Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\EUEDKEPM] 'Start' = '00000001'
- [<HKLM>\System\CurrentControlSet\Services\EUEDKEPM] 'ImagePath' = '<DRIVERS>\EUEDKEPM.sys'
- [<HKLM>\System\CurrentControlSet\Services\EUDCPEPM] 'Start' = '00000000'
- [<HKLM>\System\CurrentControlSet\Services\EUDCPEPM] 'ImagePath' = 'system32\drivers\EUDCPEPM.sys'
Создает следующие сервисы
- 'EUEDKEPM' <DRIVERS>\EUEDKEPM.sys
- 'EUDCPEPM' <DRIVERS>\EUDCPEPM.sys
Вредоносные функции
Запускает на исполнение
- '<SYSTEM32>\taskkill.exe' /IM EUCloneServer.exe /F
Изменения в файловой системе
Создает следующие файлы
- %ProgramFiles%\epm\res\loading.gif
- %ProgramFiles%\epm\dc\bin\agent.dll
- %ProgramFiles%\epm\dc\bin\activeonline.dll
- %ProgramFiles%\epm\dc\bin\activationonline.dll
- %ProgramFiles%\epm\dc\bin\accountmanager.dll
- %ProgramFiles%\epm\bin\winchkdsk.exe
- %ProgramFiles%\epm\dc\bin\winchkdsk.exe
- %ProgramFiles%\epm\dc\bin\tblang.exe
- %ProgramFiles%\epm\bin\spawn.exe
- %ProgramFiles%\epm\nircmd.exe
- %ProgramFiles%\epm\bin\main.exe
- %ProgramFiles%\epm\bin\atl90.dll
- %ProgramFiles%\epm\hidcon.exe
- %ProgramFiles%\epm\dc\bin\drvsetup.exe
- %ProgramFiles%\epm\bin\convertfat2ntfs.exe
- %ProgramFiles%\epm\bin\adddrivers.exe
- %ProgramFiles%\epm\multi\epmui_en.qm
- %ProgramFiles%\epm\bin\winformat.mo
- %ProgramFiles%\epm\bin\thread.mo
- %ProgramFiles%\epm\bin\sectorcopy.mo
- %ProgramFiles%\epm\bin\resizentfs.mo
- %ProgramFiles%\epm\bin\reglib.mo
- %ProgramFiles%\epm\bin\partitionrecovery.mo
- %ProgramFiles%\epm\dc\bin\eucloneserver.exe
- %ProgramFiles%\epm\dc\bin\authorizedmng.dll
- %ProgramFiles%\epm\bin\autoupdate.dll
- %ProgramFiles%\epm\dc\bin\boot.dll
- %ProgramFiles%\epm\dc\bin\eucloneclient.dll
- %ProgramFiles%\epm\bin\eucloneclient.dll
- %ProgramFiles%\epm\dc\bin\erasedata.dll
- %ProgramFiles%\epm\dc\bin\enumdisk.dll
- %ProgramFiles%\epm\dc\bin\efiboot.dll
- %ProgramFiles%\epm\dc\bin\dsrestore.dll
- %ProgramFiles%\epm\dc\bin\dsmonitor.dll
- %ProgramFiles%\epm\dc\bin\devicemanager.dll
- %ProgramFiles%\epm\dc\bin\deviceio.dll
- %ProgramFiles%\epm\dc\bin\deviceadapter.dll
- %ProgramFiles%\epm\dc\bin\device.dll
- %ProgramFiles%\epm\dc\bin\correctmbr.dll
- %ProgramFiles%\epm\dc\bin\compressfile.dll
- %ProgramFiles%\epm\dc\bin\common.dll
- %ProgramFiles%\epm\dc\bin\codelog.dll
- %ProgramFiles%\epm\bin\codelog.dll
- %ProgramFiles%\epm\dc\bin\cmdpack.dll
- %ProgramFiles%\epm\dc\bin\cmdmanager.dll
- %ProgramFiles%\epm\dc\bin\cloudoperator.dll
- %ProgramFiles%\epm\dc\bin\callbackoperator.dll
- %ProgramFiles%\epm\dc\bin\burn.dll
- %ProgramFiles%\epm\dc\bin\bpvolume.dll
- %ProgramFiles%\epm\dc\bin\bootdriver.dll
- %ProgramFiles%\epm\bin\partition.mo
- %ProgramFiles%\epm\bin\eulicensedll.dll
- %ProgramFiles%\epm\bin\ntfsutil.mo
- %ProgramFiles%\epm\bin\ntfslib.mo
- %ProgramFiles%\epm\bin\common.mo
- %ProgramFiles%\epm\bin\checkversion.mo
- %ProgramFiles%\epm\bin\callbackoperator.mo
- %ProgramFiles%\epm\dc\bin\microsoft.vc90.crt.cat
- %ProgramFiles%\epm\multi\res_en_us\uiconfigadd.ini
- %ProgramFiles%\epm\res\uiconfig.ini
- %ProgramFiles%\epm\res\toolsapp.ini
- %ProgramFiles%\epm\dc\multi\res_en_us\res\tbemlib.ini
- %ProgramFiles%\epm\dc\bin\tbconfig.ini
- %ProgramFiles%\epm\bin\tbconfig.ini
- %ProgramFiles%\epm\bin\config.mo
- %ProgramFiles%\epm\multi\res_en_us\setup.ini
- %ProgramFiles%\epm\multi\res_en_us\language.ini
- %ProgramFiles%\epm\res\langind.ini
- %ProgramFiles%\epm\dc\bin\euclone.ini
- %ProgramFiles%\epm\dc\multi\res_en_us\bin\dsbackupconfig.ini
- %ProgramFiles%\epm\res\consolehelp.ini
- %ProgramFiles%\epm\res\stylesheet.css
- %ProgramFiles%\epm\dc\bin\tbconfig.xml
- %ProgramFiles%\epm\start.cmd
- %ProgramFiles%\epm\bin\winformat.manifest
- %ProgramFiles%\epm\bin\winchkdsk.manifest
- %ProgramFiles%\epm\dc\multi\res_en_us\res\language.ini
- %ProgramFiles%\epm\bin\convertfattontfs.mo
- %ProgramFiles%\epm\bin\device.mo
- %ProgramFiles%\epm\bin\deviceadapter.mo
- %ProgramFiles%\epm\bin\ntfsformat.mo
- %ProgramFiles%\epm\bin\ntfsfilesystemanalyser.mo
- %ProgramFiles%\epm\bin\ntfscopy.mo
- %ProgramFiles%\epm\bin\mom.mo
- %ProgramFiles%\epm\bin\mergepartition.mo
- %ProgramFiles%\epm\bin\log.mo
- %ProgramFiles%\epm\bin\ldmmanager.mo
- %ProgramFiles%\epm\bin\fixup.mo
- %ProgramFiles%\epm\bin\filesystemcheck.mo
- %ProgramFiles%\epm\bin\filesystemanalyser.mo
- %ProgramFiles%\epm\bin\filesystem.mo
- %ProgramFiles%\epm\bin\fatresizemove.mo
- %ProgramFiles%\epm\bin\fatlib.mo
- %ProgramFiles%\epm\bin\fatformat.mo
- %ProgramFiles%\epm\bin\fatfilesystemmove.mo
- %ProgramFiles%\epm\bin\fatfilesystemanalyser.mo
- %ProgramFiles%\epm\bin\fatcopy.mo
- %ProgramFiles%\epm\bin\extresizemove.mo
- %ProgramFiles%\epm\bin\extformat.mo
- %ProgramFiles%\epm\bin\extfilesystemanalyser.mo
- %ProgramFiles%\epm\bin\error.mo
- %ProgramFiles%\epm\bin\efiboot.mo
- %ProgramFiles%\epm\bin\devicemanager.mo
- %ProgramFiles%\epm\bin\ntfsresizemove.mo
- %ProgramFiles%\epm\bin\imageformats\qgif.dll
- %ProgramFiles%\epm\dc\bin\eclog.log
- %ProgramFiles%\epm\dc\bin\fatfilesystemanalyser.dll
- %ProgramFiles%\epm\bin\uicreatewinpemodule.dll
- %ProgramFiles%\epm\bin\uicreatemodule.dll
- %ProgramFiles%\epm\bin\uiclonemodule.dll
- %ProgramFiles%\epm\dc\bin\transmit.dll
- %ProgramFiles%\epm\dc\bin\tbservice.dll
- %ProgramFiles%\epm\dc\bin\tbgetremotenetinfo.dll
- %ProgramFiles%\epm\dc\bin\tbfirewall.dll
- %ProgramFiles%\epm\dc\bin\tbdataswap.dll
- %ProgramFiles%\epm\dc\bin\superfat.dll
- %ProgramFiles%\epm\dc\bin\ssleay32.dll
- %ProgramFiles%\epm\dc\bin\uilogic.dll
- %ProgramFiles%\epm\bin\ssleay32.dll
- %ProgramFiles%\epm\dc\bin\reglib.dll
- %ProgramFiles%\epm\dc\bin\rapidntfs.dll
- %ProgramFiles%\epm\bin\platforms\qwindows.dll
- %ProgramFiles%\epm\bin\qtlib.dll
- %ProgramFiles%\epm\bin\qt5winextras.dll
- %ProgramFiles%\epm\bin\qt5widgets.dll
- %ProgramFiles%\epm\bin\qt5gui.dll
- %ProgramFiles%\epm\bin\qt5core.dll
- %ProgramFiles%\epm\bin\iconengines\qsvgicon.dll
- %ProgramFiles%\epm\bin\platforms\qoffscreen.dll
- %ProgramFiles%\epm\dc\bin\resizentfs.dll
- %ProgramFiles%\epm\bin\uimainmodule.dll
- %ProgramFiles%\epm\bin\uimanager.dll
- %ProgramFiles%\epm\bin\uirecoverymodule.dll
- %ProgramFiles%\epm\bin\eclog.log
- %ProgramFiles%\epm\bin\epmlog.log
- %WINDIR%\temp\udd4d46.tmp
- %HOMEPATH%\desktop\easeus partition master 14.5.lnk
- <DRIVERS>\.sys
- <DRIVERS>\eudcpepm.sys
- %WINDIR%\temp\udd3246.tmp
- <DRIVERS>\euedkepm.sys
- %ProgramFiles%\epm\dc\bin\easeusdrv.log
- %ProgramFiles%\epm\drv\euedkepm.sys
- %ProgramFiles%\epm\drv\eudcpepm.sys
- %ProgramFiles%\epm\dc\bin\usb\x64\delenum.sys
- %ProgramFiles%\epm\dc\bin\usb\x86\delenum.sys
- %ProgramFiles%\epm\dc\bin\zstd.dll
- %ProgramFiles%\epm\dc\bin\zlib1.dll
- %ProgramFiles%\epm\bin\zlib1.dll
- %ProgramFiles%\epm\dc\bin\xmlwrapper.dll
- %ProgramFiles%\epm\dc\bin\vsssupport.dll
- %ProgramFiles%\epm\dc\bin\vcomp90.dll
- %ProgramFiles%\epm\dc\bin\usbbootable.dll
- %ProgramFiles%\epm\dc\bin\universal.dll
- %ProgramFiles%\epm\bin\uitoolsmodule.dll
- %ProgramFiles%\epm\bin\uiresizemovemodule.dll
- %ProgramFiles%\epm\bin\platforms\qminimal.dll
- %ProgramFiles%\epm\bin\thread.manifest
- %ProgramFiles%\epm\bin\imageformats\qico.dll
- %ProgramFiles%\epm\dc\bin\partition.dll
- %ProgramFiles%\epm\bin\mfc90u.dll
- %ProgramFiles%\epm\dc\bin\mfc90enu.dll
- %ProgramFiles%\epm\dc\bin\mfc90.dll
- %ProgramFiles%\epm\bin\mfc90.dll
- %ProgramFiles%\epm\dc\bin\logsys.dll
- %ProgramFiles%\epm\dc\bin\log.dll
- %ProgramFiles%\epm\bin\licensemgr.dll
- %ProgramFiles%\epm\dc\bin\license.dll
- %ProgramFiles%\epm\dc\bin\libxml2-2.dll
- %ProgramFiles%\epm\dc\bin\liblzma-5.dll
- %ProgramFiles%\epm\dc\bin\mfc90u.dll
- %ProgramFiles%\epm\dc\bin\libiconv-2.dll
- %ProgramFiles%\epm\bin\libeay32.dll
- %ProgramFiles%\epm\dc\bin\inctaskchange.dll
- %ProgramFiles%\epm\dc\bin\hotdrv.dll
- %ProgramFiles%\epm\dc\bin\getdriverinfo.dll
- %ProgramFiles%\epm\dc\bin\filesystemcheck.dll
- %ProgramFiles%\epm\dc\bin\filesystemanalyser.dll
- %ProgramFiles%\epm\dc\bin\filestorage.dll
- %ProgramFiles%\epm\dc\bin\fatsupport.dll
- %ProgramFiles%\epm\dc\bin\fatresizemove.dll
- %ProgramFiles%\epm\dc\bin\fatlib.dll
- %ProgramFiles%\epm\dc\bin\libeay32.dll
- %ProgramFiles%\epm\bin\mfcm90.dll
- %ProgramFiles%\epm\dc\bin\mfcm90.dll
- %ProgramFiles%\epm\bin\mfcm90u.dll
- %ProgramFiles%\epm\dc\bin\options.dll
- %ProgramFiles%\epm\dc\bin\ntfsutil.dll
- %ProgramFiles%\epm\dc\bin\ntfssupport.dll
- %ProgramFiles%\epm\dc\bin\ntfslib.dll
- %ProgramFiles%\epm\dc\bin\ntfsformat.dll
- %ProgramFiles%\epm\dc\bin\ntfsfilesystemanalyser.dll
- %ProgramFiles%\epm\dc\bin\ntfscopy.dll
- %ProgramFiles%\epm\dc\bin\netdrive.dll
- %ProgramFiles%\epm\dc\bin\nasoperator.dll
- %ProgramFiles%\epm\dc\bin\msvcr90.dll
- %ProgramFiles%\epm\bin\msvcr90.dll
- %ProgramFiles%\epm\dc\bin\msvcr120.dll
- %ProgramFiles%\epm\bin\msvcr120.dll
- %ProgramFiles%\epm\bin\msvcr100.dll
- %ProgramFiles%\epm\dc\bin\msvcp90.dll
- %ProgramFiles%\epm\bin\msvcp90.dll
- %ProgramFiles%\epm\dc\bin\msvcp60,2.dll
- %ProgramFiles%\epm\dc\bin\msvcp120.dll
- %ProgramFiles%\epm\bin\msvcp120.dll
- %ProgramFiles%\epm\bin\msvcp100.dll
- %ProgramFiles%\epm\dc\bin\msvcm90.dll
- %ProgramFiles%\epm\bin\msvcm90.dll
- %ProgramFiles%\epm\dc\bin\mfcm90u.dll
- %ProgramFiles%\epm\dc\bin\eupipe.dll
- %ProgramFiles%\epm\dc\bin\fatcopy.dll
- %ProgramFiles%\epm\bin\spawn.exe.manifest
- %ProgramFiles%\epm\res\loading\loading01.png
- %ProgramFiles%\epm\res\ic_explore.png
- %ProgramFiles%\epm\res\ic_dynamic.png
- %ProgramFiles%\epm\res\ic_descend.png
- %ProgramFiles%\epm\res\ic_delete.png
- %ProgramFiles%\epm\res\ic_create.png
- %ProgramFiles%\epm\res\ic_convert.png
- %ProgramFiles%\epm\res\ic_close.png
- %ProgramFiles%\epm\res\ic_clone.png
- %ProgramFiles%\epm\res\ic_check.png
- %ProgramFiles%\epm\res\ic_basic.png
- %ProgramFiles%\epm\res\ic_format.png
- %ProgramFiles%\epm\res\ic_ascend.png
- %ProgramFiles%\epm\res\ic_4k.png
- %ProgramFiles%\epm\res\icon_wrong.png
- %ProgramFiles%\epm\res\icon_winpe.png
- %ProgramFiles%\epm\res\icon_toolsm.png
- %ProgramFiles%\epm\res\icon_tool.png
- %ProgramFiles%\epm\res\icon_recovery.png
- %ProgramFiles%\epm\res\icon_quest.png
- %ProgramFiles%\epm\res\icon_pctrans.png
- %ProgramFiles%\epm\res\icon_partition_recovery.png
- %ProgramFiles%\epm\res\icon_partition.png
- %ProgramFiles%\epm\res\ic_allocatespace.png
- %ProgramFiles%\epm\res\ic_hide.png
- %ProgramFiles%\epm\res\ic_initialize.png
- %ProgramFiles%\epm\res\ic_label.png
- %ProgramFiles%\epm\res\link_broken.png
- %ProgramFiles%\epm\res\limthintover.png
- %ProgramFiles%\epm\res\limthint.png
- %ProgramFiles%\epm\res\installyes.png
- %ProgramFiles%\epm\res\installno.png
- %ProgramFiles%\epm\res\info.png
- %ProgramFiles%\epm\res\ic_wipe.png
- %ProgramFiles%\epm\res\ic_unhide.png
- %ProgramFiles%\epm\res\ic_surface.png
- %ProgramFiles%\epm\res\ic_setactive.png
- %ProgramFiles%\epm\res\ic_resize_ex.png
- %ProgramFiles%\epm\res\ic_resize.png
- %ProgramFiles%\epm\res\ic_repair.png
- %ProgramFiles%\epm\res\ic_property.png
- %ProgramFiles%\epm\res\ic_primary.png
- %ProgramFiles%\epm\res\ic_nfts.png
- %ProgramFiles%\epm\res\ic_more_arrow.png
- %ProgramFiles%\epm\res\ic_more.png
- %ProgramFiles%\epm\res\ic_migrateos.png
- %ProgramFiles%\epm\res\ic_merge.png
- %ProgramFiles%\epm\res\ic_mbr.png
- %ProgramFiles%\epm\res\ic_logical.png
- %ProgramFiles%\epm\res\ic_letter.png
- %ProgramFiles%\epm\res\icon_mobimover.png
- %ProgramFiles%\epm\res\list.png
- %ProgramFiles%\epm\res\icon_migrate.png
- %ProgramFiles%\epm\res\icon_dropdown.png
- %ProgramFiles%\epm\res\compare_server.png
- %ProgramFiles%\epm\res\compare_professional.png
- %ProgramFiles%\epm\res\compare_free.png
- %ProgramFiles%\epm\res\closepop.png
- %ProgramFiles%\epm\res\cleanup.png
- %ProgramFiles%\epm\res\check_unsel_disable.png
- %ProgramFiles%\epm\res\check_unsel.png
- %ProgramFiles%\epm\res\check_sel_disable.png
- %ProgramFiles%\epm\res\check_sel.png
- %ProgramFiles%\epm\res\check_halfsel_disable.png
- %ProgramFiles%\epm\res\compare_unlimited.png
- %ProgramFiles%\epm\res\check_halfsel.png
- %ProgramFiles%\epm\res\buy.png
- %ProgramFiles%\epm\res\border_shadow.png
- %ProgramFiles%\epm\res\arrow_expand.png
- %ProgramFiles%\epm\res\arrowu.png
- %ProgramFiles%\epm\res\arrowd.png
- %ProgramFiles%\epm\res\apply.png
- %ProgramFiles%\epm\res\allocatedel.png
- %ProgramFiles%\epm\res\allocateadd.png
- %ProgramFiles%\epm\res\activate_log.png
- %ProgramFiles%\epm\res\waiting.gif
- %ProgramFiles%\epm\res\buy_version_disable.png
- %ProgramFiles%\epm\res\disk_icon_s.png
- %ProgramFiles%\epm\res\drag.png
- %ProgramFiles%\epm\res\drive.png
- %ProgramFiles%\epm\res\icon_disk_os.png
- %ProgramFiles%\epm\res\icon_disk_epm.png
- %ProgramFiles%\epm\res\icon_command.png
- %ProgramFiles%\epm\res\icon_combox_arrow_normal.png
- %ProgramFiles%\epm\res\icon_combox_arrow_disbale.png
- %ProgramFiles%\epm\res\icon_combox_arrow_disable.png
- %ProgramFiles%\epm\res\icon_clone.png
- %ProgramFiles%\epm\res\icon_backup.png
- %ProgramFiles%\epm\res\icon_arrow_up.png
- %ProgramFiles%\epm\res\icon_arrow_down.png
- %ProgramFiles%\epm\res\icon_alert.png
- %ProgramFiles%\epm\res\icon_addriver.png
- %ProgramFiles%\epm\res\ico-logo.png
- %ProgramFiles%\epm\res\helppop.png
- %ProgramFiles%\epm\res\hdoublearrow.png
- %ProgramFiles%\epm\res\hand.png
- %ProgramFiles%\epm\res\free_disable.png
- %ProgramFiles%\epm\res\folder.png
- %ProgramFiles%\epm\res\fleur.png
- %ProgramFiles%\epm\res\fill_bg.png
- %ProgramFiles%\epm\res\file.png
- %ProgramFiles%\epm\res\erroricon.png
- %ProgramFiles%\epm\res\easeus.png
- %ProgramFiles%\epm\res\icon_info.png
- %ProgramFiles%\epm\res\version_no.png
- %ProgramFiles%\epm\bin\resizentfs.manifest
- %ProgramFiles%\epm\res\loading\loading02.png
- %ProgramFiles%\epm\bin\fatfilesystemmove.manifest
- %ProgramFiles%\epm\bin\fatfilesystemanalyser.manifest
- %ProgramFiles%\epm\bin\fatcopy.manifest
- %ProgramFiles%\epm\bin\extresizemove.manifest
- %ProgramFiles%\epm\bin\extformat.manifest
- %ProgramFiles%\epm\bin\extfilesystemanalyser.manifest
- %ProgramFiles%\epm\bin\error.manifest
- %ProgramFiles%\epm\bin\devicemanager.manifest
- %ProgramFiles%\epm\bin\deviceadapter.manifest
- %ProgramFiles%\epm\bin\device.manifest
- %ProgramFiles%\epm\bin\fatformat.manifest
- %ProgramFiles%\epm\bin\convertfattontfs.manifest
- %ProgramFiles%\epm\bin\config.manifest
- %ProgramFiles%\epm\bin\common.manifest
- %ProgramFiles%\epm\bin\checkversion.manifest
- %ProgramFiles%\epm\bin\callbackoperator.manifest
- %ProgramFiles%\epm\bin\autoupdate.manifest
- %ProgramFiles%\epm\res\48_48_8.ico
- %ProgramFiles%\epm\res\192_192_32.ico
- %ProgramFiles%\epm\res\yiwo.png
- %ProgramFiles%\epm\res\wizard_arrow_disable.png
- %ProgramFiles%\epm\res\wizard_arrow.png
- %ProgramFiles%\epm\bin\convertapplication.manifest
- %ProgramFiles%\epm\bin\fatlib.manifest
- %ProgramFiles%\epm\bin\fatresizemove.manifest
- %ProgramFiles%\epm\bin\filesystem.manifest
- %ProgramFiles%\epm\bin\reglib.manifest
- %ProgramFiles%\epm\bin\partitionrecovery.manifest
- %ProgramFiles%\epm\bin\partition.manifest
- %ProgramFiles%\epm\bin\ntfsutil.manifest
- %ProgramFiles%\epm\bin\ntfsresizemove.manifest
- %ProgramFiles%\epm\bin\ntfslib.manifest
- %ProgramFiles%\epm\bin\ntfsformat.manifest
- %ProgramFiles%\epm\bin\ntfsfilesystemanalyser.manifest
- %ProgramFiles%\epm\bin\ntfscopy.manifest
- %ProgramFiles%\epm\bin\mom.manifest
- %ProgramFiles%\epm\dc\bin\microsoft.vc90.openmp.manifest
- %ProgramFiles%\epm\dc\bin\microsoft.vc90.mfcloc.manifest
- %ProgramFiles%\epm\dc\bin\microsoft.vc90.mfc.manifest
- %ProgramFiles%\epm\bin\microsoft.vc90.mfc.manifest
- %ProgramFiles%\epm\dc\bin\microsoft.vc90.crt.manifest
- %ProgramFiles%\epm\bin\microsoft.vc90.crt.manifest
- %ProgramFiles%\epm\dc\bin\microsoft.vc90.atl.manifest
- %ProgramFiles%\epm\bin\microsoft.vc90.atl.manifest
- %ProgramFiles%\epm\bin\log.manifest
- %ProgramFiles%\epm\bin\ldmmanager.manifest
- %ProgramFiles%\epm\bin\fixup.manifest
- %ProgramFiles%\epm\bin\filesystemcheck.manifest
- %ProgramFiles%\epm\bin\filesystemanalyser.manifest
- %ProgramFiles%\epm\res\warnicon.png
- %ProgramFiles%\epm\bin\sectorcopy.manifest
- %ProgramFiles%\epm\res\version_yes.png
- %ProgramFiles%\epm\res\unlimited_enable.png
- %ProgramFiles%\epm\res\menu_settings.png
- %ProgramFiles%\epm\res\menu_pm.png
- %ProgramFiles%\epm\res\menu_more.png
- %ProgramFiles%\epm\res\menu_help.png
- %ProgramFiles%\epm\res\menu_google.png
- %ProgramFiles%\epm\res\menu_generate_report.png
- %ProgramFiles%\epm\res\menu_fb.png
- %ProgramFiles%\epm\res\menu_email.png
- %ProgramFiles%\epm\res\menu_check_upgrade.png
- %ProgramFiles%\epm\res\menu_about.png
- %ProgramFiles%\epm\res\menu_tech.png
- %ProgramFiles%\epm\res\logo_update.png
- %ProgramFiles%\epm\res\logocolour_toolm.png
- %ProgramFiles%\epm\res\logocolour_tb.png
- %ProgramFiles%\epm\res\logocolour_pct.png
- %ProgramFiles%\epm\res\logocolour_mm.png
- %ProgramFiles%\epm\res\logocolour_drw.png
- %ProgramFiles%\epm\res\loading\loading07.png
- %ProgramFiles%\epm\res\loading\loading06.png
- %ProgramFiles%\epm\res\loading\loading05.png
- %ProgramFiles%\epm\res\loading\loading04.png
- %ProgramFiles%\epm\res\loading\loading03.png
- %ProgramFiles%\epm\res\logo_chkupdate.png
- %ProgramFiles%\epm\res\menu_twitter.png
- %ProgramFiles%\epm\res\pci_unallocated.png
- %ProgramFiles%\epm\res\pie_ring.png
- %ProgramFiles%\epm\res\undo.png
- %ProgramFiles%\epm\res\unconnectserver.png
- %ProgramFiles%\epm\res\unallocated_block.png
- %ProgramFiles%\epm\res\title_restorewindow.png
- %ProgramFiles%\epm\res\title_minimize.png
- %ProgramFiles%\epm\res\title_menu.png
- %ProgramFiles%\epm\res\title_maximize.png
- %ProgramFiles%\epm\res\title_logo.png
- %ProgramFiles%\epm\res\title_help.png
- %ProgramFiles%\epm\res\title_close.png
- %ProgramFiles%\epm\res\title_activate.png
- %ProgramFiles%\epm\res\taskitem.png
- %ProgramFiles%\epm\res\success_b.png
- %ProgramFiles%\epm\res\start-logo.png
- %ProgramFiles%\epm\res\start-bg.png
- %ProgramFiles%\epm\res\server_enable.png
- %ProgramFiles%\epm\res\refresh.png
- %ProgramFiles%\epm\res\redo.png
- %ProgramFiles%\epm\res\radio_unchecked_disable.png
- %ProgramFiles%\epm\res\radio_unchecked.png
- %ProgramFiles%\epm\res\radio_checked_disable.png
- %ProgramFiles%\epm\res\radio_checked.png
- %ProgramFiles%\epm\res\professinal_enable.png
- %ProgramFiles%\epm\res\loading\loading00.png
- %ProgramFiles%\epm\dc\bin\tblogsysclient.tblog
Удаляет следующие файлы
- %WINDIR%\temp\udd3246.tmp
- <DRIVERS>\.sys
- %WINDIR%\temp\udd4d46.tmp
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- '%ProgramFiles%\epm\hidcon.exe' start.cmd
- '%ProgramFiles%\epm\nircmd.exe' wait 2000
- '%ProgramFiles%\epm\dc\bin\drvsetup.exe' drv -install
- '%ProgramFiles%\epm\nircmd.exe' shortcut "%ProgramFiles%\epm\bin\Main.exe" "~$folder.desktop$" "EaseUS Partition Master 14.5"
- '%ProgramFiles%\epm\bin\main.exe'
- '%ProgramFiles%\epm\dc\bin\eucloneserver.exe' 440 452
- '<SYSTEM32>\cmd.exe' /c start.cmd' (со скрытым окном)
- '%ProgramFiles%\epm\dc\bin\eucloneserver.exe' 440 452' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c start.cmd
- '<SYSTEM32>\vds.exe'
