Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Classes\HDZfile\shell\open\command] '' = '%WINDIR%\temp\ltdkyqdsad\HDSentinel.exe "%1"'
Creates or modifies the following files
- <SYSTEM32>\tasks\harddisksentinel\hard disk sentinel_user
Modifies file system
Creates the following files
- %WINDIR%\temp\ltdkyqdsad\afaapi.dll
- %WINDIR%\temp\ltdkyqdsad\statusw.icd
- %WINDIR%\temp\ltdkyqdsad\statusn.icd
- %WINDIR%\temp\ltdkyqdsad\statusg.icd
- %WINDIR%\temp\ltdkyqdsad\statusb.icd
- %WINDIR%\temp\ltdkyqdsad\status.icd
- %WINDIR%\temp\ltdkyqdsad\ssleay32.dll
- %WINDIR%\temp\ltdkyqdsad\sp.lng
- %WINDIR%\temp\ltdkyqdsad\skpro.lng
- %WINDIR%\temp\ltdkyqdsad\sk.lng
- %WINDIR%\temp\ltdkyqdsad\rupro.lng
- %WINDIR%\temp\ltdkyqdsad\ru.lng
- %WINDIR%\temp\ltdkyqdsad\ru.chm
- %WINDIR%\temp\ltdkyqdsad\ropro.lng
- %WINDIR%\temp\ltdkyqdsad\ro.lng
- %WINDIR%\temp\ltdkyqdsad\removehds7.vbs
- %WINDIR%\temp\ltdkyqdsad\ptbrpro.lng
- %WINDIR%\temp\ltdkyqdsad\ptbr.lng
- %WINDIR%\temp\ltdkyqdsad\pri2plgnnapa.dll
- %WINDIR%\temp\ltdkyqdsad\prerrlog.dll
- %WINDIR%\temp\ltdkyqdsad\prdecode.dll
- %WINDIR%\temp\ltdkyqdsad\plpro.lng
- %WINDIR%\temp\ltdkyqdsad\pl.lng
- %WINDIR%\temp\ltdkyqdsad\pl.chm
- %WINDIR%\temp\ltdkyqdsad\mkpro.lng
- %WINDIR%\temp\ltdkyqdsad\mk.lng
- %WINDIR%\temp\ltdkyqdsad\libxml2.dll
- %WINDIR%\temp\ltdkyqdsad\libeay32.dll
- %WINDIR%\temp\ltdkyqdsad\jppro.lng
- %WINDIR%\temp\ltdkyqdsad\jp.lng
- %WINDIR%\temp\ltdkyqdsad\it.lng
- %WINDIR%\temp\ltdkyqdsad\itpro.lng
- %WINDIR%\temp\ltdkyqdsad\storagetest.dll
- %WINDIR%\temp\ltdkyqdsad\storarc.dll
- %APPDATA%\hard disk sentinel\hds_control_remove.vbs
- %LOCALAPPDATA%\microsoft\windows sidebar\gadgets\hard disk sentinel.gadget\hdsentinel.html
- %LOCALAPPDATA%\microsoft\windows sidebar\gadgets\hard disk sentinel.gadget\gadget.xml
- %LOCALAPPDATA%\microsoft\windows sidebar\gadgets\hard disk sentinel.gadget\hdsentinel.png
- %WINDIR%\temp\ltdkyqdsad\diskdata_mass_storage_device_zz3ve7sk392y_st6oa31b.hdi
- %WINDIR%\temp\ltdkyqdsad\diskdata_western_digital_hdd_aad95vtgxu_1.0.hdi
- %WINDIR%\temp\ltdkyqdsad\diskdata_mass_storage_device_zz3ve7sk392y_st6oa31b.dat
- %WINDIR%\temp\ltdkyqdsad\diskdata_western_digital_hdd_aad95vtgxu_1.0.dat
- %TEMP%\241121102227292.74833633.tmp
- %WINDIR%\temp\ltdkyqdsad\winsched.txt
- %WINDIR%\temp\ltdkyqdsad\vista_statusw.icd
- %WINDIR%\temp\ltdkyqdsad\vista_statusn.icd
- %WINDIR%\temp\ltdkyqdsad\vista_statusg.icd
- %WINDIR%\temp\ltdkyqdsad\vista_statusb.icd
- %WINDIR%\temp\ltdkyqdsad\unins000.exe
- %WINDIR%\temp\ltdkyqdsad\hdsaction.exe
- %WINDIR%\temp\ltdkyqdsad\unins000.dat
- %WINDIR%\temp\ltdkyqdsad\ukpro.lng
- %WINDIR%\temp\ltdkyqdsad\uk.lng
- %WINDIR%\temp\ltdkyqdsad\twpro.lng
- %WINDIR%\temp\ltdkyqdsad\tw.lng
- %WINDIR%\temp\ltdkyqdsad\trpro.lng
- %WINDIR%\temp\ltdkyqdsad\tr.lng
- %WINDIR%\temp\ltdkyqdsad\swpro.lng
- %WINDIR%\temp\ltdkyqdsad\sw.lng
- %WINDIR%\temp\ltdkyqdsad\storelibir.dll
- %WINDIR%\temp\ltdkyqdsad\storelibir-2.dll
- %WINDIR%\temp\ltdkyqdsad\storelib2.dlz
- %WINDIR%\temp\ltdkyqdsad\storelib.dll
- %WINDIR%\temp\ltdkyqdsad\storectrl.dll
- %WINDIR%\temp\ltdkyqdsad\it.chm
- %WINDIR%\temp\ltdkyqdsad\infomgr.dll
- %WINDIR%\temp\ltdkyqdsad\idpro.lng
- %WINDIR%\temp\ltdkyqdsad\diskdata_sandisk_cruzer_fit_4c530001310303108281_1.27_scsi.hdi
- %WINDIR%\temp\ltdkyqdsad\diskdata_hgst_hts545050a7e680_131117te85134n1zy8xr_gg2oae30.hdi
- %WINDIR%\temp\ltdkyqdsad\diskdata_hgst_hts545050a7e680_131117te85134n1zy8xr_gg2oae30.dat
- %WINDIR%\temp\ltdkyqdsad\detw64.dll
- %WINDIR%\temp\ltdkyqdsad\detw.dll
- %WINDIR%\temp\ltdkyqdsad\detrc.dll
- %WINDIR%\temp\ltdkyqdsad\detpex.dlz
- %WINDIR%\temp\ltdkyqdsad\detp.dll
- %WINDIR%\temp\ltdkyqdsad\detjm.dll
- %WINDIR%\temp\ltdkyqdsad\dethp.dll
- %WINDIR%\temp\ltdkyqdsad\detect.dll
- %WINDIR%\temp\ltdkyqdsad\detect.dat
- %WINDIR%\temp\ltdkyqdsad\deta.dll
- %WINDIR%\temp\ltdkyqdsad\depro.lng
- %WINDIR%\temp\ltdkyqdsad\de.lng
- %WINDIR%\temp\ltdkyqdsad\dapro.lng
- %WINDIR%\temp\ltdkyqdsad\da.lng
- %WINDIR%\temp\ltdkyqdsad\czpro.lng
- %WINDIR%\temp\ltdkyqdsad\cz.lng
- %WINDIR%\temp\ltdkyqdsad\cnpro.lng
- %WINDIR%\temp\ltdkyqdsad\cn.lng
- %WINDIR%\temp\ltdkyqdsad\bgpro.lng
- %WINDIR%\temp\ltdkyqdsad\bg.lng
- %WINDIR%\temp\ltdkyqdsad\bepro.lng
- %WINDIR%\temp\ltdkyqdsad\be.lng
- %WINDIR%\temp\ltdkyqdsad\bc_vbdll.dll
- %WINDIR%\temp\ltdkyqdsad\arpro.lng
- %WINDIR%\temp\ltdkyqdsad\ar.lng
- %WINDIR%\temp\ltdkyqdsad\diskdata_sandisk_sdssda120g_161584401097_z22000rl.hdi
- %WINDIR%\temp\ltdkyqdsad\driveaddremovelog.txt
- %WINDIR%\temp\ltdkyqdsad\diskdata_sandisk_sdssda120g_161584401097_z22000rl.dat
- %WINDIR%\temp\ltdkyqdsad\du.lng
- %WINDIR%\temp\ltdkyqdsad\id.lng
- %WINDIR%\temp\ltdkyqdsad\dupro.lng
- %WINDIR%\temp\ltdkyqdsad\hupro.lng
- %WINDIR%\temp\ltdkyqdsad\hu.lng
- %WINDIR%\temp\ltdkyqdsad\hu.chm
- %WINDIR%\temp\ltdkyqdsad\hds_eula_hu.txt
- %WINDIR%\temp\ltdkyqdsad\hds_eula_en.txt
- %WINDIR%\temp\ltdkyqdsad\hdsversion.txt
- %WINDIR%\temp\ltdkyqdsad\hdsirena.mp3
- %WINDIR%\temp\ltdkyqdsad\hdsentineltray.exe
- %WINDIR%\temp\ltdkyqdsad\hdsentinel.vsx
- %WINDIR%\temp\ltdkyqdsad\hdsentinel.vsh
- %WINDIR%\temp\ltdkyqdsad\hdsentinel.sys
- %WINDIR%\temp\ltdkyqdsad\hdsentinel.ini
- %WINDIR%\temp\ltdkyqdsad\hdsentinel.exe
- %WINDIR%\temp\ltdkyqdsad\vista_status.icd
- %APPDATA%\hard disk sentinel\hds_control_check.vbs
- %WINDIR%\temp\ltdkyqdsad\hdnotify.wav
- %WINDIR%\temp\ltdkyqdsad\hdd.jpg
- %WINDIR%\temp\ltdkyqdsad\harddisksentinelupdate.exe
- %WINDIR%\temp\ltdkyqdsad\grpro.lng
- %WINDIR%\temp\ltdkyqdsad\gr.lng
- %WINDIR%\temp\ltdkyqdsad\frpro.lng
- %WINDIR%\temp\ltdkyqdsad\fr.lng
- %WINDIR%\temp\ltdkyqdsad\fnp_act_installer.dll
- %WINDIR%\temp\ltdkyqdsad\fipro.lng
- %WINDIR%\temp\ltdkyqdsad\fi.lng
- %WINDIR%\temp\ltdkyqdsad\fi.chm
- %WINDIR%\temp\ltdkyqdsad\enpro.lng
- %WINDIR%\temp\ltdkyqdsad\en.lng
- %WINDIR%\temp\ltdkyqdsad\en.chm
- %WINDIR%\temp\ltdkyqdsad\hdsctrl.exe
- %APPDATA%\hard disk sentinel\hds_control_add.vbs
Deletes the following files
- %TEMP%\241121102227292.74833633.tmp
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '%WINDIR%\temp\ltdkyqdsad\hdsentinel.exe'
- '%WINDIR%\temp\ltdkyqdsad\detect.dll' *WMIC2* . "%TEMP%\241121102227292.74833633.tmp" SELECT Index,PNPDeviceID FROM Win32_DiskDrive
Executes the following
- '%WINDIR%\syswow64\fsutil.exe' behavior query disabledeletenotify
- '%WINDIR%\syswow64\cscript.exe' //NOLOGO "%APPDATA%\Hard Disk Sentinel\hds_control_remove.vbs"
- '%WINDIR%\syswow64\cscript.exe' //NOLOGO "%APPDATA%\Hard Disk Sentinel\hds_control_check.vbs"
- '%WINDIR%\syswow64\cscript.exe' //NOLOGO "%APPDATA%\Hard Disk Sentinel\hds_control_add.vbs"
- '%WINDIR%\temp\ltdkyqdsad\detect.dll' *WMIC2* . "%TEMP%\241121102227292.74833633.tmp" SELECT Index,PNPDeviceID FROM Win32_DiskDrive' (with hidden window)
- '%WINDIR%\syswow64\fsutil.exe' behavior query disabledeletenotify' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //NOLOGO "%APPDATA%\Hard Disk Sentinel\hds_control_remove.vbs"' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //NOLOGO "%APPDATA%\Hard Disk Sentinel\hds_control_check.vbs"' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //NOLOGO "%APPDATA%\Hard Disk Sentinel\hds_control_add.vbs"' (with hidden window)
