Техническая информация
Вредоносные функции:
Завершает или пытается завершить
следующие пользовательские процессы:
- iexplore.exe
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\aut1.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\is-5G0E5.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\is-G0P9G.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\is-5Q37D.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\is-LD8EE.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\is-04MJT.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\is-8H601.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\zh_TW\LC_MESSAGES\is-U4B8H.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\zh_CN\LC_MESSAGES\is-KF9S2.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\tr_TR\LC_MESSAGES\is-UT4UE.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\ru_RU\LC_MESSAGES\is-SAE7I.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\pl_PL\LC_MESSAGES\is-IUGGP.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\ar_EG\LC_MESSAGES\is-8IBTE.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\nl_NL\LC_MESSAGES\is-6KAJV.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\ko_KR\LC_MESSAGES\is-5ST18.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\it_IT\LC_MESSAGES\is-EE855.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\hu_HU\LC_MESSAGES\is-G18VP.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\fr_FR\LC_MESSAGES\is-61EUP.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\es_ES\LC_MESSAGES\is-N0V2D.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\en_US\LC_MESSAGES\is-0UO56.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\el_GR\LC_MESSAGES\is-5C2GD.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\de_DE\LC_MESSAGES\is-UAJD3.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\pt_BR\LC_MESSAGES\is-H1VT1.tmp
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-LA5IH.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\ar_EG\LC_MESSAGES\is-P0KML.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\WinToHDD.ini
- %ProgramFiles%\Hasleo\WinToHDD\bin\WinToHDD.ini
- %ALLUSERSPROFILE%\Desktop\Hasleo WinToHDD.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Hasleo WinToHDD\Uninstall Hasleo WinToHDD.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Hasleo WinToHDD\Hasleo WinToHDD on the Web.url
- %ALLUSERSPROFILE%\Start Menu\Programs\Hasleo WinToHDD\Hasleo WinToHDD.lnk
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\is-TPKM3.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\zh_TW\LC_MESSAGES\is-47Q39.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\zh_CN\LC_MESSAGES\is-ALTJV.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\tr_TR\LC_MESSAGES\is-HO2AO.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\bg_BG\LC_MESSAGES\is-BKCK9.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\is-K388L.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\pl_PL\LC_MESSAGES\is-I7GBS.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\nl_NL\LC_MESSAGES\is-EK6PO.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\ko_KR\LC_MESSAGES\is-AOMMV.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\it_IT\LC_MESSAGES\is-VUGB2.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\hu_HU\LC_MESSAGES\is-IPBHU.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\fr_FR\LC_MESSAGES\is-MVARI.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\es_ES\LC_MESSAGES\is-SQSBU.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\en_US\LC_MESSAGES\is-DSIE8.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\el_GR\LC_MESSAGES\is-BFIIC.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\de_DE\LC_MESSAGES\is-LLJVE.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\pt_BR\LC_MESSAGES\is-N55RQ.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\bg_BG\LC_MESSAGES\is-PEPAT.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\ar_EG\LC_MESSAGES\is-NSJ5C.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\ar_EG\LC_MESSAGES\is-GJ8TR.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\is-E85H6.tmp
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-EEDHR.tmp
- %ProgramFiles%\Hasleo\WinToHDD\res\el_GR\LC_MESSAGES\is-0K5K7.tmp
- %ProgramFiles%\Hasleo\WinToHDD\res\de_DE\LC_MESSAGES\is-B96QG.tmp
- %ProgramFiles%\Hasleo\WinToHDD\res\bg_BG\LC_MESSAGES\is-87DHQ.tmp
- %ProgramFiles%\Hasleo\WinToHDD\res\ar_EG\LC_MESSAGES\is-CKH54.tmp
- %ProgramFiles%\Hasleo\WinToHDD\res\ar_EG\LC_MESSAGES\is-FHGNE.tmp
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-3FL6U.tmp
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-I8RQG.tmp
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-OIQ48.tmp
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-JKV8L.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\WinToHDD.ini
- %ProgramFiles%\Hasleo\WinToHDD\res\es_ES\LC_MESSAGES\is-1FQ7H.tmp
- %ProgramFiles%\Hasleo\WinToHDD\is-B94SN.tmp
- %TEMP%\is-KUM25.tmp\unins000.dll
- %TEMP%\is-KUM25.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-G042M.tmp\WinToHDD_Free.tmp
- %TEMP%\WinToHDD_Free.exe
- %TEMP%\WinToHDD.ini
- %TEMP%\aut3.tmp
- %TEMP%\WINTOH~1.EXE
- %TEMP%\aut2.tmp
- %TEMP%\main.ico
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-ILPCJ.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\ru_RU\LC_MESSAGES\is-T8LLO.tmp
- %ProgramFiles%\Hasleo\WinToHDD\res\fr_FR\LC_MESSAGES\is-36RM1.tmp
- %ProgramFiles%\Hasleo\WinToHDD\res\ko_KR\LC_MESSAGES\is-K4SFB.tmp
- %ProgramFiles%\Hasleo\WinToHDD\res\hu_HU\LC_MESSAGES\is-CPP8P.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\is-3KJK3.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\is-OMDHU.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\is-O1UNB.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\is-S9H19.tmp
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\is-M61J4.tmp
- %ProgramFiles%\Hasleo\WinToHDD\WINPE\Windows\System32\is-8RER4.tmp
- %ProgramFiles%\Hasleo\WinToHDD\WINPE\Windows\System32\is-15N06.tmp
- %ProgramFiles%\Hasleo\WinToHDD\WINPE\Windows\System32\is-4AHNL.tmp
- %ProgramFiles%\Hasleo\WinToHDD\WINPE\Windows\System32\is-OODMJ.tmp
- %ProgramFiles%\Hasleo\WinToHDD\res\it_IT\LC_MESSAGES\is-694PR.tmp
- %ProgramFiles%\Hasleo\WinToHDD\is-8FJL7.tmp
- %ProgramFiles%\Hasleo\WinToHDD\res\en_US\LC_MESSAGES\is-SB9S2.tmp
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-SO2NP.tmp
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-U8FOF.tmp
- %ProgramFiles%\Hasleo\WinToHDD\res\zh_TW\LC_MESSAGES\is-79AGR.tmp
- %ProgramFiles%\Hasleo\WinToHDD\res\zh_CN\LC_MESSAGES\is-JHUK6.tmp
- %ProgramFiles%\Hasleo\WinToHDD\res\tr_TR\LC_MESSAGES\is-DS93T.tmp
- %ProgramFiles%\Hasleo\WinToHDD\res\ru_RU\LC_MESSAGES\is-T3G13.tmp
- %ProgramFiles%\Hasleo\WinToHDD\res\pt_BR\LC_MESSAGES\is-51936.tmp
- %ProgramFiles%\Hasleo\WinToHDD\res\pl_PL\LC_MESSAGES\is-RUL2R.tmp
- %ProgramFiles%\Hasleo\WinToHDD\res\nl_NL\LC_MESSAGES\is-42GS7.tmp
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-MVFFJ.tmp
- %ProgramFiles%\Hasleo\WinToHDD\unins000.dat
Удаляет следующие файлы:
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut3.tmp
- %TEMP%\main.ico
- %TEMP%\is-KUM25.tmp\unins000.dll
- %TEMP%\is-KUM25.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-G042M.tmp\WinToHDD_Free.tmp
- %ProgramFiles%\Hasleo\WinToHDD\bin\WinToHDD.ini
Перемещает следующие файлы:
- %TEMP%\main.ico в %TEMP%\main.ico
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\is-04MJT.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\AppLoader.exe
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\is-8H601.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\WinToHDD.ini
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\zh_TW\LC_MESSAGES\is-U4B8H.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\zh_TW\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\zh_CN\LC_MESSAGES\is-KF9S2.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\zh_CN\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\tr_TR\LC_MESSAGES\is-UT4UE.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\tr_TR\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\ru_RU\LC_MESSAGES\is-SAE7I.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\ru_RU\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\pt_BR\LC_MESSAGES\is-H1VT1.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\pt_BR\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\pl_PL\LC_MESSAGES\is-IUGGP.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\pl_PL\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\nl_NL\LC_MESSAGES\is-6KAJV.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\nl_NL\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\ko_KR\LC_MESSAGES\is-5ST18.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\ko_KR\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\it_IT\LC_MESSAGES\is-EE855.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\it_IT\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\hu_HU\LC_MESSAGES\is-G18VP.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\hu_HU\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\fr_FR\LC_MESSAGES\is-61EUP.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\fr_FR\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\es_ES\LC_MESSAGES\is-N0V2D.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\es_ES\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\en_US\LC_MESSAGES\is-0UO56.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\en_US\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\el_GR\LC_MESSAGES\is-5C2GD.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\el_GR\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\de_DE\LC_MESSAGES\is-UAJD3.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\de_DE\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\is-LD8EE.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\intl.dll
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\is-5Q37D.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\libcurl.dll
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\is-G0P9G.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\Log.dll
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\is-5G0E5.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\VHDOperationEx.dll
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\zh_CN\LC_MESSAGES\is-ALTJV.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\zh_CN\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\tr_TR\LC_MESSAGES\is-HO2AO.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\tr_TR\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\ru_RU\LC_MESSAGES\is-T8LLO.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\ru_RU\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\pt_BR\LC_MESSAGES\is-N55RQ.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\pt_BR\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\pl_PL\LC_MESSAGES\is-I7GBS.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\pl_PL\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\nl_NL\LC_MESSAGES\is-EK6PO.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\nl_NL\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\ko_KR\LC_MESSAGES\is-AOMMV.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\ko_KR\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\it_IT\LC_MESSAGES\is-VUGB2.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\it_IT\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\fr_FR\LC_MESSAGES\is-MVARI.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\fr_FR\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\hu_HU\LC_MESSAGES\is-IPBHU.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\hu_HU\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\es_ES\LC_MESSAGES\is-SQSBU.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\es_ES\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\en_US\LC_MESSAGES\is-DSIE8.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\en_US\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\el_GR\LC_MESSAGES\is-BFIIC.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\el_GR\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\de_DE\LC_MESSAGES\is-LLJVE.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\de_DE\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\bg_BG\LC_MESSAGES\is-PEPAT.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\bg_BG\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\ar_EG\LC_MESSAGES\is-P0KML.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\ar_EG\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\ar_EG\LC_MESSAGES\is-8IBTE.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\ar_EG\LC_MESSAGES\Translated by.txt
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\is-K388L.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\WinToHDD.exe
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\zh_TW\LC_MESSAGES\is-47Q39.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\res\zh_TW\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\bg_BG\LC_MESSAGES\is-BKCK9.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\bg_BG\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\ar_EG\LC_MESSAGES\is-NSJ5C.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\ar_EG\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\ar_EG\LC_MESSAGES\is-GJ8TR.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\res\ar_EG\LC_MESSAGES\Translated by.txt
- %ProgramFiles%\Hasleo\WinToHDD\res\it_IT\LC_MESSAGES\is-694PR.tmp в %ProgramFiles%\Hasleo\WinToHDD\res\it_IT\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\res\hu_HU\LC_MESSAGES\is-CPP8P.tmp в %ProgramFiles%\Hasleo\WinToHDD\res\hu_HU\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\res\fr_FR\LC_MESSAGES\is-36RM1.tmp в %ProgramFiles%\Hasleo\WinToHDD\res\fr_FR\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\res\es_ES\LC_MESSAGES\is-1FQ7H.tmp в %ProgramFiles%\Hasleo\WinToHDD\res\es_ES\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\res\en_US\LC_MESSAGES\is-SB9S2.tmp в %ProgramFiles%\Hasleo\WinToHDD\res\en_US\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\res\el_GR\LC_MESSAGES\is-0K5K7.tmp в %ProgramFiles%\Hasleo\WinToHDD\res\el_GR\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\res\de_DE\LC_MESSAGES\is-B96QG.tmp в %ProgramFiles%\Hasleo\WinToHDD\res\de_DE\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\res\bg_BG\LC_MESSAGES\is-87DHQ.tmp в %ProgramFiles%\Hasleo\WinToHDD\res\bg_BG\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\res\ar_EG\LC_MESSAGES\is-CKH54.tmp в %ProgramFiles%\Hasleo\WinToHDD\res\ar_EG\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\res\ar_EG\LC_MESSAGES\is-FHGNE.tmp в %ProgramFiles%\Hasleo\WinToHDD\res\ar_EG\LC_MESSAGES\Translated by.txt
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-3FL6U.tmp в %ProgramFiles%\Hasleo\WinToHDD\bin\WinToHDD.exe
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-I8RQG.tmp в %ProgramFiles%\Hasleo\WinToHDD\bin\VHDOperationEx.dll
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-OIQ48.tmp в %ProgramFiles%\Hasleo\WinToHDD\bin\Log.dll
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-JKV8L.tmp в %ProgramFiles%\Hasleo\WinToHDD\bin\libcurl.dll
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-ILPCJ.tmp в %ProgramFiles%\Hasleo\WinToHDD\bin\intl.dll
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-EEDHR.tmp в %ProgramFiles%\Hasleo\WinToHDD\bin\AppLoader.exe
- %ProgramFiles%\Hasleo\WinToHDD\is-B94SN.tmp в %ProgramFiles%\Hasleo\WinToHDD\unins000.exe
- %ProgramFiles%\Hasleo\WinToHDD\res\ko_KR\LC_MESSAGES\is-K4SFB.tmp в %ProgramFiles%\Hasleo\WinToHDD\res\ko_KR\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\res\nl_NL\LC_MESSAGES\is-42GS7.tmp в %ProgramFiles%\Hasleo\WinToHDD\res\nl_NL\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\res\pl_PL\LC_MESSAGES\is-RUL2R.tmp в %ProgramFiles%\Hasleo\WinToHDD\res\pl_PL\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\res\pt_BR\LC_MESSAGES\is-51936.tmp в %ProgramFiles%\Hasleo\WinToHDD\res\pt_BR\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\is-3KJK3.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\VHDOperationEx.dll
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\is-OMDHU.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\Log.dll
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\is-O1UNB.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\libcurl.dll
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\is-S9H19.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\intl.dll
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\is-M61J4.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\AppLoader.exe
- %ProgramFiles%\Hasleo\WinToHDD\WINPE\Windows\System32\is-8RER4.tmp в %ProgramFiles%\Hasleo\WinToHDD\WINPE\Windows\System32\Winpeshl.ini
- %ProgramFiles%\Hasleo\WinToHDD\WINPE\Windows\System32\is-15N06.tmp в %ProgramFiles%\Hasleo\WinToHDD\WINPE\Windows\System32\Winpeshl-usb.ini
- %ProgramFiles%\Hasleo\WinToHDD\WINPE\Windows\System32\is-4AHNL.tmp в %ProgramFiles%\Hasleo\WinToHDD\WINPE\Windows\System32\Unattend.xml
- %ProgramFiles%\Hasleo\WinToHDD\is-8FJL7.tmp в %ProgramFiles%\Hasleo\WinToHDD\unins000.dll
- %ProgramFiles%\Hasleo\WinToHDD\WINPE\Windows\System32\is-OODMJ.tmp в %ProgramFiles%\Hasleo\WinToHDD\WINPE\Windows\System32\Unattend-x64.xml
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-MVFFJ.tmp в %ProgramFiles%\Hasleo\WinToHDD\bin\WinToHDD.ini
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-LA5IH.tmp в %ProgramFiles%\Hasleo\WinToHDD\bin\License-Enterprise.rtf
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-SO2NP.tmp в %ProgramFiles%\Hasleo\WinToHDD\bin\License-Professional.rtf
- %ProgramFiles%\Hasleo\WinToHDD\bin\is-U8FOF.tmp в %ProgramFiles%\Hasleo\WinToHDD\bin\License-Free.rtf
- %ProgramFiles%\Hasleo\WinToHDD\res\zh_TW\LC_MESSAGES\is-79AGR.tmp в %ProgramFiles%\Hasleo\WinToHDD\res\zh_TW\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\res\zh_CN\LC_MESSAGES\is-JHUK6.tmp в %ProgramFiles%\Hasleo\WinToHDD\res\zh_CN\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\res\tr_TR\LC_MESSAGES\is-DS93T.tmp в %ProgramFiles%\Hasleo\WinToHDD\res\tr_TR\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\res\ru_RU\LC_MESSAGES\is-T3G13.tmp в %ProgramFiles%\Hasleo\WinToHDD\res\ru_RU\LC_MESSAGES\WinToHDD.mo
- %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\is-E85H6.tmp в %ProgramFiles%\Hasleo\WinToHDD\x86\WinToHDD\bin\WinToHDD.exe
- %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\is-TPKM3.tmp в %ProgramFiles%\Hasleo\WinToHDD\x64\WinToHDD\bin\WinToHDD.ini
Подменяет следующие файлы:
- %ProgramFiles%\Hasleo\WinToHDD\bin\WinToHDD.ini
Изменяет файл HOSTS.
Сетевая активность:
Подключается к:
- 'localhost':1039
- 'localhost':80
TCP:
Запросы HTTP GET:
- http://www.ea###efi.com/wintohdd/thanks-install.html via localhost
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Создает и запускает на исполнение:
- '%TEMP%\WinToHDD_Free.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-G042M.tmp\WinToHDD_Free.tmp' /SL5="$100F4,8800592,129536,%TEMP%\WinToHDD_Free.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Запускает на исполнение:
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -nohome
- '<SYSTEM32>\cmd.exe' /c sc stop "PcaSvc"
