Trojan.MulDrop6.62021

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ClearTKHandle' = '%ProgramFiles%\eGalaxTouch\ClearTKHandle.exe'

Вредоносные функции:

Запускает на исполнение:

'%TEMP%\RarSFX0\InoTouch\setup.exe' /s

Изменения в файловой системе:

Создает следующие файлы:

C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
%ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\setu6b33.rra
%ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\_Set6b91.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
%ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\data6aa7.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
%ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\data6ac6.rra
%ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\ISSe6bc0.rra
%ProgramFiles%\eGalaxTouch\logo6da4.rra
%ProgramFiles%\eGalaxTouch\Decl6d85.rra
%ProgramFiles%\eGalaxTouch\m2r6de3.rra
%ProgramFiles%\eGalaxTouch\m2l6dc3.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\setu6c5c.rra
%ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\setu6c1e.rra
%WINDIR%\Cursors\TKT_6d56.rra
%ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\setup.ini
%ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\layo6a78.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\defa3de9.rra
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\isrt3d9b.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\_IsR3e18.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
%ProgramFiles%\eGalaxTouch\touc6e02.rra
%ProgramFiles%\eGalaxTouch\comb78b0.rra
%WINDIR%\inf\comb7881.rra
%ProgramFiles%\eGalaxTouch\comb791e.rra
%ProgramFiles%\eGalaxTouch\comb78df.rra
%ProgramFiles%\eGalaxTouch\sert7853.rra
%ProgramFiles%\eGalaxTouch\xtou77a7.rra
%ProgramFiles%\eGalaxTouch\Moni7759.rra
%ProgramFiles%\eGalaxTouch\sert7824.rra
%ProgramFiles%\eGalaxTouch\xtou77f5.rra
%ProgramFiles%\eGalaxTouch\xTou795c.rra
%WINDIR%\inf\oem3.inf
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
%WINDIR%\inf\oem3.PNF
<DRIVERS>\comb7ab4.rra
%ProgramFiles%\eGalaxTouch\devc79d9.rra
%ProgramFiles%\eGalaxTouch\SerT79aa.rra
<DRIVERS>\SerT7a66.rra
<DRIVERS>\xTou7a08.rra
%ProgramFiles%\eGalaxTouch\comb770a.rra
%ProgramFiles%\eGalaxTouch\Laun72b5.rra
%ProgramFiles%\eGalaxTouch\xAut7267.rra
%ProgramFiles%\eGalaxTouch\mfc47361.rra
%ProgramFiles%\eGalaxTouch\xTou72f4.rra
%ProgramFiles%\eGalaxTouch\xtku6edd.rra
%ProgramFiles%\eGalaxTouch\eGal6e40.rra
%ProgramFiles%\eGalaxTouch\prof6e21.rra
%ProgramFiles%\eGalaxTouch\xTou6e9e.rra
%ProgramFiles%\eGalaxTouch\Clea6e6f.rra
%ProgramFiles%\eGalaxTouch\msvc73ee.rra
<SYSTEM32>\eGal767e.rra
%ProgramFiles%\eGalaxTouch\eGal764f.rra
%ProgramFiles%\eGalaxTouch\ESC776dc.rra
%ProgramFiles%\eGalaxTouch\touc76ad.rra
%ProgramFiles%\eGalaxTouch\mouc7630.rra
%ProgramFiles%\eGalaxTouch\Ding75a3.rra
%ProgramFiles%\eGalaxTouch\User742c.rra
%ProgramFiles%\eGalaxTouch\sear7601.rra
%ProgramFiles%\eGalaxTouch\Ding75d2.rra
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\Stri3d7c.rra
%TEMP%\RarSFX0\InoTouch\global\touch.scat
%TEMP%\RarSFX0\InoTouch\global\TOUCH.INI
%TEMP%\RarSFX0\InoTouch\global\xAuto4PtsCal.exe
%TEMP%\RarSFX0\InoTouch\global\UserGuide.chm
%TEMP%\RarSFX0\InoTouch\global\TKT_BLK.CUR
%TEMP%\RarSFX0\InoTouch\global\PROFILE.TXT
%TEMP%\RarSFX0\InoTouch\global\msvcrt.dll
%TEMP%\RarSFX0\InoTouch\global\Thumbs.db
%TEMP%\RarSFX0\InoTouch\global\search.avi
%TEMP%\RarSFX0\InoTouch\global\xtkutility.dll
%TEMP%\RarSFX0\InoTouch\PS2setup.iss
%TEMP%\RarSFX0\InoTouch\layout.bin
%TEMP%\RarSFX0\InoTouch\setup.ini
%TEMP%\RarSFX0\InoTouch\setup.exe
%TEMP%\RarSFX0\InoTouch\ISSetup.dll
%TEMP%\RarSFX0\InoTouch\global\XTouch32EX.dll
%TEMP%\RarSFX0\InoTouch\global\xtkutility2k.dll
%TEMP%\RarSFX0\InoTouch\global\xTouchMon2k.exe
%TEMP%\RarSFX0\InoTouch\global\xTouchMon.exe
%TEMP%\RarSFX0\InoTouch\global\mouclass.sys
%TEMP%\RarSFX0\InoTouch\global\COMBUS.exe
%TEMP%\RarSFX0\InoTouch\global\ClearTKHandle.exe
%TEMP%\RarSFX0\InoTouch\global\Ding.wav
%TEMP%\RarSFX0\InoTouch\global\Declaration.pdf
%TEMP%\RarSFX0\InoTouch\Declaration.txt
%TEMP%\RarSFX0\InoTouch\data1.cab
%TEMP%\RarSFX0\InoTouch\Auto setup.exe.lnk
%TEMP%\RarSFX0\InoTouch\data2.cab
%TEMP%\RarSFX0\InoTouch\data1.hdr
%TEMP%\RarSFX0\InoTouch\global\DingCal.wav
%TEMP%\RarSFX0\InoTouch\global\m2R.bmp
%TEMP%\RarSFX0\InoTouch\global\m2L.bmp
%TEMP%\RarSFX0\InoTouch\global\MonitorMapping.exe
%TEMP%\RarSFX0\InoTouch\global\mfc42.dll
%TEMP%\RarSFX0\InoTouch\global\logo1.bmp
%TEMP%\RarSFX0\InoTouch\global\eGalaxTouch_reg.ini
%TEMP%\RarSFX0\InoTouch\global\eGalaxTouch.exe
%TEMP%\RarSFX0\InoTouch\global\LaunchTouchMon.exe
%TEMP%\RarSFX0\InoTouch\global\ESC7000.txt
%TEMP%\RarSFX0\InoTouch\setup.inx
%TEMP%\RarSFX0\InoTouch\XTouch32EX.dll
%TEMP%\RarSFX0\InoTouch\x86\xtouch.sys
%APPDATA%\Microsoft\Protect\CREDHIST
%TEMP%\RarSFX0\InoTouch\_Setup.dll
%TEMP%\RarSFX0\InoTouch\x86\xtouch.inf
%TEMP%\RarSFX0\InoTouch\x86\sertouch.inf
%TEMP%\RarSFX0\InoTouch\x86\sertouch.cat
%TEMP%\RarSFX0\InoTouch\x86\xtouch.cat
%TEMP%\RarSFX0\InoTouch\x86\sertouch.sys
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\8a79d3a9208601304565fac486a0adad_23ef5514-3059-436f-a4a7-4cefaab20eb1
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\dotn3d1e.rra
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\core3cef.rra
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\DIFx3d5d.rra
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\Font3d3e.rra
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\_ISU3cd0.rra
%TEMP%\{77A9406E-C40D-4658-BACD-D96B49FA83B0}\_Setup.dll
%TEMP%\{77A9406E-C40D-4658-BACD-D96B49FA83B0}\setup.ini
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\setu3c82.rra
%TEMP%\3ba7.rra
%TEMP%\RarSFX0\InoTouch\x86\DPInst.exe
%TEMP%\RarSFX0\InoTouch\x64\combus.sys
%TEMP%\RarSFX0\InoTouch\x64\combus.inf
%TEMP%\RarSFX0\InoTouch\x64\DPInst.exe
%TEMP%\RarSFX0\InoTouch\x64\devcon.exe
%TEMP%\RarSFX0\InoTouch\x64\combus.cat
%TEMP%\RarSFX0\InoTouch\setup.iss
%TEMP%\RarSFX0\InoTouch\setup.isn
%TEMP%\RarSFX0\InoTouch\TouchKit.xpo
%TEMP%\RarSFX0\InoTouch\setup.log
%TEMP%\RarSFX0\InoTouch\x64\sertouch.cat
%TEMP%\RarSFX0\InoTouch\x86\combus.inf
%TEMP%\RarSFX0\InoTouch\x86\combus.cat
%TEMP%\RarSFX0\InoTouch\x86\devcon.exe
%TEMP%\RarSFX0\InoTouch\x86\combus.sys
%TEMP%\RarSFX0\InoTouch\x64\xtouch.sys
%TEMP%\RarSFX0\InoTouch\x64\sertouch.sys
%TEMP%\RarSFX0\InoTouch\x64\sertouch.inf
%TEMP%\RarSFX0\InoTouch\x64\xtouch.inf
%TEMP%\RarSFX0\InoTouch\x64\xtouch.cat

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
%TEMP%\RarSFX0\InoTouch\global\Thumbs.db

Удаляет следующие файлы:

%TEMP%\RarSFX0\InoTouch\setup.log

Перемещает следующие файлы:

%ProgramFiles%\eGalaxTouch\eGal764f.rra в %ProgramFiles%\eGalaxTouch\eGalaxTouch_reg.ini
%ProgramFiles%\eGalaxTouch\mouc7630.rra в %ProgramFiles%\eGalaxTouch\mouclass.sys
%ProgramFiles%\eGalaxTouch\sear7601.rra в %ProgramFiles%\eGalaxTouch\search.avi
<SYSTEM32>\eGal767e.rra в <SYSTEM32>\eGalaxTouch_reg.ini
%ProgramFiles%\eGalaxTouch\comb770a.rra в %ProgramFiles%\eGalaxTouch\combus.exe
%ProgramFiles%\eGalaxTouch\ESC776dc.rra в %ProgramFiles%\eGalaxTouch\ESC7000.txt
%ProgramFiles%\eGalaxTouch\touc76ad.rra в %ProgramFiles%\eGalaxTouch\touch.scat
%ProgramFiles%\eGalaxTouch\mfc47361.rra в %ProgramFiles%\eGalaxTouch\mfc42.dll
%ProgramFiles%\eGalaxTouch\xTou72f4.rra в %ProgramFiles%\eGalaxTouch\xTouch32ex.dll
%ProgramFiles%\eGalaxTouch\Laun72b5.rra в %ProgramFiles%\eGalaxTouch\LaunchTouchMon.exe
%ProgramFiles%\eGalaxTouch\msvc73ee.rra в %ProgramFiles%\eGalaxTouch\msvcrt.dll
%ProgramFiles%\eGalaxTouch\Ding75d2.rra в %ProgramFiles%\eGalaxTouch\DingCal.wav
%ProgramFiles%\eGalaxTouch\Ding75a3.rra в %ProgramFiles%\eGalaxTouch\Ding.wav
%ProgramFiles%\eGalaxTouch\User742c.rra в %ProgramFiles%\eGalaxTouch\UserGuide.chm
%ProgramFiles%\eGalaxTouch\Moni7759.rra в %ProgramFiles%\eGalaxTouch\MonitorMapping.exe
%ProgramFiles%\eGalaxTouch\SerT79aa.rra в %ProgramFiles%\eGalaxTouch\SerTouch.sys
%ProgramFiles%\eGalaxTouch\xTou795c.rra в %ProgramFiles%\eGalaxTouch\xTouch.sys
%ProgramFiles%\eGalaxTouch\comb791e.rra в %ProgramFiles%\eGalaxTouch\combus.cat
%ProgramFiles%\eGalaxTouch\devc79d9.rra в %ProgramFiles%\eGalaxTouch\devcon.exe
<DRIVERS>\comb7ab4.rra в <DRIVERS>\combus.sys
<DRIVERS>\SerT7a66.rra в <DRIVERS>\SerTouch.sys
<DRIVERS>\xTou7a08.rra в <DRIVERS>\xTouch.sys
%ProgramFiles%\eGalaxTouch\sert7824.rra в %ProgramFiles%\eGalaxTouch\sertouch.inf
%ProgramFiles%\eGalaxTouch\xtou77f5.rra в %ProgramFiles%\eGalaxTouch\xtouch.cat
%ProgramFiles%\eGalaxTouch\xtou77a7.rra в %ProgramFiles%\eGalaxTouch\xtouch.inf
%ProgramFiles%\eGalaxTouch\sert7853.rra в %ProgramFiles%\eGalaxTouch\sertouch.cat
%ProgramFiles%\eGalaxTouch\comb78df.rra в %ProgramFiles%\eGalaxTouch\combus.sys
%ProgramFiles%\eGalaxTouch\comb78b0.rra в %ProgramFiles%\eGalaxTouch\combus.inf
%WINDIR%\inf\comb7881.rra в %WINDIR%\inf\combus.inf
%ProgramFiles%\eGalaxTouch\xAut7267.rra в %ProgramFiles%\eGalaxTouch\xAuto4PtsCal.exe
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\_IsR3e18.rra в %TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\_IsRes.dll
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\defa3de9.rra в %TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\default.pal
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\isrt3d9b.rra в %TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\isrt.dll
%ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\layo6a78.rra в %ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\layout.bin
%ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\setu6b33.rra в %ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\setup.exe
%ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\data6ac6.rra в %ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\data1.cab
%ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\data6aa7.rra в %ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\data1.hdr
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\core3cef.rra в %TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\corecomp.ini
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\_ISU3cd0.rra в %TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\_ISUser.dll
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\setu3c82.rra в %TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\setup.inx
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\dotn3d1e.rra в %TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\dotnetinstaller.exe
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\Stri3d7c.rra в %TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\StringTable-0009-English.ips
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\DIFx3d5d.rra в %TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\DIFxData.ini
%TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\Font3d3e.rra в %TEMP%\{9340EA3A-2E2E-4B68-82A9-4673C4C7697E}\{C6A750AE-6029-4435-9A8D-06507AA46798}\FontData.ini
%ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\_Set6b91.rra в %ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\_Setup.dll
%ProgramFiles%\eGalaxTouch\prof6e21.rra в %ProgramFiles%\eGalaxTouch\profile.txt
%ProgramFiles%\eGalaxTouch\touc6e02.rra в %ProgramFiles%\eGalaxTouch\touch.ini
%ProgramFiles%\eGalaxTouch\m2r6de3.rra в %ProgramFiles%\eGalaxTouch\m2r.bmp
%ProgramFiles%\eGalaxTouch\eGal6e40.rra в %ProgramFiles%\eGalaxTouch\eGalaxTouch.exe
%ProgramFiles%\eGalaxTouch\xtku6edd.rra в %ProgramFiles%\eGalaxTouch\xtkutility.dll
%ProgramFiles%\eGalaxTouch\xTou6e9e.rra в %ProgramFiles%\eGalaxTouch\xTouchMon.exe
%ProgramFiles%\eGalaxTouch\Clea6e6f.rra в %ProgramFiles%\eGalaxTouch\ClearTKHandle.exe
%ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\setu6c5c.rra в %ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\setup.ini
%ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\setu6c1e.rra в %ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\setup.inx
%ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\ISSe6bc0.rra в %ProgramFiles%\InstallShield Installation Information\{C6A750AE-6029-4435-9A8D-06507AA46798}\ISSetup.dll
%WINDIR%\Cursors\TKT_6d56.rra в %WINDIR%\Cursors\TKT_BLK.cur
%ProgramFiles%\eGalaxTouch\m2l6dc3.rra в %ProgramFiles%\eGalaxTouch\m2l.bmp
%ProgramFiles%\eGalaxTouch\logo6da4.rra в %ProgramFiles%\eGalaxTouch\logo1.bmp
%ProgramFiles%\eGalaxTouch\Decl6d85.rra в %ProgramFiles%\eGalaxTouch\Declaration.pdf

Подменяет следующие файлы:

%TEMP%\RarSFX0\InoTouch\setup.log

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'EDIT' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней