Technical Information
Modifies file system:
Creates the following files:
- %TEMP%\RFSEE24.tmp\jp-Japanese.rfi
- %TEMP%\RFSEE24.tmp\license-kr.txt
- %TEMP%\RFSEE24.tmp\it-Italian.rfi
- %TEMP%\RFSEE24.tmp\license-jp.txt
- %TEMP%\RFSEE24.tmp\kr-Korean.rfi
- %TEMP%\RFSEE24.tmp\license-nl.txt
- %TEMP%\RFSEE24.tmp\nl-Dutch.rfi
- %TEMP%\RFSEE24.tmp\license-lt.txt
- %TEMP%\RFSEE24.tmp\lt-Lithuanian.rfi
- %TEMP%\RFSEE24.tmp\license-it.txt
- %TEMP%\RFSEE24.tmp\license-fr.txt
- %TEMP%\RFSEE24.tmp\fr-French.rfi
- %TEMP%\RFSEE24.tmp\license-fi.txt
- %TEMP%\RFSEE24.tmp\fi-Finnish.rfi
- %TEMP%\RFSEE24.tmp\license-he.txt
- %TEMP%\RFSEE24.tmp\hr-Croatian.rfi
- %TEMP%\RFSEE24.tmp\hu-Hungarian.rfi
- %TEMP%\RFSEE24.tmp\he-Hebrew.rfi
- %TEMP%\RFSEE24.tmp\license-hr.txt
- %TEMP%\RFSEE24.tmp\license-tr.txt
- %TEMP%\RFSEE24.tmp\tr-Turkish.rfi
- %TEMP%\RFSEE24.tmp\se-Swedish.rfi
- %TEMP%\RFSEE24.tmp\sk-Slovak.rfi
- %TEMP%\RFSEE24.tmp\license-ua.txt
- %TEMP%\RFSEE24.tmp\zh-Chinese.rfi
- %TEMP%\RFSEE24.tmp\affid.txt
- %TEMP%\RFSEE24.tmp\ua-Ukrainian.rfi
- %TEMP%\RFSEE24.tmp\license-zh.txt
- %TEMP%\RFSEE24.tmp\license-se.txt
- %TEMP%\RFSEE24.tmp\pl-Polish.rfi
- %TEMP%\RFSEE24.tmp\license-ru.txt
- %TEMP%\RFSEE24.tmp\no-Norwegian.rfi
- %TEMP%\RFSEE24.tmp\license-pl.txt
- %TEMP%\RFSEE24.tmp\ru-Russian.rfi
- %TEMP%\RFSEE24.tmp\license-sc.txt
- %TEMP%\RFSEE24.tmp\sc-Serbian.rfi
- %TEMP%\RFSEE24.tmp\license-sb.txt
- %TEMP%\RFSEE24.tmp\sb-Serbian.rfi
- %TEMP%\RFSEE24.tmp\es-Spanish.rfi
- %TEMP%\RFSEE24.tmp\safenotes.exe
- %TEMP%\RFSEE24.tmp\passcards.exe
- %TEMP%\RFSEE24.tmp\robotaskbaricon.exe
- %TEMP%\RFSEE24.tmp\identities.exe
- %TEMP%\RFSEE24.tmp\passwordgenerator.exe
- %TEMP%\RFSEE24.tmp\Firefox\install.rdf
- %TEMP%\RFSEE24.tmp\Firefox\chrome.manifest
- %TEMP%\RFSEE24.tmp\dndhandle.gif
- %TEMP%\RFSEE24.tmp\rfmozhlp.dll
- %TEMP%\RFSEE24.tmp\roboform.dll
- %TEMP%\aut2.tmp
- <Current directory>\appsetup.exe
- %TEMP%\aut1.tmp
- <Current directory>\vd.exe
- %TEMP%\aut3.tmp
- %TEMP%\RFSEE24.tmp\rfwipeout.exe
- %TEMP%\RFSEE24.tmp\install.bmp
- <Current directory>\AiRoboForm-Portable-roma1.exe
- %TEMP%\_rf.log
- %TEMP%\RFSEE24.tmp\license-cz.txt
- %TEMP%\RFSEE24.tmp\cz-Czech.rfi
- %TEMP%\RFSEE24.tmp\license-cn.txt
- %TEMP%\RFSEE24.tmp\cn-Chinese.rfi
- %TEMP%\RFSEE24.tmp\license-de.txt
- %TEMP%\RFSEE24.tmp\dk-Danish.rfi
- %TEMP%\RFSEE24.tmp\license-es.txt
- %TEMP%\RFSEE24.tmp\de-German.rfi
- %TEMP%\RFSEE24.tmp\license-dk.txt
- %TEMP%\RFSEE24.tmp\br-Brasilian.rfi
- %TEMP%\RFSEE24.tmp\Firefox\components\rfhelper.js
- %TEMP%\RFSEE24.tmp\Firefox\components\rfproxy_31.dll
- %TEMP%\RFSEE24.tmp\Firefox\chrome\roboform.jar
- %TEMP%\RFSEE24.tmp\Firefox\components\rfproxy_31.xpt
- %TEMP%\RFSEE24.tmp\license-en.txt
- %TEMP%\RFSEE24.tmp\ar-Arabic.rfi
- %TEMP%\RFSEE24.tmp\license-br.txt
- %TEMP%\RFSEE24.tmp\en-english.rfi
- %TEMP%\RFSEE24.tmp\license-ar.txt
Deletes the following files:
- %TEMP%\aut3.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'CSCHiddenWindow' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'BaseBar' WindowName: 'ChanApp'
Creates and executes the following:
- '<Current directory>\AiRoboForm-Portable-roma1.exe'
- '%TEMP%\RFSEE24.tmp\rfwipeout.exe' pp
- '<Current directory>\vd.exe'
- '<Current directory>\appsetup.exe'
Executes the following:
- '<SYSTEM32>\rundll32.exe' fldrclnr.dll,Wizard_RunDLL
- '%WINDIR%\explorer.exe'
