Техническая информация
- '<SYSTEM32>\taskkill.exe' /IM eservutil.exe /F
- %TEMP%\RarSFX0\0.cmd
- %TEMP%\RarSFX0\0.exe
- %TEMP%\RarSFX0\active.data
- %CommonProgramFiles%\ArcSoft\esinter\Bin\eservutil.exe
- %CommonProgramFiles%\ArcSoft\esinter\Bin\esinter.exe
- %CommonProgramFiles%\ArcSoft\esinter\Bin\esIpm3.dll
- %ProgramFiles%\ArcSoft\PhotoStudio 6\Language\ResDll\en\MenuRes.dll
- %ProgramFiles%\ArcSoft\PhotoStudio 6\Language\ResDll\en\Res_Dll.dll
- %ProgramFiles%\ArcSoft\PhotoStudio 6\Language\ResDll\en\Extras.set
- %TEMP%\RarSFX0\active.data
- %TEMP%\RarSFX0\0.exe
- %TEMP%\RarSFX0\0.cmd
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
- '%TEMP%\RarSFX0\0.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\0.cmd" "