Техническая информация
Для обеспечения автозапуска и распространения
Создает следующие файлы на съемном носителе
- <Имя диска съемного носителя>:\!!!-restore-my-files-!!!.txt
Изменения в файловой системе
Создает следующие файлы
- C:\!!!-restore-my-files-!!!.txt
- %ProgramFiles(x86)%\adobe\!!!-restore-my-files-!!!.txt
- %CommonProgramFiles(x86)%\!!!-restore-my-files-!!!.txt
- %ProgramFiles(x86)%\internet explorer\!!!-restore-my-files-!!!.txt
- %ProgramFiles(x86)%\microsoft analysis services\!!!-restore-my-files-!!!.txt
- %ProgramFiles(x86)%\microsoft office\!!!-restore-my-files-!!!.txt
- %ProgramFiles(x86)%\microsoft visual studio 8\!!!-restore-my-files-!!!.txt
- %ProgramFiles(x86)%\microsoft.net\!!!-restore-my-files-!!!.txt
- %ProgramFiles(x86)%\msbuild\!!!-restore-my-files-!!!.txt
- %CommonProgramFiles%\!!!-restore-my-files-!!!.txt
- %ProgramFiles(x86)%\opera\!!!-restore-my-files-!!!.txt
- %ProgramFiles(x86)%\steam\!!!-restore-my-files-!!!.txt
- %ProgramFiles(x86)%\uninstall information\!!!-restore-my-files-!!!.txt
- %ALLUSERSPROFILE%\adobe\!!!-restore-my-files-!!!.txt
- %ALLUSERSPROFILE%\microsoft\!!!-restore-my-files-!!!.txt
- %ALLUSERSPROFILE%\microsoft help\!!!-restore-my-files-!!!.txt
- %ALLUSERSPROFILE%\mozilla\!!!-restore-my-files-!!!.txt
- %ALLUSERSPROFILE%\oracle\!!!-restore-my-files-!!!.txt
- %ALLUSERSPROFILE%\package cache\!!!-restore-my-files-!!!.txt
- %ProgramFiles%\uninstall information\!!!-restore-my-files-!!!.txt
- %ProgramFiles%\winrar\!!!-restore-my-files-!!!.txt
- %ProgramFiles%\reference assemblies\!!!-restore-my-files-!!!.txt
- %ProgramFiles%\msbuild\!!!-restore-my-files-!!!.txt
- %ProgramFiles%\mozilla thunderbird\!!!-restore-my-files-!!!.txt
- C:\kms\!!!-restore-my-files-!!!.txt
- C:\msocache\!!!-restore-my-files-!!!.txt
- %ProgramFiles%\!!!-restore-my-files-!!!.txt
- %ProgramFiles(x86)%\!!!-restore-my-files-!!!.txt
- %ALLUSERSPROFILE%\!!!-restore-my-files-!!!.txt
- C:\recovery\!!!-restore-my-files-!!!.txt
- <Текущая директория>\!!!-restore-my-files-!!!.txt
- C:\users\!!!-restore-my-files-!!!.txt
- %ALLUSERSPROFILE%\sun\!!!-restore-my-files-!!!.txt
- %ProgramFiles(x86)%\reference assemblies\!!!-restore-my-files-!!!.txt
- C:\msocache\all users\!!!-restore-my-files-!!!.txt
- %ProgramFiles%\internet explorer\!!!-restore-my-files-!!!.txt
- %ProgramFiles%\java\!!!-restore-my-files-!!!.txt
- %ProgramFiles%\microsoft analysis services\!!!-restore-my-files-!!!.txt
- %ProgramFiles%\microsoft office\!!!-restore-my-files-!!!.txt
- %ProgramFiles%\microsoft sql server compact edition\!!!-restore-my-files-!!!.txt
- %ProgramFiles%\microsoft sync framework\!!!-restore-my-files-!!!.txt
- %ProgramFiles%\microsoft synchronization services\!!!-restore-my-files-!!!.txt
- %ProgramFiles%\mozilla firefox\!!!-restore-my-files-!!!.txt
- D:\!!!-restore-my-files-!!!.txt
- %ProgramFiles%\dvd maker\!!!-restore-my-files-!!!.txt
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\!!!-restore-my-files-!!!.txt
Перемещает следующие файлы
- %ProgramFiles%\desktop.ini в %ProgramFiles%\desktop.ini.3545c5e9
- %ProgramFiles%\winrar\default.sfx в %ProgramFiles%\winrar\default.sfx.3545c5e9
- %ProgramFiles%\winrar\default64.sfx в %ProgramFiles%\winrar\default64.sfx.3545c5e9
- %ProgramFiles%\winrar\descript.ion в %ProgramFiles%\winrar\descript.ion.3545c5e9
- %ProgramFiles%\winrar\license.txt в %ProgramFiles%\winrar\license.txt.3545c5e9
- %ProgramFiles%\winrar\order.htm в %ProgramFiles%\winrar\order.htm.3545c5e9
- %ProgramFiles%\winrar\rar.txt в %ProgramFiles%\winrar\rar.txt.3545c5e9
- %ProgramFiles%\winrar\rarfiles.lst в %ProgramFiles%\winrar\rarfiles.lst.3545c5e9
- %ProgramFiles%\winrar\rarnew.dat в %ProgramFiles%\winrar\rarnew.dat.3545c5e9
- %ProgramFiles%\winrar\readme.txt в %ProgramFiles%\winrar\readme.txt.3545c5e9
- %ProgramFiles%\winrar\uninstall.lst в %ProgramFiles%\winrar\uninstall.lst.3545c5e9
- %ProgramFiles%\winrar\whatsnew.txt в %ProgramFiles%\winrar\whatsnew.txt.3545c5e9
- %ProgramFiles%\winrar\wincon.sfx в %ProgramFiles%\winrar\wincon.sfx.3545c5e9
- %ProgramFiles%\winrar\wincon64.sfx в %ProgramFiles%\winrar\wincon64.sfx.3545c5e9
- %ProgramFiles%\winrar\winrar.chm в %ProgramFiles%\winrar\winrar.chm.3545c5e9
- %ProgramFiles%\winrar\zip.sfx в %ProgramFiles%\winrar\zip.sfx.3545c5e9
- %ProgramFiles%\winrar\zip64.sfx в %ProgramFiles%\winrar\zip64.sfx.3545c5e9
- %ProgramFiles%\winrar\zipnew.dat в %ProgramFiles%\winrar\zipnew.dat.3545c5e9
- %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets в %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets.3545c5e9
- %ProgramFiles(x86)%\opera\installation_status.xml в %ProgramFiles(x86)%\opera\installation_status.xml.3545c5e9
- %ProgramFiles(x86)%\opera\installer_prefs.json в %ProgramFiles(x86)%\opera\installer_prefs.json.3545c5e9
- %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml в %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml.3545c5e9
- %ProgramFiles%\mozilla thunderbird\updater.ini в %ProgramFiles%\mozilla thunderbird\updater.ini.3545c5e9
- %ProgramFiles(x86)%\opera\resources.pri в %ProgramFiles(x86)%\opera\resources.pri.3545c5e9
- %ProgramFiles%\mozilla thunderbird\update-settings.ini в %ProgramFiles%\mozilla thunderbird\update-settings.ini.3545c5e9
- %ProgramFiles%\mozilla thunderbird\removed-files в %ProgramFiles%\mozilla thunderbird\removed-files.3545c5e9
- %ProgramFiles(x86)%\desktop.ini в %ProgramFiles(x86)%\desktop.ini.3545c5e9
- %ProgramFiles%\mozilla firefox\accessible.tlb в %ProgramFiles%\mozilla firefox\accessible.tlb.3545c5e9
- %ProgramFiles%\mozilla firefox\application.ini в %ProgramFiles%\mozilla firefox\application.ini.3545c5e9
- %ProgramFiles%\mozilla firefox\crashreporter.ini в %ProgramFiles%\mozilla firefox\crashreporter.ini.3545c5e9
- %ProgramFiles%\mozilla firefox\dependentlibs.list в %ProgramFiles%\mozilla firefox\dependentlibs.list.3545c5e9
- %ProgramFiles%\mozilla firefox\firefox.visualelementsmanifest.xml в %ProgramFiles%\mozilla firefox\firefox.visualelementsmanifest.xml.3545c5e9
- %ProgramFiles%\mozilla firefox\install.log в %ProgramFiles%\mozilla firefox\install.log.3545c5e9
- %ProgramFiles%\mozilla firefox\omni.ja в %ProgramFiles%\mozilla firefox\omni.ja.3545c5e9
- %ProgramFiles%\mozilla firefox\platform.ini в %ProgramFiles%\mozilla firefox\platform.ini.3545c5e9
- %ProgramFiles%\mozilla firefox\precomplete в %ProgramFiles%\mozilla firefox\precomplete.3545c5e9
- %ProgramFiles%\mozilla firefox\removed-files в %ProgramFiles%\mozilla firefox\removed-files.3545c5e9
- %ProgramFiles%\mozilla firefox\update-settings.ini в %ProgramFiles%\mozilla firefox\update-settings.ini.3545c5e9
- %ProgramFiles%\mozilla firefox\updater.ini в %ProgramFiles%\mozilla firefox\updater.ini.3545c5e9
- %ProgramFiles%\mozilla thunderbird\accessible.tlb в %ProgramFiles%\mozilla thunderbird\accessible.tlb.3545c5e9
- %ProgramFiles%\mozilla thunderbird\application.ini в %ProgramFiles%\mozilla thunderbird\application.ini.3545c5e9
- %ProgramFiles%\mozilla thunderbird\crashreporter.ini в %ProgramFiles%\mozilla thunderbird\crashreporter.ini.3545c5e9
- %ProgramFiles%\mozilla thunderbird\dependentlibs.list в %ProgramFiles%\mozilla thunderbird\dependentlibs.list.3545c5e9
- %ProgramFiles%\mozilla thunderbird\install.log в %ProgramFiles%\mozilla thunderbird\install.log.3545c5e9
- %ProgramFiles%\mozilla thunderbird\omni.ja в %ProgramFiles%\mozilla thunderbird\omni.ja.3545c5e9
- %ProgramFiles%\mozilla thunderbird\platform.ini в %ProgramFiles%\mozilla thunderbird\platform.ini.3545c5e9
- %ProgramFiles%\mozilla thunderbird\precomplete в %ProgramFiles%\mozilla thunderbird\precomplete.3545c5e9
- %ProgramFiles%\mozilla thunderbird\thunderbird.visualelementsmanifest.xml в %ProgramFiles%\mozilla thunderbird\thunderbird.visualelementsmanifest.xml.3545c5e9
- %ProgramFiles(x86)%\steam\steam.cfg в %ProgramFiles(x86)%\steam\steam.cfg.3545c5e9
Изменяет следующие файлы
- D:\install.log
- %ProgramFiles%\mozilla thunderbird\removed-files
- %ProgramFiles%\mozilla thunderbird\precomplete
- %ProgramFiles%\mozilla thunderbird\platform.ini
- %ProgramFiles%\mozilla thunderbird\omni.ja
- %ProgramFiles%\mozilla thunderbird\install.log
- %ProgramFiles%\mozilla thunderbird\dependentlibs.list
- %ProgramFiles%\mozilla thunderbird\crashreporter.ini
- %ProgramFiles%\mozilla thunderbird\application.ini
- %ProgramFiles%\mozilla thunderbird\accessible.tlb
- %ProgramFiles%\mozilla firefox\updater.ini
- %ProgramFiles%\mozilla firefox\update-settings.ini
- %ProgramFiles%\mozilla firefox\removed-files
- %ProgramFiles%\mozilla firefox\precomplete
- %ProgramFiles%\mozilla firefox\platform.ini
- %ProgramFiles%\mozilla firefox\omni.ja
- %ProgramFiles%\mozilla firefox\install.log
- %ProgramFiles%\mozilla firefox\firefox.visualelementsmanifest.xml
- %ProgramFiles%\mozilla firefox\dependentlibs.list
- %ProgramFiles%\mozilla firefox\crashreporter.ini
- %ProgramFiles%\mozilla firefox\application.ini
- %ProgramFiles%\mozilla firefox\accessible.tlb
- C:\users\desktop.ini
- <Имя диска съемного носителя>:\delete.avi
- %ProgramFiles(x86)%\desktop.ini
- %ProgramFiles%\desktop.ini
- C:\kms\kms_vl_all_aio_debug.log
- C:\kms\kms_vl_all_aio.cmd
- %ProgramFiles%\mozilla thunderbird\thunderbird.visualelementsmanifest.xml
- %ProgramFiles%\mozilla thunderbird\update-settings.ini
Изменяет множество файлов.
Сетевая активность
Подключается к
- '<LOCALNET>.23.0':445
- '<LOCALNET>.23.161':445
- '<LOCALNET>.23.162':445
- '<LOCALNET>.23.163':445
- '<LOCALNET>.23.164':445
- '<LOCALNET>.23.165':445
- '<LOCALNET>.23.166':445
- '<LOCALNET>.23.167':445
- '<LOCALNET>.23.168':445
- '<LOCALNET>.23.169':445
- '<LOCALNET>.23.170':445
- '<LOCALNET>.23.171':445
- '<LOCALNET>.23.172':445
- '<LOCALNET>.23.173':445
- '<LOCALNET>.23.175':445
- '<LOCALNET>.23.189':445
- '<LOCALNET>.23.176':445
- '<LOCALNET>.23.177':445
- '<LOCALNET>.23.178':445
- '<LOCALNET>.23.179':445
- '<LOCALNET>.23.180':445
- '<LOCALNET>.23.181':445
- '<LOCALNET>.23.182':445
- '<LOCALNET>.23.183':445
- '<LOCALNET>.23.184':445
- '<LOCALNET>.23.185':445
- '<LOCALNET>.23.186':445
- '<LOCALNET>.23.187':445
- '<LOCALNET>.23.188':445
- '<LOCALNET>.23.160':445
- '<LOCALNET>.23.174':445
- '<LOCALNET>.23.159':445
- '<LOCALNET>.23.142':445
- '<LOCALNET>.23.129':445
- '<LOCALNET>.23.130':445
- '<LOCALNET>.23.131':445
- '<LOCALNET>.23.132':445
- '<LOCALNET>.23.133':445
- '<LOCALNET>.23.134':445
- '<LOCALNET>.23.135':445
- '<LOCALNET>.23.136':445
- '<LOCALNET>.23.137':445
- '<LOCALNET>.23.138':445
- '<LOCALNET>.23.139':445
- '<LOCALNET>.23.140':445
- '<LOCALNET>.23.141':445
- '<LOCALNET>.23.143':445
- '<LOCALNET>.23.157':445
- '<LOCALNET>.23.144':445
- '<LOCALNET>.23.145':445
- '<LOCALNET>.23.146':445
- '<LOCALNET>.23.147':445
- '<LOCALNET>.23.148':445
- '<LOCALNET>.23.149':445
- '<LOCALNET>.23.150':445
- '<LOCALNET>.23.151':445
- '<LOCALNET>.23.152':445
- '<LOCALNET>.23.153':445
- '<LOCALNET>.23.154':445
- '<LOCALNET>.23.155':445
- '<LOCALNET>.23.156':445
- '<LOCALNET>.23.158':445
- '<LOCALNET>.23.207':445
- '<LOCALNET>.23.253':445
- '<LOCALNET>.23.192':445
- '<LOCALNET>.23.225':445
- '<LOCALNET>.23.226':445
- '<LOCALNET>.23.227':445
- '<LOCALNET>.23.228':445
- '<LOCALNET>.23.229':445
- '<LOCALNET>.23.230':445
- '<LOCALNET>.23.231':445
- '<LOCALNET>.23.232':445
- '<LOCALNET>.23.233':445
- '<LOCALNET>.23.234':445
- '<LOCALNET>.23.235':445
- '<LOCALNET>.23.236':445
- '<LOCALNET>.23.237':445
- '<LOCALNET>.23.239':445
- '<LOCALNET>.23.191':445
- '<LOCALNET>.23.240':445
- '<LOCALNET>.23.241':445
- '<LOCALNET>.23.242':445
- '<LOCALNET>.23.243':445
- '<LOCALNET>.23.244':445
- '<LOCALNET>.23.245':445
- '<LOCALNET>.23.246':445
- '<LOCALNET>.23.247':445
- '<LOCALNET>.23.248':445
- '<LOCALNET>.23.249':445
- '<LOCALNET>.23.250':445
- '<LOCALNET>.23.251':445
- '<LOCALNET>.23.252':445
- '<LOCALNET>.23.224':445
- '<LOCALNET>.23.128':445
- '<LOCALNET>.23.223':445
- '<LOCALNET>.23.206':445
- '<LOCALNET>.23.193':445
- '<LOCALNET>.23.194':445
- '<LOCALNET>.23.195':445
- '<LOCALNET>.23.196':445
- '<LOCALNET>.23.197':445
- '<LOCALNET>.23.198':445
- '<LOCALNET>.23.199':445
- '<LOCALNET>.23.200':445
- '<LOCALNET>.23.201':445
- '<LOCALNET>.23.202':445
- '<LOCALNET>.23.203':445
- '<LOCALNET>.23.204':445
- '<LOCALNET>.23.205':445
- '<LOCALNET>.23.190':445
- '<LOCALNET>.23.221':445
- '<LOCALNET>.23.208':445
- '<LOCALNET>.23.209':445
- '<LOCALNET>.23.210':445
- '<LOCALNET>.23.211':445
- '<LOCALNET>.23.212':445
- '<LOCALNET>.23.213':445
- '<LOCALNET>.23.214':445
- '<LOCALNET>.23.215':445
- '<LOCALNET>.23.216':445
- '<LOCALNET>.23.217':445
- '<LOCALNET>.23.218':445
- '<LOCALNET>.23.219':445
- '<LOCALNET>.23.220':445
- '<LOCALNET>.23.222':445
- '<LOCALNET>.23.238':445
- '<LOCALNET>.23.127':445
- '<LOCALNET>.23.110':445
- '<LOCALNET>.23.33':445
- '<LOCALNET>.23.34':445
- '<LOCALNET>.23.35':445
- '<LOCALNET>.23.36':445
- '<LOCALNET>.23.37':445
- '<LOCALNET>.23.38':445
- '<LOCALNET>.23.39':445
- '<LOCALNET>.23.40':445
- '<LOCALNET>.23.41':445
- '<LOCALNET>.23.42':445
- '<LOCALNET>.23.43':445
- '<LOCALNET>.23.44':445
- '<LOCALNET>.23.45':445
- '<LOCALNET>.23.47':445
- '<LOCALNET>.23.61':445
- '<LOCALNET>.23.48':445
- '<LOCALNET>.23.49':445
- '<LOCALNET>.23.50':445
- '<LOCALNET>.23.51':445
- '<LOCALNET>.23.52':445
- '<LOCALNET>.23.53':445
- '<LOCALNET>.23.54':445
- '<LOCALNET>.23.55':445
- '<LOCALNET>.23.56':445
- '<LOCALNET>.23.57':445
- '<LOCALNET>.23.58':445
- '<LOCALNET>.23.59':445
- '<LOCALNET>.23.60':445
- '<LOCALNET>.23.32':445
- '<LOCALNET>.23.46':445
- '<LOCALNET>.23.31':445
- '<LOCALNET>.23.14':445
- '<LOCALNET>.23.1':445
- '<LOCALNET>.23.2':445
- '<LOCALNET>.23.3':445
- '<LOCALNET>.23.4':445
- '<LOCALNET>.23.5':445
- '<LOCALNET>.23.6':445
- '<LOCALNET>.23.7':445
- '<LOCALNET>.23.8':445
- '<LOCALNET>.23.9':445
- '<LOCALNET>.23.10':445
- '<LOCALNET>.23.11':445
- '<LOCALNET>.23.12':445
- '<LOCALNET>.23.13':445
- '<LOCALNET>.23.15':445
- '<LOCALNET>.23.29':445
- '<LOCALNET>.23.16':445
- '<LOCALNET>.23.17':445
- '<LOCALNET>.23.18':445
- '<LOCALNET>.23.19':445
- '<LOCALNET>.23.20':445
- '<LOCALNET>.23.21':445
- '<LOCALNET>.23.22':445
- '<LOCALNET>.23.23':445
- '<LOCALNET>.23.24':445
- '<LOCALNET>.23.25':445
- '<LOCALNET>.23.26':445
- '<LOCALNET>.23.27':445
- '<LOCALNET>.23.28':445
- '<LOCALNET>.23.30':445
- '<LOCALNET>.23.79':445
- '<LOCALNET>.23.125':445
- '<LOCALNET>.23.64':445
- '<LOCALNET>.23.97':445
- '<LOCALNET>.23.98':445
- '<LOCALNET>.23.99':445
- '<LOCALNET>.23.100':445
- '<LOCALNET>.23.101':445
- '<LOCALNET>.23.102':445
- '<LOCALNET>.23.103':445
- '<LOCALNET>.23.104':445
- '<LOCALNET>.23.105':445
- '<LOCALNET>.23.106':445
- '<LOCALNET>.23.107':445
- '<LOCALNET>.23.108':445
- '<LOCALNET>.23.109':445
- '<LOCALNET>.23.111':445
- '<LOCALNET>.23.63':445
- '<LOCALNET>.23.112':445
- '<LOCALNET>.23.113':445
- '<LOCALNET>.23.114':445
- '<LOCALNET>.23.115':445
- '<LOCALNET>.23.116':445
- '<LOCALNET>.23.117':445
- '<LOCALNET>.23.118':445
- '<LOCALNET>.23.119':445
- '<LOCALNET>.23.120':445
- '<LOCALNET>.23.121':445
- '<LOCALNET>.23.122':445
- '<LOCALNET>.23.123':445
- '<LOCALNET>.23.124':445
- '<LOCALNET>.23.96':445
- '<LOCALNET>.23.126':445
- '<LOCALNET>.23.95':445
- '<LOCALNET>.23.78':445
- '<LOCALNET>.23.65':445
- '<LOCALNET>.23.66':445
- '<LOCALNET>.23.67':445
- '<LOCALNET>.23.68':445
- '<LOCALNET>.23.69':445
- '<LOCALNET>.23.70':445
- '<LOCALNET>.23.71':445
- '<LOCALNET>.23.72':445
- '<LOCALNET>.23.73':445
- '<LOCALNET>.23.74':445
- '<LOCALNET>.23.75':445
- '<LOCALNET>.23.76':445
- '<LOCALNET>.23.77':445
- '<LOCALNET>.23.62':445
- '<LOCALNET>.23.93':445
- '<LOCALNET>.23.80':445
- '<LOCALNET>.23.81':445
- '<LOCALNET>.23.82':445
- '<LOCALNET>.23.83':445
- '<LOCALNET>.23.84':445
- '<LOCALNET>.23.85':445
- '<LOCALNET>.23.86':445
- '<LOCALNET>.23.87':445
- '<LOCALNET>.23.88':445
- '<LOCALNET>.23.89':445
- '<LOCALNET>.23.90':445
- '<LOCALNET>.23.91':445
- '<LOCALNET>.23.92':445
- '<LOCALNET>.23.94':445
- '<LOCALNET>.23.254':445
