begin
QuarantineFile('C:\Program Files (x86)\wHemEQQzU\NWgByX.dll', '');
QuarantineFile('C:\Users\KO\AppData\Local\Programs\3729cb\9b5eb96eeb.msi', '');
DeleteFile('C:\Program Files (x86)\NinjaBrowser\NinjaBrowser\Application\137.0.6613.124\elevation_service.exe', '64');
DeleteFile('C:\Program Files (x86)\NinjaBrowser\NinjaBrowser\Application\137.0.6613.124\eventlog_provider.dll', '64');
DeleteFile('C:\Program Files (x86)\NinjaBrowser\NinjaBrowser\Application\NinjaBrowser.exe', '64');
DeleteFile('C:\Users\KO\AppData\Local\Programs\3729cb\9b5eb96eeb.msi', '64');
DeleteFile('C:\Program Files (x86)\WyyHRJJOUCclC\vfOYlWb.dll', '64');
DeleteFile('C:\Program Files (x86)\rHPotDbdxQEU2\SNXWvguBYygXI.dll', '64');
DeleteFile('C:\Program Files (x86)\wHemEQQzU\NWgByX.dll', '64');
DeleteFile('C:\ProgramData\pierce-sail\bin.exe', '64');
DeleteFile('C:\Program Files (x86)\usdULSFCtWzOBasFesR\iOvWVlZ.dll', '64');
DeleteService('ChromiumElevationService');
DeleteSchedulerTask('chat-saver-S-1-5-21-2663235146-1921599251-30963202-1001');
DeleteSchedulerTask('EdgeUpdate');
DeleteSchedulerTask('FQNzQgsDZdglobCyiTm2');
DeleteSchedulerTask('kIcTmBftZcXrpb');
DeleteSchedulerTask('MAnrEVOPXhcbgmY2');
DeleteSchedulerTask('secure-waistcoat');
DeleteSchedulerTask('tmTytgrOditDEYEwM2');
DeleteSchedulerTask('WzxCjfYPoGKxm2');
ExecuteSysClean;
ExecuteWizard('TSW', 2, 3, true);
RebootWindows(true);
end.begin
CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
end.R0 - HKCU\Software\Microsoft\Internet Explorer\Main: [Start Page] = hxxps://vvv.ya.ru/?win=650&clid=2323969-673
O4 - HKCU\..\Run: [AMDNoiseSuppression] = C:\Windows\system32\AMD\ANR\AMDNoiseSuppression.exe (file missing)
O4 - HKLM\..\Session Manager: [BootExecute] = (no file)
O4 - HKU\S-1-5-18\..\Run: [AMDNoiseSuppression] = C:\Windows\system32\AMD\ANR\AMDNoiseSuppression.exe (file missing) (User 'LocalSystem')
O6 - IE Policy: HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions - present
O6 - IE Policy: HKU\S-1-5-19\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions - present
O6 - IE Policy: HKU\S-1-5-20\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions - present
O7 - Policy: HKLM\Software\Microsoft\Windows Defender\Features: [TamperProtection] = (missing)
O18 - HKLM\Software\Classes\Protocols\Filter\application/octet-stream: [CLSID] = {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - (no file)
O18 - HKLM\Software\Classes\Protocols\Filter\application/x-complus: [CLSID] = {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - (no file)
O18 - HKLM\Software\Classes\Protocols\Filter\application/x-msdownload: [CLSID] = {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - (no file)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D595DA6-BC59-47AE-A527-EC01FCE2E615} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D595DA6-BC59-47AE-A527-EC01FCE2E615} - \Microsoft\Windows\Speech\SpeechModelDownloadTask (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7A7B60AA-BA42-409F-BC97-7BCFEFAD6308} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7A7B60AA-BA42-409F-BC97-7BCFEFAD6308} - \Microsoft\Windows\LanguageComponentsInstaller\Installation (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{80436C26-BC19-4930-9051-F06F0E0BA960} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{80436C26-BC19-4930-9051-F06F0E0BA960} - \Microsoft\Windows\Management\Provisioning\Logon (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A499FA48-7057-4AC1-9702-44C6FD924058} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A499FA48-7057-4AC1-9702-44C6FD924058} - \Microsoft\Windows\LanguageComponentsInstaller\ReconcileLanguageResources (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B97C7632-DD50-4F07-8E4E-F1450795BF78} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B97C7632-DD50-4F07-8E4E-F1450795BF78} - \Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C3944556-15CF-467E-89E2-29D4BFD3EC5A} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C3944556-15CF-467E-89E2-29D4BFD3EC5A} - \Microsoft\Windows\Diagnosis\Scheduled (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CD0446AF-D5F6-4616-85CE-058C20FCE9EC} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CD0446AF-D5F6-4616-85CE-058C20FCE9EC} - \Microsoft\Windows\Shell\FamilySafetyRefreshTask (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DFDC1B83-7FD3-4C77-8CD1-7391D1680ACA} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DFDC1B83-7FD3-4C77-8CD1-7391D1680ACA} - \Microsoft\Windows\Shell\FamilySafetyMonitor (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E38739C8-A84F-4F9B-8913-DCA75BC35C79} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E38739C8-A84F-4F9B-8913-DCA75BC35C79} - \Microsoft\Windows\Management\Provisioning\Cellular (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F472261A-A57A-465B-A695-5F2E75E37782} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F472261A-A57A-465B-A695-5F2E75E37782} - \Microsoft\Windows\ApplicationData\DsSvcCleanup (no xml)
O22 - Tasks: (damaged) EdgeUpdate - C:\Windows\system32\cmd.exe /c auditpol /set /category:"Система" /success:enable && auditpol /set /category:"Подробное отслеживание" /subcategory:"Создание процесса" /success:enable (user missing) (sign: 'Microsoft')
O22 - Tasks: (damaged) secure-waistcoat - C:\ProgramData\pierce-sail\bin.exe /H (file missing) (user missing)
O22 - Tasks: (damaged) StartAUEP - C:\Program Files\AMD\Performance Profile Client\AUEPMaster.exe (user missing) (sign: 'Advanced Micro Devices')
O22 - Tasks: chat-saver-S-1-5-21-2663235146-1921599251-30963202-1001 - C:\Windows\System32\msiexec.exe /i "C:\Users\KO\AppData\Local\Programs\3729cb\9b5eb96eeb.msi" /quiet YIPRWHU=1 (sign: 'Microsoft')
O22 - Tasks: EdgeUpdate - C:\Windows\system32\cmd.exe /c auditpol /set /category:"Система" /success:enable && auditpol /set /category:"Подробное отслеживание" /subcategory:"Создание процесса" /success:enable (sign: 'Microsoft')
O22 - Tasks: FQNzQgsDZdglobCyiTm2 - C:\Windows\system32\cmd.exe /C if exist "C:\Program Files (x86)\WyyHRJJOUCclC\vfOYlWb.dll" rundll32 "C:\Program Files (x86)\WyyHRJJOUCclC\vfOYlWb.dll",#1 (sign: 'Microsoft')
O22 - Tasks: kIcTmBftZcXrpb - C:\Windows\system32\cmd.exe /C if exist "C:\Program Files (x86)\rHPotDbdxQEU2\SNXWvguBYygXI.dll" rundll32 "C:\Program Files (x86)\rHPotDbdxQEU2\SNXWvguBYygXI.dll",#1 (sign: 'Microsoft')
O22 - Tasks: MAnrEVOPXhcbgmY2 - C:\Windows\system32\cmd.exe /C if exist "C:\Program Files (x86)\wHemEQQzU\NWgByX.dll" rundll32 "C:\Program Files (x86)\wHemEQQzU\NWgByX.dll",#1 (sign: 'Microsoft')
O22 - Tasks: secure-waistcoat - C:\ProgramData\pierce-sail\bin.exe /H (file missing)
O22 - Tasks: tmTytgrOditDEYEwM2 - C:\Windows\system32\cmd.exe /C if exist "C:\Program Files (x86)\usdULSFCtWzOBasFesR\iOvWVlZ.dll" rundll32 "C:\Program Files (x86)\usdULSFCtWzOBasFesR\iOvWVlZ.dll",#1 (sign: 'Microsoft')
O22 - Tasks: WzxCjfYPoGKxm2 - C:\Windows\system32\forfiles.exe /p C:\Windows\system32 /m wscript.exe /c "cmd /C if exist ^"C:\ProgramData\aikZcKHWDyyBLoVB\RWGmBQi.wsf^" @FNAME ^"C:\ProgramData\aikZcKHWDyyBLoVB\RWGmBQi.wsf^"" (sign: 'Microsoft')
O23 - Service S3: Chromium Elevation Service (ChromiumElevationService) - (ChromiumElevationService) - C:\Program Files (x86)\NinjaBrowser\NinjaBrowser\Application\137.0.6613.124\elevation_service.exe (file missing)
O23 - Service S3: FACEITService - C:\Program Files\FACEIT AC\faceitservice.exe (file missing)
O23 - Service S3: OpenSSH SSH Server - (sshd) - C:\Windows\System32\OpenSSH\sshd.exe (file missing)
O23 - Driver S1: FACEIT - C:\Program Files\FACEIT AC\FACEIT_AC.sys (file missing)
O27 - Account: (Missing) HKLM\..\ProfileList\S-1-5-21-2663235146-1921599251-30963202-1004 [ProfileImagePath] = C:\Users\DevToolsUser (folder missing)Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
Unlock: C:\FRST\
RemoveProxy:
HKLM\...\Policies\Explorer: [SettingsPageVisibility] hide:windowsdefender
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ограничение <==== ВНИМАНИЕ
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Ограничение <==== ВНИМАНИЕ
HKLM\SOFTWARE\Policies\Microsoft\MRT: Ограничение <==== ВНИМАНИЕ
HKLM\Software\Policies\...\system: [EnableSmartScreen] 0
HKU\S-1-5-21-2663235146-1921599251-30963202-1001\...\Run: [FACEIT] => "C:\Users\KO\AppData\Local\FACEIT\update.exe" --processStart "FACEIT.exe" (Нет файла)
HKU\S-1-5-21-2663235146-1921599251-30963202-1001\...\Run: [YandexBrowserAutoLaunch_1887E07EA7F5B502D58C7131719731B7] => "C:\Users\KO\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --shutdown-if-not-closed-by-system-restart (Нет файла)
GroupPolicy: Ограничение - Edge <==== ВНИМАНИЕ
Policies: C:\ProgramData\NTUSER.pol: Ограничение <==== ВНИМАНИЕ
HKLM\SOFTWARE\Policies\Microsoft\Edge: Ограничение <==== ВНИМАНИЕ
Task: {8AA87F4E-0CFB-465B-8FF9-F74C8F2D44BE} - System32\Tasks\AMDInstallUEP => C:\Program Files\AMD\InstallUEP\AMDInstallUEP.exe (Нет файла)
Edge HomePage: Default -> hxxps://find-it.pro/?utm_source=distr_m
Edge DefaultSearchURL: Default -> hxxps://xfinder.pro/q?q={searchTerms}
Edge DefaultSearchKeyword: Default -> xfinder.pro
Edge DefaultSuggestURL: Default -> hxxps://xfinder.pro/q/suggest.php?q={searchTerms}
C:\Users\KO\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ggnchfknjkebijkdlbddehcpgfebapdc
C:\Users\KO\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\hbiichfklkmlebacdfhkojcpmmakmamk
C:\Users\KO\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem
CHR HKU\S-1-5-21-2663235146-1921599251-30963202-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [gbccnnpigcfcheaeicpldgmjjojjmldb]
CHR HKU\S-1-5-21-2663235146-1921599251-30963202-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pchfckkccldkbclgdepkaonamkignanh]
S4 ssh-agent; %SystemRoot%\System32\OpenSSH\ssh-agent.exe [X]
U4 HomeGroupListener; отсутствует ImagePath
U4 HomeGroupProvider; отсутствует ImagePath
2025-09-13 01:47 - 2025-09-13 01:48 - 000000000 ___DC C:\ProgramData\aikZcKHWDyyBLoVB
2025-09-13 01:47 - 2025-09-13 01:48 - 000000000 ____D C:\Program Files (x86)\WyyHRJJOUCclC
2025-09-13 01:47 - 2025-09-13 01:48 - 000000000 ____D C:\Program Files (x86)\usdULSFCtWzOBasFesR
2025-09-13 01:47 - 2025-09-13 01:48 - 000000000 ____D C:\Program Files (x86)\rHPotDbdxQEU2
2025-09-13 01:47 - 2025-09-13 01:48 - 000000000 ____D C:\Program Files (x86)\lnnyEeYBABUn
2025-09-13 01:46 - 2025-09-17 21:12 - 000000000 ____D C:\Program Files (x86)\wHemEQQzU
2025-08-01 06:41 - 2025-08-01 06:41 - 000000000 ____D C:\Program Files\ChromiumTemp1960_393500616
2025-08-01 06:40 - 2025-08-01 06:40 - 000000000 ___DC C:\ProgramData\FjjBjvXPlFNPRlV
2025-08-01 06:04 - 2025-08-01 06:04 - 000000000 ____D C:\Users\KO\AppData\Local\highstone-updater
2025-08-01 05:55 - 2025-08-01 05:55 - 000000000 ___DC C:\ProgramData\playerFolder
Chat Saver 1.0.0.0 (HKU\S-1-5-21-2663235146-1921599251-30963202-1001\...\{721ef88f-a4a3-4ba5-b5c2-6d35fd52bc04}) (Version: 1.0.0.0 - Chat Saver) Hidden
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{2ABD6384-2E18-40E8-8439-F06D21E0B03D}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.195.43\psuser_64.dll => Нет файла
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{2FDB3305-19B8-4FE2-972B-ED5E97CBBD6E}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.195.39\psuser_64.dll => Нет файла
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{41B09861-5409-4D44-8CA4-D49FBFAA2E6F}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.195.49\psuser_64.dll => Нет файла
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{4FFB4BD8-A109-4F25-A4DB-313678B19417}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.195.31\psuser_64.dll => Нет файла
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{5FC44EBC-3A1F-4FBB-85E5-34405788C8D7}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.187.41\psuser_64.dll => Нет файла
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{6DD6748E-7DAE-47EF-B4D5-03AA1B06D697}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.187.39\psuser_64.dll => Нет файла
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{78C1ADF4-6DAE-4164-AEFA-4E3EAD9E750A}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.195.19\psuser_64.dll => Нет файла
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{79F05C14-E714-4C12-9924-93C812894CB0}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.195.57\psuser_64.dll => Нет файла
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{7EFB4924-4B93-4C43-9832-9C3D05E85214}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.195.59\psuser_64.dll => Нет файла
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{83F21C4B-8643-4A08-A29A-822AFD835037}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.193.5\psuser_64.dll => Нет файла
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{A087E49F-1F8E-4603-A200-55537B737421}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.195.25\psuser_64.dll => Нет файла
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{B258532D-3529-4BEB-BF38-F08F98B3968C}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.195.15\psuser_64.dll => Нет файла
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{B29F5F83-90DF-479A-BDE7-8A9F4412E394}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.171.39\psuser_64.dll => Нет файла
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{BC4C72EF-3055-4A6D-86E1-AE4D24DB63CA}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.195.35\psuser_64.dll => Нет файла
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{C88B3957-621C-415B-8EE5-B688FC7EF924}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.195.61\psuser_64.dll => Нет файла
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{D2188EEC-2B0F-488C-8ECA-5285E8ECD87D}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.195.69\psuser_64.dll => Нет файла
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{D8599F80-3D26-46D2-8CF1-0AD21B0ECF31}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.195.65\psuser_64.dll => Нет файла
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{DAA7499A-B3AC-4419-A89B-124318504051}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.185.29\psuser_64.dll => Нет файла
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{E3D57E77-FE71-4D06-BD34-D48820074909}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.181.5\psuser_64.dll => Нет файла
CustomCLSID: HKU\S-1-5-21-2663235146-1921599251-30963202-1001_Classes\CLSID\{F46A78BD-06FC-442C-88DF-0500F08F2379}\InprocServer32 -> C:\Users\KO\AppData\Local\Microsoft\EdgeUpdate\1.3.195.45\psuser_64.dll => Нет файла
AlternateDataStreams: C:\ProgramData:9e72711e [1294]
AlternateDataStreams: C:\ProgramData:DNS [40]
AlternateDataStreams: C:\ProgramData:NT [40]
AlternateDataStreams: C:\Users\All Users:9e72711e [1294]
AlternateDataStreams: C:\Users\All Users:DNS [40]
AlternateDataStreams: C:\Users\All Users:NT [40]
AlternateDataStreams: C:\Users\Все пользователи:9e72711e [1294]
AlternateDataStreams: C:\Users\Все пользователи:DNS [40]
AlternateDataStreams: C:\Users\Все пользователи:NT [40]
AlternateDataStreams: C:\ProgramData\Application Data:9e72711e [1294]
AlternateDataStreams: C:\ProgramData\Application Data:DNS [40]
AlternateDataStreams: C:\ProgramData\Application Data:NT [40]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:9e72711e [1294]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:DNS [40]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT [40]
AlternateDataStreams: C:\Users\KO\Application Data:9e72711e [1294]
AlternateDataStreams: C:\Users\KO\Application Data:DNS [40]
AlternateDataStreams: C:\Users\KO\Application Data:NT [40]
AlternateDataStreams: C:\Users\KO\AppData\Roaming:9e72711e [1294]
AlternateDataStreams: C:\Users\KO\AppData\Roaming:DNS [40]
AlternateDataStreams: C:\Users\KO\AppData\Roaming:NT [40]
AlternateDataStreams: C:\Users\KO\Documents\GTA San Andreas User Files:9e72711e [1294]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [10084]
Reg: reg export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules C:\Firewall.reg
C:\Firewall.reg
CMD: netsh advfirewall reset
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
Zip: C:\FRST\Quarantine
EmptyTemp:
Reboot:
End::
