Trojan.DownLoader11.15345

Technical Information

Malicious functions:

Creates and executes the following:

'%CommonProgramFiles%\InstallShield\Driver\10\Intel 32\IDriver.exe' 32\IDriver.exe -Embedding
'%TEMP%\pft3.tmp\Device Manager\Delete.exe' %PROGRAM_FILES%\Philips\Philips GoGear HDD\
'%TEMP%\pft3.tmp\fscommand\DMSetup_ENG.exe'
'%TEMP%\pft3.tmp\Device Manager\setup.exe' /L1033

Executes the following:

'<SYSTEM32>\msiexec.exe' -Embedding 22AB9CFC425E265F81A3BBA8F1FB3112 M Global\MSI0000
'<SYSTEM32>\regsvr32.exe' /s %PROGRAM_FILES%\Philips\Common\DM.dll
'<SYSTEM32>\regsvr32.exe' /s %PROGRAM_FILES%\Philips\Common\USBCON~1.DLL
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' -Embedding 27B71C3491AD2E892753BAD9C1DBDCA1 C
'<SYSTEM32>\msiexec.exe' -Embedding FC0EA4439663F5B63C188F1657A48581

Modifies file system :

Creates the following files:

%WINDIR%\Installer\MSIA.tmp
%WINDIR%\Installer\2ee33.mst
%WINDIR%\Installer\MSIB.tmp
%WINDIR%\Installer\MSID.tmp
%WINDIR%\Installer\MSIC.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%WINDIR%\Installer\2ee32.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
%WINDIR%\Installer\MSIE.tmp
%WINDIR%\Installer\MSI15.tmp
%WINDIR%\Installer\MSI14.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Philips GoGear HDD\Help GoGear HDD.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Philips GoGear HDD\Uninstall.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Philips GoGear HDD\Philips GoGear HDD.lnk
%WINDIR%\Installer\MSI10.tmp
%WINDIR%\Installer\MSIF.tmp
C:\Config.Msi\2ee35.rbs
%WINDIR%\Installer\MSI13.tmp
%WINDIR%\Installer\MSI12.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
%ALLUSERSPROFILE%\Desktop\Philips GoGear HDD.lnk
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\sqli655d.rra
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\Firm650f.rra
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\unic65cb.rra
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\WNAS6696.rra
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\USBC6638.rra
%PROGRAM_FILES%\Philips\Common\unic6260.rra
%PROGRAM_FILES%\Philips\Common\sqli6212.rra
%PROGRAM_FILES%\Philips\Common\USBC62ec.rra
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\DM6483.rra
%PROGRAM_FILES%\Philips\Common\WNAS6379.rra
%PROGRAM_FILES%\Philips\Philips GoGear HDD\bin\unic6742.rra
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\ITALY\Devi6fcd.rra
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\GERMAN\Devi6ef2.rra
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\PORTUGAL\Devi70b8.rra
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\SWEDEN\Devi72ea.rra
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\SPAIN\Devi71f0.rra
%PROGRAM_FILES%\Philips\Philips GoGear HDD\bin\Devi6965.rra
%PROGRAM_FILES%\Philips\Philips GoGear HDD\bin\Firm685b.rra
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\DUTCH\Devi6bc6.rra
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\FRANCE\Devi6e08.rra
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\ENGLISH\Devi6d1e.rra
%WINDIR%\Installer\MSI17.tmp
%WINDIR%\Installer\MSI16.tmp
%WINDIR%\Installer\MSI19.tmp
%TEMP%\3907a.mst
%WINDIR%\Installer\MSI1A.tmp
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\NewShortcut2_B184A2F73EC84B86841227E0D53BA535
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\ARPPRODUCTICON.exe
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\NewShortcut4_B184A2F73EC84B86841227E0D53BA535.exe
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\1033.mst
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\NewShortcut3_B184A2F73EC84B86841227E0D53BA535_1.exe
%PROGRAM_FILES%\Philips\Philips GoGear HDD\Help\Help564a.rra
%PROGRAM_FILES%\Philips\Philips GoGear HDD\Config\MyDB5e68.rra
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\firmware\Encr5c64.rra
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Config\MyDB5ffe.rra
%PROGRAM_FILES%\Philips\Common\Firm61b4.rra
%PROGRAM_FILES%\Philips\Common\DM60f8.rra
%PROGRAM_FILES%\Philips\Philips GoGear HDD\Config\devi58ab.rra
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Help\Help5763.rra
%PROGRAM_FILES%\Philips\Philips GoGear HDD\Config\Encr5948.rra
%WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\firmware\devi5ba9.rra
<SYSTEM32>\Philips GoGear HDD\devi5aaf.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
%TEMP%\pft3.tmp\Device Manager\config\MyDB
%TEMP%\pft3.tmp\Device Manager\bin\SWEDEN\DeviceManagerUI.exe
%TEMP%\pft3.tmp\Device Manager\Delete.exe
%TEMP%\pft3.tmp\Device Manager\DLLS\Firmware.dll
%TEMP%\pft3.tmp\Device Manager\DLLS\DM.dll
%TEMP%\pft3.tmp\Device Manager\bin\GERMAN\DeviceManagerUI.exe
%TEMP%\pft3.tmp\Device Manager\bin\FRANCE\DeviceManagerUI.exe
%TEMP%\pft3.tmp\Device Manager\bin\ITALY\DeviceManagerUI.exe
%TEMP%\pft3.tmp\Device Manager\bin\SPAIN\DeviceManagerUI.exe
%TEMP%\pft3.tmp\Device Manager\bin\PORTUGAL\DeviceManagerUI.exe
%TEMP%\pft3.tmp\Device Manager\DLLS\sqlite.dll
%TEMP%\pft3.tmp\Device Manager\firmwares\deviceConfig.properties
%TEMP%\pft3.tmp\Device Manager\Driver\PUMSS_DMM.inf
%TEMP%\pft3.tmp\Device Manager\firmwares\Encrypted_FWImage_HDD070_4.41d.ebn
%TEMP%\pft3.tmp\Device Manager\help\Help_ENG.chm
%TEMP%\pft3.tmp\Device Manager\help\Help_Dutch.chm
%TEMP%\pft3.tmp\Device Manager\DLLS\USBConnections.dll
%TEMP%\pft3.tmp\Device Manager\DLLS\unicows.dll
%TEMP%\pft3.tmp\Device Manager\DLLS\WNASPI32.DLL
%TEMP%\pft3.tmp\Device Manager\Driver\PUMSSPDR.pdr
%TEMP%\pft3.tmp\Device Manager\Driver\PUMSS.sys
%TEMP%\pft3.tmp\Device Manager\0x040c.ini
%TEMP%\pft3.tmp\Device Manager\0x040a.ini
%TEMP%\pft3.tmp\Device Manager\0x0410.ini
%TEMP%\pft3.tmp\Device Manager\0x0416.ini
%TEMP%\pft3.tmp\Device Manager\0x0413.ini
%TEMP%\plf1.tmp
%TEMP%\ext2.tmp
%TEMP%\pft3.tmp\pftw1.pkg
%TEMP%\pft3.tmp\Device Manager\0x0409.ini
%TEMP%\pft3.tmp\Device Manager\0x0407.ini
%TEMP%\pft3.tmp\Device Manager\0x041d.ini
%TEMP%\pft3.tmp\Device Manager\1046.mst
%TEMP%\pft3.tmp\Device Manager\1043.mst
%TEMP%\pft3.tmp\Device Manager\1053.mst
%TEMP%\pft3.tmp\Device Manager\bin\ENGLISH\DeviceManagerUI.exe
%TEMP%\pft3.tmp\Device Manager\bin\DUTCH\DeviceManagerUI.exe
%TEMP%\pft3.tmp\Device Manager\1033.mst
%TEMP%\pft3.tmp\Device Manager\1031.mst
%TEMP%\pft3.tmp\Device Manager\1034.mst
%TEMP%\pft3.tmp\Device Manager\1040.mst
%TEMP%\pft3.tmp\Device Manager\1036.mst
%TEMP%\pft3.tmp\Device Manager\help\Help_ESP.chm
%CommonProgramFiles%\InstallShield\Driver\10\Intel 32\ISRT.dll
C:\Config.Msi\2ee31.rbs
%CommonProgramFiles%\InstallShield\Driver\10\Intel 32\_ISRES1033.dll
%CommonProgramFiles%\InstallShield\Driver\10\Intel 32\iGdiCnv.dll
%CommonProgramFiles%\InstallShield\Driver\10\Intel 32\IDriver.exe
%APPDATA%\Microsoft\CryptnetUrlCache\Content\74BFD122C0875EC75DBE5C6DB4C59019
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\74BFD122C0875EC75DBE5C6DB4C59019
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\486CC6AFD08942336C61FCD401C4A1D1
%WINDIR%\Installer\MSI6.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\Content\486CC6AFD08942336C61FCD401C4A1D1
%CommonProgramFiles%\InstallShield\Driver\10\Intel 32\IUserCnv.dll
%TEMP%\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\_ISRES.DLL
%TEMP%\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\IsConfig.INI
%TEMP%\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\_ISUSER.DLL
%TEMP%\MSI9.tmp
%TEMP%\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\String1033.txt
%CommonProgramFiles%\InstallShield\Driver\10\Intel 32\objpscnv.dll
%CommonProgramFiles%\InstallShield\Driver\10\Intel 32\IScrCnv.dll
%CommonProgramFiles%\InstallShield\Driver\10\Intel 32\IDriver2.exe
%TEMP%\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\ISRT.DLL
%TEMP%\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\setup.inx
%TEMP%\pft3.tmp\Device Manager\instmsia.exe
%TEMP%\pft3.tmp\Device Manager\install_bkg_logo.bmp
%TEMP%\pft3.tmp\Device Manager\instmsiw.exe
%TEMP%\pft3.tmp\Device Manager\Philips GoGear HDD Device Manager.msi
%TEMP%\pft3.tmp\Device Manager\ISScript10.Msi
%TEMP%\pft3.tmp\Device Manager\help\Help_ger.chm
%TEMP%\pft3.tmp\Device Manager\help\Help_Fr.chm
%TEMP%\pft3.tmp\Device Manager\help\Help_Itl.chm
%TEMP%\pft3.tmp\Device Manager\help\Help_Swe.chm
%TEMP%\pft3.tmp\Device Manager\help\Help_Por.chm
%TEMP%\pft3.tmp\Device Manager\setup.exe
%TEMP%\pft3.tmp\fscommand\DMSetup_NLD.exe
%TEMP%\pft3.tmp\fscommand\DMSetup_ITA.exe
%TEMP%\pft3.tmp\fscommand\DMSetup_PTB.exe
%WINDIR%\Installer\2ee2e.msi
%TEMP%\pft3.tmp\fscommand\DMSetup_SVE.exe
%TEMP%\pft3.tmp\fscommand\DMSetup_DEU.exe
%TEMP%\pft3.tmp\Device Manager\Setup.ini
%TEMP%\pft3.tmp\fscommand\DMSetup_ENG.exe
%TEMP%\pft3.tmp\fscommand\DMSetup_FRA.exe
%TEMP%\pft3.tmp\fscommand\DMSetup_ESP.exe

Deletes the following files:

%WINDIR%\Installer\MSI16.tmp
%WINDIR%\Installer\MSI17.tmp
%WINDIR%\Installer\MSIF.tmp
%WINDIR%\Installer\MSI13.tmp
%WINDIR%\Installer\MSI14.tmp
%WINDIR%\Installer\MSI15.tmp
%WINDIR%\Installer\MSIA.tmp
%WINDIR%\Installer\2ee32.msi
%WINDIR%\Installer\2ee33.mst
C:\Config.Msi\2ee35.rbs
%WINDIR%\Installer\MSI19.tmp
%WINDIR%\Installer\MSI1A.tmp
C:\Config.Msi\2ee31.rbs
%WINDIR%\Installer\2ee2e.msi
%TEMP%\MSI9.tmp
%TEMP%\ext2.tmp
%TEMP%\pft3.tmp\pftw1.pkg
%WINDIR%\Installer\MSI6.tmp
%WINDIR%\Installer\MSIE.tmp
%WINDIR%\Installer\MSI10.tmp
%WINDIR%\Installer\MSI12.tmp
%WINDIR%\Installer\MSIB.tmp
%WINDIR%\Installer\MSIC.tmp
%WINDIR%\Installer\MSID.tmp

Moves the following files:

from %PROGRAM_FILES%\Philips\Philips GoGear HDD\bin\unic6742.rra to %PROGRAM_FILES%\Philips\Philips GoGear HDD\bin\unicows.dll
from %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\WNAS6696.rra to %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\WNASPI32.DLL
from %PROGRAM_FILES%\Philips\Philips GoGear HDD\bin\Devi6965.rra to %PROGRAM_FILES%\Philips\Philips GoGear HDD\bin\DeviceManagerUI.exe
from %PROGRAM_FILES%\Philips\Philips GoGear HDD\bin\Firm685b.rra to %PROGRAM_FILES%\Philips\Philips GoGear HDD\bin\Firmware.dll
from %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\sqli655d.rra to %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\sqlite.dll
from %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\Firm650f.rra to %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\Firmware.dll
from %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\USBC6638.rra to %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\USBConnections.dll
from %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\unic65cb.rra to %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\unicows.dll
from %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\PORTUGAL\Devi70b8.rra to %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\PORTUGAL\DeviceManagerUI.exe
from %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\ITALY\Devi6fcd.rra to %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\ITALY\DeviceManagerUI.exe
from %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\SWEDEN\Devi72ea.rra to %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\SWEDEN\DeviceManagerUI.exe
from %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\SPAIN\Devi71f0.rra to %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\SPAIN\DeviceManagerUI.exe
from %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\ENGLISH\Devi6d1e.rra to %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\ENGLISH\DeviceManagerUI.exe
from %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\DUTCH\Devi6bc6.rra to %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\DUTCH\DeviceManagerUI.exe
from %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\GERMAN\Devi6ef2.rra to %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\GERMAN\DeviceManagerUI.exe
from %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\FRANCE\Devi6e08.rra to %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\bin\FRANCE\DeviceManagerUI.exe
from %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\firmware\devi5ba9.rra to %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\firmware\deviceConfig.properties
from <SYSTEM32>\Philips GoGear HDD\devi5aaf.rra to <SYSTEM32>\Philips GoGear HDD\deviceConfig.properties
from %PROGRAM_FILES%\Philips\Philips GoGear HDD\Config\MyDB5e68.rra to %PROGRAM_FILES%\Philips\Philips GoGear HDD\Config\MyDB
from %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\firmware\Encr5c64.rra to %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\firmware\Encrypted_FWImage_HDD070_4.41d.ebn
from %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Help\Help5763.rra to %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Help\Help GoGear HDD.chm
from %PROGRAM_FILES%\Philips\Philips GoGear HDD\Help\Help564a.rra to %PROGRAM_FILES%\Philips\Philips GoGear HDD\Help\Help GoGear HDD.chm
from %PROGRAM_FILES%\Philips\Philips GoGear HDD\Config\Encr5948.rra to %PROGRAM_FILES%\Philips\Philips GoGear HDD\Config\Encrypted_FWImage_HDD070_4.41d.ebn
from %PROGRAM_FILES%\Philips\Philips GoGear HDD\Config\devi58ab.rra to %PROGRAM_FILES%\Philips\Philips GoGear HDD\Config\deviceConfig.properties
from %PROGRAM_FILES%\Philips\Common\USBC62ec.rra to %PROGRAM_FILES%\Philips\Common\USBConnections.dll
from %PROGRAM_FILES%\Philips\Common\unic6260.rra to %PROGRAM_FILES%\Philips\Common\unicows.dll
from %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\DM6483.rra to %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Common\DM.dll
from %PROGRAM_FILES%\Philips\Common\WNAS6379.rra to %PROGRAM_FILES%\Philips\Common\WNASPI32.DLL
from %PROGRAM_FILES%\Philips\Common\DM60f8.rra to %PROGRAM_FILES%\Philips\Common\DM.dll
from %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Config\MyDB5ffe.rra to %WINDIR%\Installer\{B184A2F7-3EC8-4B86-8412-27E0D53BA535}\Config\MyDB
from %PROGRAM_FILES%\Philips\Common\sqli6212.rra to %PROGRAM_FILES%\Philips\Common\sqlite.dll
from %PROGRAM_FILES%\Philips\Common\Firm61b4.rra to %PROGRAM_FILES%\Philips\Common\Firmware.dll

Network activity:

Connects to:

'cr#.#hawte.com':80
'wp#d':80

TCP:

HTTP GET requests:

cr#.#hawte.com/ThawteCodeSigningCA.crl
cr#.#hawte.com/ThawtePremiumServerCA.crl
wp#d/wpad.dat

UDP:

DNS ASK cr#.#hawte.com
DNS ASK wp#d

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial