rfbtnsvc64.exe
RfBtnSvc Application by Dritek System Inc. (Signed)
Overview
There are 3 versions of rfbtnsvc64.exe in the wild, the latest version being 1, 6, 11, 5. It is started as a Windows Service called 'RfButtonDriverService' with the name 'RfButtonDriverService'. In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). The average file size is about 93.86 KB. The file is a digitally signed and issued to Dritek System Inc. by VeriSign. The executable is a .NET framework assembly utilizing the CLR. During the process's lifecycle, the typical CPU resource utilization is about 0.0007% including both foreground and background operations, the average private memory consumption is about 1.48 MB with the maximum memory reaching around 4.98 MB.
 Details
|
| File name: | rfbtnsvc64.exe |
| Publisher: | Dritek System INC. |
| Product name: | RfBtnSvc Application |
| Typical file path: | C:\windows\rfbtnsvc64.exe |
| Original name: | RfBtnSvc.exe |
| Certificate |
| Issued to: | Dritek System Inc. |
| Authority (CA): | VeriSign |
| Effective date: | Wednesday, September 30, 2009 |
| Expiration date: | Monday, October 15, 2012 |
| Windows Service |
| Service name: | RfButtonDriverService |
| Display name: | RfButtonDriverService |
| Type: | Win32OwnProcess |
Behaviors
(Note, the behaviors below are for all versions of rfbtnsvc64.exe, select a unique version for details.)
Services
Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)
- RfButtonDriverService
- 'RfButtonDriverService' (Dritek RF Button Command Service)
All file variations of rfbtnsvc64.exe
Distribution by Windows OS
| OS version | distribution |
| Windows 8 |
75.00% |
|
| Windows 8.1 Single Language |
8.33% |
|
| Windows 8.1 |
8.33% |
|
| Windows 8 Single Language |
8.33% |
|
Distribution by country
United States installs about 47.92% of RfBtnSvc Application.
