Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\RSP2STOR] 'ImagePath' = 'system32\DRIVERS\RtsP2Stor.sys'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\7zS04BE01D1\APBin\DisplayIcon.ico
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\SDRT2169.rra
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RmbC205f.rra
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\Disp2030.rra
- <DRIVERS>\RtsP1fd2.rra
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RtsP1f94.rra
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RtsP1d71.rra
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RtsP1d52.rra
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RtsP1d32.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- %TEMP%\7zS04BE01D1\DriverBin_32bit\RtsP2Stor.sys
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- %WINDIR%\inf\oem3.inf
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\setup.ini
- %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\setu3aec.rra
- %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\setu3acd.rra
- %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\ISSe3a7e.rra
- %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\_Set3a50.rra
- %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\setu3a01.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\data3907.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\data38f8.rra
- %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\layo38e8.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\revc1d13.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RsCR1ce4.rra
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RIco1c67.rra
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\conf1c48.rra
- %TEMP%\7zS04BE01D1\layout.bin
- %TEMP%\7zS04BE01D1\APBin_32bit\RsCRLib.dll
- %TEMP%\7zS04BE01D1\APBin_32bit\RIconMan.exe
- %TEMP%\7zS04BE01D1\APBin\SDRTCPRM.dll
- %TEMP%\7zS04BE01D1\APBin\RmbChange_PCIE.exe
- %TEMP%\7zS04BE01D1\usetup.iss
- %TEMP%\7zS04BE01D1\setup.iss
- %TEMP%\7zS04BE01D1\setup.inx
- %TEMP%\7zS04BE01D1\setup.ini
- %TEMP%\7zS04BE01D1\DriverBin_64bit\RtsP2StorMSI.inf
- %TEMP%\7zS04BE01D1\APBin_64bit\RsCRLib.dll
- %TEMP%\7zS04BE01D1\DriverBin_64bit\RtsP2Stor.cat
- %TEMP%\7zS04BE01D1\DriverBin_32bit\RtsP2StorMSI.inf
- %TEMP%\7zS04BE01D1\DriverBin_32bit\RtsP2Stor.cat
- %TEMP%\7zS04BE01D1\data2.cab
- %TEMP%\7zS04BE01D1\data1.hdr
- %TEMP%\7zS04BE01D1\data1.cab
- %TEMP%\7zS04BE01D1\APBin_64bit\config.ini
- %TEMP%\7zS04BE01D1\APBin_32bit\config.ini
- %WINDIR%\inf\oem3.PNF
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- %TEMP%\7zS04BE01D1\DriverBin_32bit\revcon.exe
- %TEMP%\7zS04BE01D1\DriverBin_64bit\revcon.exe
- %TEMP%\7zS04BE01D1\APBin_64bit\RIconMan.exe
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\_IsR15ef.rra
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\defa15d0.rra
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\isrt1591.rra
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\Stri1562.rra
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\DIFx1534.rra
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\Font1514.rra
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\dotn14f5.rra
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\core14b7.rra
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\lice1488.rra
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\setu1449.rra
- %TEMP%\1284.rra
- %TEMP%\{3F666684-5274-48F7-9D7D-359C5948676A}\setup.ini
- %TEMP%\{3F666684-5274-48F7-9D7D-359C5948676A}\_Setup.dll
- %TEMP%\7zS04BE01D1\_Setup.dll
- %TEMP%\7zS04BE01D1\setup.exe
- %TEMP%\7zS04BE01D1\ISSetup.dll
- %TEMP%\7zS04BE01D1\DriverBin_64bit\RtsP2StorIcon.dll
- %TEMP%\7zS04BE01D1\DriverBin_64bit\RtsP2Stor.sys
- %TEMP%\7zS04BE01D1\DriverBin_32bit\RtsP2StorIcon.dll
- <SYSTEM32>\sda\SDRT35e6.rra
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
Перемещает следующие файлы:
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\setu1449.rra в %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\setup.inx
- %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\setu3acd.rra в %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\setup.inx
- %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\ISSe3a7e.rra в %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\ISSetup.dll
- %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\_Set3a50.rra в %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\_Setup.dll
- %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\setu3a01.rra в %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\setup.exe
- %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\data3907.rra в %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\data1.cab
- %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\data38f8.rra в %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\data1.hdr
- %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\layo38e8.rra в %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\layout.bin
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\SDRT2169.rra в %ProgramFiles%\Realtek\Realtek PCIE Card Reader\SDRTCPRM.dll
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RmbC205f.rra в %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RmbChange_PCIE.exe
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\Disp2030.rra в %ProgramFiles%\Realtek\Realtek PCIE Card Reader\DisplayIcon.ico
- <DRIVERS>\RtsP1fd2.rra в <DRIVERS>\RtsP2Stor.sys
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RtsP1f94.rra в %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RtsP2StorMSI.inf
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RtsP1d71.rra в %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RtsP2StorIcon.dll
- %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\setu3aec.rra в %ProgramFiles%\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\setup.ini
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RtsP1d52.rra в %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RtsP2Stor.sys
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\revc1d13.rra в %ProgramFiles%\Realtek\Realtek PCIE Card Reader\revcon.exe
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RsCR1ce4.rra в %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RsCRLib.dll
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RIco1c67.rra в %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RIconMan.exe
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\conf1c48.rra в %ProgramFiles%\Realtek\Realtek PCIE Card Reader\config.ini
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\_IsR15ef.rra в %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\_IsRes.dll
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\defa15d0.rra в %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\default.pal
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\isrt1591.rra в %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\isrt.dll
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\Stri1562.rra в %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\StringTable-0009-English.ips
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\DIFx1534.rra в %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\DIFxData.ini
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\Font1514.rra в %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\FontData.ini
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\dotn14f5.rra в %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\dotnetinstaller.exe
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\core14b7.rra в %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\corecomp.ini
- %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\lice1488.rra в %TEMP%\{9E8EDEE3-2140-403E-A2A4-0657BD1CF618}\{C1594429-8296-4652-BF54-9DBE4932A44C}\license.rtf
- %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RtsP1d32.rra в %ProgramFiles%\Realtek\Realtek PCIE Card Reader\RtsP2Stor.cat
- <SYSTEM32>\sda\SDRT35e6.rra в <SYSTEM32>\sda\SDRTCPRM.dll
Другое:
Создает и запускает на исполнение:
- '%TEMP%\7zS04BE01D1\setup.exe'
- '%ProgramFiles%\Realtek\Realtek PCIE Card Reader\revcon.exe' RS_dp_add RtsP2StorMSI.inf
- '%ProgramFiles%\Realtek\Realtek PCIE Card Reader\revcon.exe' RS_update RtsP2StorMSI.inf PCI\VEN_10EC&DEV_5229&CC_FF00
- '%ProgramFiles%\Realtek\Realtek PCIE Card Reader\revcon.exe' RS_remove PCI\VEN_10EC&DEV_5229&CC_FF00
