Техническая информация
Для обеспечения автозапуска и распространения
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\RSBASTOR] 'ImagePath' = 'system32\DRIVERS\RtsBaStor.sys'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\7zsc27204cf\04creader\apbin\config.ini
- <DRIVERS>\rtsb12bf.rra
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\rtsb12bf.rra
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\rtsb1157.rra
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\rtsb1138.rra
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\revc1119.rra
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\rscr1119.rra
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\conf12ce.rra
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\rico108c.rra
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\defaef29.rra
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\isrtef1a.rra
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\strief0a.rra
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\isbeef0a.rra
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\difxef0a.rra
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\fonteefa.rra
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\_isref29.rra
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\disp12de.rra
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\rmbc12de.rra
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\sdrt132c.rra
- %WINDIR%\syswow64\sda\sdrt5834.rra
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
- %WINDIR%\temp\udd2906.tmp
- %TEMP%\{695b3478-4fe3-45cd-8241-3919c3ec766c}\set2772.tmp
- %TEMP%\{695b3478-4fe3-45cd-8241-3919c3ec766c}\set258d.tmp
- %TEMP%\{695b3478-4fe3-45cd-8241-3919c3ec766c}\set234a.tmp
- %TEMP%\{695b3478-4fe3-45cd-8241-3919c3ec766c}\set2220.tmp
- %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\setup.ini
- %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\setu162a.rra
- %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\setu160a.rra
- %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\isse15cc.rra
- %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\_set15bc.rra
- %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\setu159d.rra
- %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\data14f1.rra
- %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\layo14f1.rra
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\dotneefa.rra
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\rmb.log
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\coreeeeb.rra
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\setueecb.rra
- %TEMP%\7zsc27204cf\04creader\usetup.iss
- %TEMP%\7zsc27204cf\04creader\setup.iss
- %TEMP%\7zsc27204cf\04creader\setup.inx
- %TEMP%\7zsc27204cf\04creader\setup.ini
- %TEMP%\7zsc27204cf\04creader\readme.txt
- %TEMP%\7zsc27204cf\04creader\layout.bin
- %TEMP%\7zsc27204cf\04creader\apbin\rmbchange_pcie.exe
- %TEMP%\7zsc27204cf\04creader\driverbin_64bit\rtsbastormsi.inf
- %TEMP%\7zsc27204cf\04creader\driverbin_32bit\rtsbastormsi.inf
- %TEMP%\7zsc27204cf\04creader\driverbin_32bit\rtsbastor.cat
- %TEMP%\7zsc27204cf\04creader\data2.cab
- %TEMP%\7zsc27204cf\04creader\data1.hdr
- %TEMP%\7zsc27204cf\04creader\data1.cab
- %TEMP%\7zsc27204cf\04creader\apbin\displayicon.ico
- %TEMP%\7zsc27204cf\04creader\driverbin_64bit\rtsbastor.cat
- %TEMP%\7zsc27204cf\04creader\apbin\sdrtcprm.dll
- %TEMP%\7zsc27204cf\04creader\apbin_32bit\riconman.exe
- %TEMP%\7zsc27204cf\04creader\apbin_32bit\rscrlib.dll
- %TEMP%\ee10.rra
- %TEMP%\{d6b87d5f-ad51-4fdf-8d1f-726d43b99072}\setup.ini
- %TEMP%\{d6b87d5f-ad51-4fdf-8d1f-726d43b99072}\_setup.dll
- %TEMP%\7zsc27204cf\04creader\_setup.dll
- %TEMP%\7zsc27204cf\04creader\setup.exe
- %TEMP%\7zsc27204cf\04creader\issetup.dll
- %TEMP%\7zsc27204cf\04creader\driverbin_64bit\rtsbastoricon.dll
- %TEMP%\7zsc27204cf\04creader\driverbin_64bit\rtsbastor.sys
- %TEMP%\7zsc27204cf\04creader\driverbin_64bit\revcon.exe
- %TEMP%\7zsc27204cf\04creader\driverbin_32bit\sdrtcprm.dll
- %TEMP%\7zsc27204cf\04creader\driverbin_32bit\rtsbastoricon.dll
- %TEMP%\7zsc27204cf\04creader\driverbin_32bit\rtsbastor.sys
- %TEMP%\7zsc27204cf\04creader\driverbin_32bit\revcon.exe
- %TEMP%\7zsc27204cf\04creader\apbin_64bit\rscrlib.dll
- %TEMP%\7zsc27204cf\04creader\apbin_64bit\riconman.exe
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\liceeeeb.rra
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\config.ini
Присваивает атрибут 'скрытый' для следующих файлов
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
Удаляет следующие файлы
- %WINDIR%\temp\udd2906.tmp
- %TEMP%\{695b3478-4fe3-45cd-8241-3919c3ec766c}\rtsbastor.cat
- %TEMP%\{695b3478-4fe3-45cd-8241-3919c3ec766c}\rtsbastor.sys
- %TEMP%\{695b3478-4fe3-45cd-8241-3919c3ec766c}\rtsbastoricon.dll
- %TEMP%\{695b3478-4fe3-45cd-8241-3919c3ec766c}\rtsbastormsi.inf
Перемещает следующие файлы
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\setueecb.rra в %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\setup.inx
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\rmbc12de.rra в %ProgramFiles(x86)%\realtek\realtek pcie card reader\rmbchange_pcie.exe
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\sdrt132c.rra в %ProgramFiles(x86)%\realtek\realtek pcie card reader\sdrtcprm.dll
- %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\layo14f1.rra в %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\layout.bin
- %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\data14f1.rra в %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\data1.hdr
- %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\data14f1.rra в %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\data1.cab
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\conf12ce.rra в %ProgramFiles(x86)%\realtek\realtek pcie card reader\config.ini
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\disp12de.rra в %ProgramFiles(x86)%\realtek\realtek pcie card reader\displayicon.ico
- %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\setu159d.rra в %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\setup.exe
- %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\setu160a.rra в %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\setup.inx
- %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\setu162a.rra в %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\setup.ini
- %TEMP%\{695b3478-4fe3-45cd-8241-3919c3ec766c}\set2220.tmp в %TEMP%\{695b3478-4fe3-45cd-8241-3919c3ec766c}\rtsbastormsi.inf
- %TEMP%\{695b3478-4fe3-45cd-8241-3919c3ec766c}\set234a.tmp в %TEMP%\{695b3478-4fe3-45cd-8241-3919c3ec766c}\rtsbastoricon.dll
- %TEMP%\{695b3478-4fe3-45cd-8241-3919c3ec766c}\set258d.tmp в %TEMP%\{695b3478-4fe3-45cd-8241-3919c3ec766c}\rtsbastor.cat
- %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\_set15bc.rra в %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\_setup.dll
- %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\isse15cc.rra в %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\issetup.dll
- <DRIVERS>\rtsb12bf.rra в <DRIVERS>\rtsbastor.sys
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\rtsb12bf.rra в %ProgramFiles(x86)%\realtek\realtek pcie card reader\rtsbastormsi.inf
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\rtsb1157.rra в %ProgramFiles(x86)%\realtek\realtek pcie card reader\rtsbastoricon.dll
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\coreeeeb.rra в %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\corecomp.ini
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\dotneefa.rra в %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\dotnetinstaller.exe
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\fonteefa.rra в %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\fontdata.ini
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\difxef0a.rra в %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\difxdata.ini
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\isbeef0a.rra в %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\isbew64.exe
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\strief0a.rra в %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\stringtable-0009-english.ips
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\liceeeeb.rra в %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\license.rtf
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\isrtef1a.rra в %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\isrt.dll
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\_isref29.rra в %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\_isres.dll
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\rico108c.rra в %ProgramFiles(x86)%\realtek\realtek pcie card reader\riconman.exe
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\rscr1119.rra в %ProgramFiles(x86)%\realtek\realtek pcie card reader\rscrlib.dll
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\revc1119.rra в %ProgramFiles(x86)%\realtek\realtek pcie card reader\revcon.exe
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\rtsb1138.rra в %ProgramFiles(x86)%\realtek\realtek pcie card reader\rtsbastor.cat
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\rtsb1138.rra в %ProgramFiles(x86)%\realtek\realtek pcie card reader\rtsbastor.sys
- %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\defaef29.rra в %TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\{c1594429-8296-4652-bf54-9dbe4932a44c}\default.pal
- %TEMP%\{695b3478-4fe3-45cd-8241-3919c3ec766c}\set2772.tmp в %TEMP%\{695b3478-4fe3-45cd-8241-3919c3ec766c}\rtsbastor.sys
- %WINDIR%\syswow64\sda\sdrt5834.rra в %WINDIR%\syswow64\sda\sdrtcprm.dll
Подменяет следующие файлы
- %ProgramFiles(x86)%\realtek\realtek pcie card reader\rtsb1138.rra
- %ProgramFiles(x86)%\installshield installation information\{c1594429-8296-4652-bf54-9dbe4932a44c}\data14f1.rra
Другое
Создает и запускает на исполнение
- '%TEMP%\7zsc27204cf\04creader\setup.exe'
- '%TEMP%\{2c5b734d-c535-4a58-982f-1c275a06dda9}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BB43F673-C0AB-416B-A558-20A10345344F}
- '%ProgramFiles(x86)%\realtek\realtek pcie card reader\revcon.exe' RS_dp_add RtsBaStorMSI.inf
- '%ProgramFiles(x86)%\realtek\realtek pcie card reader\revcon.exe' RS_update RtsBaStorMSI.inf PCI\VEN_10EC&DEV_5289&CC_FF00
- '%ProgramFiles(x86)%\realtek\realtek pcie card reader\revcon.exe' RS_remove PCI\VEN_10EC&DEV_5289&CC_FF00
- '%ProgramFiles(x86)%\realtek\realtek pcie card reader\revcon.exe' RS_update RtsBaStorMSI.inf PCI\VEN_10EC&DEV_5286&CC_FF00
- '%ProgramFiles(x86)%\realtek\realtek pcie card reader\revcon.exe' RS_remove PCI\VEN_10EC&DEV_5286&CC_FF00
- '%ProgramFiles(x86)%\realtek\realtek pcie card reader\rmbchange_pcie.exe' /install
- '%ProgramFiles(x86)%\realtek\realtek pcie card reader\revcon.exe' RS_dp_add RtsBaStorMSI.inf' (со скрытым окном)
- '%ProgramFiles(x86)%\realtek\realtek pcie card reader\revcon.exe' RS_update RtsBaStorMSI.inf PCI\VEN_10EC&DEV_5289&CC_FF00' (со скрытым окном)
- '%ProgramFiles(x86)%\realtek\realtek pcie card reader\revcon.exe' RS_remove PCI\VEN_10EC&DEV_5289&CC_FF00' (со скрытым окном)
- '%ProgramFiles(x86)%\realtek\realtek pcie card reader\revcon.exe' RS_update RtsBaStorMSI.inf PCI\VEN_10EC&DEV_5286&CC_FF00' (со скрытым окном)
- '%ProgramFiles(x86)%\realtek\realtek pcie card reader\revcon.exe' RS_remove PCI\VEN_10EC&DEV_5286&CC_FF00' (со скрытым окном)
- '%ProgramFiles(x86)%\realtek\realtek pcie card reader\rmbchange_pcie.exe' /install' (со скрытым окном)
