Перейти к содержанию

[sclown@elude.in][id=********]desktop.ini.notfound


Рекомендуемые сообщения

добрый день, зашифровали данные, 2008r2, поясните пожалуйста если знаете как произошел взлом и запуск данного вируса, остались ли процессы, после одного сервера пошли по рдп по другим которые из другого леса с другими учетками, как подобрали пароли?, после смены утихло но опасаюсь что есть процессы, проверяю постоянно монитором ресурсов, если какие нибудь шансы на восстановление?

Ссылка на комментарий
Поделиться на другие сайты

файлы приложил

1 архив это исходники 

2 архив это шифрованые эти же файлы

исходники достал из shadowcopy

но пока восстанавливал, прозевал новую рдп сесию и теневая копия стала 0, есть несколько папок с документами которые не успел достать

интересно что примапил 2 теневые копии с дистрибутивами и документами, дистрибутивы успешно вытащил за сутки, а документы не успел 

сменил пароли 2 раза, убил лишние учетки из админов, выключил Adinistrator, закрыл все выходы в интернет

заранее благодарен

1.7z 2.7z Frst.7z

Ссылка на комментарий
Поделиться на другие сайты

Тип вымогателя The DMR, пока в стадии изучения.

Создайте запрос на расшифровку.

 

Примите к сведению - после выполнения скрипта все открытые вкладки браузеров будут закрыты, произойдет выход из аккаунтов, временные файлы, корзина, история браузеров, куки и кэш будут очищены.

  • Отключите до перезагрузки антивирус.
  • Выделите следующий код:
    Start::
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\!!! READ THIS !!!.hta [2020-07-21] () [File not signed]
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO RECOVER ENCRYPTED FILES.txt [2020-07-21] () [File not signed]
    2020-07-22 08:36 - 2020-07-21 22:01 - 000002906 _____ C:\Users\john.BE1\Downloads\!!! READ THIS !!!.hta
    2020-07-22 08:36 - 2020-07-21 22:01 - 000002906 _____ C:\Users\john.BE1\Documents\!!! READ THIS !!!.hta
    2020-07-22 08:36 - 2020-07-21 22:01 - 000002906 _____ C:\Users\john.BE1\Desktop\!!! READ THIS !!!.hta
    2020-07-22 08:36 - 2020-07-21 22:01 - 000002906 _____ C:\Users\john.BE1\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-22 08:36 - 2020-07-21 22:01 - 000002906 _____ C:\Users\john.BE1\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-22 08:36 - 2020-07-21 22:01 - 000002906 _____ C:\Users\john.BE1\!!! READ THIS !!!.hta
    2020-07-22 08:36 - 2020-07-21 22:01 - 000002216 _____ C:\Users\john.BE1\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-22 08:36 - 2020-07-21 22:01 - 000002216 _____ C:\Users\john.BE1\Downloads\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-22 08:36 - 2020-07-21 22:01 - 000002216 _____ C:\Users\john.BE1\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-22 08:36 - 2020-07-21 22:01 - 000002216 _____ C:\Users\john.BE1\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-22 08:36 - 2020-07-21 22:01 - 000002216 _____ C:\Users\john.BE1\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-22 08:36 - 2020-07-21 22:01 - 000002216 _____ C:\Users\john.BE1\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-22 07:42 - 2020-07-22 08:22 - 000000000 ____D C:\Users\Radionov-EA\Desktop\New folder
    2020-07-21 22:02 - 2020-07-22 20:42 - 000001998 ____H C:\Users\john\Documents\Default.rdp
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Rozhkov-MV\Downloads\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Rozhkov-MV\Documents\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Rozhkov-MV\Desktop\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Rozhkov-MV\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Rozhkov-MV\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Rozhkov-MV\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Radionov-EA\Downloads\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Radionov-EA\Documents\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Radionov-EA\Desktop\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Radionov-EA\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Radionov-EA\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Radionov-EA\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Public\Downloads\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Public\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Nikitin-VA\Downloads\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Nikitin-VA\Documents\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Nikitin-VA\Desktop\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Nikitin-VA\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Nikitin-VA\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Nikitin-VA\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\nemtsev-av\Downloads\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\nemtsev-av\Documents\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\nemtsev-av\Desktop\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\nemtsev-av\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\nemtsev-av\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\nemtsev-av\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Matyushina-EA\Desktop\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Matyushina-EA\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Matyushina-EA\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Matyushina-EA\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Kuchevskiy-DA\Downloads\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Kuchevskiy-DA\Documents\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Kuchevskiy-DA\Desktop\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Kuchevskiy-DA\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Kuchevskiy-DA\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Kuchevskiy-DA\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Kovalchuk-MV\Desktop\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Kovalchuk-MV\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Kovalchuk-MV\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Kovalchuk-MV\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\KL-AK-B05B2ACB2ABC00\Downloads\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\KL-AK-B05B2ACB2ABC00\Documents\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\KL-AK-B05B2ACB2ABC00\Desktop\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\KL-AK-B05B2ACB2ABC00\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\KL-AK-B05B2ACB2ABC00\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\KL-AK-B05B2ACB2ABC00\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\KL-AK-7547D12E181358\Downloads\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\KL-AK-7547D12E181358\Documents\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\KL-AK-7547D12E181358\Desktop\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\KL-AK-7547D12E181358\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\KL-AK-7547D12E181358\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\KL-AK-7547D12E181358\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\KL-AK-40BDA3B7E6EA4D\Downloads\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\KL-AK-40BDA3B7E6EA4D\Documents\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\KL-AK-40BDA3B7E6EA4D\Desktop\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\KL-AK-40BDA3B7E6EA4D\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\KL-AK-40BDA3B7E6EA4D\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\KL-AK-40BDA3B7E6EA4D\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Kirbitov-MY\Downloads\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Kirbitov-MY\Documents\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Kirbitov-MY\Desktop\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Kirbitov-MY\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Kirbitov-MY\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Kirbitov-MY\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\john\Downloads\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\john\Documents\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\john\Desktop\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\john\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\john\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\john\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\ignatiev-kk\Downloads\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\ignatiev-kk\Documents\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\ignatiev-kk\Desktop\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\ignatiev-kk\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\ignatiev-kk\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\ignatiev-kk\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\ess_backup\Downloads\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\ess_backup\Documents\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\ess_backup\Desktop\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\ess_backup\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\ess_backup\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\ess_backup\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Default\Downloads\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Default\Documents\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Default\Desktop\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Default\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Default\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Default User\Downloads\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Default User\Documents\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Default User\Desktop\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Default User\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Default User\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Consultant\Downloads\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Consultant\Documents\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Consultant\Desktop\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Consultant\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Consultant\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Consultant\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Classic .NET AppPool\Downloads\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Classic .NET AppPool\Documents\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Classic .NET AppPool\Desktop\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Classic .NET AppPool\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Classic .NET AppPool\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Classic .NET AppPool\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002906 _____ C:\ProgramData\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Rozhkov-MV\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Rozhkov-MV\Downloads\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Rozhkov-MV\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Rozhkov-MV\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Rozhkov-MV\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Rozhkov-MV\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Radionov-EA\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Radionov-EA\Downloads\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Radionov-EA\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Radionov-EA\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Radionov-EA\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Radionov-EA\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Public\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Public\Downloads\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Nikitin-VA\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Nikitin-VA\Downloads\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Nikitin-VA\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Nikitin-VA\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Nikitin-VA\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Nikitin-VA\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\nemtsev-av\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\nemtsev-av\Downloads\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\nemtsev-av\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\nemtsev-av\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\nemtsev-av\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\nemtsev-av\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Matyushina-EA\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Matyushina-EA\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Matyushina-EA\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Matyushina-EA\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Kuchevskiy-DA\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Kuchevskiy-DA\Downloads\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Kuchevskiy-DA\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Kuchevskiy-DA\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Kuchevskiy-DA\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Kuchevskiy-DA\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Kovalchuk-MV\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Kovalchuk-MV\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Kovalchuk-MV\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Kovalchuk-MV\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\KL-AK-B05B2ACB2ABC00\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\KL-AK-B05B2ACB2ABC00\Downloads\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\KL-AK-B05B2ACB2ABC00\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\KL-AK-B05B2ACB2ABC00\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\KL-AK-B05B2ACB2ABC00\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\KL-AK-B05B2ACB2ABC00\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\KL-AK-7547D12E181358\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\KL-AK-7547D12E181358\Downloads\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\KL-AK-7547D12E181358\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\KL-AK-7547D12E181358\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\KL-AK-7547D12E181358\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\KL-AK-7547D12E181358\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\KL-AK-40BDA3B7E6EA4D\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\KL-AK-40BDA3B7E6EA4D\Downloads\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\KL-AK-40BDA3B7E6EA4D\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\KL-AK-40BDA3B7E6EA4D\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\KL-AK-40BDA3B7E6EA4D\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\KL-AK-40BDA3B7E6EA4D\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Kirbitov-MY\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Kirbitov-MY\Downloads\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Kirbitov-MY\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Kirbitov-MY\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Kirbitov-MY\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Kirbitov-MY\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\john\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\john\Downloads\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\john\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\john\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\john\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\john\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\ignatiev-kk\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\ignatiev-kk\Downloads\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\ignatiev-kk\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\ignatiev-kk\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\ignatiev-kk\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\ignatiev-kk\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\ess_backup\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\ess_backup\Downloads\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\ess_backup\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\ess_backup\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\ess_backup\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\ess_backup\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Default\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Default\Downloads\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Default\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Default\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Default\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Default User\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Default User\Downloads\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Default User\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Default User\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Default User\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Consultant\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Consultant\Downloads\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Consultant\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Consultant\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Consultant\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Consultant\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Classic .NET AppPool\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Classic .NET AppPool\Downloads\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Classic .NET AppPool\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Classic .NET AppPool\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Classic .NET AppPool\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Classic .NET AppPool\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 22:01 - 2020-07-21 22:01 - 000002216 _____ C:\ProgramData\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 21:59 - 2020-07-21 21:59 - 000002906 _____ C:\Program Files (x86)\!!! READ THIS !!!.hta
    2020-07-21 21:59 - 2020-07-21 21:59 - 000002216 _____ C:\Program Files (x86)\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 21:58 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Public\Documents\!!! READ THIS !!!.hta
    2020-07-21 21:58 - 2020-07-21 22:01 - 000002906 _____ C:\Users\Public\Desktop\!!! READ THIS !!!.hta
    2020-07-21 21:58 - 2020-07-21 22:01 - 000002906 _____ C:\ProgramData\Documents\!!! READ THIS !!!.hta
    2020-07-21 21:58 - 2020-07-21 22:01 - 000002906 _____ C:\ProgramData\Desktop\!!! READ THIS !!!.hta
    2020-07-21 21:58 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Public\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 21:58 - 2020-07-21 22:01 - 000002216 _____ C:\Users\Public\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 21:58 - 2020-07-21 22:01 - 000002216 _____ C:\ProgramData\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 21:58 - 2020-07-21 22:01 - 000002216 _____ C:\ProgramData\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 21:58 - 2020-07-21 22:00 - 000002906 _____ C:\Users\Administrator\Downloads\!!! READ THIS !!!.hta
    2020-07-21 21:58 - 2020-07-21 22:00 - 000002906 _____ C:\Users\Administrator\Documents\!!! READ THIS !!!.hta
    2020-07-21 21:58 - 2020-07-21 22:00 - 000002906 _____ C:\Users\Administrator\Desktop\!!! READ THIS !!!.hta
    2020-07-21 21:58 - 2020-07-21 22:00 - 000002906 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\!!! READ THIS !!!.hta
    2020-07-21 21:58 - 2020-07-21 22:00 - 000002906 _____ C:\Users\Administrator\AppData\Roaming\!!! READ THIS !!!.hta
    2020-07-21 21:58 - 2020-07-21 22:00 - 000002906 _____ C:\Users\Administrator\!!! READ THIS !!!.hta
    2020-07-21 21:58 - 2020-07-21 22:00 - 000002906 _____ C:\Users\!!! READ THIS !!!.hta
    2020-07-21 21:58 - 2020-07-21 22:00 - 000002906 _____ C:\ProgramData\!!! READ THIS !!!.hta
    2020-07-21 21:58 - 2020-07-21 22:00 - 000002216 _____ C:\Users\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 21:58 - 2020-07-21 22:00 - 000002216 _____ C:\Users\Administrator\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 21:58 - 2020-07-21 22:00 - 000002216 _____ C:\Users\Administrator\Downloads\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 21:58 - 2020-07-21 22:00 - 000002216 _____ C:\Users\Administrator\Documents\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 21:58 - 2020-07-21 22:00 - 000002216 _____ C:\Users\Administrator\Desktop\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 21:58 - 2020-07-21 22:00 - 000002216 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 21:58 - 2020-07-21 22:00 - 000002216 _____ C:\Users\Administrator\AppData\Roaming\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 21:58 - 2020-07-21 22:00 - 000002216 _____ C:\ProgramData\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 21:58 - 2020-07-21 21:58 - 000002906 _____ C:\Program Files\Common Files\!!! READ THIS !!!.hta
    2020-07-21 21:58 - 2020-07-21 21:58 - 000002906 _____ C:\Program Files\!!! READ THIS !!!.hta
    2020-07-21 21:58 - 2020-07-21 21:58 - 000002906 _____ C:\!!! READ THIS !!!.hta
    2020-07-21 21:58 - 2020-07-21 21:58 - 000002216 _____ C:\Program Files\HOW TO RECOVER ENCRYPTED FILES.txt
    2020-07-21 21:58 - 2020-07-21 21:58 - 000002216 _____ C:\Program Files\Common Files\HOW TO RECOVER ENCRYPTED FILES.txt
    End::

  • Скопируйте выделенный текст (правой кнопкой - Копировать).
  • Запустите FRST (FRST64) от имени администратора.
  • Нажмите Fix один раз (!) и подождите. Программа создаст лог-файл (Fixlog.txt). Прикрепите его к своему следующему сообщению.


Компьютер перезагрузите вручную. Пересмотрите открытые порты в брандмауэре, все ли нужны.

Подробнее читайте в этом руководстве.
 

Ссылка на комментарий
Поделиться на другие сайты

Пожалуйста, войдите, чтобы комментировать

Вы сможете оставить комментарий после входа в



Войти
×
×
  • Создать...