Technical Information
Modifies file system:
Creates the following files:
- C:\temp\mono2013\ftd2xx.h
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\Disk1\setup.log
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_IsR204b.rra
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\defa200c.rra
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\isrt1fae.rra
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Stri1f70.rra
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\DIFx1f31.rra
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Font1f02.rra
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\dotn1ec4.rra
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\core1e95.rra
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_ISU1e57.rra
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Setu1e08.rra
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Lice1dda.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\layo5082.rra
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem5.CAT
- %WINDIR%\Temp\Unin5862.rra
- %WINDIR%\Temp\Unin5843.rra
- %WINDIR%\Temp\Dele5804.rra
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\ser257c6.rra
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\ser25797.rra
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\pnpr5739.rra
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\pl23570a.rra
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\Ser256cc.rra
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\Inst563f.rra
- %WINDIR%\Temp\QRem55e1.rra
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\QRem5584.rra
- %WINDIR%\inf\SERW5507.rra
- <SYSTEM32>\SERS5499.rra
- %WINDIR%\inf\SERS54c8.rra
- <SYSTEM32>\SER9546a.rra
- %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.ini
- %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setu53ed.rra
- %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setu53af.rra
- %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\ISSe5341.rra
- %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_Set5303.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setu5228.rra
- %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data50e0.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data50b1.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- %WINDIR%\inf\oem5.inf
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setu1d8b.rra
- %TEMP%\1abd.rra
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\setup.ini
- C:\temp\mono2013\dpinst.xml
- C:\temp\mono2013\db-inst.bat
- C:\temp\mono2013\Static\i386\ftd2xx.lib
- C:\temp\mono2013\Static\amd64\ftd2xx.lib
- C:\temp\mono2013\i386\ftserui2.dll
- C:\temp\mono2013\i386\ftser2k.sys
- C:\temp\mono2013\i386\ftlang.dll
- C:\temp\mono2013\i386\ftdibus.sys
- C:\temp\mono2013\i386\ftd2xx.lib
- C:\temp\mono2013\i386\ftd2xx.dll
- C:\temp\mono2013\i386\ftcserco.dll
- C:\temp\mono2013\i386\ftbusui.dll
- C:\temp\mono2013\amd64\ftserui2.dll
- C:\temp\mono2013\amd64\ftser2k.sys
- C:\temp\mono2013\amd64\ftlang.dll
- C:\temp\mono2013\amd64\ftdibus.sys
- C:\temp\mono2013\amd64\ftd2xx64.dll
- C:\temp\mono2013\amd64\ftd2xx.lib
- C:\temp\mono2013\amd64\ftcserco.dll
- C:\temp\mono2013\amd64\ftbusui.dll
- C:\temp\mono2013\PL2303_Prolific_DriverInstaller_v1.5.0.exe
- C:\temp\mono2013\OS_Detect.exe
- C:\temp\mono2013\monolink_universal_v1_9_3.msi
- C:\temp\mono2013\ftdiport.inf
- C:\temp\mono2013\ftdiport.cat
- C:\temp\mono2013\ftdibus.inf
- C:\temp\mono2013\ftdibus.cat
- C:\temp\mono2013\DPInst_Monx64.exe
- C:\temp\mono2013\DPInst_Monx86.exe
- C:\temp\mono2013\DPInstx64.exe
- C:\temp\mono2013\DPInstx86.exe
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\Disk1\_Setup.dll
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\Disk1\setup.iss
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\Disk1\setup.inx
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\Disk1\setup.ini
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\Disk1\setup.exe
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\Disk1\layout.bin
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\Disk1\ISSetup.dll
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\Disk1\data1.hdr
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\Disk1\data1.cab
- %WINDIR%\inf\oem4.PNF
- %WINDIR%\inf\oem4.inf
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
- <SYSTEM32>\DRVSTORE\ftdiport_0EFDBCB5E96F0C2519E4BAB3ACFF9710D0110630\i386\ftserui2.dll
- <SYSTEM32>\DRVSTORE\ftdiport_0EFDBCB5E96F0C2519E4BAB3ACFF9710D0110630\i386\ftser2k.sys
- <SYSTEM32>\DRVSTORE\ftdiport_0EFDBCB5E96F0C2519E4BAB3ACFF9710D0110630\i386\ftcserco.dll
- <SYSTEM32>\DRVSTORE\ftdiport_0EFDBCB5E96F0C2519E4BAB3ACFF9710D0110630\ftdiport.cat
- <SYSTEM32>\DRVSTORE\ftdiport_0EFDBCB5E96F0C2519E4BAB3ACFF9710D0110630\ftdiport.inf
- %WINDIR%\inf\oem3.PNF
- %WINDIR%\inf\oem3.inf
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- <SYSTEM32>\DRVSTORE\ftdibus_393D217A384FCA9FA355A3389273055B6988059E\i386\ftbusui.dll
- <SYSTEM32>\DRVSTORE\ftdibus_393D217A384FCA9FA355A3389273055B6988059E\i386\ftdibus.sys
- <SYSTEM32>\DRVSTORE\ftdibus_393D217A384FCA9FA355A3389273055B6988059E\i386\FTLang.Dll
- <SYSTEM32>\DRVSTORE\ftdibus_393D217A384FCA9FA355A3389273055B6988059E\i386\ftd2xx.dll
- <SYSTEM32>\DRVSTORE\ftdibus_393D217A384FCA9FA355A3389273055B6988059E\ftdibus.cat
- <SYSTEM32>\DRVSTORE\ftdibus_393D217A384FCA9FA355A3389273055B6988059E\ftdibus.inf
- %WINDIR%\DPINST.LOG
- C:\temp\mono2013\DefaultRecipe.rdd
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\_Setup.dll
- %WINDIR%\inf\oem5.PNF
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem5.CAT
Deletes the following files:
- %WINDIR%\inf\SERWPL.INF
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\Disk1\_Setup.dll
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\Disk1\setup.iss
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\Disk1\setup.inx
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\Disk1\setup.ini
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\Disk1\setup.exe
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\Disk1\layout.bin
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\Disk1\ISSetup.dll
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\Disk1\data1.hdr
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\Disk1\data1.cab
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.inx
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\_Setup.dll
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\License.txt
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_ISUser.dll
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\corecomp.ini
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\dotnetinstaller.exe
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\FontData.ini
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\DIFxData.ini
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\StringTable-0009-English.ips
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\isrt.dll
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\default.pal
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_IsRes.dll
- %WINDIR%\inf\SERSPL.INF
- %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\SetupEx.dll
- %TEMP%\{FDBD1A6C-3EE1-4D43-815A-59B73138A78F}\setup.ini
Moves the following files:
- from %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setu1d8b.rra to %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.inx
- from <SYSTEM32>\SER9546a.rra to <SYSTEM32>\SER9PL.sys
- from <SYSTEM32>\SERS5499.rra to <SYSTEM32>\SERSPL.VXD
- from %WINDIR%\inf\SERS54c8.rra to %WINDIR%\inf\SERSPL.INF
- from %WINDIR%\inf\SERW5507.rra to %WINDIR%\inf\SERWPL.INF
- from %WINDIR%\Temp\QRem55e1.rra to %WINDIR%\Temp\QRemover.exe
- from %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\Inst563f.rra to %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\InstallDriver.exe
- from %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\QRem5584.rra to %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\QRemover.exe
- from %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\Ser256cc.rra to %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\Ser2pl64.sys
- from %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\pl23570a.rra to %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\pl2303.cat
- from %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\pnpr5739.rra to %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\pnpreg.exe
- from %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\ser25797.rra to %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\ser2pl.inf
- from %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\ser257c6.rra to %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\XP\ser2pl.sys
- from %WINDIR%\Temp\Dele5804.rra to %WINDIR%\Temp\DeleteUSB.exe
- from %WINDIR%\Temp\Unin5843.rra to %WINDIR%\Temp\Uninstall.ICO
- from %WINDIR%\Temp\Unin5862.rra to %WINDIR%\Temp\Uninstall.exe
- from %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setu53ed.rra to %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.ini
- from %WINDIR%\Temp\Uninstall.exe to %WINDIR%\Temp\PLUninst.exe
- from %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setu53af.rra to %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.inx
- from %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_Set5303.rra to %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_Setup.dll
- from %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Lice1dda.rra to %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\License.txt
- from %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Setu1e08.rra to %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\SetupEx.dll
- from %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_ISU1e57.rra to %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_ISUser.dll
- from %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\core1e95.rra to %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\corecomp.ini
- from %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\dotn1ec4.rra to %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\dotnetinstaller.exe
- from %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Font1f02.rra to %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\FontData.ini
- from %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\DIFx1f31.rra to %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\DIFxData.ini
- from %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Stri1f70.rra to %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\StringTable-0009-English.ips
- from %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\isrt1fae.rra to %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\isrt.dll
- from %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\defa200c.rra to %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\default.pal
- from %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_IsR204b.rra to %TEMP%\{C09930C7-E470-4AEB-A446-24FF9FCDEBF5}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_IsRes.dll
- from %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\layo5082.rra to %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\layout.bin
- from %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data50b1.rra to %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data1.hdr
- from %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data50e0.rra to %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data1.cab
- from %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setu5228.rra to %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.exe
- from %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\ISSe5341.rra to %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\ISSetup.dll
- from %TEMP%\1abd.rra to %ProgramFiles%\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.ilg
Network activity:
Connects to:
- 'wp#d':80
- '20#.#6.232.182':80
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
- http://crl.microsoft.com/pki/crl/products/MicrosoftRootAuthority.crl via 20#.#6.232.182
- http://crl.microsoft.com/pki/crl/products/MicWinHarComPCA_2010-11-01.crl via 20#.#6.232.182
- http://crl.microsoft.com/pki/crl/products/tspca.crl via 20#.#6.232.182
UDP:
- DNS ASK wp#d
- DNS ASK crl.microsoft.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- 'C:\temp\mono2013\OS_Detect.exe'
- 'C:\temp\mono2013\DPInst_Monx86.exe'
- 'C:\temp\mono2013\DPInstx86.exe'
- 'C:\temp\mono2013\PL2303_Prolific_DriverInstaller_v1.5.0.exe' /s
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""C:\temp\mono2013\db-inst.bat" "
