Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Classes\HDZfile\shell\open\command] '' = '%ProgramFiles%\Hard Disk Sentinel\HDSentinel.exe "%1"'
Вредоносные функции
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами
- [<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
Изменения в файловой системе
Создает следующие файлы
- %ProgramFiles%\hard disk sentinel\hdsirena.mp3
- %ProgramFiles%\hard disk sentinel\dethp2.dll
- %ProgramFiles%\hard disk sentinel\dethp.dll
- %ProgramFiles%\hard disk sentinel\detect.dll
- %ProgramFiles%\hard disk sentinel\detat.dll
- %ProgramFiles%\hard disk sentinel\deta1.dll
- %ProgramFiles%\hard disk sentinel\deta.dll
- %ProgramFiles%\hard disk sentinel\bc_vbdll.dll
- %ProgramFiles%\hard disk sentinel\afaapi.dll
- %ProgramFiles%\hard disk sentinel\109commandlib.dll
- %ProgramFiles%\hard disk sentinel\hdsentineltray.exe
- %ProgramFiles%\hard disk sentinel\hdsentinel.exe
- %ProgramFiles%\hard disk sentinel\hdsctrl.exe
- %ProgramFiles%\hard disk sentinel\hdsaction.exe
- %ProgramFiles%\hard disk sentinel\detjm.dll
- %ProgramFiles%\hard disk sentinel\hdsentinel.vsx
- %ProgramFiles%\hard disk sentinel\hdsentinel.rdi
- %ProgramFiles%\hard disk sentinel\ukpro.lng
- %ProgramFiles%\hard disk sentinel\uk.lng
- %ProgramFiles%\hard disk sentinel\twpro.lng
- %ProgramFiles%\hard disk sentinel\tw.lng
- %ProgramFiles%\hard disk sentinel\trpro.lng
- %ProgramFiles%\hard disk sentinel\tr.lng
- %ProgramFiles%\hard disk sentinel\swpro.lng
- %ProgramFiles%\hard disk sentinel\sw.lng
- %ProgramFiles%\hard disk sentinel\sp.lng
- %ProgramFiles%\hard disk sentinel\skpro.lng
- %ProgramFiles%\hard disk sentinel\sk.lng
- %ProgramFiles%\hard disk sentinel\rupro.lng
- %ProgramFiles%\hard disk sentinel\hdsentinel.vsh
- %ProgramFiles%\hard disk sentinel\prerrlog.dll
- %ProgramFiles%\hard disk sentinel\hdsdata\diskdata_mass_storage_device_zzbmzgqvp88_st6oa31b.hdi
- %ProgramFiles%\hard disk sentinel\detmv.dll
- %ProgramFiles%\hard disk sentinel\hdsdata\diskdata_western_digital_hdd_aavom064b0_1.0.hdi
- %ProgramFiles%\hard disk sentinel\hdsdata\diskdata_mass_storage_device_zzbmzgqvp88_st6oa31b.dat
- %ProgramFiles%\hard disk sentinel\hdsdata\diskdata_western_digital_hdd_aavom064b0_1.0.dat
- %TEMP%\190801165028621.38464506.tmp
- %ProgramFiles%\hard disk sentinel\hdsdata\log.txt
- %ProgramFiles%\hard disk sentinel\hdsentinel.sys
- %ProgramFiles%\hard disk sentinel\storelibir.dll
- %ProgramFiles%\hard disk sentinel\storelibir-2.dll
- %ProgramFiles%\hard disk sentinel\storelib.dll
- %ProgramFiles%\hard disk sentinel\storectrl.dll
- %ProgramFiles%\hard disk sentinel\storarc.dll
- %ProgramFiles%\hard disk sentinel\storagetest.dll
- %ProgramFiles%\hard disk sentinel\ssleay32.dll
- %ProgramFiles%\hard disk sentinel\ru.lng
- %ProgramFiles%\hard disk sentinel\pri2plgnnapa.dll
- %ProgramFiles%\hard disk sentinel\prdecode.dll
- %ProgramFiles%\hard disk sentinel\mv_api.dll
- %ProgramFiles%\hard disk sentinel\libxml2.dll
- %ProgramFiles%\hard disk sentinel\libeay32.dll
- %ProgramFiles%\hard disk sentinel\infomgr.dll
- %ProgramFiles%\hard disk sentinel\hdsevtmsg.dll
- %ProgramFiles%\hard disk sentinel\fnp_act_installer.dll
- %ProgramFiles%\hard disk sentinel\detw64.dll
- %ProgramFiles%\hard disk sentinel\detw.dll
- %ProgramFiles%\hard disk sentinel\detrd64.dll
- %ProgramFiles%\hard disk sentinel\detrd.dll
- %ProgramFiles%\hard disk sentinel\detrc.dll
- %ProgramFiles%\hard disk sentinel\detp.dll
- %ProgramFiles%\hard disk sentinel\detjm2.dll
- %ProgramFiles%\hard disk sentinel\detjmx.dll
- %ProgramFiles%\hard disk sentinel\ropro.lng
- %ProgramFiles%\hard disk sentinel\czpro.lng
- %ProgramFiles%\hard disk sentinel\cn.lng
- %ProgramFiles%\hard disk sentinel\bgpro.lng
- %ProgramFiles%\hard disk sentinel\bg.lng
- %ProgramFiles%\hard disk sentinel\bepro.lng
- %ProgramFiles%\hard disk sentinel\be.lng
- %ProgramFiles%\hard disk sentinel\arpro.lng
- %ProgramFiles%\hard disk sentinel\ar.lng
- %ProgramFiles%\hard disk sentinel\vista_statusw.icd
- %ProgramFiles%\hard disk sentinel\vista_statusn.icd
- %ProgramFiles%\hard disk sentinel\vista_statusg.icd
- %ProgramFiles%\hard disk sentinel\vista_statusb.icd
- %ProgramFiles%\hard disk sentinel\vista_status.icd
- %ProgramFiles%\hard disk sentinel\statusw.icd
- %ProgramFiles%\hard disk sentinel\cnpro.lng
- %ProgramFiles%\hard disk sentinel\statusn.icd
- %ProgramFiles%\hard disk sentinel\statusb.icd
- %ProgramFiles%\hard disk sentinel\status.icd
- %ProgramFiles%\hard disk sentinel\storelib2.dlz
- %ProgramFiles%\hard disk sentinel\detpex.dlz
- %ProgramFiles%\hard disk sentinel\hdsdata\reg.dat
- %ProgramFiles%\hard disk sentinel\detect.dat
- %ProgramFiles%\hard disk sentinel\hdsdata\hdsentinel.ini
- %ProgramFiles%\hard disk sentinel\hds_eula_hu.txt
- %ProgramFiles%\hard disk sentinel\hds_eula_en.txt
- %ProgramFiles%\hard disk sentinel\hdsversion.txt
- %ProgramFiles%\hard disk sentinel\removehds7.vbs
- %ProgramFiles%\hard disk sentinel\hdd.jpg
- %ProgramFiles%\hard disk sentinel\hdnotify.wav
- %ProgramFiles%\hard disk sentinel\statusg.icd
- %ProgramFiles%\hard disk sentinel\hu.lng
- %ProgramFiles%\hard disk sentinel\ptbrpro.lng
- %ProgramFiles%\hard disk sentinel\da.lng
- %ProgramFiles%\hard disk sentinel\ptbr.lng
- %ProgramFiles%\hard disk sentinel\plpro.lng
- %ProgramFiles%\hard disk sentinel\pl.lng
- %ProgramFiles%\hard disk sentinel\mkpro.lng
- %ProgramFiles%\hard disk sentinel\mk.lng
- %ProgramFiles%\hard disk sentinel\kopro.lng
- %ProgramFiles%\hard disk sentinel\ko.lng
- %ProgramFiles%\hard disk sentinel\jppro.lng
- %ProgramFiles%\hard disk sentinel\jp.lng
- %ProgramFiles%\hard disk sentinel\itpro.lng
- %ProgramFiles%\hard disk sentinel\it.lng
- %ProgramFiles%\hard disk sentinel\idpro.lng
- %ProgramFiles%\hard disk sentinel\id.lng
- %ProgramFiles%\hard disk sentinel\ro.lng
- %ProgramFiles%\hard disk sentinel\hupro.lng
- %ProgramFiles%\hard disk sentinel\grpro.lng
- %ProgramFiles%\hard disk sentinel\gr.lng
- %ProgramFiles%\hard disk sentinel\frpro.lng
- %ProgramFiles%\hard disk sentinel\fr.lng
- %ProgramFiles%\hard disk sentinel\fipro.lng
- %ProgramFiles%\hard disk sentinel\fi.lng
- %ProgramFiles%\hard disk sentinel\enpro.lng
- %ProgramFiles%\hard disk sentinel\en.lng
- %ProgramFiles%\hard disk sentinel\dupro.lng
- %ProgramFiles%\hard disk sentinel\du.lng
- %ProgramFiles%\hard disk sentinel\depro.lng
- %ProgramFiles%\hard disk sentinel\de.lng
- %ProgramFiles%\hard disk sentinel\dapro.lng
- %ProgramFiles%\hard disk sentinel\cz.lng
- %ProgramFiles%\hard disk sentinel\hdsdata\driveaddremovelog.txt
Удаляет следующие файлы
- %TEMP%\190801165028621.38464506.tmp
Другое
Ищет следующие окна
- ClassName: 'Progman' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
Создает и запускает на исполнение
- '%ProgramFiles%\hard disk sentinel\hdsentinel.exe'
- '%ProgramFiles%\hard disk sentinel\detect.dll' *WMIC2* . "%TEMP%\190801165028621.38464506.tmp" SELECT Index,PNPDeviceID FROM Win32_DiskDrive
- '%ProgramFiles%\hard disk sentinel\detect.dll' *WMIC2* . "%TEMP%\190801165028621.38464506.tmp" SELECT Index,PNPDeviceID FROM Win32_DiskDrive' (со скрытым окном)
