Техническая информация
Для обеспечения автозапуска и распространения
Создает следующие файлы на съемном носителе
- <Имя диска съемного носителя>:\incident_report.pdf
Изменения в файловой системе
Создает следующие файлы
- C:\incident_report.pdf
- %HOMEPATH%\favorites\microsoft websites\incident_report.pdf
- %HOMEPATH%\favorites\msn websites\incident_report.pdf
- %HOMEPATH%\favorites\windows live\incident_report.pdf
- %HOMEPATH%\links\incident_report.pdf
- %HOMEPATH%\local settings\incident_report.pdf
- %HOMEPATH%\music\incident_report.pdf
- %HOMEPATH%\my documents\incident_report.pdf
- %HOMEPATH%\pictures\incident_report.pdf
- %HOMEPATH%\videos\incident_report.pdf
- %HOMEPATH%\printhood\incident_report.pdf
- %HOMEPATH%\recent\incident_report.pdf
- %HOMEPATH%\saved games\incident_report.pdf
- %HOMEPATH%\searches\incident_report.pdf
- %HOMEPATH%\sendto\incident_report.pdf
- %HOMEPATH%\start menu\incident_report.pdf
- %HOMEPATH%\templates\incident_report.pdf
- %HOMEPATH%\favorites\links for united states\incident_report.pdf
- %HOMEPATH%\nethood\incident_report.pdf
- %HOMEPATH%\favorites\links\incident_report.pdf
- %HOMEPATH%\incident_report.pdf
- <Текущая директория>\incident_report.pdf
- C:\documents and settings\incident_report.pdf
- C:\kms\incident_report.pdf
- C:\recovery\incident_report.pdf
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\incident_report.pdf
- C:\users\incident_report.pdf
- C:\users\default user\incident_report.pdf
- %HOMEPATH%\application data\incident_report.pdf
- %HOMEPATH%\downloads\incident_report.pdf
- %HOMEPATH%\contacts\incident_report.pdf
- %HOMEPATH%\cookies\incident_report.pdf
- %HOMEPATH%\desktop\incident_report.pdf
- %HOMEPATH%\documents\incident_report.pdf
- %HOMEPATH%\documents\my music\incident_report.pdf
- %HOMEPATH%\documents\my pictures\incident_report.pdf
- %HOMEPATH%\documents\my videos\incident_report.pdf
- %HOMEPATH%\favorites\incident_report.pdf
- D:\incident_report.pdf
Изменяет следующие файлы
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\winre.wim.6c5oy2dvr6
- %HOMEPATH%\favorites\links\desktop.ini.6c5oy2dvr6
- %HOMEPATH%\downloads\desktop.ini.6c5oy2dvr6
- %HOMEPATH%\desktop\desktop.ini.6c5oy2dvr6
- %HOMEPATH%\contacts\desktop.ini.6c5oy2dvr6
- %HOMEPATH%\videos\desktop.ini.6c5oy2dvr6
- %HOMEPATH%\saved games\desktop.ini.6c5oy2dvr6
- %HOMEPATH%\ntuser.ini.6c5oy2dvr6
- %HOMEPATH%\favorites\windows live\windows live spaces.url.6c5oy2dvr6
- %HOMEPATH%\favorites\windows live\windows live gallery.url.6c5oy2dvr6
- %HOMEPATH%\favorites\msn websites\msnbc news.url.6c5oy2dvr6
- %HOMEPATH%\favorites\msn websites\msn sports.url.6c5oy2dvr6
- %HOMEPATH%\favorites\msn websites\msn entertainment.url.6c5oy2dvr6
- %HOMEPATH%\favorites\microsoft websites\microsoft store.url.6c5oy2dvr6
- %HOMEPATH%\favorites\microsoft websites\microsoft at home.url.6c5oy2dvr6
- %HOMEPATH%\favorites\microsoft websites\ie add-on site.url.6c5oy2dvr6
- %HOMEPATH%\favorites\links for united states\gobiernousa.gov.url.6c5oy2dvr6
- %HOMEPATH%\favorites\links\web slice gallery.url.6c5oy2dvr6
- %HOMEPATH%\favorites\desktop.ini.6c5oy2dvr6
- %HOMEPATH%\documents\desktop.ini.6c5oy2dvr6
- %HOMEPATH%\desktop\dial.bmp.6c5oy2dvr6
- %HOMEPATH%\desktop\default.bmp.6c5oy2dvr6
- %HOMEPATH%\desktop\correct.avi.6c5oy2dvr6
- %HOMEPATH%\desktop\contosoroot_1.cer.6c5oy2dvr6
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.6c5oy2dvr6
- %HOMEPATH%\contacts\user.contact.6c5oy2dvr6
- C:\users\desktop.ini.6c5oy2dvr6
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\boot.sdi.6c5oy2dvr6
- %HOMEPATH%\favorites\links for united states\desktop.ini.6c5oy2dvr6
- %HOMEPATH%\favorites\links for united states\usa.gov.url.6c5oy2dvr6
Изменяет множество файлов.
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Сетевая активность
TCP
Другие
- '34.##9.100.209':443
