Поддержка
Круглосуточная поддержка

Позвоните

Бесплатно по России:
8-800-333-79-32

ЧаВо | Форум

Ваши запросы

  • Все: -
  • Незакрытые: -
  • Последний: -

Позвоните

Бесплатно по России:
8-800-333-79-32

Свяжитесь с нами Незакрытые запросы: 

Профиль

Профиль

Trojan.Encoder.38501

Добавлен в вирусную базу Dr.Web: 2024-01-20

Описание добавлено:

Техническая информация

Для обеспечения автозапуска и распространения
Создает следующие файлы на съемном носителе
  • <Имя диска съемного носителя>:\file recovery_id_103892593113.txt
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует:
  • Компонент восстановления системы (SR)
Запускает на исполнение
  • '<SYSTEM32>\taskkill.exe' /F /IM postgresql*
  • '<SYSTEM32>\net.exe' stop "MSSQL" /y
  • '<SYSTEM32>\net.exe' stop "SQLWriter" /y
  • '<SYSTEM32>\net.exe' stop "SQLTELEMETRY" /y
  • '<SYSTEM32>\net.exe' stop "SQLBrowser" /y
  • '<SYSTEM32>\net.exe' stop "SQLSERVERAGENT" /y
  • '<SYSTEM32>\net.exe' stop "MSSQLSERVER" /y
  • '<SYSTEM32>\net.exe' stop "SQLAgent" /y
  • '<SYSTEM32>\net.exe' stop "MSSQLFDLauncher" /y
  • '<SYSTEM32>\taskkill.exe' /F /IM pg_ctl*
  • '<SYSTEM32>\taskkill.exe' /F /IM SQLAGENT*
  • '<SYSTEM32>\taskkill.exe' /F /IM sqlceip*
  • '<SYSTEM32>\taskkill.exe' /F /IM sqlservr*
  • '<SYSTEM32>\taskkill.exe' /F /IM sqlwriter*
  • '<SYSTEM32>\taskkill.exe' /F /IM sqlbrowser*
  • '<SYSTEM32>\taskkill.exe' /F /IM postgres*
  • '<SYSTEM32>\net.exe' stop "MSSQLServerOLAPService" /y
Читает файлы, отвечающие за хранение паролей сторонними программами
  • %LOCALAPPDATA%\google\chrome\user data\default\cookies
  • %LOCALAPPDATA%\google\chrome\user data\default\login data
  • %LOCALAPPDATA%\google\chrome\user data\default\web data
  • %HOMEPATH%\desktop\000814251_video_01.avi
  • %HOMEPATH%\desktop\508softwareandos.doc
  • %HOMEPATH%\desktop\adhd_and_obesity.docx
  • %HOMEPATH%\desktop\archer.avi
  • %HOMEPATH%\desktop\coffee.bmp
  • %HOMEPATH%\desktop\february_catalogue__2015.doc
  • %HOMEPATH%\desktop\fi51.doc
  • %HOMEPATH%\desktop\hanni_umami_chapter.doc
  • %HOMEPATH%\desktop\holycrosschurchinstructions.docx
  • %HOMEPATH%\desktop\issi2013_template_for_posters.docx
  • %HOMEPATH%\desktop\join.avi
  • %HOMEPATH%\desktop\testcertificate.cer
Изменения в файловой системе
Создает следующие файлы
  • <Текущая директория>\systime.exe
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_br\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_pt\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\session storage\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\jumplisticonsold\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\jumplisticons\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_tw\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_cn\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_br\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_pt\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_tw\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_cn\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\file recovery_id_103892593113.txt
  • %HOMEPATH%\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\file recovery_id_103892593113.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\file recovery_id_103892593113.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\file recovery_id_103892593113.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\file recovery_id_103892593113.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\file recovery_id_103892593113.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\security_state\file recovery_id_103892593113.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\file recovery_id_103892593113.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\file recovery_id_103892593113.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\file recovery_id_103892593113.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\file recovery_id_103892593113.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\file recovery_id_103892593113.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\file recovery_id_103892593113.txt
  • %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\file recovery_id_103892593113.txt
  • %APPDATA%\mozilla\firefox\crash reports\file recovery_id_103892593113.txt
  • %APPDATA%\microsoft\windows\themes\file recovery_id_103892593113.txt
  • %APPDATA%\microsoft\windows\sendto\file recovery_id_103892593113.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\file recovery_id_103892593113.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\file recovery_id_103892593113.txt
  • %APPDATA%\telegram desktop\file recovery_id_103892593113.txt
  • %APPDATA%\thunderbird\crash reports\file recovery_id_103892593113.txt
  • %HOMEPATH%\searches\file recovery_id_103892593113.txt
  • %HOMEPATH%\favorites\windows live\file recovery_id_103892593113.txt
  • %HOMEPATH%\favorites\msn websites\file recovery_id_103892593113.txt
  • %HOMEPATH%\favorites\microsoft websites\file recovery_id_103892593113.txt
  • %HOMEPATH%\favorites\links for united states\file recovery_id_103892593113.txt
  • %HOMEPATH%\favorites\links\file recovery_id_103892593113.txt
  • %HOMEPATH%\desktop\file recovery_id_103892593113.txt
  • %APPDATA%\thunderbird\profiles\hmz1jddi.default\file recovery_id_103892593113.txt
  • %HOMEPATH%\contacts\file recovery_id_103892593113.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\file recovery_id_103892593113.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\file recovery_id_103892593113.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\file recovery_id_103892593113.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\file recovery_id_103892593113.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\file recovery_id_103892593113.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\file recovery_id_103892593113.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\file recovery_id_103892593113.txt
  • %APPDATA%\microsoft\windows\recent\automaticdestinations\file recovery_id_103892593113.txt
  • %APPDATA%\microsoft\windows\libraries\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\windows\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\windows\wer\reportqueue\critical_microsoft .net f_5deabd23d637fc27acf7bfdd613025667396c824_cab_0fbabd8f\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\windows\history\history.ie5\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\windows\explorer\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\media player\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b025\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\internet explorer\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\internet explorer\recovery\high\active\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\feeds cache\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\feeds cache\xwtafhng\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\feeds cache\bbs9hw0e\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\feeds cache\6fwa5ftw\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\feeds cache\15ivkcr3\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\feeds\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\windows mail\backup\new\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\windows mail\stationery\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\windows mail\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\windows media\12.0\file recovery_id_103892593113.txt
  • %APPDATA%\microsoft\windows\cookies\file recovery_id_103892593113.txt
  • %APPDATA%\microsoft\protect\file recovery_id_103892593113.txt
  • %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\file recovery_id_103892593113.txt
  • %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%low\sun\java\deployment\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%low\oracle\java\au\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\microsoft\feeds\feeds for united states~\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\startupcache\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\cache2\entries\file recovery_id_103892593113.txt
  • %TEMP%\file recovery_id_103892593113.txt
  • %TEMP%\opera installer\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\startupcache\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\offlinecache\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\file recovery_id_103892593113.txt
  • %APPDATA%\microsoft\windows\ietldcache\file recovery_id_103892593113.txt
  • %APPDATA%\microsoft\windows\recent\customdestinations\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\cache\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\application\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\pepperflash\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\extensions\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\file recovery_id_103892593113.txt
  • C:\users\public\videos\sample videos\file recovery_id_103892593113.txt
  • C:\users\public\recorded tv\sample media\file recovery_id_103892593113.txt
  • C:\users\public\pictures\sample pictures\file recovery_id_103892593113.txt
  • C:\users\public\music\sample music\file recovery_id_103892593113.txt
  • C:\users\public\libraries\file recovery_id_103892593113.txt
  • C:\users\default\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\databases\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extension rules\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extension state\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_gb\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_us\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\file recovery_id_103892593113.txt
  • C:\users\default\appdata\roaming\microsoft\windows\sendto\file recovery_id_103892593113.txt
  • C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\file recovery_id_103892593113.txt
  • C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
  • %TEMP%\csc2a4a.tmp
  • %TEMP%\t2qaj0rd.out
  • %TEMP%\t2qaj0rd.cmdline
  • %TEMP%\t2qaj0rd.0.cs
  • <Текущая директория>\wallpaper.ps1
  • <Текущая директория>\103892593113.jpg
  • <Текущая директория>\zlib1.dll
  • <Текущая директория>\libpcre2-8-0.dll
  • <Текущая директория>\libintl-8.dll
  • <Текущая директория>\libiconv-2.dll
  • <Текущая директория>\libgobject-2.0-0.dll
  • <Текущая директория>\libgmodule-2.0-0.dll
  • <Текущая директория>\libglib-2.0-0.dll
  • <Текущая директория>\libgio-2.0-0.dll
  • <Текущая директория>\libffi-8.dll
  • %TEMP%\res2a4b.tmp
  • %TEMP%\t2qaj0rd.dll
  • C:\users\public\documents\file recovery_id_103892593113.txt
  • C:\users\public\desktop\file recovery_id_103892593113.txt
  • C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
  • C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
  • C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
  • C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
  • C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
  • C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
  • C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\file recovery_id_103892593113.txt
  • C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\file recovery_id_103892593113.txt
  • C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\file recovery_id_103892593113.txt
  • C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
  • C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
  • C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
  • C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
  • C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
  • C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
  • C:\kms\file recovery_id_103892593113.txt
  • C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_us\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_pt\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_br\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_gb\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_tw\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_cn\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_pt\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_br\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_tw\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_cn\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\file recovery_id_103892593113.txt
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\file recovery_id_103892593113.txt
  • D:\file recovery_id_103892593113.txt
Удаляет следующие файлы
  • %TEMP%\res2a4b.tmp
  • %TEMP%\csc2a4a.tmp
  • %TEMP%\t2qaj0rd.cmdline
  • %TEMP%\t2qaj0rd.dll
  • %TEMP%\t2qaj0rd.0.cs
  • %TEMP%\t2qaj0rd.pdb
  • %TEMP%\t2qaj0rd.out
  • <Текущая директория>\103892593113.jpg
  • <Текущая директория>\wallpaper.ps1
Перемещает следующие файлы
  • %TEMP%\adobesfx.log в %TEMP%\adobesfx.log.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.jsonlz4.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202 в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.baklz4 в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.baklz4.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\.metadata-v2 в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\.metadata-v2.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\search.json.mozlz4 в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\search.json.mozlz4.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\previous.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\previous.jsonlz4.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\trrblacklist.txt в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\trrblacklist.txt.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\.metadata-v2 в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\.metadata-v2.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\security_state\data.safe.bin в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\security_state\data.safe.bin.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\securitypreloadstate.txt в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\securitypreloadstate.txt.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729070.71d7d59d-5451-4f15-bb9e-420e88a3061f.first-shutdown.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729070.71d7d59d-5451-4f15-bb9e-420e88a3061f.first-shutdown.jsonlz4.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\license.txt в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\license.txt.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\manifest.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\manifest.json.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729067.9cd37e15-817f-4044-81be-e43af1dfc595.main.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729067.9cd37e15-817f-4044-81be-e43af1dfc595.main.jsonlz4.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.lib в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.lib.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\2a211dea-1f81-457a-9f7c-a174126ff0dd в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\2a211dea-1f81-457a-9f7c-a174126ff0dd.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\71d7d59d-5451-4f15-bb9e-420e88a3061f в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\71d7d59d-5451-4f15-bb9e-420e88a3061f.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\9cd37e15-817f-4044-81be-e43af1dfc595 в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\9cd37e15-817f-4044-81be-e43af1dfc595.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\dc35f7c9-5b80-4042-a301-e84d8619b27e в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\dc35f7c9-5b80-4042-a301-e84d8619b27e.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.sig в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.sig.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.live
  • %APPDATA%\thunderbird\crash reports\installtime20210406220621 в %APPDATA%\thunderbird\crash reports\installtime20210406220621.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913 в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\securitypreloadstate.txt в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\securitypreloadstate.txt.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\search.json.mozlz4 в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\search.json.mozlz4.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sitesecurityservicestate.txt в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sitesecurityservicestate.txt.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\.metadata-v2 в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\.metadata-v2.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\parent.lock в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\parent.lock.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\alternateservices.txt в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\alternateservices.txt.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addonstartup.json.lz4 в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addonstartup.json.lz4.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\store.json.mozlz4 в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\store.json.mozlz4.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4 в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4 в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4 в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite.live
  • %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json в %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json.live
  • %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js в %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729047.dc35f7c9-5b80-4042-a301-e84d8619b27e.event.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729047.dc35f7c9-5b80-4042-a301-e84d8619b27e.event.jsonlz4.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729016.2a211dea-1f81-457a-9f7c-a174126ff0dd.new-profile.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729016.2a211dea-1f81-457a-9f7c-a174126ff0dd.new-profile.jsonlz4.live
  • %TEMP%\dd_vcredist_amd64_20230912172247.log в %TEMP%\dd_vcredist_amd64_20230912172247.log.live
  • %TEMP%\dd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log в %TEMP%\dd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log.live
  • %TEMP%\dd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log в %TEMP%\dd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log.live
  • %TEMP%\dd_vcredist_x86_20230912171710.log в %TEMP%\dd_vcredist_x86_20230912171710.log.live
  • %TEMP%\dd_vcredist_amd64_20230912172315.log в %TEMP%\dd_vcredist_amd64_20230912172315.log.live
  • %TEMP%\dd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log.live
  • %TEMP%\dd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log в %TEMP%\dd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log.live
  • %TEMP%\dd_vcredist_amd64_20230912172134.log в %TEMP%\dd_vcredist_amd64_20230912172134.log.live
  • %TEMP%\dd_vcredist_x86_20230912171759.log в %TEMP%\dd_vcredist_x86_20230912171759.log.live
  • %TEMP%\dd_vcredist_x86_20230912171936.log в %TEMP%\dd_vcredist_x86_20230912171936.log.live
  • %TEMP%\dd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log.live
  • %TEMP%\dd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log.live
  • %TEMP%\dd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log.live
  • %TEMP%\dd_vcredist_x86_20230912172157.log в %TEMP%\dd_vcredist_x86_20230912172157.log.live
  • %TEMP%\dd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log.live
  • %TEMP%\dd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log.live
  • %TEMP%\dd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log.live
  • %TEMP%\dd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log в %TEMP%\dd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log.live
  • %TEMP%\dd_vcredist_amd64_20230912172034.log в %TEMP%\dd_vcredist_amd64_20230912172034.log.live
  • %TEMP%\dd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log в %TEMP%\dd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log.live
  • %TEMP%\aspnetsetup_00000.log в %TEMP%\aspnetsetup_00000.log.live
  • %TEMP%\aspnetsetup_00001.log в %TEMP%\aspnetsetup_00001.log.live
  • %TEMP%\chrome_installer.log в %TEMP%\chrome_installer.log.live
  • %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt в %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.live
  • %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt в %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.live
  • %TEMP%\dd_setuputility.txt в %TEMP%\dd_setuputility.txt.live
  • %TEMP%\dd_vcredistui12db.txt в %TEMP%\dd_vcredistui12db.txt.live
  • %TEMP%\adobearm.log в %TEMP%\adobearm.log.live
  • %TEMP%\dd_vcredist_amd64_20230912171641.log в %TEMP%\dd_vcredist_amd64_20230912171641.log.live
  • %TEMP%\dd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log в %TEMP%\dd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log.live
  • %TEMP%\dd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log в %TEMP%\dd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log.live
  • %TEMP%\dd_vcredist_amd64_20230912171735.log в %TEMP%\dd_vcredist_amd64_20230912171735.log.live
  • %TEMP%\dd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log в %TEMP%\dd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log.live
  • %TEMP%\dd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log в %TEMP%\dd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log.live
  • %TEMP%\dd_vcredist_amd64_20230912171824.log в %TEMP%\dd_vcredist_amd64_20230912171824.log.live
  • %TEMP%\dd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log в %TEMP%\dd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log.live
  • %TEMP%\dd_vcredistmsi12db.txt в %TEMP%\dd_vcredistmsi12db.txt.live
  • %TEMP%\dd_vcredist_x86_20230912172157_002_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20230912172157_002_vcruntimeadditional_x86.log.live
  • %TEMP%\dd_vcredist_x86_20230912172224.log в %TEMP%\dd_vcredist_x86_20230912172224.log.live
  • %TEMP%\dd_vcredist_x86_20230912172322.log в %TEMP%\dd_vcredist_x86_20230912172322.log.live
  • %TEMP%\dd_vcredist_x86_20230912172322_001_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20230912172322_001_vcruntimeminimum_x86.log.live
  • %APPDATA%\microsoft\windows\libraries\documents.library-ms в %APPDATA%\microsoft\windows\libraries\documents.library-ms.live
  • %APPDATA%\microsoft\windows\libraries\music.library-ms в %APPDATA%\microsoft\windows\libraries\music.library-ms.live
  • %APPDATA%\microsoft\windows\libraries\pictures.library-ms в %APPDATA%\microsoft\windows\libraries\pictures.library-ms.live
  • %APPDATA%\microsoft\windows\libraries\videos.library-ms в %APPDATA%\microsoft\windows\libraries\videos.library-ms.live
  • %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms в %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms.live
  • %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget в %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.live
  • %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink в %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.live
  • %APPDATA%\microsoft\windows\sendto\documents.mydocs в %APPDATA%\microsoft\windows\sendto\documents.mydocs.live
  • %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail в %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail.live
  • %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json в %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json.live
  • %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 в %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addonstartup.json.lz4 в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addonstartup.json.lz4.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\alternateservices.txt в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\alternateservices.txt.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\bookmarks-2023-09-29_11_w-7ab47btxtewdh4a2yehg==.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\bookmarks-2023-09-29_11_w-7ab47btxtewdh4a2yehg==.jsonlz4.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json.live
  • %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\preferred в %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\preferred.live
  • %APPDATA%\microsoft\protect\credhist в %APPDATA%\microsoft\protect\credhist.live
  • %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\51da22b7-9513-4885-adb9-cd2e72f47f0a в %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\51da22b7-9513-4885-adb9-cd2e72f47f0a.live
  • %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\f58155b4b1d5a524ca0261c3ee99fb50_d99ef00b-ccd3-4f1d-9980-90ac453b0b47 в %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\f58155b4b1d5a524ca0261c3ee99fb50_d99ef00b-ccd3-4f1d-9980-90ac453b0b47.live
  • %TEMP%\dd_vcredist_x86_20230912172350.log в %TEMP%\dd_vcredist_x86_20230912172350.log.live
  • %TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt в %TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt.live
  • %TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt в %TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt.live
  • %TEMP%\dd_vcredist_x86_20230912172322_002_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20230912172322_002_vcruntimeadditional_x86.log.live
  • %TEMP%\javadeployreg.log в %TEMP%\javadeployreg.log.live
  • %TEMP%\jusched.log в %TEMP%\jusched.log.live
  • %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt в %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt.live
  • %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt в %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt.live
  • %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt в %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt.live
  • %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt в %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt.live
  • %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt в %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt.live
  • %TEMP%\opera_crashreporter.log в %TEMP%\opera_crashreporter.log.live
  • %TEMP%\rgia609.tmp в %TEMP%\rgia609.tmp.live
  • %TEMP%\rgia609.tmp-tmp в %TEMP%\rgia609.tmp-tmp.live
  • %TEMP%\tmpaddon в %TEMP%\tmpaddon.live
  • %TEMP%\wmsetup.log в %TEMP%\wmsetup.log.live
  • %TEMP%\setupexe(202309121734336dc).log в %TEMP%\setupexe(202309121734336dc).log.live
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\store.json.mozlz4 в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\store.json.mozlz4.live
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.live
Изменяет следующие файлы
  • C:\kms\kms_vl_all_aio.cmd
  • C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml
  • C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml
  • C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml
  • C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.msi
  • C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlklr.cab
  • C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml
  • C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publr.cab
  • C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml
  • C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.msi
  • C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml
  • C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\pptlr.cab
  • C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
  • C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.msi
  • C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml
  • C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml
  • C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.msi
  • C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab
  • C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml
  • C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab
  • C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab
  • C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
  • C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.msi
  • C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
  • C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab
  • C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
  • C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.msi
  • C:\kms\kms_vl_all_aio_debug.log
  • C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordlr.cab
  • C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.msi
Изменяет множество файлов.
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Другое
Ищет следующие окна
  • ClassName: 'EDIT' WindowName: ''
  • ClassName: 'SystemTray_Main' WindowName: ''
  • ClassName: '' WindowName: ''
Создает и запускает на исполнение
  • '<Текущая директория>\systime.exe'
  • '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File "<Текущая директория>\wallpaper.ps1"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\t2qaj0rd.cmdline"' (со скрытым окном)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2A4B.tmp" "%TEMP%\CSC2A4A.tmp"' (со скрытым окном)
Запускает на исполнение
  • '<SYSTEM32>\cmd.exe' /c powershell -ExecutionPolicy Bypass -File "<Текущая директория>\wallpaper.ps1"
  • '<SYSTEM32>\net1.exe' stop "MSSQLFDLauncher" /y
  • '<SYSTEM32>\cmd.exe' /c cmd /c net stop "MSSQLSERVER" /y
  • '<SYSTEM32>\cmd.exe' /c net stop "MSSQLSERVER" /y
  • '<SYSTEM32>\net1.exe' stop "MSSQLSERVER" /y
  • '<SYSTEM32>\cmd.exe' /c cmd /c net stop "SQLSERVERAGENT" /y
  • '<SYSTEM32>\cmd.exe' /c net stop "SQLSERVERAGENT" /y
  • '<SYSTEM32>\net1.exe' stop "SQLSERVERAGENT" /y
  • '<SYSTEM32>\cmd.exe' /c cmd /c net stop "SQLBrowser" /y
  • '<SYSTEM32>\cmd.exe' /c net stop "SQLBrowser" /y
  • '<SYSTEM32>\net1.exe' stop "SQLBrowser" /y
  • '<SYSTEM32>\cmd.exe' /c cmd /c net stop "MSSQLFDLauncher" /y
  • '<SYSTEM32>\cmd.exe' /c net stop "MSSQLFDLauncher" /y
  • '<SYSTEM32>\cmd.exe' /c cmd /c net stop "SQLTELEMETRY" /y
  • '<SYSTEM32>\cmd.exe' /c cmd /c net stop "SQLWriter" /y
  • '<SYSTEM32>\cmd.exe' /c net stop "SQLWriter" /y
  • '<SYSTEM32>\net1.exe' stop "SQLWriter" /y
  • '<SYSTEM32>\cmd.exe' /c cmd /c net stop "MSSQL" /y
  • '<SYSTEM32>\cmd.exe' /c net stop "MSSQL" /y
  • '<SYSTEM32>\net1.exe' stop "MSSQL" /y
  • '<SYSTEM32>\cmd.exe' /c cmd /c net stop "SQLAgent" /y
  • '<SYSTEM32>\cmd.exe' /c net stop "SQLAgent" /y
  • '<SYSTEM32>\net1.exe' stop "SQLAgent" /y
  • '<SYSTEM32>\cmd.exe' /c cmd /c net stop "MSSQLServerOLAPService" /y
  • '<SYSTEM32>\cmd.exe' /c net stop "SQLTELEMETRY" /y
  • '<SYSTEM32>\net1.exe' stop "SQLTELEMETRY" /y
  • '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM postgres*"
  • '<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM postgres*"
  • '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM pg_ctl*"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2A4B.tmp" "%TEMP%\CSC2A4A.tmp"
  • '<SYSTEM32>\cmd.exe' /c cmd /c "bcdedit /set {current} recoveryenabled no"
  • '<SYSTEM32>\cmd.exe' /c "bcdedit /set {current} recoveryenabled no"
  • '<SYSTEM32>\cmd.exe' /c cmd /c "bcdedit /set {default} recoveryenabled no"
  • '<SYSTEM32>\cmd.exe' /c "bcdedit /set {default} recoveryenabled no"
  • '<SYSTEM32>\cmd.exe' /c cmd /c "bcdedit /set {current} bootstatuspolicy ignoreallfailures"
  • '<SYSTEM32>\cmd.exe' /c "bcdedit /set {current} bootstatuspolicy ignoreallfailures"
  • '<SYSTEM32>\bcdedit.exe' /set {current} bootstatuspolicy ignoreallfailures
  • '<SYSTEM32>\cmd.exe' /c cmd /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
  • '<SYSTEM32>\cmd.exe' /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
  • '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\t2qaj0rd.cmdline"
  • '<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM postgresql*"
  • '<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM sqlbrowser*"
  • '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM sqlbrowser*"
  • '<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM sqlwriter*"
  • '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM sqlwriter*"
  • '<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM sqlservr*"
  • '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM sqlservr*"
  • '<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM sqlceip*"
  • '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM sqlceip*"
  • '<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM SQLAGENT*"
  • '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM SQLAGENT*"
  • '<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM pg_ctl*"
  • '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM postgresql*"
  • '<SYSTEM32>\cmd.exe' /c net stop "MSSQLServerOLAPService" /y
  • '<SYSTEM32>\net1.exe' stop "MSSQLServerOLAPService" /y

Рекомендации по лечению

  1. В случае если операционная система способна загрузиться (в штатном режиме или режиме защиты от сбоев), скачайте лечащую утилиту Dr.Web CureIt! и выполните с ее помощью полную проверку вашего компьютера, а также используемых вами переносных носителей информации.
  2. Если загрузка операционной системы невозможна, измените настройки BIOS вашего компьютера, чтобы обеспечить возможность загрузки ПК с компакт-диска или USB-накопителя. Скачайте образ аварийного диска восстановления системы Dr.Web® LiveDisk или утилиту записи Dr.Web® LiveDisk на USB-накопитель, подготовьте соответствующий носитель. Загрузив компьютер с использованием данного носителя, выполните его полную проверку и лечение обнаруженных угроз.
Скачать Dr.Web

По серийному номеру

Выполните полную проверку системы с использованием Антивируса Dr.Web Light для macOS. Данный продукт можно загрузить с официального сайта Apple App Store.

На загруженной ОС выполните полную проверку всех дисковых разделов с использованием продукта Антивирус Dr.Web для Linux.

Скачать Dr.Web

По серийному номеру

  1. Если мобильное устройство функционирует в штатном режиме, загрузите и установите на него бесплатный антивирусный продукт Dr.Web для Android Light. Выполните полную проверку системы и используйте рекомендации по нейтрализации обнаруженных угроз.
  2. Если мобильное устройство заблокировано троянцем-вымогателем семейства Android.Locker (на экране отображается обвинение в нарушении закона, требование выплаты определенной денежной суммы или иное сообщение, мешающее нормальной работе с устройством), выполните следующие действия:
    • загрузите свой смартфон или планшет в безопасном режиме (в зависимости от версии операционной системы и особенностей конкретного мобильного устройства эта процедура может быть выполнена различными способами; обратитесь за уточнением к инструкции, поставляемой вместе с приобретенным аппаратом, или напрямую к его производителю);
    • после активации безопасного режима установите на зараженное устройство бесплатный антивирусный продукт Dr.Web для Android Light и произведите полную проверку системы, выполнив рекомендации по нейтрализации обнаруженных угроз;
    • выключите устройство и включите его в обычном режиме.

Подробнее о Dr.Web для Android

Демо бесплатно на 14 дней

Выдаётся при установке