9B-99D0-401B-B802-3FE4828286F9},30:CECB90E899DCC7BF9EAC20D89E9C978F69ECD78F799B90D8CEBB072F8EEB67E8E9ACE78FFEAC Default
- '%CommonProgramFiles%\InstallShield\UpdateService\agent.exe' -Embedding
- '%CommonProgramFiles%\InstallShield\UpdateService\issch.exe' -start
- '%CommonProgramFiles%\InstallShield\UpdateService\issch.exe' -set "%CommonProgramFiles%\InstallShield\UpdateService\isuspm.exe /scheduler" -wk 1
- '%WINDIR%\Downloaded Program Files\dwusplay.EXE' /REGSTUB"%WINDIR%\Downloaded Program Files\dwusplay.dll"
- '%TEMP%\RarSFX0\Setup.exe'
- '%TEMP%\RarSFX0\Setup.exe' RE /r /s
- '%CommonProgramFiles%\InstallShield\UpdateService\agent.exe' /REGSERVER
- '%WINDIR%\Downloaded Program Files\dwusplay.exe' /REGSERVER
- '%CommonProgramFiles%\InstallShield\UpdateService\ISDM.exe' /REGSERVER
Запускает на исполнение:
- '<SYSTEM32>\taskhost.exe' /l{2669AB9B-99D0-401B-B802-3FE4828286F9} /1033
- '<SYSTEM32>\svchost.exe' -k swprv
- '<SYSTEM32>\vssvc.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Downloaded Program Files\dwus9dc4.rra
- %CommonProgramFiles%\InstallShield\UpdateService\issc9de3.rra
- %WINDIR%\Downloaded Program Files\dwus9da5.rra
- %CommonProgramFiles%\InstallShield\UpdateService\ISDM9cda.rra
- %WINDIR%\Downloaded Program Files\isus9d47.rra
- %CommonProgramFiles%\InstallShield\UpdateService\pm9f98.rra
- %CommonProgramFiles%\InstallShield\UpdateService\_isp9fe6.rra
- %CommonProgramFiles%\InstallShield\UpdateService\pm9eae.rra
- %CommonProgramFiles%\InstallShield\UpdateService\_isu9e31.rra
- %CommonProgramFiles%\InstallShield\UpdateService\ISUS9e51.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\data99de.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setu9a89.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\data99bf.rra
- %BOOT_VOL%\Boot\BCD
- %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\layo9923.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setup.ibt
- %CommonProgramFiles%\InstallShield\UpdateService\agen9cab.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setup.ini
- %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setu9ab8.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setu9af7.rra
- %CommonProgramFiles%\InstallShield\UpdateService\ISUSa005.rra
- %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\Humsa331.rra
- C:\ProgramData\InstallShield\UpdateService\Database\{2669AB9B-99D0-401B-B802-3FE4828286F9}.ini
- %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\Humsa2e3.rra
- %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\cidca16c.rra
- %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\HUMSa295.rra
- C:\ProgramData\InstallShield\UpdateService\Database\{4D2778E5-AD01-4e75-A6DA-1D5831514609}.ini
- C:\ProgramData\InstallShield\UpdateService\Database\isuspm.ini
- %TEMP%\_isdelet.ini
- C:\ProgramData\Microsoft\Windows\Start Menu\Program Updates.lnk
- %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\_setup.dll
- %CommonProgramFiles%\InstallShield\UpdateService\images\lefta044.rra
- %CommonProgramFiles%\InstallShield\UpdateService\images\lefta053.rra
- %CommonProgramFiles%\InstallShield\UpdateService\images\Helpa034.rra
- %CommonProgramFiles%\InstallShield\UpdateService\images\backa015.rra
- %CommonProgramFiles%\InstallShield\UpdateService\images\Filea025.rra
- %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\CIDCa10f.rra
- %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\WdfCa11e.rra
- %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\CIDCa0ff.rra
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\ISUSa0d0.rra
- <SYSTEM32>\ISUSa0e0.rra
- %BOOT_VOL%\Boot\BCD.LOG
- %APPDATA%\Roaming\Microsoft\Protect\S-1-5-21-2832440558-3064306045-1455513625-1000\cef410db-6006-4aab-9175-05458f999631
- %APPDATA%\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2832440558-3064306045-1455513625-1000\4b59e9b7ab1c32cbcdfcf3111f25c0e0_97c09787-6498-4b10-8f65-9471d842c55e
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp8F45.tmp\temp.000
- %TEMP%\iss8DBE.tmp\setup.ini
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\set8FA4.tmp
- %TEMP%\isp9BD5.tmp\temp.000
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iKeA03C.tmp
- %TEMP%\_se9E29.tmp
- %TEMP%\igd9C92.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp9C34.tmp\temp.000
- %TEMP%\bye8A15.tmp\Disk1\setup.ibt
- %TEMP%\bye8A15.tmp\Disk1\data1.hdr
- %TEMP%\bye8A15.tmp\Disk1\engine32.cab
- %TEMP%\RarSFX0\Setup.exe
- %TEMP%\ISPackFiles.ini
- %TEMP%\bye8A15.tmp\Disk1\setup.ini
- %TEMP%\bye8A15.tmp\Disk1\layout.bin
- %TEMP%\bye8A15.tmp\Disk1\setup.inx
- %TEMP%\bye8A15.tmp\Disk1\data1.cab
- %TEMP%\bye8A15.tmp\Disk1\setup.exe
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\DotA25F.tmp
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\Stric11c.rra
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\isrtc17a.rra
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\Fontc004.rra
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\HsInbcf8.rra
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\corebedb.rra
- C:\System Volume Information\Syscache.hve.LOG1
- C:\System Volume Information\Syscache.hve
- %WINDIR%\setup.iss
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\defac1b8.rra
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\_IsRc206.rra
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsPA908.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsProBE.tlb
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iusA771.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\ctoA425.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iscA5CB.tmp
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setubb52.rra
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\licebc8a.rra
- %TEMP%\b579.rra
- %CommonProgramFiles%\InstallShield\Professional\RunTime\iKernel.rgs
- %CommonProgramFiles%\InstallShield\Professional\RunTime\ObjAB69.tmp
Удаляет следующие файлы:
- %TEMP%\bye8A15.tmp\Disk1\data1.cab
- %TEMP%\bye8A15.tmp\Disk1\setup.exe
- %TEMP%\bye8A15.tmp\Disk1\setup.inx
- %TEMP%\bye8A15.tmp\Disk1\engine32.cab
- %TEMP%\bye8A15.tmp\Disk1\setup.ibt
- %TEMP%\bye8A15.tmp\Disk1\data1.hdr
- %TEMP%\bye8A15.tmp\Disk1\setup.ini
- %TEMP%\isp9BD5.tmp\_Setup.dll
- %TEMP%\_isdelet.ini
- %TEMP%\RarSFX0\Setup.exe
- %TEMP%\bye8A15.tmp\Disk1\layout.bin
- %TEMP%\ISPackFiles.ini
- %TEMP%\iss8DBE.tmp\setup.ini
- %APPDATA%\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2832440558-3064306045-1455513625-1000\4b59e9b7ab1c32cbcdfcf3111f25c0e0_97c09787-6498-4b10-8f65-9471d842c55e
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsPA908.tmp
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\_IsRes.dll
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\default.pal
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\set8FA4.tmp
- %TEMP%\igd9C92.tmp
- %TEMP%\_se9E29.tmp
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\isrt.dll
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\HsInst.dll
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\license.rtf
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setup.inx
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\StringTable-0804-Chinese (Simplified).ips
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\FontData.ini
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\corecomp.ini
Перемещает следующие файлы:
- %CommonProgramFiles%\InstallShield\UpdateService\_isp9fe6.rra в %CommonProgramFiles%\InstallShield\UpdateService\_ispmres.dll
- %CommonProgramFiles%\InstallShield\UpdateService\pm9f98.rra в %CommonProgramFiles%\InstallShield\UpdateService\pm.html
- %CommonProgramFiles%\InstallShield\UpdateService\pm9eae.rra в %CommonProgramFiles%\InstallShield\UpdateService\pm.css
- %CommonProgramFiles%\InstallShield\UpdateService\images\Filea025.rra в %CommonProgramFiles%\InstallShield\UpdateService\images\File16.gif
- %CommonProgramFiles%\InstallShield\UpdateService\images\backa015.rra в %CommonProgramFiles%\InstallShield\UpdateService\images\background.jpg
- %CommonProgramFiles%\InstallShield\UpdateService\ISUSa005.rra в %CommonProgramFiles%\InstallShield\UpdateService\ISUSPM.exe.manifest
- %CommonProgramFiles%\InstallShield\UpdateService\ISUS9e51.rra в %CommonProgramFiles%\InstallShield\UpdateService\ISUSPM.exe
- %WINDIR%\Downloaded Program Files\dwus9da5.rra в %WINDIR%\Downloaded Program Files\dwusplay.exe
- %WINDIR%\Downloaded Program Files\isus9d47.rra в %WINDIR%\Downloaded Program Files\isusweb.dll
- %CommonProgramFiles%\InstallShield\UpdateService\ISDM9cda.rra в %CommonProgramFiles%\InstallShield\UpdateService\ISDM.exe
- %CommonProgramFiles%\InstallShield\UpdateService\_isu9e31.rra в %CommonProgramFiles%\InstallShield\UpdateService\_isusres.dll
- %CommonProgramFiles%\InstallShield\UpdateService\issc9de3.rra в %CommonProgramFiles%\InstallShield\UpdateService\issch.exe
- %WINDIR%\Downloaded Program Files\dwus9dc4.rra в %WINDIR%\Downloaded Program Files\dwusplay.dll
- %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\HUMSa295.rra в %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\HUMS.SYS
- %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\cidca16c.rra в %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\cidcusb.cat
- %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\WdfCa11e.rra в %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\WdfCoinstaller.dll
- %TEMP%\b579.rra в %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setup.ilg
- %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\Humsa331.rra в %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\Humspdr.pdr
- %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\Humsa2e3.rra в %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\Hums.inf
- %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\CIDCa10f.rra в %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\CIDCUSB.sys
- %CommonProgramFiles%\InstallShield\UpdateService\images\lefta053.rra в %CommonProgramFiles%\InstallShield\UpdateService\images\left_task2.gif
- %CommonProgramFiles%\InstallShield\UpdateService\images\lefta044.rra в %CommonProgramFiles%\InstallShield\UpdateService\images\left_task.gif
- %CommonProgramFiles%\InstallShield\UpdateService\images\Helpa034.rra в %CommonProgramFiles%\InstallShield\UpdateService\images\HelpDoc16.gif
- %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\CIDCa0ff.rra в %PROGRAM_FILES%\CIDC\»ЄґуuKeyCI800ЦЗДЬГЬВлФїіЧЗэ¶Ї\CIDCUSB.inf
- <SYSTEM32>\ISUSa0e0.rra в <SYSTEM32>\ISUSPM.cpl
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\ISUSa0d0.rra в %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\ISUSRT.ini
- %CommonProgramFiles%\InstallShield\UpdateService\agen9cab.rra в %CommonProgramFiles%\InstallShield\UpdateService\agent.exe
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iusA771.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iuser.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iscA5CB.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iscript.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\ctoA425.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\ctor.dll
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\licebc8a.rra в %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\license.rtf
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setubb52.rra в %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setup.inx
- %CommonProgramFiles%\InstallShield\Professional\RunTime\ObjAB69.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\Objectps.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\DotA25F.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\DotNetInstaller.exe
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp9C34.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp9C34.tmp\IGdi.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp8F45.tmp\setup.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp8F45.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp8F45.tmp\setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iKeA03C.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iKernel.dll
- %TEMP%\isp9BD5.tmp\temp.000 в %TEMP%\isp9BD5.tmp\_Setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp9C34.tmp\IGdi.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iGdi.dll
- %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\data99de.rra в %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\data1.cab
- %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\data99bf.rra в %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\data1.hdr
- %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\layo9923.rra в %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\layout.bin
- %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setu9af7.rra в %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setup.ini
- %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setu9ab8.rra в %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setup.inx
- %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setu9a89.rra в %PROGRAM_FILES%\InstallShield Installation Information\{2669AB9B-99D0-401B-B802-3FE4828286F9}\setup.exe
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\_IsRc206.rra в %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\_IsRes.dll
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\Fontc004.rra в %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\FontData.ini
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\corebedb.rra в %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\corecomp.ini
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\HsInbcf8.rra в %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\HsInst.dll
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\defac1b8.rra в %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\default.pal
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\isrtc17a.rra в %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\isrt.dll
- %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\Stric11c.rra в %TEMP%\{36D97CA7-3AD9-46E6-9F38-268980572D9B}\{2669AB9B-99D0-401B-B802-3FE4828286F9}\StringTable-0804-Chinese (Simplified).ips
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
