Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%CommonProgramFiles%\InstallShield\Driver\10\Intel 32\IDriver.exe' 32\IDriver.exe -Embedding
- '%TEMP%\pft3.tmp\Device Manager\Delete.exe' %PROGRAM_FILES%\Philips\Philips GoGear HDD\
- '%TEMP%\pft3.tmp\fscommand\DMSetup_ENG.exe'
- '%TEMP%\pft3.tmp\Device Manager\setup.exe' /L1033
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' -Embedding 22AB9CFC425E265F81A3BBA8F1FB3112 M Global\MSI0000
- '<SYSTEM32>\regsvr32.exe' /s %PROGRAM_FILES%\Philips\Common\DM.dll
- '<SYSTEM32>\regsvr32.exe' /s %PROGRAM_FILES%\Philips\Common\USBCON~1.DLL
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 27B71C3491AD2E892753BAD9C1DBDCA1 C
- '<SYSTEM32>\msiexec.exe' -Embedding FC0EA4439663F5B63C188F1657A48581
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Installer\2ee33.mst
- %WINDIR%\Installer\MSIB.tmp
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\MSIC.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\Installer\2ee32.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- %WINDIR%\Installer\MSIE.tmp
- %WINDIR%\Installer\MSI15.tmp
- %WINDIR%\Installer\MSI14.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Philips GoGear HDD\Help GoGear HDD.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Philips GoGear HDD\Uninstall.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Philips GoGear HDD\Philips GoGear HDD.lnk
- %WINDIR%\Installer\MSI10.tmp
- %WINDIR%\Installer\MSIF.tmp
- C:\Config.Msi\2ee35.rbs
- %WINDIR%\Installer\MSI13.tmp
- %WINDIR%\Installer\MSI12.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
- %ALLUSERSPROFILE%\Desktop\Philips GoGear HDD.lnk
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\sqli655d.rra
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\Firm650f.rra
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\unic65cb.rra
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\WNAS6696.rra
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\USBC6638.rra
- %PROGRAM_FILES%\Philips\Common\unic6260.rra
- %PROGRAM_FILES%\Philips\Common\sqli6212.rra
- %PROGRAM_FILES%\Philips\Common\USBC62ec.rra
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\DM6483.rra
- %PROGRAM_FILES%\Philips\Common\WNAS6379.rra
- %PROGRAM_FILES%\Philips\Philips GoGear HDD\bin\unic6742.rra
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\ITALY\Devi6fcd.rra
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\GERMAN\Devi6ef2.rra
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\PORTUGAL\Devi70b8.rra
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\SWEDEN\Devi72ea.rra
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\SPAIN\Devi71f0.rra
- %PROGRAM_FILES%\Philips\Philips GoGear HDD\bin\Devi6965.rra
- %PROGRAM_FILES%\Philips\Philips GoGear HDD\bin\Firm685b.rra
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\DUTCH\Devi6bc6.rra
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\FRANCE\Devi6e08.rra
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\ENGLISH\Devi6d1e.rra
- %WINDIR%\Installer\MSI17.tmp
- %WINDIR%\Installer\MSI16.tmp
- %WINDIR%\Installer\MSI19.tmp
- %TEMP%\3907a.mst
- %WINDIR%\Installer\MSI1A.tmp
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\NewShortcut2_B184A2F73EC84B86841227E0D53BA535
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\ARPPRODUCTICON.exe
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\NewShortcut4_B184A2F73EC84B86841227E0D53BA535.exe
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\1033.mst
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\NewShortcut3_B184A2F73EC84B86841227E0D53BA535_1.exe
- %PROGRAM_FILES%\Philips\Philips GoGear HDD\Help\Help564a.rra
- %PROGRAM_FILES%\Philips\Philips GoGear HDD\Config\MyDB5e68.rra
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\firmware\Encr5c64.rra
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Config\MyDB5ffe.rra
- %PROGRAM_FILES%\Philips\Common\Firm61b4.rra
- %PROGRAM_FILES%\Philips\Common\DM60f8.rra
- %PROGRAM_FILES%\Philips\Philips GoGear HDD\Config\devi58ab.rra
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Help\Help5763.rra
- %PROGRAM_FILES%\Philips\Philips GoGear HDD\Config\Encr5948.rra
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\firmware\devi5ba9.rra
- <SYSTEM32>\Philips GoGear HDD\devi5aaf.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- %TEMP%\pft3.tmp\Device Manager\config\MyDB
- %TEMP%\pft3.tmp\Device Manager\bin\SWEDEN\DeviceManagerUI.exe
- %TEMP%\pft3.tmp\Device Manager\Delete.exe
- %TEMP%\pft3.tmp\Device Manager\DLLS\Firmware.dll
- %TEMP%\pft3.tmp\Device Manager\DLLS\DM.dll
- %TEMP%\pft3.tmp\Device Manager\bin\GERMAN\DeviceManagerUI.exe
- %TEMP%\pft3.tmp\Device Manager\bin\FRANCE\DeviceManagerUI.exe
- %TEMP%\pft3.tmp\Device Manager\bin\ITALY\DeviceManagerUI.exe
- %TEMP%\pft3.tmp\Device Manager\bin\SPAIN\DeviceManagerUI.exe
- %TEMP%\pft3.tmp\Device Manager\bin\PORTUGAL\DeviceManagerUI.exe
- %TEMP%\pft3.tmp\Device Manager\DLLS\sqlite.dll
- %TEMP%\pft3.tmp\Device Manager\firmwares\deviceConfig.properties
- %TEMP%\pft3.tmp\Device Manager\Driver\PUMSS_DMM.inf
- %TEMP%\pft3.tmp\Device Manager\firmwares\Encrypted_FWImage_HDD070_4.41d.ebn
- %TEMP%\pft3.tmp\Device Manager\help\Help_ENG.chm
- %TEMP%\pft3.tmp\Device Manager\help\Help_Dutch.chm
- %TEMP%\pft3.tmp\Device Manager\DLLS\USBConnections.dll
- %TEMP%\pft3.tmp\Device Manager\DLLS\unicows.dll
- %TEMP%\pft3.tmp\Device Manager\DLLS\WNASPI32.DLL
- %TEMP%\pft3.tmp\Device Manager\Driver\PUMSSPDR.pdr
- %TEMP%\pft3.tmp\Device Manager\Driver\PUMSS.sys
- %TEMP%\pft3.tmp\Device Manager\0x040c.ini
- %TEMP%\pft3.tmp\Device Manager\0x040a.ini
- %TEMP%\pft3.tmp\Device Manager\0x0410.ini
- %TEMP%\pft3.tmp\Device Manager\0x0416.ini
- %TEMP%\pft3.tmp\Device Manager\0x0413.ini
- %TEMP%\plf1.tmp
- %TEMP%\ext2.tmp
- %TEMP%\pft3.tmp\pftw1.pkg
- %TEMP%\pft3.tmp\Device Manager\0x0409.ini
- %TEMP%\pft3.tmp\Device Manager\0x0407.ini
- %TEMP%\pft3.tmp\Device Manager\0x041d.ini
- %TEMP%\pft3.tmp\Device Manager\1046.mst
- %TEMP%\pft3.tmp\Device Manager\1043.mst
- %TEMP%\pft3.tmp\Device Manager\1053.mst
- %TEMP%\pft3.tmp\Device Manager\bin\ENGLISH\DeviceManagerUI.exe
- %TEMP%\pft3.tmp\Device Manager\bin\DUTCH\DeviceManagerUI.exe
- %TEMP%\pft3.tmp\Device Manager\1033.mst
- %TEMP%\pft3.tmp\Device Manager\1031.mst
- %TEMP%\pft3.tmp\Device Manager\1034.mst
- %TEMP%\pft3.tmp\Device Manager\1040.mst
- %TEMP%\pft3.tmp\Device Manager\1036.mst
- %TEMP%\pft3.tmp\Device Manager\help\Help_ESP.chm
- %CommonProgramFiles%\InstallShield\Driver\10\Intel 32\ISRT.dll
- C:\Config.Msi\2ee31.rbs
- %CommonProgramFiles%\InstallShield\Driver\10\Intel 32\_ISRES1033.dll
- %CommonProgramFiles%\InstallShield\Driver\10\Intel 32\iGdiCnv.dll
- %CommonProgramFiles%\InstallShield\Driver\10\Intel 32\IDriver.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\74BFD122C0875EC75DBE5C6DB4C59019
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\74BFD122C0875EC75DBE5C6DB4C59019
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\486CC6AFD08942336C61FCD401C4A1D1
- %WINDIR%\Installer\MSI6.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\486CC6AFD08942336C61FCD401C4A1D1
- %CommonProgramFiles%\InstallShield\Driver\10\Intel 32\IUserCnv.dll
- %TEMP%\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\_ISRES.DLL
- %TEMP%\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\IsConfig.INI
- %TEMP%\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\_ISUSER.DLL
- %TEMP%\MSI9.tmp
- %TEMP%\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\String1033.txt
- %CommonProgramFiles%\InstallShield\Driver\10\Intel 32\objpscnv.dll
- %CommonProgramFiles%\InstallShield\Driver\10\Intel 32\IScrCnv.dll
- %CommonProgramFiles%\InstallShield\Driver\10\Intel 32\IDriver2.exe
- %TEMP%\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\ISRT.DLL
- %TEMP%\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\setup.inx
- %TEMP%\pft3.tmp\Device Manager\instmsia.exe
- %TEMP%\pft3.tmp\Device Manager\install_bkg_logo.bmp
- %TEMP%\pft3.tmp\Device Manager\instmsiw.exe
- %TEMP%\pft3.tmp\Device Manager\Philips GoGear HDD Device Manager.msi
- %TEMP%\pft3.tmp\Device Manager\ISScript10.Msi
- %TEMP%\pft3.tmp\Device Manager\help\Help_ger.chm
- %TEMP%\pft3.tmp\Device Manager\help\Help_Fr.chm
- %TEMP%\pft3.tmp\Device Manager\help\Help_Itl.chm
- %TEMP%\pft3.tmp\Device Manager\help\Help_Swe.chm
- %TEMP%\pft3.tmp\Device Manager\help\Help_Por.chm
- %TEMP%\pft3.tmp\Device Manager\setup.exe
- %TEMP%\pft3.tmp\fscommand\DMSetup_NLD.exe
- %TEMP%\pft3.tmp\fscommand\DMSetup_ITA.exe
- %TEMP%\pft3.tmp\fscommand\DMSetup_PTB.exe
- %WINDIR%\Installer\2ee2e.msi
- %TEMP%\pft3.tmp\fscommand\DMSetup_SVE.exe
- %TEMP%\pft3.tmp\fscommand\DMSetup_DEU.exe
- %TEMP%\pft3.tmp\Device Manager\Setup.ini
- %TEMP%\pft3.tmp\fscommand\DMSetup_ENG.exe
- %TEMP%\pft3.tmp\fscommand\DMSetup_FRA.exe
- %TEMP%\pft3.tmp\fscommand\DMSetup_ESP.exe
Удаляет следующие файлы:
- %WINDIR%\Installer\MSI16.tmp
- %WINDIR%\Installer\MSI17.tmp
- %WINDIR%\Installer\MSIF.tmp
- %WINDIR%\Installer\MSI13.tmp
- %WINDIR%\Installer\MSI14.tmp
- %WINDIR%\Installer\MSI15.tmp
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Installer\2ee32.msi
- %WINDIR%\Installer\2ee33.mst
- C:\Config.Msi\2ee35.rbs
- %WINDIR%\Installer\MSI19.tmp
- %WINDIR%\Installer\MSI1A.tmp
- C:\Config.Msi\2ee31.rbs
- %WINDIR%\Installer\2ee2e.msi
- %TEMP%\MSI9.tmp
- %TEMP%\ext2.tmp
- %TEMP%\pft3.tmp\pftw1.pkg
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\MSIE.tmp
- %WINDIR%\Installer\MSI10.tmp
- %WINDIR%\Installer\MSI12.tmp
- %WINDIR%\Installer\MSIB.tmp
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSID.tmp
Перемещает следующие файлы:
- %PROGRAM_FILES%\Philips\Philips GoGear HDD\bin\unic6742.rra в %PROGRAM_FILES%\Philips\Philips GoGear HDD\bin\unicows.dll
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\WNAS6696.rra в %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\WNASPI32.DLL
- %PROGRAM_FILES%\Philips\Philips GoGear HDD\bin\Devi6965.rra в %PROGRAM_FILES%\Philips\Philips GoGear HDD\bin\DeviceManagerUI.exe
- %PROGRAM_FILES%\Philips\Philips GoGear HDD\bin\Firm685b.rra в %PROGRAM_FILES%\Philips\Philips GoGear HDD\bin\Firmware.dll
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\sqli655d.rra в %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\sqlite.dll
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\Firm650f.rra в %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\Firmware.dll
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\USBC6638.rra в %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\USBConnections.dll
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\unic65cb.rra в %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\unicows.dll
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\PORTUGAL\Devi70b8.rra в %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\PORTUGAL\DeviceManagerUI.exe
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\ITALY\Devi6fcd.rra в %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\ITALY\DeviceManagerUI.exe
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\SWEDEN\Devi72ea.rra в %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\SWEDEN\DeviceManagerUI.exe
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\SPAIN\Devi71f0.rra в %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\SPAIN\DeviceManagerUI.exe
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\ENGLISH\Devi6d1e.rra в %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\ENGLISH\DeviceManagerUI.exe
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\DUTCH\Devi6bc6.rra в %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\DUTCH\DeviceManagerUI.exe
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\GERMAN\Devi6ef2.rra в %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\GERMAN\DeviceManagerUI.exe
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\FRANCE\Devi6e08.rra в %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\FRANCE\DeviceManagerUI.exe
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\firmware\devi5ba9.rra в %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\firmware\deviceConfig.properties
- <SYSTEM32>\Philips GoGear HDD\devi5aaf.rra в <SYSTEM32>\Philips GoGear HDD\deviceConfig.properties
- %PROGRAM_FILES%\Philips\Philips GoGear HDD\Config\MyDB5e68.rra в %PROGRAM_FILES%\Philips\Philips GoGear HDD\Config\MyDB
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\firmware\Encr5c64.rra в %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\firmware\Encrypted_FWImage_HDD070_4.41d.ebn
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Help\Help5763.rra в %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Help\Help GoGear HDD.chm
- %PROGRAM_FILES%\Philips\Philips GoGear HDD\Help\Help564a.rra в %PROGRAM_FILES%\Philips\Philips GoGear HDD\Help\Help GoGear HDD.chm
- %PROGRAM_FILES%\Philips\Philips GoGear HDD\Config\Encr5948.rra в %PROGRAM_FILES%\Philips\Philips GoGear HDD\Config\Encrypted_FWImage_HDD070_4.41d.ebn
- %PROGRAM_FILES%\Philips\Philips GoGear HDD\Config\devi58ab.rra в %PROGRAM_FILES%\Philips\Philips GoGear HDD\Config\deviceConfig.properties
- %PROGRAM_FILES%\Philips\Common\USBC62ec.rra в %PROGRAM_FILES%\Philips\Common\USBConnections.dll
- %PROGRAM_FILES%\Philips\Common\unic6260.rra в %PROGRAM_FILES%\Philips\Common\unicows.dll
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\DM6483.rra в %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\DM.dll
- %PROGRAM_FILES%\Philips\Common\WNAS6379.rra в %PROGRAM_FILES%\Philips\Common\WNASPI32.DLL
- %PROGRAM_FILES%\Philips\Common\DM60f8.rra в %PROGRAM_FILES%\Philips\Common\DM.dll
- %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Config\MyDB5ffe.rra в %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Config\MyDB
- %PROGRAM_FILES%\Philips\Common\sqli6212.rra в %PROGRAM_FILES%\Philips\Common\sqlite.dll
- %PROGRAM_FILES%\Philips\Common\Firm61b4.rra в %PROGRAM_FILES%\Philips\Common\Firmware.dll
Сетевая активность:
Подключается к:
- 'cr#.#hawte.com':80
- 'wp#d':80
TCP:
Запросы HTTP GET:
- cr#.#hawte.com/ThawteCodeSigningCA.crl
- cr#.#hawte.com/ThawtePremiumServerCA.crl
- wp#d/wpad.dat
UDP:
- DNS ASK cr#.#hawte.com
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
