Trojan.Encoder.37679

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\dtffkggw

Создает следующие файлы на съемном носителе

<Имя диска съемного носителя>:\how to restore your tcvjuo files.txt
<Имя диска съемного носителя>:\000814251_video_01.avi
<Имя диска съемного носителя>:\1189.jpg
<Имя диска съемного носителя>:\13.jpg
<Имя диска съемного носителя>:\3.jpg
<Имя диска съемного носителя>:\4f0bf7ff71f28.jpeg
<Имя диска съемного носителя>:\asaprojectcompetition.pptx
<Имя диска съемного носителя>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
<Имя диска съемного носителя>:\roozenedowebinar.pptx
<Имя диска съемного носителя>:\waterresourcesag.pptx
<Имя диска съемного носителя>:\gruenspecht_02172016.pptx

Вредоносные функции

Для затруднения выявления своего присутствия в системе

удаляет теневые копии разделов.

Запускает из анализируемого файла большое количество процессов.

Изменения в файловой системе

Создает следующие файлы

%WINDIR%\temp\sqaw.bat
%ProgramFiles%\mozilla thunderbird\features\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla thunderbird\defaults\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla thunderbird\defaults\pref\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla thunderbird\defaults\messenger\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla thunderbird\chrome\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla thunderbird\chrome\icons\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla thunderbird\visualelements\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla firefox\how to restore your tcvjuo files.txt
%ProgramFiles%\microsoft office\office16\onenote\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla firefox\uninstall\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla firefox\fonts\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla firefox\distibution\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla firefox\defaults\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla firefox\defaults\pref\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla firefox\browser\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla firefox\browser\features\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla firefox\browser\visualelements\how to restore your tcvjuo files.txt
%ProgramFiles%\microsoft office\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla firefox\gmp-clearkey\how to restore your tcvjuo files.txt
%ProgramFiles%\microsoft office\office16\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla thunderbird\fonts\how to restore your tcvjuo files.txt
%ProgramFiles%\windows media player\media renderer\how to restore your tcvjuo files.txt
%ProgramFiles%\windows security\browsercore\how to restore your tcvjuo files.txt
%ProgramFiles%\windows security\browsercore\en-us\how to restore your tcvjuo files.txt
%ProgramFiles%\windows photo viewer\how to restore your tcvjuo files.txt
%ProgramFiles%\windows photo viewer\en-us\how to restore your tcvjuo files.txt
%ProgramFiles%\windows multimedia platform\how to restore your tcvjuo files.txt
%ProgramFiles%\windows media player\how to restore your tcvjuo files.txt
%ProgramFiles%\windows media player\en-us\how to restore your tcvjuo files.txt
%ProgramFiles%\windows media player\visualizations\how to restore your tcvjuo files.txt
%ProgramFiles%\windows media player\skins\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla thunderbird\uninstall\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla thunderbird\isp\how to restore your tcvjuo files.txt
%ProgramFiles%\windows mail\how to restore your tcvjuo files.txt
%ProgramFiles%\windows defender.bak\how to restore your tcvjuo files.txt
%ProgramFiles%\windows defender.bak\en-us\how to restore your tcvjuo files.txt
%ProgramFiles%\windows defender.bak\offline\how to restore your tcvjuo files.txt
%ProgramFiles%\windows defender advanced threat protection\how to restore your tcvjuo files.txt
%ProgramFiles%\windows defender advanced threat protection\en-us\how to restore your tcvjuo files.txt
%ProgramFiles%\windows defender advanced threat protection\classification\how to restore your tcvjuo files.txt
%ProgramFiles%\winrar\how to restore your tcvjuo files.txt
%ProgramFiles%\mozilla thunderbird\how to restore your tcvjuo files.txt
%ProgramFiles%\windows media player\network sharing\how to restore your tcvjuo files.txt
%ProgramFiles%\microsoft office\office16\1033\how to restore your tcvjuo files.txt
%ProgramFiles%\java\how to restore your tcvjuo files.txt
%ProgramFiles%\java\jre1.8.0_77\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
D:\how to restore your tcvjuo files.txt
%WINDIR%\temp\sdzjzgliyxw.dll
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\how to restore your tcvjuo files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\how to restore your tcvjuo files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\applet\how to restore your tcvjuo files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\security\how to restore your tcvjuo files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\management\how to restore your tcvjuo files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\jfr\how to restore your tcvjuo files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\images\how to restore your tcvjuo files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\how to restore your tcvjuo files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\fonts\how to restore your tcvjuo files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\ext\how to restore your tcvjuo files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\how to restore your tcvjuo files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\cmm\how to restore your tcvjuo files.txt
%ProgramFiles%\java\jre1.8.0_77\lib\amd64\how to restore your tcvjuo files.txt
C:\msocache\all users\how to restore your tcvjuo files.txt
%ProgramFiles%\java\jre1.8.0_77\bin\how to restore your tcvjuo files.txt
%ProgramFiles%\java\jre1.8.0_77\bin\server\how to restore your tcvjuo files.txt
%ProgramFiles%\java\jre1.8.0_77\bin\plugin2\how to restore your tcvjuo files.txt
%ProgramFiles%\java\jre1.8.0_77\bin\dtplugin\how to restore your tcvjuo files.txt
%ProgramFiles%\internet explorer\how to restore your tcvjuo files.txt
%ProgramFiles%\internet explorer\images\how to restore your tcvjuo files.txt
%ProgramFiles%\internet explorer\en-us\how to restore your tcvjuo files.txt
%ProgramFiles%\internet explorer\signup\how to restore your tcvjuo files.txt
C:\msocache\how to restore your tcvjuo files.txt
%ProgramFiles%\windows security\how to restore your tcvjuo files.txt
nul

Перемещает следующие файлы

%ProgramFiles%\internet explorer\signup\install.ins в %ProgramFiles%\internet explorer\signup\install.ins.tcvjuo
%ProgramFiles%\microsoft office\office16\onenote\prnms006.inf в %ProgramFiles%\microsoft office\office16\onenote\prnms006.inf.tcvjuo
%ProgramFiles%\microsoft office\office16\onenote\sendtoonenote.gpd в %ProgramFiles%\microsoft office\office16\onenote\sendtoonenote.gpd.tcvjuo
%ProgramFiles%\mozilla firefox\browser\features\doh-rollout@mozilla.org.xpi в %ProgramFiles%\mozilla firefox\browser\features\doh-rollout@mozilla.org.xpi.tcvjuo
%ProgramFiles%\microsoft office\office16\onenote\sendtoonenotenames.gpd в %ProgramFiles%\microsoft office\office16\onenote\sendtoonenotenames.gpd.tcvjuo
%ProgramFiles%\mozilla firefox\browser\features\formautofill@mozilla.org.xpi в %ProgramFiles%\mozilla firefox\browser\features\formautofill@mozilla.org.xpi.tcvjuo
%ProgramFiles%\mozilla firefox\browser\features\pictureinpicture@mozilla.org.xpi в %ProgramFiles%\mozilla firefox\browser\features\pictureinpicture@mozilla.org.xpi.tcvjuo
%ProgramFiles%\mozilla firefox\browser\features\screenshots@mozilla.org.xpi в %ProgramFiles%\mozilla firefox\browser\features\screenshots@mozilla.org.xpi.tcvjuo
%ProgramFiles%\mozilla firefox\install.log в %ProgramFiles%\mozilla firefox\install.log.tcvjuo
%ProgramFiles%\mozilla firefox\accessible.tlb в %ProgramFiles%\mozilla firefox\accessible.tlb.tcvjuo
%ProgramFiles%\microsoft office\office16\visiocustom.propdesc в %ProgramFiles%\microsoft office\office16\visiocustom.propdesc.tcvjuo
%ProgramFiles%\mozilla firefox\dependentlibs.list в %ProgramFiles%\mozilla firefox\dependentlibs.list.tcvjuo
%ProgramFiles%\mozilla firefox\distibution\policies.json в %ProgramFiles%\mozilla firefox\distibution\policies.json.tcvjuo
%ProgramFiles%\mozilla firefox\firefox.exe.sig в %ProgramFiles%\mozilla firefox\firefox.exe.sig.tcvjuo
%ProgramFiles%\mozilla firefox\fonts\twemojimozilla.ttf в %ProgramFiles%\mozilla firefox\fonts\twemojimozilla.ttf.tcvjuo
%ProgramFiles%\mozilla firefox\defaults\pref\channel-prefs.js в %ProgramFiles%\mozilla firefox\defaults\pref\channel-prefs.js.tcvjuo
%ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\clearkey.dll.sig в %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\clearkey.dll.sig.tcvjuo
%ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\manifest.json в %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\manifest.json.tcvjuo
%ProgramFiles%\mozilla firefox\browser\features\webcompat-reporter@mozilla.org.xpi в %ProgramFiles%\mozilla firefox\browser\features\webcompat-reporter@mozilla.org.xpi.tcvjuo
%ProgramFiles%\mozilla firefox\browser\omni.ja в %ProgramFiles%\mozilla firefox\browser\omni.ja.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\psfont.properties.ja в %ProgramFiles%\java\jre1.8.0_77\lib\psfont.properties.ja.tcvjuo
%ProgramFiles%\mozilla firefox\browser\features\webcompat@mozilla.org.xpi в %ProgramFiles%\mozilla firefox\browser\features\webcompat@mozilla.org.xpi.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\security\javaws.policy в %ProgramFiles%\java\jre1.8.0_77\lib\security\javaws.policy.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\resources.jar в %ProgramFiles%\java\jre1.8.0_77\lib\resources.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\rt.jar в %ProgramFiles%\java\jre1.8.0_77\lib\rt.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\security\us_export_policy.jar в %ProgramFiles%\java\jre1.8.0_77\lib\security\us_export_policy.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\security\blacklist в %ProgramFiles%\java\jre1.8.0_77\lib\security\blacklist.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\security\blacklisted.certs в %ProgramFiles%\java\jre1.8.0_77\lib\security\blacklisted.certs.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\security\cacerts в %ProgramFiles%\java\jre1.8.0_77\lib\security\cacerts.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\security\java.policy в %ProgramFiles%\java\jre1.8.0_77\lib\security\java.policy.tcvjuo
%ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote.cat в %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote.cat.tcvjuo
%ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote_win7.inf в %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote_win7.inf.tcvjuo
%ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote_win7.cat в %ProgramFiles%\microsoft office\office16\onenote\prnsendtoonenote_win7.cat.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\sound.properties в %ProgramFiles%\java\jre1.8.0_77\lib\sound.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\tzmappings в %ProgramFiles%\java\jre1.8.0_77\lib\tzmappings.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\release в %ProgramFiles%\java\jre1.8.0_77\release.tcvjuo
%ProgramFiles%\microsoft office\office16\1033\mso example intl setup file b.txt в %ProgramFiles%\microsoft office\office16\1033\mso example intl setup file b.txt.tcvjuo
%ProgramFiles%\microsoft office\office16\1033\mso example intl setup file a.txt в %ProgramFiles%\microsoft office\office16\1033\mso example intl setup file a.txt.tcvjuo
%ProgramFiles%\microsoft office\office16\custom.propdesc в %ProgramFiles%\microsoft office\office16\custom.propdesc.tcvjuo
%ProgramFiles%\microsoft office\office16\mso example setup file a.txt в %ProgramFiles%\microsoft office\office16\mso example setup file a.txt.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\security\java.security в %ProgramFiles%\java\jre1.8.0_77\lib\security\java.security.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\security\local_policy.jar в %ProgramFiles%\java\jre1.8.0_77\lib\security\local_policy.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\psfontj2d.properties в %ProgramFiles%\java\jre1.8.0_77\lib\psfontj2d.properties.tcvjuo
%ProgramFiles%\mozilla firefox\installation_telemetry.json в %ProgramFiles%\mozilla firefox\installation_telemetry.json.tcvjuo
%ProgramFiles%\mozilla firefox\removed-files в %ProgramFiles%\mozilla firefox\removed-files.tcvjuo
%ProgramFiles%\mozilla thunderbird\omni.ja в %ProgramFiles%\mozilla thunderbird\omni.ja.tcvjuo
%ProgramFiles%\mozilla thunderbird\precomplete в %ProgramFiles%\mozilla thunderbird\precomplete.tcvjuo
%ProgramFiles%\mozilla thunderbird\removed-files в %ProgramFiles%\mozilla thunderbird\removed-files.tcvjuo
%ProgramFiles%\mozilla thunderbird\uninstall\uninstall.log в %ProgramFiles%\mozilla thunderbird\uninstall\uninstall.log.tcvjuo
%ProgramFiles%\winrar\default.sfx в %ProgramFiles%\winrar\default.sfx.tcvjuo
%ProgramFiles%\winrar\default64.sfx в %ProgramFiles%\winrar\default64.sfx.tcvjuo
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-task-summary-dialog.ico в %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-task-summary-dialog.ico.tcvjuo
%ProgramFiles%\mozilla thunderbird\isp\spamassassin.sfd в %ProgramFiles%\mozilla thunderbird\isp\spamassassin.sfd.tcvjuo
%ProgramFiles%\mozilla thunderbird\isp\spampal.sfd в %ProgramFiles%\mozilla thunderbird\isp\spampal.sfd.tcvjuo
%ProgramFiles%\winrar\descript.ion в %ProgramFiles%\winrar\descript.ion.tcvjuo
%ProgramFiles%\winrar\rarfiles.lst в %ProgramFiles%\winrar\rarfiles.lst.tcvjuo
%ProgramFiles%\winrar\readme.txt в %ProgramFiles%\winrar\readme.txt.tcvjuo
%ProgramFiles%\winrar\uninstall.lst в %ProgramFiles%\winrar\uninstall.lst.tcvjuo
%ProgramFiles%\winrar\whatsnew.txt в %ProgramFiles%\winrar\whatsnew.txt.tcvjuo
%ProgramFiles%\winrar\wincon.sfx в %ProgramFiles%\winrar\wincon.sfx.tcvjuo
%ProgramFiles%\winrar\wincon64.sfx в %ProgramFiles%\winrar\wincon64.sfx.tcvjuo
%ProgramFiles%\winrar\winrar.chm в %ProgramFiles%\winrar\winrar.chm.tcvjuo
%ProgramFiles%\winrar\license.txt в %ProgramFiles%\winrar\license.txt.tcvjuo
%ProgramFiles%\winrar\rar.txt в %ProgramFiles%\winrar\rar.txt.tcvjuo
%ProgramFiles%\mozilla firefox\plugin-container.exe.sig в %ProgramFiles%\mozilla firefox\plugin-container.exe.sig.tcvjuo
%ProgramFiles%\mozilla firefox\omni.ja в %ProgramFiles%\mozilla firefox\omni.ja.tcvjuo
%ProgramFiles%\mozilla thunderbird\isp\bogofilter.sfd в %ProgramFiles%\mozilla thunderbird\isp\bogofilter.sfd.tcvjuo
%ProgramFiles%\mozilla firefox\uninstall\uninstall.log в %ProgramFiles%\mozilla firefox\uninstall\uninstall.log.tcvjuo
%ProgramFiles%\mozilla firefox\xul.dll.sig в %ProgramFiles%\mozilla firefox\xul.dll.sig.tcvjuo
%ProgramFiles%\mozilla thunderbird\accessible.tlb в %ProgramFiles%\mozilla thunderbird\accessible.tlb.tcvjuo
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\abcardwindow.ico в %ProgramFiles%\mozilla thunderbird\chrome\icons\default\abcardwindow.ico.tcvjuo
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\addressbookwindow.ico в %ProgramFiles%\mozilla thunderbird\chrome\icons\default\addressbookwindow.ico.tcvjuo
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-alarm-dialog.ico в %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-alarm-dialog.ico.tcvjuo
%ProgramFiles%\mozilla thunderbird\isp\popfile.sfd в %ProgramFiles%\mozilla thunderbird\isp\popfile.sfd.tcvjuo
%ProgramFiles%\mozilla firefox\precomplete в %ProgramFiles%\mozilla firefox\precomplete.tcvjuo
%ProgramFiles%\mozilla thunderbird\isp\dspam.sfd в %ProgramFiles%\mozilla thunderbird\isp\dspam.sfd.tcvjuo
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-event-dialog.ico в %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-event-dialog.ico.tcvjuo
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\msgcomposewindow.ico в %ProgramFiles%\mozilla thunderbird\chrome\icons\default\msgcomposewindow.ico.tcvjuo
%ProgramFiles%\mozilla thunderbird\defaults\pref\channel-prefs.js в %ProgramFiles%\mozilla thunderbird\defaults\pref\channel-prefs.js.tcvjuo
%ProgramFiles%\mozilla thunderbird\dependentlibs.list в %ProgramFiles%\mozilla thunderbird\dependentlibs.list.tcvjuo
%ProgramFiles%\mozilla thunderbird\features\wetransfer@extensions.thunderbird.net.xpi в %ProgramFiles%\mozilla thunderbird\features\wetransfer@extensions.thunderbird.net.xpi.tcvjuo
%ProgramFiles%\mozilla thunderbird\fonts\twemojimozilla.ttf в %ProgramFiles%\mozilla thunderbird\fonts\twemojimozilla.ttf.tcvjuo
%ProgramFiles%\mozilla thunderbird\install.log в %ProgramFiles%\mozilla thunderbird\install.log.tcvjuo
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-event-summary-dialog.ico в %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-event-summary-dialog.ico.tcvjuo
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-task-dialog.ico в %ProgramFiles%\mozilla thunderbird\chrome\icons\default\calendar-task-dialog.ico.tcvjuo
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\messengerwindow.ico в %ProgramFiles%\mozilla thunderbird\chrome\icons\default\messengerwindow.ico.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\plugin.jar в %ProgramFiles%\java\jre1.8.0_77\lib\plugin.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\net.properties в %ProgramFiles%\java\jre1.8.0_77\lib\net.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\meta-index в %ProgramFiles%\java\jre1.8.0_77\lib\meta-index.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_it.properties в %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_it.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_fr.properties в %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_fr.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_ja.properties в %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_ja.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_ko.properties в %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_ko.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_pt_br.properties в %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_pt_br.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_sv.properties в %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_sv.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_cn.properties в %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_cn.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_de.properties в %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_de.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\ext\jaccess.jar в %ProgramFiles%\java\jre1.8.0_77\lib\ext\jaccess.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages.properties в %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash@2x.gif в %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash@2x.gif.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash_11-lic.gif в %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash_11-lic.gif.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash_11@2x-lic.gif в %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash_11@2x-lic.gif.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\deploy.jar в %ProgramFiles%\java\jre1.8.0_77\lib\deploy.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\ext\access-bridge-64.jar в %ProgramFiles%\java\jre1.8.0_77\lib\ext\access-bridge-64.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\ext\cldrdata.jar в %ProgramFiles%\java\jre1.8.0_77\lib\ext\cldrdata.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\ext\dnsns.jar в %ProgramFiles%\java\jre1.8.0_77\lib\ext\dnsns.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_tw.properties в %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_tw.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_hk.properties в %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_zh_hk.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash.gif в %ProgramFiles%\java\jre1.8.0_77\lib\deploy\splash.gif.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\content-types.properties в %ProgramFiles%\java\jre1.8.0_77\lib\content-types.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\calendars.properties в %ProgramFiles%\java\jre1.8.0_77\lib\calendars.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\license в %ProgramFiles%\java\jre1.8.0_77\license.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\readme.txt в %ProgramFiles%\java\jre1.8.0_77\readme.txt.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme-javafx.txt в %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme-javafx.txt.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme.txt в %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme.txt.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\bin\javacpl.cpl в %ProgramFiles%\java\jre1.8.0_77\bin\javacpl.cpl.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\bin\server\xusage.txt в %ProgramFiles%\java\jre1.8.0_77\bin\server\xusage.txt.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\bin\server\classes.jsa в %ProgramFiles%\java\jre1.8.0_77\bin\server\classes.jsa.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\currency.data в %ProgramFiles%\java\jre1.8.0_77\lib\currency.data.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\ext\jfxrt.jar в %ProgramFiles%\java\jre1.8.0_77\lib\ext\jfxrt.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\copyright в %ProgramFiles%\java\jre1.8.0_77\copyright.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\classlist в %ProgramFiles%\java\jre1.8.0_77\lib\classlist.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\charsets.jar в %ProgramFiles%\java\jre1.8.0_77\lib\charsets.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\cmm\ciexyz.pf в %ProgramFiles%\java\jre1.8.0_77\lib\cmm\ciexyz.pf.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\cmm\gray.pf в %ProgramFiles%\java\jre1.8.0_77\lib\cmm\gray.pf.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\cmm\linear_rgb.pf в %ProgramFiles%\java\jre1.8.0_77\lib\cmm\linear_rgb.pf.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\cmm\pycc.pf в %ProgramFiles%\java\jre1.8.0_77\lib\cmm\pycc.pf.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\cmm\srgb.pf в %ProgramFiles%\java\jre1.8.0_77\lib\cmm\srgb.pf.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\amd64\jvm.cfg в %ProgramFiles%\java\jre1.8.0_77\lib\amd64\jvm.cfg.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\accessibility.properties в %ProgramFiles%\java\jre1.8.0_77\lib\accessibility.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_es.properties в %ProgramFiles%\java\jre1.8.0_77\lib\deploy\messages_es.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\ext\localedata.jar в %ProgramFiles%\java\jre1.8.0_77\lib\ext\localedata.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_linknodrop32x32.gif в %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_linknodrop32x32.gif.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_movenodrop32x32.gif в %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_movenodrop32x32.gif.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\javafx.properties в %ProgramFiles%\java\jre1.8.0_77\lib\javafx.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\javaws.jar в %ProgramFiles%\java\jre1.8.0_77\lib\javaws.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\jce.jar в %ProgramFiles%\java\jre1.8.0_77\lib\jce.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\jfr\default.jfc в %ProgramFiles%\java\jre1.8.0_77\lib\jfr\default.jfc.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\jfr\profile.jfc в %ProgramFiles%\java\jre1.8.0_77\lib\jfr\profile.jfc.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_linkdrop32x32.gif в %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_linkdrop32x32.gif.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_copydrop32x32.gif в %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_copydrop32x32.gif.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_movedrop32x32.gif в %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_movedrop32x32.gif.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\jfr.jar в %ProgramFiles%\java\jre1.8.0_77\lib\jfr.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\logging.properties в %ProgramFiles%\java\jre1.8.0_77\lib\logging.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\management\jmxremote.access в %ProgramFiles%\java\jre1.8.0_77\lib\management\jmxremote.access.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\management\jmxremote.password.template в %ProgramFiles%\java\jre1.8.0_77\lib\management\jmxremote.password.template.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\management\management.properties в %ProgramFiles%\java\jre1.8.0_77\lib\management\management.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\management\snmp.acl.template в %ProgramFiles%\java\jre1.8.0_77\lib\management\snmp.acl.template.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\management-agent.jar в %ProgramFiles%\java\jre1.8.0_77\lib\management-agent.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\jfxswt.jar в %ProgramFiles%\java\jre1.8.0_77\lib\jfxswt.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\jsse.jar в %ProgramFiles%\java\jre1.8.0_77\lib\jsse.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\jvm.hprof.txt в %ProgramFiles%\java\jre1.8.0_77\lib\jvm.hprof.txt.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_copynodrop32x32.gif в %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\win32_copynodrop32x32.gif.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\invalid32x32.gif в %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\invalid32x32.gif.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\ext\meta-index в %ProgramFiles%\java\jre1.8.0_77\lib\ext\meta-index.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\ext\sunec.jar в %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunec.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\ext\sunjce_provider.jar в %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunjce_provider.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\ext\sunmscapi.jar в %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunmscapi.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\ext\sunpkcs11.jar в %ProgramFiles%\java\jre1.8.0_77\lib\ext\sunpkcs11.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\ext\zipfs.jar в %ProgramFiles%\java\jre1.8.0_77\lib\ext\zipfs.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\flavormap.properties в %ProgramFiles%\java\jre1.8.0_77\lib\flavormap.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\fontconfig.bfc в %ProgramFiles%\java\jre1.8.0_77\lib\fontconfig.bfc.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\fontconfig.properties.src в %ProgramFiles%\java\jre1.8.0_77\lib\fontconfig.properties.src.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\ext\nashorn.jar в %ProgramFiles%\java\jre1.8.0_77\lib\ext\nashorn.jar.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightdemibold.ttf в %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightdemibold.ttf.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightitalic.ttf в %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightitalic.ttf.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightregular.ttf в %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightregular.ttf.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidasansdemibold.ttf в %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidasansdemibold.ttf.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidasansregular.ttf в %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidasansregular.ttf.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidatypewriterbold.ttf в %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidatypewriterbold.ttf.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidatypewriterregular.ttf в %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidatypewriterregular.ttf.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\hijrah-config-umalqura.properties в %ProgramFiles%\java\jre1.8.0_77\lib\hijrah-config-umalqura.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\cursors.properties в %ProgramFiles%\java\jre1.8.0_77\lib\images\cursors\cursors.properties.tcvjuo
%ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightdemiitalic.ttf в %ProgramFiles%\java\jre1.8.0_77\lib\fonts\lucidabrightdemiitalic.ttf.tcvjuo
%ProgramFiles%\winrar\zip.sfx в %ProgramFiles%\winrar\zip.sfx.tcvjuo
%ProgramFiles%\winrar\zip64.sfx в %ProgramFiles%\winrar\zip64.sfx.tcvjuo

Изменяет следующие файлы

<Имя диска съемного носителя>:\000814251_video_01.avi.tcvjuo
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\pptlr.cab.tcvjuo
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.cab.tcvjuo
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publishermui.msi.tcvjuo
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.msi.tcvjuo
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.msi.tcvjuo
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.msi.tcvjuo
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.msi.tcvjuo
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordlr.cab.tcvjuo
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.cab.tcvjuo
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excellr.cab.tcvjuo
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.msi.tcvjuo
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordmui.msi.tcvjuo
<Имя диска съемного носителя>:\roozenedowebinar.pptx.tcvjuo
<Имя диска съемного носителя>:\waterresourcesag.pptx.tcvjuo
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.msi.tcvjuo
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlklr.cab.tcvjuo
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\owow64ww.cab.tcvjuo
<Имя диска съемного носителя>:\gruenspecht_02172016.pptx.tcvjuo
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms.tcvjuo
<Имя диска съемного носителя>:\asaprojectcompetition.pptx.tcvjuo
D:\install.log.tcvjuo
<Имя диска съемного носителя>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx.tcvjuo
<Имя диска съемного носителя>:\1189.jpg.tcvjuo
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onotelr.cab.tcvjuo
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proofing.msi.tcvjuo

Изменяет множество файлов.

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Другое

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c "%WINDIR%\temp\sqaw.bat"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-AppV-Client/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-AppV-Client/Admin"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-AppV-Client-Streamingux/Debug"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationSrcPrefetch"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationPlatform"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationPipeline"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-AppV-Client/Virtual Applications"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-AppV-Client/Operational"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationMediaEngine"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationMP4"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationDeviceProxy"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationDS"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationContentProtection"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationAsyncWrapper"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationPerformanceCore"
'<SYSTEM32>\wevtutil.exe' CL "DirectShowPluginControl"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-AppV-SharedPerformance/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-App Agent/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-App Agent/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-App Agent/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-Agent Driver/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-Agent Driver/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-Admin/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-RMS-MSIPC/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-PerfTrack-MSHTML/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-PerfTrack-IEFRAME/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-OneCore-Setup/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-JSDumpHeap/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-IEFRAME/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-IE/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Client-Licensing-Platform/Diagnostic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Client-Licensing-Platform/Debug"
'<SYSTEM32>\wevtutil.exe' CL "MedaFoundationVideoProcD3D"
'<SYSTEM32>\wevtutil.exe' CL "MediaFoundationPerformance"
'<SYSTEM32>\wevtutil.exe' CL "MedaFoundationVideoProc"
'<SYSTEM32>\wevtutil.exe' CL "MF_MediaFoundationFrameServer"
'<SYSTEM32>\wevtutil.exe' CL "MF_MediaFoundationDeviceProxy"
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=F: /on=F: /maxsize=unbounded
'<SYSTEM32>\wevtutil.exe' CL "Analytic"
'<SYSTEM32>\wevtutil.exe' CL "AirSpaceChannel"
'<SYSTEM32>\wevtutil.exe' CL "AMSI/Debug"
'<SYSTEM32>\wevtutil.exe' EL
'<SYSTEM32>\cmd.exe' /c WEVTUTIL EL
'<SYSTEM32>\sc.exe' stop VSS
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=F: /on=F: /maxsize=401MB
'<SYSTEM32>\wevtutil.exe' CL "DebugChannel"
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=D: /on=D: /maxsize=unbounded
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=D: /on=D: /maxsize=401MB
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=C: /on=C: /maxsize=unbounded
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=C: /on=C: /maxsize=401MB
'<SYSTEM32>\timeout.exe' /T 5
'<SYSTEM32>\sc.exe' start vss
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-IPC/Operational"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-Client-Licensing-Platform/Admin"
'<SYSTEM32>\wevtutil.exe' CL "DirectShowFilterGraph"
'<SYSTEM32>\wevtutil.exe' CL "EndpointMapper"
'<SYSTEM32>\wevtutil.exe' CL "Application"
'<SYSTEM32>\wevtutil.exe' CL "MF_MediaFoundationDeviceMFT"
'<SYSTEM32>\wevtutil.exe' CL "Key Management Service"
'<SYSTEM32>\wevtutil.exe' CL "Internet Explorer"
'<SYSTEM32>\wevtutil.exe' CL "Intel-iaLPSS2-I2C/Performance"
'<SYSTEM32>\wevtutil.exe' CL "Intel-iaLPSS2-I2C/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Intel-iaLPSS2-GPIO2/Performance"
'<SYSTEM32>\wevtutil.exe' CL "Intel-iaLPSS2-GPIO2/Debug"
'<SYSTEM32>\wevtutil.exe' CL "Intel-iaLPSS-I2C/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Intel-iaLPSS-GPIO/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "IHM_DebugChannel"
'<SYSTEM32>\wevtutil.exe' CL "HardwareEvents"
'<SYSTEM32>\wevtutil.exe' CL "General Logging"
'<SYSTEM32>\wevtutil.exe' CL "ForwardedEvents"
'<SYSTEM32>\wevtutil.exe' CL "FirstUXPerf-Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Els_Hyphenation/Analytic"
'<SYSTEM32>\wevtutil.exe' CL "Microsoft-User Experience Virtualization-SQM Uploader/Analytic"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней