RobotDemo and PuzzleMedia

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 TerminateProcessByName('c:\program files (x86)\transmission\transmission-qt.exe');
 SetServiceStart('Transmission', 4);
 DeleteFile('C:\Program Files (x86)\Transmission\Qt5Core.dll','32');
 DeleteFile('c:\program files (x86)\transmission\transmission-qt.exe','32');
 DeleteService('Transmission');
 DeleteFileMask('C:\Program Files (x86)\Transmission', '*', true);
 DeleteDirectory('C:\Program Files (x86)\Transmission');
 DeleteFileMask('C:\ProgramData\RobotDemo', '*', true);
 DeleteDirectory('C:\ProgramData\RobotDemo');
 DeleteFileMask('C:\ProgramData\PuzzleMedia', '*', true);
 DeleteDirectory('C:\ProgramData\PuzzleMedia');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

begin
DeleteFile(GetAVZDirectory+'quarantine.7z');
ExecuteFile(GetAVZDirectory+'7za.exe', 'a -mx9 -pmalware quarantine ./Quarantine/', 1, 0, true);
end.

O4 - HKCU\..\StartupApproved\Run: [utweb] = C:\Users\rvall\AppData\Roaming\uTorrent Web\utweb.exe /MINIMIZED (file missing) (2021/06/06)
O15 - Trusted Zone: http://webcompanion.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{6f68d3fa-27a4-4a22-b08d-5d3074119ca1}: [NameServer] = 178.175.133.58
O17 - HKLM\System\CCS\Services\Tcpip\..\{6f68d3fa-27a4-4a22-b08d-5d3074119ca1}: [NameServer] = 37.1.207.126
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive1: (no name) - {BBACC218-34EA-4666-9D7A-C78F2274A524} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive2: (no name) - {5AB7172C-9C11-405C-8DD5-AF20F3606282} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive3: (no name) - {A78ED123-AB77-406B-9962-2A5D9D2F7F30} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive4: (no name) - {F241C880-6982-4CE5-8CF7-7085BA96DA5A} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive5: (no name) - {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive6: (no name) - {9AA2F32D-362A-42D9-9328-24A483E2CCC3} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive7: (no name) - {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive1: (no name) - {BBACC218-34EA-4666-9D7A-C78F2274A524} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive2: (no name) - {5AB7172C-9C11-405C-8DD5-AF20F3606282} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive3: (no name) - {A78ED123-AB77-406B-9962-2A5D9D2F7F30} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive4: (no name) - {F241C880-6982-4CE5-8CF7-7085BA96DA5A} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive5: (no name) - {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive6: (no name) - {9AA2F32D-362A-42D9-9328-24A483E2CCC3} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive7: (no name) - {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} - (no file)

Start::
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ограничение <==== ВНИМАНИЕ
IFEO\CompatTelRunner.exe: [Debugger] C:\Windows\system32\systray.exe
GroupPolicy: Ограничение - Chrome <==== ВНИМАНИЕ
Policies: C:\ProgramData\NTUSER.pol: Ограничение <==== ВНИМАНИЕ
HKLM\SOFTWARE\Policies\Google: Ограничение <==== ВНИМАНИЕ
Tcpip\..\Interfaces\{6f68d3fa-27a4-4a22-b08d-5d3074119ca1}: [NameServer] 178.175.133.58,37.1.207.126
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ограничение <==== ВНИМАНИЕ
C:\Users\rvall\AppData\Local\Google\Chrome\User Data\Guest Profile\Extensions\meejmcfbiapijdfaadackoblffmidlig
CHR StartupUrls: Default -> "hxxp://mail.ru/cnt/10445?gp=812204","hxxps://mail.ru/cnt/10445?gp=811570","hxxps://mail.ru/cnt/10445?gp=813024","hxxps://www.google.com","hxxps://ovgorskiy.ru","hxxps://find-it.pro/?utm_source=distr_m"
CHR HomePage: System Profile -> hxxps://find-it.pro/?utm_source=distr_m
CHR StartupUrls: System Profile -> "hxxps://find-it.pro/?utm_source=distr_m"
CHR DefaultSearchURL: System Profile -> hxxp://search-cdn.net/fip/?q={searchTerms}
CHR DefaultSearchKeyword: System Profile -> cdn
C:\Users\rvall\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\meejmcfbiapijdfaadackoblffmidlig
2021-08-22 13:40 - 2021-08-22 14:58 - 000000000 ____D C:\ProgramData\PuzzleMedia
2021-07-30 11:35 - 2021-07-30 11:35 - 000000000 ____D C:\ProgramData\RobotDemo
2021-07-30 11:35 - 2021-07-30 11:35 - 000000000 ____D C:\Program Files (x86)\Transmission
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [7758]
AlternateDataStreams: C:\Users\rvall\Application Data:fb0f338e3c50142088eeb9509e846c1a [394]
AlternateDataStreams: C:\Users\rvall\AppData\Roaming:fb0f338e3c50142088eeb9509e846c1a [394]
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://find-it.pro/?utm_source=distr_m
HKU\S-1-5-21-348097729-3486381231-2036525703-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://find-it.pro/?utm_source=distr_m
SearchScopes: HKU\S-1-5-21-348097729-3486381231-2036525703-1001 -> DefaultScope {8C3078A0-9AAB-4371-85D1-656CA8E46EE8} URL = hxxp://search-cdn.net/fip/?q={searchTerms}
SearchScopes: HKU\S-1-5-21-348097729-3486381231-2036525703-1001 -> {8C3078A0-9AAB-4371-85D1-656CA8E46EE8} URL = hxxp://search-cdn.net/fip/?q={searchTerms}
FirewallRules: [TCP Query User{00BE3F17-8E6D-429C-89E2-43C4D19563B1}D:\call of duty modern warfare\modernwarfare.exe] => (Allow) D:\call of duty modern warfare\modernwarfare.exe => Нет файла
FirewallRules: [UDP Query User{95FD3D7F-B227-4508-A6B9-15721ACB20C0}D:\call of duty modern warfare\modernwarfare.exe] => (Allow) D:\call of duty modern warfare\modernwarfare.exe => Нет файла
FirewallRules: [TCP Query User{3BBC9F5A-9CD9-492F-A50A-D44B2F6CE179}C:1\fsd\binaries\wingdk\fsd-wingdk-shipping.exe] => (Allow) C:1\fsd\binaries\wingdk\fsd-wingdk-shipping.exe => Нет файла
FirewallRules: [UDP Query User{A1494D31-4077-4663-AF11-20CB672FC062}C:1\fsd\binaries\wingdk\fsd-wingdk-shipping.exe] => (Allow) C:1\fsd\binaries\wingdk\fsd-wingdk-shipping.exe => Нет файла
FirewallRules: [TCP Query User{71156BB9-1570-4875-9C98-9A8CE45B4267}D:\crysis 2  maximum edition\bin32\crysis2.exe] => (Allow) D:\crysis 2  maximum edition\bin32\crysis2.exe => Нет файла
FirewallRules: [UDP Query User{D61BD8BB-FA68-4AA6-88D9-EF7043D4D4B4}D:\crysis 2  maximum edition\bin32\crysis2.exe] => (Allow) D:\crysis 2  maximum edition\bin32\crysis2.exe => Нет файла
FirewallRules: [TCP Query User{79674EE2-B0E5-4C24-B5CB-4DFFE1A37D94}D:\roguecompany\roguecompany\binaries\win64\roguecompany.exe] => (Allow) D:\roguecompany\roguecompany\binaries\win64\roguecompany.exe => Нет файла
FirewallRules: [UDP Query User{80D07F66-D952-4165-8517-10D60039666D}D:\roguecompany\roguecompany\binaries\win64\roguecompany.exe] => (Allow) D:\roguecompany\roguecompany\binaries\win64\roguecompany.exe => Нет файла
FirewallRules: [{0FA961D5-7C12-4D5C-8CC0-87DC0FB03BEE}] => (Allow) D:\TheCycleEarlyAccess\Prospect\Binaries\Win64\Prospect-Win64-Shipping.exe => Нет файла
FirewallRules: [{85988CA6-ABBA-4D42-8072-41ADE0176AC3}] => (Allow) D:\TheCycleEarlyAccess\Prospect\Binaries\Win64\Prospect-Win64-Shipping.exe => Нет файла
FirewallRules: [{04A256E2-0FC8-4484-8B70-C613C3758F0B}] => (Allow) D:\TheCycleEarlyAccess\Prospect\Binaries\Win64\Prospect-Win64-Shipping.exe => Нет файла
FirewallRules: [{41BB9A22-7758-4447-A232-6CA6B72EB0FD}] => (Allow) D:\TheCycleEarlyAccess\Prospect\Binaries\Win64\Prospect-Win64-Shipping.exe => Нет файла
FirewallRules: [TCP Query User{D65AF9C2-375B-4921-A700-BBD85E63F3EC}D:\scavengers\scavenger\binaries\win64\scavenger-win64-shipping.exe] => (Allow) D:\scavengers\scavenger\binaries\win64\scavenger-win64-shipping.exe => Нет файла
FirewallRules: [UDP Query User{561BBA7A-157A-4F92-8344-2C0BB5A15FFE}D:\scavengers\scavenger\binaries\win64\scavenger-win64-shipping.exe] => (Allow) D:\scavengers\scavenger\binaries\win64\scavenger-win64-shipping.exe => Нет файла
FirewallRules: [TCP Query User{74ECC739-7408-4917-BAC0-18F20EF1F3E2}D:\games\battlefield 4\bf4.exe] => (Allow) D:\games\battlefield 4\bf4.exe => Нет файла
FirewallRules: [UDP Query User{0661873B-B9BD-4995-B4EE-F85E35215FE5}D:\games\battlefield 4\bf4.exe] => (Allow) D:\games\battlefield 4\bf4.exe => Нет файла
FirewallRules: [TCP Query User{3AF8CCF8-0C9E-4000-BBD6-03A9FE6ACE95}D:\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) D:\cyberpunk 2077\bin\x64\cyberpunk2077.exe => Нет файла
FirewallRules: [UDP Query User{B0202B39-7EB3-402B-A1E4-5CF43C3AF8BE}D:\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) D:\cyberpunk 2077\bin\x64\cyberpunk2077.exe => Нет файла
FirewallRules: [TCP Query User{8F339682-DCE6-48C8-9DE0-30A9E1668250}D:\bfh\bfh.exe] => (Allow) D:\bfh\bfh.exe => Нет файла
FirewallRules: [UDP Query User{EE6D2BBD-681E-433A-B52B-1C135A1CA586}D:\bfh\bfh.exe] => (Allow) D:\bfh\bfh.exe => Нет файла
FirewallRules: [{179F66BE-7DF5-435A-8C6D-9E79BDEFFEF7}] => (Allow) E:\Enlisted\launcher.exe => Нет файла
FirewallRules: [{078EE836-DB3D-4B18-A9BC-1ADE48659648}] => (Allow) E:\Enlisted\launcher.exe => Нет файла
FirewallRules: [{695F5DE4-3B80-4381-9FCF-1D013CEE48A2}] => (Allow) E:\Enlisted\bpreport.exe => Нет файла
FirewallRules: [{24F9B6C5-CFE4-4E88-BA9E-B6E67F04D449}] => (Allow) E:\Enlisted\bpreport.exe => Нет файла
FirewallRules: [{85EBB068-28B2-40ED-A949-E3CC28ADF5B9}] => (Allow) E:\Enlisted\gaijin_downloader.exe => Нет файла
FirewallRules: [{7A69AD3C-68B0-4A5B-A270-7E69502E351F}] => (Allow) E:\Enlisted\gaijin_downloader.exe => Нет файла
FirewallRules: [TCP Query User{4FEDDBCF-AE4D-470A-B759-FC8D258D0E55}E:\enlisted\win64\enlisted.exe] => (Allow) E:\enlisted\win64\enlisted.exe => Нет файла
FirewallRules: [UDP Query User{049B799D-431E-4A6A-96F0-73319395426C}E:\enlisted\win64\enlisted.exe] => (Allow) E:\enlisted\win64\enlisted.exe => Нет файла
FirewallRules: [TCP Query User{C680284F-8E53-4ADC-85C6-88EAD1B0F875}D:\games\crash bandicoot 4 its about time\lava\binaries\win64\lava-win64-shipping.exe] => (Allow) D:\games\crash bandicoot 4 its about time\lava\binaries\win64\lava-win64-shipping.exe => Нет файла
FirewallRules: [UDP Query User{1BEEE838-C135-4472-8912-A5044D9EB6FA}D:\games\crash bandicoot 4 its about time\lava\binaries\win64\lava-win64-shipping.exe] => (Allow) D:\games\crash bandicoot 4 its about time\lava\binaries\win64\lava-win64-shipping.exe => Нет файла
FirewallRules: [TCP Query User{E868B5A0-DB70-48BF-A5F0-5A663905C651}C:6\games\battlefield 1\bf1.exe] => (Allow) C:6\games\battlefield 1\bf1.exe => Нет файла
FirewallRules: [UDP Query User{7C8B5411-1B6F-4A7A-87BD-FF027B677467}C:6\games\battlefield 1\bf1.exe] => (Allow) C:6\games\battlefield 1\bf1.exe => Нет файла
FirewallRules: [TCP Query User{5F244BBF-7C77-4C4D-9203-B187ED35EBB5}C:6\borderlands 3\oakgame\binaries\win64\borderlands3.exe] => (Allow) C:6\borderlands 3\oakgame\binaries\win64\borderlands3.exe => Нет файла
FirewallRules: [UDP Query User{661BC3B3-47D5-4D26-A0DE-781809365FF5}C:6\borderlands 3\oakgame\binaries\win64\borderlands3.exe] => (Allow) C:6\borderlands 3\oakgame\binaries\win64\borderlands3.exe => Нет файла
FirewallRules: [TCP Query User{13E54E19-BF3D-42E7-9E5B-D53D805466A8}C:6\tom clancys ghost recon\grw.exe] => (Allow) C:6\tom clancys ghost recon\grw.exe => Нет файла
FirewallRules: [UDP Query User{C44B4443-5DA7-463A-9BEE-36AC841C0D78}C:6\tom clancys ghost recon\grw.exe] => (Allow) C:6\tom clancys ghost recon\grw.exe => Нет файла
FirewallRules: [{24C0A6E2-3617-44BA-9A36-E626268804CD}] => (Allow) C:6\Games\Apex\EasyAntiCheat_launcher.exe => Нет файла
FirewallRules: [{A1228EA2-1529-482A-ACF2-963F05870DD2}] => (Allow) C:6\Games\Apex\EasyAntiCheat_launcher.exe => Нет файла
FirewallRules: [TCP Query User{2311FFE7-43D3-4B5D-90FA-A149CAE24E74}C:\users\rvall\appdata\roaming\.tlauncher\jvms\jre1.8.0_281\bin\javaw.exe] => (Allow) C:\users\rvall\appdata\roaming\.tlauncher\jvms\jre1.8.0_281\bin\javaw.exe => Нет файла
FirewallRules: [UDP Query User{36833DEE-82A5-441D-B6B6-AF31E91AEB09}C:\users\rvall\appdata\roaming\.tlauncher\jvms\jre1.8.0_281\bin\javaw.exe] => (Allow) C:\users\rvall\appdata\roaming\.tlauncher\jvms\jre1.8.0_281\bin\javaw.exe => Нет файла
FirewallRules: [TCP Query User{86961C6D-4CB6-4450-AAEA-1863D58260AE}C:\users\rvall\appdata\roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\javaw.exe] => (Allow) C:\users\rvall\appdata\roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\javaw.exe => Нет файла
FirewallRules: [UDP Query User{E3387CD9-FD32-4647-A04B-60342869B408}C:\users\rvall\appdata\roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\javaw.exe] => (Allow) C:\users\rvall\appdata\roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\javaw.exe => Нет файла
FirewallRules: [TCP Query User{BCC33D3B-6BB7-4800-A340-BD849A11D720}C:\users\rvall\appdata\roaming\.minecraft\versions\ресупс\runtime\jre-legacy\windows\jre-legacy\bin\javaw.exe] => (Allow) C:\users\rvall\appdata\roaming\.minecraft\versions\ресупс\runtime\jre-legacy\windows\jre-legacy\bin\javaw.exe => Нет файла
FirewallRules: [UDP Query User{5D186F14-2C80-4C5D-9BC1-49D807800FB4}C:\users\rvall\appdata\roaming\.minecraft\versions\ресупс\runtime\jre-legacy\windows\jre-legacy\bin\javaw.exe] => (Allow) C:\users\rvall\appdata\roaming\.minecraft\versions\ресупс\runtime\jre-legacy\windows\jre-legacy\bin\javaw.exe => Нет файла
FirewallRules: [{7B639EF8-3C96-4A4D-AD0E-6FE663F923CE}] => (Allow) C:6\SteamLibrary\steamapps\common\Grand Theft Auto V\PlayGTAV.exe => Нет файла
FirewallRules: [{370FB1D1-E1C2-4589-B141-2E35833A3DCE}] => (Allow) C:6\SteamLibrary\steamapps\common\Grand Theft Auto V\PlayGTAV.exe => Нет файла
FirewallRules: [{798700E9-AE4E-4C9B-B860-9FBE034AD269}] => (Allow) C:6\SteamLibrary\steamapps\common\Grand Theft Auto V\GTA5.exe => Нет файла
FirewallRules: [{631E93D0-C518-4A4E-BF48-A76045FCCC0F}] => (Allow) C:6\SteamLibrary\steamapps\common\Grand Theft Auto V\GTA5.exe => Нет файла
FirewallRules: [TCP Query User{C800C395-1B29-4E19-9C1F-E2419441CB13}E:\james cameron`s avatar - the game\bin\avatar.exe] => (Allow) E:\james cameron`s avatar - the game\bin\avatar.exe => Нет файла
FirewallRules: [UDP Query User{A1E8643F-8A12-448C-A886-47D68F746CB8}E:\james cameron`s avatar - the game\bin\avatar.exe] => (Allow) E:\james cameron`s avatar - the game\bin\avatar.exe => Нет файла
FirewallRules: [TCP Query User{EB1859B6-6536-40EB-8CAF-642279CA2D5D}E:\dawn of war iii\relicdow3.exe] => (Allow) E:\dawn of war iii\relicdow3.exe => Нет файла
FirewallRules: [UDP Query User{CDA0E947-3B65-4A48-8114-2E45358018BE}E:\dawn of war iii\relicdow3.exe] => (Allow) E:\dawn of war iii\relicdow3.exe => Нет файла
FirewallRules: [{2DF0017C-C30A-4029-8C72-D17FAFF19E33}] => (Allow) E:\Command and Conquer - Generals\Command and Conquer Generals Zero Hour\game.dat => Нет файла
FirewallRules: [{26BB204E-EC6C-47F4-A9D2-2DB5962BCD2C}] => (Allow) E:\Command and Conquer - Generals\Command and Conquer Generals Zero Hour\game.dat => Нет файла
FirewallRules: [{2F23CB20-A2AB-4B47-B297-C9B86A1775E9}] => (Allow) E:\Command and Conquer - Generals\Command and Conquer Generals Zero Hour\generals.exe => Нет файла
FirewallRules: [{F8036085-ABFC-41D2-81C7-D968EAA26E2C}] => (Allow) E:\Command and Conquer - Generals\Command and Conquer Generals Zero Hour\generals.exe => Нет файла
FirewallRules: [TCP Query User{C8A521C2-2075-48B6-A683-DA7C2D2BF390}E:\ubiclub\hyper scape\hyperscape.exe] => (Allow) E:\ubiclub\hyper scape\hyperscape.exe => Нет файла
FirewallRules: [UDP Query User{6A6D4173-2F91-4D44-93C5-91573270BA34}E:\ubiclub\hyper scape\hyperscape.exe] => (Allow) E:\ubiclub\hyper scape\hyperscape.exe => Нет файла
FirewallRules: [TCP Query User{D84B32EE-AE14-4369-ACB1-FC0652872136}E:\steamlibrary\steamapps\common\grand theft auto v\gta5.exe] => (Allow) E:\steamlibrary\steamapps\common\grand theft auto v\gta5.exe => Нет файла
FirewallRules: [UDP Query User{83BAF87B-5F7B-4200-A9B6-38E6BB73CC37}E:\steamlibrary\steamapps\common\grand theft auto v\gta5.exe] => (Allow) E:\steamlibrary\steamapps\common\grand theft auto v\gta5.exe => Нет файла
FirewallRules: [TCP Query User{0FCF5FAD-C070-4635-A7A8-25515267830D}E:\stronghold warlords\bin\win32_galaxy_release\strongholdwarlords.exe] => (Allow) E:\stronghold warlords\bin\win32_galaxy_release\strongholdwarlords.exe => Нет файла
FirewallRules: [UDP Query User{7AA18D93-21C6-46F5-B7B0-8709AB94869E}E:\stronghold warlords\bin\win32_galaxy_release\strongholdwarlords.exe] => (Allow) E:\stronghold warlords\bin\win32_galaxy_release\strongholdwarlords.exe => Нет файла
FirewallRules: [TCP Query User{0CD15F2B-8988-48CE-B71A-16009F60F188}E:\call of duty modern warfare 2 campaign remastered\mw2cr.exe] => (Allow) E:\call of duty modern warfare 2 campaign remastered\mw2cr.exe => Нет файла
FirewallRules: [UDP Query User{692F58B5-177E-44D1-B524-B856135BE0FC}E:\call of duty modern warfare 2 campaign remastered\mw2cr.exe] => (Allow) E:\call of duty modern warfare 2 campaign remastered\mw2cr.exe => Нет файла
FirewallRules: [TCP Query User{FD3417F6-AF74-4BBA-9538-1331B8087617}E:\stronghold crusader 2\bin\win32_release\crusader2.exe] => (Block) E:\stronghold crusader 2\bin\win32_release\crusader2.exe => Нет файла
FirewallRules: [UDP Query User{0AFE88C7-177A-4593-BE6C-94CD014061E0}E:\stronghold crusader 2\bin\win32_release\crusader2.exe] => (Block) E:\stronghold crusader 2\bin\win32_release\crusader2.exe => Нет файла
FirewallRules: [TCP Query User{A9A5ABC0-E472-4329-B78D-400A84A3811E}E:\doom\doomx64.exe] => (Allow) E:\doom\doomx64.exe => Нет файла
FirewallRules: [UDP Query User{491584D3-903F-40A3-971E-7BA9A1BF79A2}E:\doom\doomx64.exe] => (Allow) E:\doom\doomx64.exe => Нет файла
FirewallRules: [{B16392E1-653F-4F43-822D-C998CAFF7A58}] => (Allow) E:\Games\Apex\EasyAntiCheat_launcher.exe => Нет файла
FirewallRules: [{0761F436-73E1-4816-9C0D-845663E428E4}] => (Allow) E:\Games\Apex\EasyAntiCheat_launcher.exe => Нет файла
FirewallRules: [TCP Query User{F3E0396E-2313-4181-8395-D26D185D3319}D:\games\it takes two\nuts\binaries\win64\ittakestwo.exe] => (Allow) D:\games\it takes two\nuts\binaries\win64\ittakestwo.exe => Нет файла
FirewallRules: [UDP Query User{6BEC4C7C-21FD-4C8C-BF97-3ED57D0F7F76}D:\games\it takes two\nuts\binaries\win64\ittakestwo.exe] => (Allow) D:\games\it takes two\nuts\binaries\win64\ittakestwo.exe => Нет файла
FirewallRules: [TCP Query User{7596AB25-CC6B-42BA-8FF0-C03AD5461C5F}E:\dying light\dyinglightgame.exe] => (Allow) E:\dying light\dyinglightgame.exe => Нет файла
FirewallRules: [UDP Query User{5F248DC8-45EA-4C59-A31A-0D1531558EBB}E:\dying light\dyinglightgame.exe] => (Allow) E:\dying light\dyinglightgame.exe => Нет файла
FirewallRules: [TCP Query User{52A01665-7D9F-43C4-9903-C7E4F9ACD07C}D:\games\it takes two\nuts\binaries\win64\ittakestwo.exe] => (Allow) D:\games\it takes two\nuts\binaries\win64\ittakestwo.exe => Нет файла
FirewallRules: [UDP Query User{5735B0E3-8BE3-4449-A37A-FF10A572CE28}D:\games\it takes two\nuts\binaries\win64\ittakestwo.exe] => (Allow) D:\games\it takes two\nuts\binaries\win64\ittakestwo.exe => Нет файла
FirewallRules: [TCP Query User{8122939F-50CC-4CB3-B94C-C4BE3FCE39DC}E:\saints row the third\srttr.exe] => (Allow) E:\saints row the third\srttr.exe => Нет файла
FirewallRules: [UDP Query User{B73AE579-4821-406A-98E0-1365F0AF1E30}E:\saints row the third\srttr.exe] => (Allow) E:\saints row the third\srttr.exe => Нет файла
FirewallRules: [TCP Query User{2A05C1EE-698F-4625-A423-4481F883033E}E:\saints row the third\srttr.exe] => (Allow) E:\saints row the third\srttr.exe => Нет файла
FirewallRules: [UDP Query User{43B7D714-0240-4026-8F30-B23442CD524F}E:\saints row the third\srttr.exe] => (Allow) E:\saints row the third\srttr.exe => Нет файла
FirewallRules: [TCP Query User{78DDD630-3F07-4082-A080-13FC9694D5BC}E:\stronghold warlords\bin\win32_galaxy_release\strongholdwarlords.exe] => (Block) E:\stronghold warlords\bin\win32_galaxy_release\strongholdwarlords.exe => Нет файла
FirewallRules: [UDP Query User{91780883-1DF7-4C90-B9BC-0CA3AC2999B6}E:\stronghold warlords\bin\win32_galaxy_release\strongholdwarlords.exe] => (Block) E:\stronghold warlords\bin\win32_galaxy_release\strongholdwarlords.exe => Нет файла
FirewallRules: [TCP Query User{340D22CC-E959-43AC-BED5-E883D7518D5A}E:\stronghold crusader 2\bin\win32_release\crusader2.exe] => (Block) E:\stronghold crusader 2\bin\win32_release\crusader2.exe => Нет файла
FirewallRules: [UDP Query User{45AFFA04-1225-45A4-90AF-D56C03A72DAD}E:\stronghold crusader 2\bin\win32_release\crusader2.exe] => (Block) E:\stronghold crusader 2\bin\win32_release\crusader2.exe => Нет файла
FirewallRules: [TCP Query User{0A122A0D-A951-4FBF-A5FE-72417A87F839}E:\dying light\dyinglightgame.exe] => (Allow) E:\dying light\dyinglightgame.exe => Нет файла
FirewallRules: [UDP Query User{7E4242C7-9F86-4D41-899D-F9F711F815C1}E:\dying light\dyinglightgame.exe] => (Allow) E:\dying light\dyinglightgame.exe => Нет файла
FirewallRules: [TCP Query User{F9E8A8C3-4D06-4868-88CC-F911DB667F66}E:\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) E:\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe => Нет файла
FirewallRules: [UDP Query User{F1CD5951-307B-42AB-AF2B-79DBB96B2C1E}E:\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) E:\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe => Нет файла
FirewallRules: [{DDEA693C-E7D8-45A0-BF9C-D532DA3FF6DA}] => (Block) E:\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe => Нет файла
FirewallRules: [{B117EEAA-EDA3-46E5-89FD-0E50FFCB0624}] => (Block) E:\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe => Нет файла
FirewallRules: [TCP Query User{204F104F-2CD3-48A2-A731-4C319FC5BED7}D:\pvz battle for neighborville\pvzbattleforneighborville.exe] => (Allow) D:\pvz battle for neighborville\pvzbattleforneighborville.exe => Нет файла
FirewallRules: [UDP Query User{4CE1FA97-8FF4-4479-BBBE-179900D7AC3E}D:\pvz battle for neighborville\pvzbattleforneighborville.exe] => (Allow) D:\pvz battle for neighborville\pvzbattleforneighborville.exe => Нет файла
FirewallRules: [{FA169B7C-105C-4F07-88C0-B93F32DF780B}] => (Allow) E:\SF2\SpecialForce2\Binaries\Win32\sf2.exe => Нет файла
FirewallRules: [{23BD33AB-B196-4A03-9212-1A0905A01A27}] => (Allow) E:\SF2\SpecialForce2\Binaries\Win32\sf2.exe => Нет файла
FirewallRules: [{EBD44714-A5E8-42D6-B8DB-7D441878244B}] => (Allow) 㩃啜敳獲牜慶汬䅜灰慄慴剜慯業杮瑜捯卜噈㙇攮數 => Нет файла
FirewallRules: [{4EF79056-6E2B-4388-AD45-853A6CDACAB8}] => (Allow) 㩃啜敳獲牜慶汬䅜灰慄慴剜慯業杮瑜捯捜牨浯摥楲敶⹲硥e => Нет файла
FirewallRules: [{F2E1219B-D38B-40FB-BE9E-FFFFBFC4B6AB}] => (Allow) 㩃啜敳獲牜慶汬䅜灰慄慴剜慯業杮瑜捯䍜牨浯履灁汰捩瑡潩屮桃潲敭攮數 => Нет файла
FirewallRules: [{2BB5F4FE-8A69-49C8-84F9-20B10846B9A6}] => (Allow) 㩃啜敳獲牜慶汬䅜灰慄慴剜慯業杮瑜捯䡜捂⸳硥e => Нет файла
FirewallRules: [{4DFE5E7A-7774-40DB-B344-F5043041630E}] => (Allow) E:\SF2\SpecialForce2\Binaries\Win32\sf2.exe => Нет файла
FirewallRules: [{E3C0C70D-2039-427F-BE0D-346C8D4E9077}] => (Allow) E:\SF2\SpecialForce2\Binaries\Win32\sf2.exe => Нет файла
FirewallRules: [TCP Query User{AA01F196-F31C-40BE-88E3-9B72C2E53ECD}D:\games\resident evil village\re8.exe] => (Allow) D:\games\resident evil village\re8.exe => Нет файла
FirewallRules: [UDP Query User{FE0D7437-AC50-4B2D-99D8-340438E046D9}D:\games\resident evil village\re8.exe] => (Allow) D:\games\resident evil village\re8.exe => Нет файла
FirewallRules: [TCP Query User{FBC3206B-C27F-4DD4-BD22-2D3F9E8E0056}E:\resident evil 6\bh6.exe] => (Block) E:\resident evil 6\bh6.exe => Нет файла
FirewallRules: [UDP Query User{E5E93EE3-0FD2-449D-AC03-0F421E7217E8}E:\resident evil 6\bh6.exe] => (Block) E:\resident evil 6\bh6.exe => Нет файла
FirewallRules: [{6CDBF7EE-2806-40FD-BCA8-16F17821CAF4}] => (Allow) E:\Titanfall2\Titanfall2.exe => Нет файла
FirewallRules: [{3D88C1DA-0268-4532-A42B-1166A54BB81E}] => (Allow) E:\Titanfall2\Titanfall2.exe => Нет файла
FirewallRules: [{5796F9C7-91E2-4748-B24E-315B4D92E8A3}] => (Allow) E:\Titanfall2\Titanfall2_trial.exe => Нет файла
FirewallRules: [{F27B9D72-032E-457F-91A7-E521BE88F46F}] => (Allow) E:\Titanfall2\Titanfall2_trial.exe => Нет файла
FirewallRules: [TCP Query User{F7983344-A340-4FFF-8C71-A4988BE65907}E:\resident evil village\re8.exe] => (Allow) E:\resident evil village\re8.exe => Нет файла
FirewallRules: [UDP Query User{D00DBD47-5819-4A0A-A4BD-CC40B9A21D26}E:\resident evil village\re8.exe] => (Allow) E:\resident evil village\re8.exe => Нет файла
FirewallRules: [{C1AF6B63-3C8C-4A3A-83E0-921482F84E45}] => (Block) E:\resident evil village\re8.exe => Нет файла
FirewallRules: [{FDE87E0E-B33A-4A3F-88F2-74F2AC86862B}] => (Block) E:\resident evil village\re8.exe => Нет файла
FirewallRules: [TCP Query User{DBD2642F-FAA9-4F97-9412-94CE8C897E78}E:\call of duty black ops cold war\blackopscoldwar.exe] => (Allow) E:\call of duty black ops cold war\blackopscoldwar.exe => Нет файла
FirewallRules: [UDP Query User{4A51F4D7-158E-4B62-B539-908C6606159C}E:\call of duty black ops cold war\blackopscoldwar.exe] => (Allow) E:\call of duty black ops cold war\blackopscoldwar.exe => Нет файла
FirewallRules: [{EACCF07A-67B8-4516-B0C1-6C3548D7CEAA}] => (Block) E:\call of duty black ops cold war\blackopscoldwar.exe => Нет файла
FirewallRules: [{80483047-5CA1-44EF-8D42-1381D385ECF9}] => (Block) E:\call of duty black ops cold war\blackopscoldwar.exe => Нет файла
FirewallRules: [TCP Query User{2BBE2D01-CCA9-433C-85F6-F10230BEF561}E:\call of duty modern warfare\modernwarfare.exe] => (Allow) E:\call of duty modern warfare\modernwarfare.exe => Нет файла
FirewallRules: [UDP Query User{0DADC95F-BBC6-4E90-95B6-4E26E99DE721}E:\call of duty modern warfare\modernwarfare.exe] => (Allow) E:\call of duty modern warfare\modernwarfare.exe => Нет файла
FirewallRules: [{FE9102F3-0892-4126-9B8C-28AE17659E4F}] => (Block) D:\program files\modifiablewindowsapps\quake 3\en\quake3.exe => Нет файла
FirewallRules: [{A627B30B-957C-485B-94F4-94793CF3F831}] => (Block) D:\program files\modifiablewindowsapps\quake 3\en\quake3.exe => Нет файла
FirewallRules: [TCP Query User{26178806-5F45-420F-B6E4-977395171E6B}D:2\twelveminutes.exe] => (Allow) D:2\twelveminutes.exe => Нет файла
FirewallRules: [UDP Query User{7F8DE427-C52D-487A-8444-19F73321CD68}D:2\twelveminutes.exe] => (Allow) D:2\twelveminutes.exe => Нет файла
FirewallRules: [{A7D30761-07A5-429B-8E1B-B551FA92CEB0}] => (Block) D:2\twelveminutes.exe => Нет файла
FirewallRules: [{5FEF3270-EF48-4822-BE1D-B18715BC1E7C}] => (Block) D:2\twelveminutes.exe => Нет файла
Reboot:
End::

Start::
CreateRestorePoint:
S2 Transmission; "C:\Program Files (x86)\Transmission\transmission-qt.exe" /go [X] <==== ВНИМАНИЕ
FirewallRules: [TCP Query User{2E959126-7C87-4B5D-8424-ABA8EA16D6D0}C:0\twelveminutes.exe] => (Allow) C:0\twelveminutes.exe => Нет файла
FirewallRules: [UDP Query User{75FEA823-E23B-4DDC-B312-0AD503B01700}C:0\twelveminutes.exe] => (Allow) C:0\twelveminutes.exe => Нет файла
FirewallRules: [TCP Query User{B5760258-E46A-4083-A476-84991BAFA5BA}D:\program files\modifiablewindowsapps\quake 3\en\quake3.exe] => (Allow) D:\program files\modifiablewindowsapps\quake 3\en\quake3.exe => Нет файла
FirewallRules: [UDP Query User{418CA02D-91DB-4349-88AA-A9712E57E9C1}D:\program files\modifiablewindowsapps\quake 3\en\quake3.exe] => (Allow) D:\program files\modifiablewindowsapps\quake 3\en\quake3.exe => Нет файла
FirewallRules: [TCP Query User{2566A8D9-66FC-4ECA-9A9A-5C45C1DA505B}E:1\theascent\binaries\wingdk\theascent-wingdk-shipping.exe] => (Allow) E:1\theascent\binaries\wingdk\theascent-wingdk-shipping.exe => Нет файла
FirewallRules: [UDP Query User{8DF88CBA-9B6F-46A0-A0BA-13DAFF4BF1C7}E:1\theascent\binaries\wingdk\theascent-wingdk-shipping.exe] => (Allow) E:1\theascent\binaries\wingdk\theascent-wingdk-shipping.exe => Нет файла
FirewallRules: [TCP Query User{13B7460A-EF82-4B35-AEDC-5FB60A793D56}E:8\theascent\binaries\wingdk\theascent-wingdk-shipping.exe] => (Allow) E:8\theascent\binaries\wingdk\theascent-wingdk-shipping.exe => Нет файла
FirewallRules: [UDP Query User{063804B9-68A5-4B3D-B140-7DB5FF577A37}E:8\theascent\binaries\wingdk\theascent-wingdk-shipping.exe] => (Allow) E:8\theascent\binaries\wingdk\theascent-wingdk-shipping.exe => Нет файла
FirewallRules: [TCP Query User{B29C04BE-0F5C-4FD1-B660-7B13D49F9C7B}C:\program files\ldplayerbox\ldvboxheadless.exe] => (Allow) C:\program files\ldplayerbox\ldvboxheadless.exe => Нет файла
FirewallRules: [UDP Query User{B3DFA20B-6B35-4582-B3DE-9732A5530D9E}C:\program files\ldplayerbox\ldvboxheadless.exe] => (Allow) C:\program files\ldplayerbox\ldvboxheadless.exe => Нет файла
FirewallRules: [TCP Query User{16C97A86-613F-4426-88AE-74111E79D455}E:\games\battlefield 4\bf4.exe] => (Allow) E:\games\battlefield 4\bf4.exe => Нет файла
FirewallRules: [UDP Query User{8A298568-9B11-469B-B450-8E92B6D7FDCB}E:\games\battlefield 4\bf4.exe] => (Allow) E:\games\battlefield 4\bf4.exe => Нет файла
FirewallRules: [TCP Query User{8B6F637A-E83D-4D0F-B20B-BAF06F7D0760}C:2\theascent\binaries\wingdk\theascent-wingdk-shipping.exe] => (Allow) C:2\theascent\binaries\wingdk\theascent-wingdk-shipping.exe => Нет файла
FirewallRules: [UDP Query User{5A3F0294-6B13-4CEA-BCB6-9FF437F41775}C:2\theascent\binaries\wingdk\theascent-wingdk-shipping.exe] => (Allow) C:2\theascent\binaries\wingdk\theascent-wingdk-shipping.exe => Нет файла
CHR StartupUrls: Default -> "hxxp://mail.ru/cnt/10445?gp=812204","hxxps://mail.ru/cnt/10445?gp=811570","hxxps://mail.ru/cnt/10445?gp=813024","hxxps://www.google.com","hxxps://ovgorskiy.ru","hxxps://find-it.pro/?utm_source=distr_m"
Reboot:
End::

Start::
CreateRestorePoint:
gap prove 2.1.2.76 (HKLM-x32\...\{9a29b522-e75f-4227-9a7d-90708a49a60f}) (Version: 2.1.2.76 - Air Zapata S. de H. y Asoc.) Hidden
Social Media Ad Blocker 1.0.0.0 (HKLM-x32\...\{58dc5fa2-e588-422e-be3e-7974346fe16c}) (Version: 1.0.0.0 - Netreklami) Hidden
Reboot:
End::