Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\RSUSBSTOR] 'ImagePath' = 'System32\Drivers\RTS5121.sys'
Изменения в файловой системе:
Создает следующие файлы:
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\layobd0c.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- %ProgramFiles%\USB 2.0 Card Reader\MassStorage\rts59d9d.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\setube74.rra
- %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\setup.ini
- %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\ISSebe16.rra
- %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\setube54.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\inf\oem3.inf
- %WINDIR%\inf\oem3.PNF
- %ALLUSERSPROFILE%\Start Menu\Programs\USB 2.0 Card Reader\UnInstall USB 2.0 Mass Storage Card Reader.lnk
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\databd1c.rra
- %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\databd3b.rra
- %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\setubda9.rra
- %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\_Setbdf7.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- %TEMP%\7zS00B8DA02\DriverBin_32bit\Rts5121.dll
- %TEMP%\7zS00B8DA02\DriverBin_32bit\RTS5121.sys
- %TEMP%\7zS00B8DA02\setup.iss
- %TEMP%\7zS00B8DA02\DriverBin_32bit\revcon.exe
- %TEMP%\7zS00B8DA02\DriverBin_32bit\rts5121icon.dll
- %TEMP%\7zS00B8DA02\_Setup.dll
- %APPDATA%\Microsoft\Protect\CREDHIST
- %TEMP%\7zS00B8DA02\ISSetup.dll
- %TEMP%\7zS00B8DA02\setup.exe
- %TEMP%\7zS00B8DA02\data2.cab
- %TEMP%\7zS00B8DA02\DriverBin_32bit\rts5121.cat
- %TEMP%\7zS00B8DA02\data1.cab
- %TEMP%\7zS00B8DA02\data1.hdr
- %TEMP%\7zS00B8DA02\DriverBin_32bit\RTS5121.inf
- %TEMP%\7zS00B8DA02\setup.ini
- %TEMP%\7zS00B8DA02\setup.inx
- %TEMP%\7zS00B8DA02\layout.bin
- %TEMP%\7zS00B8DA02\setup.bmp
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\_IsR7d44.rra
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\difx7e2f.rra
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\isrt7b6f.rra
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\defa7c79.rra
- %ProgramFiles%\USB 2.0 Card Reader\MassStorage\revc9b5b.rra
- %ProgramFiles%\USB 2.0 Card Reader\MassStorage\RTS59cc3.rra
- %ProgramFiles%\USB 2.0 Card Reader\MassStorage\RTS59d11.rra
- %ProgramFiles%\USB 2.0 Card Reader\MassStorage\rts59bd8.rra
- %ProgramFiles%\USB 2.0 Card Reader\MassStorage\Rts59c26.rra
- %TEMP%\{DFB67E81-77DE-49BB-8800-AF20A475C612}\_Setup.dll
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\setu763f.rra
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\26a521de26b42f25252e6c9000b7f446_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %TEMP%\{DFB67E81-77DE-49BB-8800-AF20A475C612}\setup.ini
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\core7797.rra
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\DIFx79f8.rra
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\Stri7ab4.rra
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\dotn7872.rra
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\Font793d.rra
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
Перемещает следующие файлы:
- %ProgramFiles%\USB 2.0 Card Reader\MassStorage\rts59d9d.rra в %ProgramFiles%\USB 2.0 Card Reader\MassStorage\rts5121icon.dll
- %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\layobd0c.rra в %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\layout.bin
- %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\databd1c.rra в %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\data1.hdr
- %ProgramFiles%\USB 2.0 Card Reader\MassStorage\Rts59c26.rra в %ProgramFiles%\USB 2.0 Card Reader\MassStorage\Rts5121.dll
- %ProgramFiles%\USB 2.0 Card Reader\MassStorage\RTS59cc3.rra в %ProgramFiles%\USB 2.0 Card Reader\MassStorage\RTS5121.inf
- %ProgramFiles%\USB 2.0 Card Reader\MassStorage\RTS59d11.rra в %ProgramFiles%\USB 2.0 Card Reader\MassStorage\RTS5121.sys
- %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\ISSebe16.rra в %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\ISSetup.dll
- %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\setube54.rra в %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\setup.inx
- %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\setube74.rra в %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\setup.ini
- %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\databd3b.rra в %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\data1.cab
- %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\setubda9.rra в %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\setup.exe
- %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\_Setbdf7.rra в %ProgramFiles%\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\_Setup.dll
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\Font793d.rra в %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\FontData.ini
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\DIFx79f8.rra в %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\DIFxData.ini
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\Stri7ab4.rra в %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\StringTable-0009-English.ips
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\setu763f.rra в %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\setup.inx
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\core7797.rra в %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\corecomp.ini
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\dotn7872.rra в %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\dotnetinstaller.exe
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\difx7e2f.rra в %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\difxapi.dll
- %ProgramFiles%\USB 2.0 Card Reader\MassStorage\revc9b5b.rra в %ProgramFiles%\USB 2.0 Card Reader\MassStorage\revcon.exe
- %ProgramFiles%\USB 2.0 Card Reader\MassStorage\rts59bd8.rra в %ProgramFiles%\USB 2.0 Card Reader\MassStorage\rts5121.cat
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\isrt7b6f.rra в %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\isrt.dll
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\defa7c79.rra в %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\default.pal
- %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\_IsR7d44.rra в %TEMP%\{76251CA3-F47D-457D-A645-17D4D06723B3}\{D10CB652-9332-4242-B7A9-2D61570144F7}\_IsRes.dll
Другое:
Создает и запускает на исполнение:
- '%ProgramFiles%\USB 2.0 Card Reader\MassStorage\revcon.exe' update RTS5121.inf USB\VID_0BDA&PID_0125
- '%ProgramFiles%\USB 2.0 Card Reader\MassStorage\revcon.exe' update RTS5121.inf USB\VID_0BDA&PID_0111
- '%ProgramFiles%\USB 2.0 Card Reader\MassStorage\revcon.exe' update RTS5121.inf USB\VID_0BDA&PID_0105
- '%TEMP%\7zS00B8DA02\setup.exe'
- '%ProgramFiles%\USB 2.0 Card Reader\MassStorage\revcon.exe' dp_add RTS5121.inf
