Trojan.Siggen18.4627

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\vrvd5] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\vrvd5] 'ImagePath' = 'system32\DRIVERS\vrvd5.sys'

Creates the following services

'vrvd5' system32\DRIVERS\vrvd5.sys

Modifies file system

Creates the following files

<Current directory>\languages\rcu_default.lng
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-convert-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-environment-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-filesystem-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-heap-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-locale-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-math-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-multibyte-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-memory-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-runtime-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-string-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-time-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-utility-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\ucrtbase.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-console-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-datetime-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-debug-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-timezone-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-util-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-sysinfo-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-synch-l1-2-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-synch-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-file-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-file-l1-2-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-file-l2-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-handle-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-heap-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-interlocked-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-libraryloader-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-errorhandling-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-crt-stdio-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-localization-l1-2-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-namedpipe-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-processenvironment-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-processthreads-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-processthreads-l1-1-1.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-profile-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-rtlsupport-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-string-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-errorhandling-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-memory-l1-1-1.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-file-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-file-l1-2-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-file-l2-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-heap-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-locale-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-math-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-multibyte-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-runtime-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-stdio-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-string-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-time-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\ucrtbase.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-debug-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\drvi32.log
%TEMP%\~rstemp\vrvd5-amd64.cat
%TEMP%\~rstemp\vrvd5-damd64.dll
%TEMP%\~rstemp\vrvd5-mamd64.sys
%TEMP%\~rstemp\vrvd5.inf
%TEMP%\~rstemp\drvi64.dll
%TEMP%\~rstemp\drvi64.log.log
<DRIVERS>\set29fc.tmp
C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-filesystem-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-processthreads-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-environment-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-processenvironment-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-handle-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-heap-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-interlocked-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-libraryloader-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-localization-l1-2-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-memory-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-memory-l1-1-1.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-namedpipe-l1-1-0.dll
<SYSTEM32>\set2a3c.tmp
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-util-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-processthreads-l1-1-1.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-profile-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-rtlsupport-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-string-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-synch-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-synch-l1-2-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-sysinfo-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-core-timezone-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-convert-l1-1-0.dll
C:\users\public\documents\rsupport\rcc50\api-ms-win-crt-utility-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-datetime-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_base\rs_eng_proxy.024
C:\users\public\documents\rsupport\common\update\grp_base\file014.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file015.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file016.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file017.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file018.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file019.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file020.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file000.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file021.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file023.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file024.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file025.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file026.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file027.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file028.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file029.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file012.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file013.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file011.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file010.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file009.rsz
<Current directory>\info.ini
C:\users\public\documents\rsupport\common\update\provs.zip
C:\users\public\documents\rsupport\common\temp\rsupportupdater\20220610113204\update\zip\dunzip\20220610113240\update.ini
C:\users\public\documents\rsupport\common\temp\rsupportupdater\20220610113204\update\zip\dunzip\20220610113240\rsup.key
C:\users\public\documents\rsupport\common\update\rsup.key
C:\users\public\documents\rsupport\common\update\update.ini
C:\users\public\documents\rsupport\common\update\rccmodule.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file030.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file022.rsz
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file002.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file003.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file004.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file005.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file006.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file007.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file008.rsz
C:\users\public\documents\rsupport\common\rclog\updater\updater_20220610113205.log
C:\users\public\documents\rsupport\common\update\grp_base\file001.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file031.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file032.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file033.rsz
C:\users\public\documents\rsupport\common\update\grp_base\rch_eng.016
C:\users\public\documents\rsupport\common\update\grp_base\rch_jpn.017
C:\users\public\documents\rsupport\common\update\grp_base\rch_chi_sim.018
C:\users\public\documents\rsupport\common\update\grp_base\rch_chi_tra.019
C:\users\public\documents\rsupport\common\update\grp_base\rch_fre.020
C:\users\public\documents\rsupport\common\update\grp_base\rch_por.021
C:\users\public\documents\rsupport\common\update\grp_base\rch_spa.022
C:\users\public\documents\rsupport\common\update\grp_base\rs_kor_proxy.023
C:\users\public\documents\rsupport\common\update\grp_base\rs_jpn_proxy.025
C:\users\public\documents\rsupport\common\update\grp_public\mfc140_ex\api-ms-win-core-console-l1-1-0.dll
C:\users\public\documents\rsupport\common\update\grp_base\rs_chi_sim_proxy.026
C:\users\public\documents\rsupport\common\update\grp_base\rs_chi_tra_proxy.027
C:\users\public\documents\rsupport\common\update\grp_base\rs_fre_proxy.028
C:\users\public\documents\rsupport\common\update\grp_base\rs_por_proxy.029
C:\users\public\documents\rsupport\common\update\grp_base\rs_spa_proxy.030
C:\users\public\documents\rsupport\common\update\grp_base\rssasnt.031
C:\users\public\documents\rsupport\common\update\grp_base\rsdrvnt.033
C:\users\public\documents\rsupport\common\update\grp_base\rssas64.034
C:\users\public\documents\rsupport\common\update\grp_base\rch_kor.015
C:\users\public\documents\rsupport\common\update\grp_base\rshosthelper.003
C:\users\public\documents\rsupport\common\update\grp_base\rcdndu.014
C:\users\public\documents\rsupport\common\update\grp_base\rsuimgr.002
C:\users\public\documents\rsupport\common\update\grp_base\file034.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file035.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file036.rsz
C:\users\public\documents\rsupport\common\update\grp_base\provs.zip
C:\users\public\documents\rsupport\common\update\grp_base\update.ini
C:\users\public\documents\rsupport\common\update\grp_base\update.zip
C:\users\public\documents\rsupport\common\update\grp_base\rssemgr.000
C:\users\public\documents\rsupport\common\update\grp_base\rsengmgr.001
C:\users\public\documents\rsupport\common\update\grp_base\rsprinter.035
C:\users\public\documents\rsupport\common\update\grp_base\cr5.012
C:\users\public\documents\rsupport\common\update\grp_base\postevent.004
C:\users\public\documents\rsupport\common\update\grp_base\bldinfo.005
C:\users\public\documents\rsupport\common\update\grp_base\rc45.006
C:\users\public\documents\rsupport\common\update\grp_base\rspxauth.007
C:\users\public\documents\rsupport\common\update\grp_base\rspxscan.008
C:\users\public\documents\rsupport\common\update\grp_base\rszip.009
C:\users\public\documents\rsupport\common\update\grp_base\scapenc.010
C:\users\public\documents\rsupport\common\update\grp_base\drvi.011
C:\users\public\documents\rsupport\common\update\grp_base\crrpt.013
%WINDIR%\temp\udd2c1e.tmp

Deletes the following files

C:\users\public\documents\rsupport\common\temp\rsupportupdater\20220610113204\update\zip\dunzip\20220610113240\rsup.key
C:\users\public\documents\rsupport\common\update\grp_base\file018.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file019.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file020.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file021.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file022.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file023.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file024.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file025.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file026.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file028.rsz
C:\users\public\documents\rsupport\common\update\grp_base\update.ini
C:\users\public\documents\rsupport\common\update\grp_base\file029.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file030.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file031.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file032.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file033.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file034.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file035.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file036.rsz
C:\users\public\documents\rsupport\common\update\grp_base\provs.zip
C:\users\public\documents\rsupport\common\update\grp_base\file017.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file027.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file016.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file003.rsz
C:\users\public\documents\rsupport\common\temp\rsupportupdater\20220610113204\update\zip\dunzip\20220610113240\update.ini
C:\users\public\documents\rsupport\common\update\update.ini
C:\users\public\documents\rsupport\common\update\provs.zip
C:\users\public\documents\rsupport\common\update\rsup.key
C:\users\public\documents\rsupport\common\update\rccmodule.rsz
%WINDIR%\temp\udd2c1e.tmp
C:\users\public\documents\rsupport\common\update\grp_base\file000.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file001.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file002.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file004.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file014.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file005.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file006.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file007.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file008.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file009.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file010.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file011.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file012.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file013.rsz
C:\users\public\documents\rsupport\common\update\grp_base\file015.rsz
C:\users\public\documents\rsupport\common\update\grp_base\update.zip

Moves the following files

from C:\users\public\documents\rsupport\common\update\grp_base\rssemgr.000 to C:\users\public\documents\rsupport\rcc50\rssemgr.exe
from C:\users\public\documents\rsupport\common\update\grp_base\rch_fre.020 to C:\users\public\documents\rsupport\rcc50\languages\rch_fre.lng
from C:\users\public\documents\rsupport\common\update\grp_base\rch_por.021 to C:\users\public\documents\rsupport\rcc50\languages\rch_por.lng
from C:\users\public\documents\rsupport\common\update\grp_base\rch_spa.022 to C:\users\public\documents\rsupport\rcc50\languages\rch_spa.lng
from C:\users\public\documents\rsupport\common\update\grp_base\rs_kor_proxy.023 to C:\users\public\documents\rsupport\rcc50\languages\rs_kor_proxy.lng
from C:\users\public\documents\rsupport\common\update\grp_base\rs_eng_proxy.024 to C:\users\public\documents\rsupport\rcc50\languages\rs_eng_proxy.lng
from C:\users\public\documents\rsupport\common\update\grp_base\rs_jpn_proxy.025 to C:\users\public\documents\rsupport\rcc50\languages\rs_jpn_proxy.lng
from C:\users\public\documents\rsupport\common\update\grp_base\rs_chi_sim_proxy.026 to C:\users\public\documents\rsupport\rcc50\languages\rs_chi_sim_proxy.lng
from C:\users\public\documents\rsupport\common\update\grp_base\rs_chi_tra_proxy.027 to C:\users\public\documents\rsupport\rcc50\languages\rs_chi_tra_proxy.lng
from C:\users\public\documents\rsupport\common\update\grp_base\rs_fre_proxy.028 to C:\users\public\documents\rsupport\rcc50\languages\rs_fre_proxy.lng
from C:\users\public\documents\rsupport\common\update\grp_base\rs_por_proxy.029 to C:\users\public\documents\rsupport\rcc50\languages\rs_por_proxy.lng
from C:\users\public\documents\rsupport\common\update\grp_base\rs_spa_proxy.030 to C:\users\public\documents\rsupport\rcc50\languages\rs_spa_proxy.lng
from C:\users\public\documents\rsupport\common\update\grp_base\rssasnt.031 to C:\users\public\documents\rsupport\rcc50\rssasnt.sys
from C:\users\public\documents\rsupport\common\update\grp_base\rsdrvnt.033 to C:\users\public\documents\rsupport\rcc50\rsdrvnt.sys
from C:\users\public\documents\rsupport\common\update\grp_base\rssas64.034 to C:\users\public\documents\rsupport\rcc50\rssas64.sys
from C:\users\public\documents\rsupport\common\update\grp_base\rsprinter.035 to C:\users\public\documents\rsupport\rcc50\rsprinter.dll
from C:\users\public\documents\rsupport\common\update\grp_base\rch_chi_tra.019 to C:\users\public\documents\rsupport\rcc50\languages\rch_chi_tra.lng
from <DRIVERS>\set29fc.tmp to <DRIVERS>\vrvd5.sys
from C:\users\public\documents\rsupport\common\update\grp_base\rch_chi_sim.018 to C:\users\public\documents\rsupport\rcc50\languages\rch_chi_sim.lng
from C:\users\public\documents\rsupport\common\update\grp_base\rch_eng.016 to C:\users\public\documents\rsupport\rcc50\languages\rch_eng.lng
from C:\users\public\documents\rsupport\common\update\grp_base\rsengmgr.001 to C:\users\public\documents\rsupport\rcc50\rsengmgr.exe
from C:\users\public\documents\rsupport\common\update\grp_base\rsuimgr.002 to C:\users\public\documents\rsupport\rcc50\rsuimgr.exe
from C:\users\public\documents\rsupport\common\update\grp_base\rshosthelper.003 to C:\users\public\documents\rsupport\rcc50\rshosthelper.exe
from C:\users\public\documents\rsupport\common\update\grp_base\postevent.004 to C:\users\public\documents\rsupport\rcc50\postevent.exe
from C:\users\public\documents\rsupport\common\update\grp_base\bldinfo.005 to C:\users\public\documents\rsupport\rcc50\bldinfo.ini
from C:\users\public\documents\rsupport\common\update\grp_base\rc45.006 to C:\users\public\documents\rsupport\rcc50\rc45.dll
from C:\users\public\documents\rsupport\common\update\grp_base\rspxauth.007 to C:\users\public\documents\rsupport\rcc50\rspxauth.dll
from C:\users\public\documents\rsupport\common\update\grp_base\rspxscan.008 to C:\users\public\documents\rsupport\rcc50\rspxscan.dll
from C:\users\public\documents\rsupport\common\update\grp_base\rszip.009 to C:\users\public\documents\rsupport\rcc50\rszip.dll
from C:\users\public\documents\rsupport\common\update\grp_base\scapenc.010 to C:\users\public\documents\rsupport\rcc50\scapenc.dll
from C:\users\public\documents\rsupport\common\update\grp_base\drvi.011 to C:\users\public\documents\rsupport\rcc50\drvi.dll
from C:\users\public\documents\rsupport\common\update\grp_base\cr5.012 to C:\users\public\documents\rsupport\rcc50\cr5.dll
from C:\users\public\documents\rsupport\common\update\grp_base\crrpt.013 to C:\users\public\documents\rsupport\rcc50\crrpt.dll
from C:\users\public\documents\rsupport\common\update\grp_base\rcdndu.014 to C:\users\public\documents\rsupport\rcc50\rcdndu.dll
from C:\users\public\documents\rsupport\common\update\grp_base\rch_kor.015 to C:\users\public\documents\rsupport\rcc50\languages\rch_kor.lng
from C:\users\public\documents\rsupport\common\update\grp_base\rch_jpn.017 to C:\users\public\documents\rsupport\rcc50\languages\rch_jpn.lng
from <SYSTEM32>\set2a3c.tmp to <SYSTEM32>\vrvd5.dll

Network activity

Connects to

'st####.startsupport.com':443
'st####.thawte.com':80
'cd#.#hawte.com':80
'microsoft.com':80
'st######.startsupport.com':443

TCP

HTTP GET requests

http://st####.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFvn094QJ%2BcWGTwWWEy%2BBXPZkW8AQUo8heZVTlMHjBBeoHCmpZzLn%2B3loCEAPqCJGiuwinhgkUJtt38HI%3D
http://cd#.#hawte.com/ThawteRSACA2018.crl
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

Other

'st####.startsupport.com':443

UDP

DNS ASK st####.startsupport.com
DNS ASK st####.thawte.com
DNS ASK cd#.#hawte.com
DNS ASK microsoft.com
DNS ASK st######.startsupport.com
DNS ASK public-trust.com

Miscellaneous

Executes the following

'<SYSTEM32>\rundll32.exe' %TEMP%\~RSTEMP\drvi64.dll,Vrvd5_Install

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial