Trend Micro Security

Trojan.Win32.WANNACASH.AA

2020年1月28日
 別名:

Ransom:Win32/Wannacash.SA!MSR (Microsoft); HEUR:Trojan-Ransom.Win32.Agent.gen (Kaspersky); Win32.Malware!Drop (Sunbelt)

 プラットフォーム:

Windows

 危険度:
 ダメージ度:
 感染力:
 感染確認数:


  • マルウェアタイプ: トロイの木馬型
  • 破壊活動の有無: なし
  • 暗号化:  
  • 感染報告の有無: はい

  概要


マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

  詳細

ファイルサイズ 2,067,968 bytes
タイプ EXE
メモリ常駐 はい
発見日 2020年1月28日

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、以下のプロセスを追加します。

  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"5c(ZP(Q$nGYX3V.u8-dR9-6w55h0o}5P" "%AppDataLocal%\Adobe\Acrobat\DC\1 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Adobe\Acrobat\DC\IconCacheRdr65536.dat"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"5c(ZP(Q$nGYX3V.u8-dR9-6w55h0o}5P" "%AppDataLocal%\Adobe\Acrobat\DC\1 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Adobe\Acrobat\DC\IconCacheRdr65536.dat"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"j~@F,zCgQDl9KM5<28v-4PAz^jlHva(k" "%AppDataLocal%\2 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\GDIPFONTCACHEV1.DAT"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"j~@F,zCgQDl9KM5<28v-4PAz^jlHva(k" "%AppDataLocal%\2 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\GDIPFONTCACHEV1.DAT"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"e)h!gIBCG=j2L,p/P7UQN#,nY@Ac{Gtn" "%AppDataLocal%\Google\Chrome\User Data\Crashpad\3 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Crashpad\settings.dat"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"e)h!gIBCG=j2L,p/P7UQN#,nY@Ac{Gtn" "%AppDataLocal%\Google\Chrome\User Data\Crashpad\3 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Crashpad\settings.dat"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"V!)>.kB~f.-dI&6CGK:oRvew-jyU0St%" "%AppDataLocal%\Google\Chrome\User Data\Default\4 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Cookies"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"V!)>.kB~f.-dI&6CGK:oRvew-jyU0St%" "%AppDataLocal%\Google\Chrome\User Data\Default\4 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Cookies"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"hb~a)}"q#fQV+BM6b$f$%HiT@,+O80Cx" "%AppDataLocal%\Google\Chrome\User Data\Default\5 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Cookies-journal"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"hb~a)}"q#fQV+BM6b$f$%HiT@,+O80Cx" "%AppDataLocal%\Google\Chrome\User Data\Default\5 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Cookies-journal"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"7}}Rw/xg" "%AppDataLocal%\Google\Chrome\User Data\Default\databases\6 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\databases\Databases.db"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"7}}Rw/xg" "%AppDataLocal%\Google\Chrome\User Data\Default\databases\6 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\databases\Databases.db"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"KfZ?FZV-jgD8Se(E1=4~hqg"8kw^U^6i" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\7 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\icon_128.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"KfZ?FZV-jgD8Se(E1=4~hqg"8kw^U^6i" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\7 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\icon_128.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"oT$q0H"^lsyEBoFEY5bdPa@F/Y6C-4Kg" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\8 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\icon_16.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"oT$q0H"^lsyEBoFEY5bdPa@F/Y6C-4Kg" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\8 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\icon_16.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp".Av$$\n%B.zcTyWDch#Iuzz.&oXHR0md" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\9 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\main.html"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp".Av$$\n%B.zcTyWDch#Iuzz.&oXHR0md" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\9 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\main.html"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"dq3c^E>#v?opN*kEG#0a>F"Qp2l*)5}e" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\10 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\main.js"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"dq3c^E>#v?opN*kEG#0a>F"Qp2l*)5}e" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\10 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\main.js"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"rw-XU(v8tA$IgYN^5B>7JX~4+k=2bS=^" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_1\11 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_1\icon_128.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"rw-XU(v8tA$IgYN^5B>7JX~4+k=2bS=^" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_1\11 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_1\icon_128.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"$m38YW&@?L,5c7AmKJ.kHAuH6fR2DlOV" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_1\12 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_1\icon_16.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"$m38YW&@?L,5c7AmKJ.kHAuH6fR2DlOV" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_1\12 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_1\icon_16.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"c"Hqa$+q!4E%0bVv#FAJZ&n6MzOD^bQ%" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_1\13 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_1\main.html"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"c"Hqa$+q!4E%0bVv#FAJZ&n6MzOD^bQ%" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_1\13 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_1\main.html"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"A?c,?vvt>Fmn:Z%B^
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"A?c,?vvt>Fmn:Z%B^
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"Xfi6-QVhNU)l$ODr0haxCO83y0ImG72f" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.2_0\15 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.2_0\128.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"Xfi6-QVhNU)l$ODr0haxCO83y0ImG72f" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.2_0\15 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.2_0\128.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"i/y@yin1cBcSDduY?CY"?G*,d8id~q*B" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\16 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\128.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"i/y@yin1cBcSDduY?CY"?G*,d8id~q*B" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\16 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\128.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"zHQe0FtW\aEF\R}Hb~Rlqz&e6/F*L2Bo" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\17 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\common.css"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"zHQe0FtW\aEF\R}Hb~Rlqz&e6/F*L2Bo" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\17 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\common.css"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"Bk=<5%OVT?WViaExvmU5+fL/Nn
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"Bk=<5%OVT?WViaExvmU5+fL/Nn
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"G)Lj:SW.}EAI13==%*+O90l5SEcpo"-X" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\19 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\options.css"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"G)Lj:SW.}EAI13==%*+O90l5SEcpo"-X" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\19 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\options.css"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"(N7(A3i\s^Sa"s^l16TS95&^ZB{^lXOX" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\20 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\popup.css"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"(N7(A3i\s^Sa"s^l16TS95&^ZB{^lXOX" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\20 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\popup.css"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"C4p7"uK\"*$?\51LHX0?lY{Y1(rv{8FH" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\21 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\popupUI.css"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"C4p7"uK\"*$?\51LHX0?lY{Y1(rv{8FH" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\21 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\popupUI.css"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"@kYlF5v@%cTx&~9/L5N6NS##3k,qqF,n" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\22 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\progress.css"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"@kYlF5v@%cTx&~9/L5N6NS##3k,qqF,n" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\22 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\progress.css"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"5uLG/X221mjSh7Ny.C?1uMq)jL-/D%j}" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\23 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\AcrobatDCLogo.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"5uLG/X221mjSh7Ny.C?1uMq)jL-/D%j}" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\23 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\AcrobatDCLogo.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"5,Uf+>5+^nBUO7)*Ri(q>u!%R57+gs!K" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\24 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_128.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"5,Uf+>5+^nBUO7)*Ri(q>u!%R57+gs!K" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\24 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_128.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"B:C4P%ryC.{i#U1,LCv7m%NiObop+^6y" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\25 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_16.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"B:C4P%ryC.{i#U1,LCv7m%NiObop+^6y" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\25 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_16.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"3}xRehgzxjDhbrO78%xCWvA.?(iGgceA" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\26 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_16_translucent.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"3}xRehgzxjDhbrO78%xCWvA.?(iGgceA" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\26 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_16_translucent.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"S{O{JA>2xZ7z7uW^DB5R>IAE\r6R42CX" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\27 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_20x19.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"S{O{JA>2xZ7z7uW^DB5R>IAE\r6R42CX" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\27 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_20x19.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"FMIh:DJ2*PGL/2NH1Lkm1Aj3rlRWbk1*" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\28 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_20x19_translucent.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"FMIh:DJ2*PGL/2NH1Lkm1Aj3rlRWbk1*" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\28 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_20x19_translucent.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"nBB1K0e@N&\$8vK6TVk0T=n>~",@Kb.." "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\29 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_24.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"nBB1K0e@N&\$8vK6TVk0T=n>~",@Kb.." "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\29 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_24.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"CFJjEqv\>e)=Zhe5oi{hcd^9Wl)9j~Q&" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\30 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_24_translucent.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"CFJjEqv\>e)=Zhe5oi{hcd^9Wl)9j~Q&" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\30 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_24_translucent.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"YXLSNJ{3ze1fYK+U.(/O6x7walr=!=*v" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\31 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_38x37.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"YXLSNJ{3ze1fYK+U.(/O6x7walr=!=*v" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\31 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_38x37.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"\lGNQ-%X8q4~FWxH4^L5eG@0rUoZX^*^" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\32 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_38x37_translucent.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"\lGNQ-%X8q4~FWxH4^L5eG@0rUoZX^*^" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\32 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_38x37_translucent.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"zGo4XNBGMM$*Z/xf5LxRc+=?l\PIx?3?" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\33 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_48.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"zGo4XNBGMM$*Z/xf5LxRc+=?l\PIx?3?" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\33 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_48.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"4(wFt3-5>Qy3Pww=)cP9jsyshElNz7da" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\34 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_48_translucent.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"4(wFt3-5>Qy3Pww=)cP9jsyshElNz7da" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\34 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_48_translucent.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp":/yzS0z5-{*5JSXMe!mv"!Mmx!$A"6=s" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\35 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_56x54.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp":/yzS0z5-{*5JSXMe!mv"!Mmx!$A"6=s" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\35 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acrobat_dc_appicon_56x54.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"!j*n>I$qMpl)Bf9ryWQ^LUwGBH(v+fC%" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\36 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acro_new.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"!j*n>I$qMpl)Bf9ryWQ^LUwGBH(v+fC%" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\36 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\acro_new.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"^=bQ2s:kX5r}Ju#c&.&ZQ^UROkiDY$WF" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\37 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\CloseX.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"^=bQ2s:kX5r}Ju#c&.&ZQ^UROkiDY$WF" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\37 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\CloseX.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"ZzqdF"7T8X38paB(qJB$MRejYALjTAD9" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\38 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\FailIcon.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"ZzqdF"7T8X38paB(qJB$MRejYALjTAD9" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\38 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\FailIcon.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"s3Oa:$~<(6D
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"s3Oa:$~<(6D
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"~v7iB"iu"lWl}tVNHArLl!nL(?X$xB23" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\40 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\progress.gif"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"~v7iB"iu"lWl}tVNHArLl!nL(?X$xB23" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\40 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\progress.gif"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"\dZj,DX!D{L$kI1SRU}sr/w"n,9s}&\e" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\41 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\spinner.gif"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"\dZj,DX!D{L$kI1SRU}sr/w"n,9s}&\e" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\41 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\spinner.gif"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"jc&>zE/6HSpZfol=YBxj?o@b1DZseAXr" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\42 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\SuccessIcon.png"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"jc&>zE/6HSpZfol=YBxj?o@b1DZseAXr" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\42 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\SuccessIcon.png"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"&GWJ?kX/6S>%^BmL\evo*uW*@
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"&GWJ?kX/6S>%^BmL\evo*uW*@
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"{%.FS\sgs5@B{S8pd8@vfuS,)ax-=Tog" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\44 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\ch-content-script.js"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"{%.FS\sgs5@B{S8pd8@vfuS,)ax-=Tog" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\44 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\ch-content-script.js"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"z01b!}p1WJr41lK7jp,xt*"&T4
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"z01b!}p1WJr41lK7jp,xt*"&T4
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp".Gr5Sg=Y&jVzc,hmwH^.tr>#u#u?%z\q" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\46 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\ff-context-menu.js"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp".Gr5Sg=Y&jVzc,hmwH^.tr>#u#u?%z\q" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\46 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\ff-context-menu.js"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"#WzDOHS\v>E^gRX-iINyi!D(cCM4p*C," "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\47 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\frame.html"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"#WzDOHS\v>E^gRX-iINyi!D(cCM4p*C," "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\47 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\frame.html"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"v#zatLQr!.J0(vjS\za,%v(t^=OqyBJv" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\48 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\frame.js"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"v#zatLQr!.J0(vjS\za,%v(t^=OqyBJv" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\48 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\frame.js"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"}a7fS}>,uIEMS=6AI,Ye.5kGL%T%TVv8" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\49 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\frameUI.html"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"}a7fS}>,uIEMS=6AI,Ye.5kGL%T%TVv8" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\49 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\frameUI.html"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"#kMy+*?T>\p=l9QK$MIJuug17/MN+p{Y" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\50 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\frameUI.js"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"#kMy+*?T>\p=l9QK$MIJuug17/MN+p{Y" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\50 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\frameUI.js"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"UZr~GE+?hk*<}lHkX{QFUB}t:HC?/Q17" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\51 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\get-html.js"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"UZr~GE+?hk*<}lHkX{QFUB}t:HC?/Q17" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\51 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\get-html.js"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"$)wRs4iNsDFg-J)*\.&UqcfK4kRUZd?+" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\libs\52 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\libs\jquery-3.1.1.js"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"$)wRs4iNsDFg-J)*\.&UqcfK4kRUZd?+" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\libs\52 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\libs\jquery-3.1.1.js"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"~3VvV\nsM#UzQ+:#,Drf!Abva(J%ZT4:" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\libs\53 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\libs\jquery-3.1.1.min.js"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"~3VvV\nsM#UzQ+:#,Drf!Abva(J%ZT4:" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\libs\53 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\libs\jquery-3.1.1.min.js"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"Nx#r6H2D^<(6wysbzi3^B/#6N{@BL.4x" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\54 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\options.html"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"Nx#r6H2D^<(6wysbzi3^B/#6N{@BL.4x" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\54 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\options.html"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"6tFpvNq!}2+G^R$!LNRe+vJmtWe+SH\i" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\55 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\options.js"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"6tFpvNq!}2+G^R$!LNRe+vJmtWe+SH\i" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\55 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\options.js"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"i5
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"i5
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"Q*~sPf
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"Q*~sPf
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"ddk-W4>&tY}oFZN3r+\m~W*?:440Pyv3" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\58 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\settings.js"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"ddk-W4>&tY}oFZN3r+\m~W*?:440Pyv3" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\58 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\settings.js"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"EMOtL7basp+CDY%VDu=eG7scXmL5D)?o" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\59 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\acro-actions.js"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"EMOtL7basp+CDY%VDu=eG7scXmL5D)?o" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\59 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\acro-actions.js"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"fp\Z#,GA$Mh/Y/?ZP(x3pAp4$9!#/~t(" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\60 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\acro-gstate.js"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"fp\Z#,GA$Mh/Y/?ZP(x3pAp4$9!#/~t(" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\60 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\acro-gstate.js"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"=Vr7(\cze2=)qBsW"v<%UQ}N%<.=f-7<" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\61 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\acro-web2pdf.js"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"=Vr7(\cze2=)qBsW"v<%UQ}N%<.=f-7<" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\61 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\acro-web2pdf.js"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"dmGZ\ggOMG"CEW-LRz"w7/?W!lmp9fYP" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\62 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\analytics.js"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"dmGZ\ggOMG"CEW-LRz"w7/?W!lmp9fYP" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\62 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\analytics.js"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"hA!ks(PpsXe(tB8u:?1g#Nq@:.wN=Fww" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\63 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\ch-context-menu.js"
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"hA!ks(PpsXe(tB8u:?1g#Nq@:.wN=Fww" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\63 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year" "%AppDataLocal%\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\ch-context-menu.js"
  • "%User Temp%\Rar.exe" a -y -ep -inul -k -m0 -hp"&3e7B+GUa3f2A
  • %User Temp%\Rar.exe a -y -ep -inul -k -m0 -hp"&3e7B+GUa3f2A

(註：%AppDataLocal%フォルダは、ローカルアプリケーションデータフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local" です。)

他のシステム変更

マルウェアは、以下のファイルを改変します。

  • %AppDataLocal%\2 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year
  • %AppDataLocal%\Google\Chrome\User Data\Crashpad\3 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year

(註：%AppDataLocal%フォルダは、ローカルアプリケーションデータフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local" です。)

マルウェアは、以下のファイルを削除します。

  • %AppDataLocal%\Google\Chrome\User Data\Crashpad\settings.dat
  • %AppDataLocal%\GDIPFONTCACHEV1.DAT

(註：%AppDataLocal%フォルダは、ローカルアプリケーションデータフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local" です。)

マルウェアは、以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
getsbi = "matka"

作成活動

マルウェアは、以下のファイルを作成します。

  • %User Temp%\Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\19.rar
  • %User Temp%\Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\45.rar
  • %User Temp%\Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\16.rar
  • %User Temp%\Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\7.rar
  • %User Temp%\Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\20.rar
  • %User Temp%\Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\61.rar
  • %AppDataLocal%\Google\Chrome\User Data\Crashpad\3 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year
  • %User Temp%\Rar.exe
  • %User Temp%\Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\10.rar
  • %User Temp%\Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\56.rar
  • %User Temp%\Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\8.rar
  • %User Temp%\Data\Default\5.rar
  • %User Temp%\Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_1\13.rar
  • %User Temp%\Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\29.rar
  • %User Temp%\Public.key
  • %AppDataLocal%\2 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year
  • %User Temp%\Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\41.rar
  • %User Temp%\Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\38.rar
  • %User Temp%\Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\57.rar

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %AppDataLocal%フォルダは、ローカルアプリケーションデータフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local" です。)

このウイルス情報は、自動解析システムにより作成されました。

  対応方法

対応検索エンジン: 9.850

手順 1

Windows XP、Windows Vista および Windows 7 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。

手順 2

「Trojan.Win32.WANNACASH.AA」で検出したファイル名を確認し、そのファイルを終了します。

[ 詳細 ]

  • すべての実行中プロセスが、Windows のタスクマネージャに表示されない場合があります。この場合、"Process Explorer" などのツールを使用しマルウェアのファイルを終了してください。"Process Explorer" については、こちらをご参照下さい。
  • 検出ファイルが、Windows のタスクマネージャまたは "Process Explorer" に表示されるものの、削除できない場合があります。この場合、コンピュータをセーフモードで再起動してください。
    セーフモードについては、こちらをご参照下さい。
  • 検出ファイルがタスクマネージャ上で表示されない場合、次の手順にお進みください。

手順 3

このレジストリ値を削除します。

[ 詳細 ]

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
    • getsbi = "matka"

手順 4

以下のファイルを検索し削除します。

[ 詳細 ]
コンポーネントファイルが隠しファイル属性の場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。
  • %User Temp%\Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\19.rar
  • %User Temp%\Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\45.rar
  • %User Temp%\Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\16.rar
  • %User Temp%\Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\7.rar
  • %User Temp%\Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\css\20.rar
  • %User Temp%\Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\lib\61.rar
  • %AppDataLocal%\Google\Chrome\User Data\Crashpad\3 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year
  • %User Temp%\Rar.exe
  • %User Temp%\Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\10.rar
  • %User Temp%\Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\56.rar
  • %User Temp%\Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\8.rar
  • %User Temp%\Data\Default\5.rar
  • %User Temp%\Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_1\13.rar
  • %User Temp%\Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\29.rar
  • %User Temp%\Public.key
  • %AppDataLocal%\2 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year
  • %User Temp%\Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\41.rar
  • %User Temp%\Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\images\38.rar
  • %User Temp%\Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\15.1.1.0_0\data\js\57.rar

手順 5

最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、ウイルス検索を実行してください。「Trojan.Win32.WANNACASH.AA」と検出したファイルはすべて削除してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。

手順 6

以下のファイルをバックアップを用いて修復します。マイクロソフト製品に関連したファイルのみに修復されます。このマルウェアが同社製品以外のプログラムをも削除した場合には、該当プログラムを再度インストールする必要があります。

  • %AppDataLocal%\2 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year
  • %AppDataLocal%\Google\Chrome\User Data\Crashpad\3 \xd0\xa4\xd0\xb0\xd0\xb9\xd0\xbb \xd0\xb7\xd0\xb0\xd1\x88\xd0\xb8\xd1\x84\xd1\x80\xd0\xbe\xd0\xb2\xd0\xb0\xd0\xbd. \xd0\x9f\xd0\xb8\xd1\x88\xd0\xb8 noallpossible@cock.li .happy new year

手順 7

以下のファイルをバックアップを用いて修復します。なお、マイクロソフト製品に関連したファイルのみ修復されます。このマルウェア／グレイウェア／スパイウェアが同社製品以外のプログラムをも削除した場合には、該当プログラムを再度インストールする必要があります。

  • %AppDataLocal%\Google\Chrome\User Data\Crashpad\settings.dat
  • %AppDataLocal%\GDIPFONTCACHEV1.DAT


ご利用はいかがでしたか？　アンケートにご協力ください