Trojan.MulDrop16.18441

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\Software\Classes\RxProfile.File\shell\open\command] '' = '"%ProgramFiles(x86)%\Rename Expert\Rename_Expert.exe" "%1"'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\aut515a.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-c9t0e.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-aicia.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-4bvs4.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-tcbou.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-v3e5b.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-pqd1f.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-lm1u5.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-1npcb.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-ejkpr.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-8dn7s.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-i3ba6.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-soj5t.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-nbrp5.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-7o7ul.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-g3vbj.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-vnohr.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-5fkih.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\is-l0hl4.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\is-5ok5g.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\is-10c0d.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-ctlet.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-eoh98.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-6sc3d.tmp
%ProgramFiles(x86)%\rename expert\viewprofiles\is-0qovn.tmp
%ProgramFiles(x86)%\rename expert\rename_expert.exe
%ProgramFiles(x86)%\rename expert\unins000.dat
%ProgramFiles(x86)%\rename expert\unins000.msg
%APPDATA%\microsoft\windows\sendto\rename expert.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\rename expert\uninstall rename expert.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\rename expert\rename expert.lnk
%WINDIR%\syswow64\is-buiv8.tmp
%ProgramFiles(x86)%\rename expert\viewprofiles\is-8ne3k.tmp
%ProgramFiles(x86)%\rename expert\viewprofiles\is-lv7jo.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-n05ec.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-2dfvh.tmp
%ProgramFiles(x86)%\rename expert\viewprofiles\is-q4van.tmp
%ProgramFiles(x86)%\rename expert\viewprofiles\is-7ri3b.tmp
%ProgramFiles(x86)%\rename expert\viewprofiles\is-t69ln.tmp
%ProgramFiles(x86)%\rename expert\viewprofiles\is-cen52.tmp
%ProgramFiles(x86)%\rename expert\viewprofiles\is-4sksc.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-4stbg.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-d5ej5.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-5ir7h.tmp
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-sp33s.tmp
%ProgramFiles(x86)%\rename expert\viewprofiles\is-61mq0.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-lm21r.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-lbl5s.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-ouukh.tmp
%ProgramFiles(x86)%\rename expert\is-5c6q3.tmp
%TEMP%\is-k5ucp.tmp\_isetup\_shfoldr.dll
%TEMP%\is-k5ucp.tmp\_isetup\_setup64.tmp
%TEMP%\is-466o8.tmp\setup.tmp
%WINDIR%\temp\temp_1\restfiles\reg64.reg
%TEMP%\aut5805.tmp
%WINDIR%\temp\temp_1\restfiles\reg.reg
%TEMP%\aut57e5.tmp
%ProgramFiles(x86)%\rename expert\is-4nu7g.tmp
%WINDIR%\temp\temp_1\restfiles\short64.cmd
%WINDIR%\temp\temp_1\restfiles\short.cmd
%TEMP%\aut57b4.tmp
%WINDIR%\temp\temp_1\restfiles\crack64.exe
%TEMP%\aut565c.tmp
%WINDIR%\temp\temp_1\restfiles\crack.exe
%TEMP%\aut5533.tmp
%WINDIR%\temp\temp_1\restfiles\setup.exe
%TEMP%\aut51d8.tmp
%WINDIR%\temp\temp_1\restfiles\blackbunny.gif
%TEMP%\aut57c5.tmp
%ProgramFiles(x86)%\rename expert\is-p77me.tmp
%ProgramFiles(x86)%\rename expert\is-b7odv.tmp
%ProgramFiles(x86)%\rename expert\is-o2tdd.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-f9pl4.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-i7m64.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-saqps.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-6m2qg.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-intvl.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-gmtv5.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-qvtqt.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-gdcqg.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-dnv9s.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-lfvc6.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-nc263.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-gar6c.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\is-3dhte.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-1q16g.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-540go.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-hjf1l.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-tgcsg.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-cn0sa.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-rnt44.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-agmlb.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\is-pec7e.tmp
%ProgramFiles(x86)%\rename expert\languages\lngde\is-a97vt.tmp
%TEMP%\20719-4972-18077-21825.vbs
%HOMEPATH%\desktop\rename expert.lnk

Удаляет следующие файлы

%TEMP%\aut515a.tmp
%WINDIR%\temp\temp_1\restfiles\setup.exe
%WINDIR%\temp\temp_1\restfiles\reg64.reg
%WINDIR%\temp\temp_1\restfiles\reg.reg
%WINDIR%\temp\temp_1\restfiles\crack64.exe
%WINDIR%\temp\temp_1\restfiles\crack.exe
%WINDIR%\temp\temp_1\restfiles\blackbunny.gif
%TEMP%\20719-4972-18077-21825.vbs
%TEMP%\is-466o8.tmp\setup.tmp
%TEMP%\is-k5ucp.tmp\_isetup\_shfoldr.dll
%TEMP%\is-k5ucp.tmp\_isetup\_setup64.tmp
%TEMP%\aut5805.tmp
%TEMP%\aut57e5.tmp
%TEMP%\aut57c5.tmp
%TEMP%\aut57b4.tmp
%TEMP%\aut565c.tmp
%TEMP%\aut5533.tmp
%TEMP%\aut51d8.tmp
%WINDIR%\temp\temp_1\restfiles\short.cmd
%WINDIR%\temp\temp_1\restfiles\short64.cmd

Перемещает следующие файлы

%ProgramFiles(x86)%\rename expert\is-5c6q3.tmp в %ProgramFiles(x86)%\rename expert\unins000.exe
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-vnohr.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\first group of letters in capitals.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-g3vbj.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\image dimensions (at end of name).rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-7o7ul.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\image dimensions + file size.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-nbrp5.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\insert file content (html-title) at end .rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-soj5t.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\insert parent folder name at the beginning.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-ctlet.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\insert part of file name into folder name.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-i3ba6.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\lower case file extension.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-ejkpr.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\move files into subfolders (image dimensions).rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-1npcb.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\numbering (at end of name).rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-lm1u5.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\photo-shooting date with conditional numbering.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-pqd1f.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\photo-shooting date with sequential numbering.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-v3e5b.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\remove duplicate characters.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-tcbou.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\renumbering.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-4bvs4.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\replace 'old' with 'new'.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-aicia.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\replace area between ().rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-c9t0e.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\replace names with track number - title.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-6sc3d.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\replace-list-example.txt
%ProgramFiles(x86)%\rename expert\viewprofiles\is-lv7jo.tmp в %ProgramFiles(x86)%\rename expert\viewprofiles\standard.xml
%ProgramFiles(x86)%\rename expert\viewprofiles\is-61mq0.tmp в %ProgramFiles(x86)%\rename expert\viewprofiles\pdf.xml
%ProgramFiles(x86)%\rename expert\viewprofiles\is-0qovn.tmp в %ProgramFiles(x86)%\rename expert\viewprofiles\iptc.xml
%ProgramFiles(x86)%\rename expert\viewprofiles\is-q4van.tmp в %ProgramFiles(x86)%\rename expert\viewprofiles\images.xml
%ProgramFiles(x86)%\rename expert\viewprofiles\is-7ri3b.tmp в %ProgramFiles(x86)%\rename expert\viewprofiles\exif.xml
%ProgramFiles(x86)%\rename expert\viewprofiles\is-t69ln.tmp в %ProgramFiles(x86)%\rename expert\viewprofiles\email.xml
%ProgramFiles(x86)%\rename expert\viewprofiles\is-4sksc.tmp в %ProgramFiles(x86)%\rename expert\viewprofiles\audio.xml
%ProgramFiles(x86)%\rename expert\viewprofiles\is-cen52.tmp в %ProgramFiles(x86)%\rename expert\viewprofiles\documents.xml
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-4stbg.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\web-safe names.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-d5ej5.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\swap text in front of and behind ' - '.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-5ir7h.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\shorten names to 3 words.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-sp33s.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\shorten names to 128 characters.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-n05ec.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\sharepoint-compliant names.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-2dfvh.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\set number of leading zeroes to two.rxprofile
%ProgramFiles(x86)%\rename expert\viewprofiles\is-8ne3k.tmp в %ProgramFiles(x86)%\rename expert\viewprofiles\video.xml
%ProgramFiles(x86)%\rename expert\languages\lngen\profiles\is-5fkih.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\profiles\casing-list-example.txt
%ProgramFiles(x86)%\rename expert\languages\lngen\is-l0hl4.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\templates.xml
%ProgramFiles(x86)%\rename expert\languages\lngen\is-5ok5g.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\license.rtf
%ProgramFiles(x86)%\rename expert\is-b7odv.tmp в %ProgramFiles(x86)%\rename expert\ielib32.dll
%ProgramFiles(x86)%\rename expert\is-4nu7g.tmp в %ProgramFiles(x86)%\rename expert\languages.xml
%ProgramFiles(x86)%\rename expert\is-p77me.tmp в %ProgramFiles(x86)%\rename expert\mediainfo.dll
%ProgramFiles(x86)%\rename expert\is-o2tdd.tmp в %ProgramFiles(x86)%\rename expert\rename_expert.exe
%ProgramFiles(x86)%\rename expert\languages\lngde\is-3dhte.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\help-de.chm
%ProgramFiles(x86)%\rename expert\languages\lngde\is-a97vt.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\license.rtf
%ProgramFiles(x86)%\rename expert\languages\lngde\is-pec7e.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\templates.xml
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-agmlb.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\anzahl fГјhrender nullen auf zwei setzen.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-rnt44.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\bereich zwischen () ersetzen.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-cn0sa.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\bildabmessungen (am ende des namens).rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-tgcsg.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\bilder verschieben in unterordner (bildmaГџe).rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-hjf1l.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\bildmaГџe + grГ¶Гџe.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-540go.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\casing-list-example.txt
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-1q16g.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\dateiendung klein schreiben.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-gar6c.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\dateiinhalt (html-titel) am ende einfГјgen .rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-i7m64.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\entferne doppelte zeichen.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-nc263.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\ersetze 'alt' durch 'neu'.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-eoh98.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\websichere namen.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-8dn7s.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\vertausche den text vor und nach ' - '.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-lm21r.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\teil vom dateinamen in ordnername einfГјgen.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-lbl5s.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\sharepoint-konforme namen.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-ouukh.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\replace-list-example.txt
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-f9pl4.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\nummerierung (am ende des namens).rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-6m2qg.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\namen des elternordners am anfang einfГјgen.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-saqps.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\neunummerierung.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-intvl.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\namen auf 3 wГ¶rter kГјrzen.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-gmtv5.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\namen auf 128 zeichen kГјrzen.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-qvtqt.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\foto-aufnahmedatum mit fortlaufender nummerierung.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-gdcqg.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\foto-aufnahmedatum mit bedingter nummerierung.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-dnv9s.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\erste buchstabengruppe in groГџbuchstaben.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngde\profiles\is-lfvc6.tmp в %ProgramFiles(x86)%\rename expert\languages\lngde\profiles\ersetze namen durch track-nr. - titel.rxprofile
%ProgramFiles(x86)%\rename expert\languages\lngen\is-10c0d.tmp в %ProgramFiles(x86)%\rename expert\languages\lngen\help-en.chm
%WINDIR%\syswow64\is-buiv8.tmp в %WINDIR%\syswow64\debenupdflibrarylite1011.dll

Другое

Ищет следующие окна

ClassName: '' WindowName: 'Rename Expert (registriert)'
ClassName: '' WindowName: 'Rename Expert (Demo)'
ClassName: '' WindowName: 'Rename Expert (registered)'
ClassName: '' WindowName: 'Rename Expert Free (non-commercial use)'
ClassName: '' WindowName: 'Rename Expert Free (nichtkommerzielle Verwendung)'
ClassName: '' WindowName: 'Rename Expert Pro (non-commercial use)'
ClassName: '' WindowName: 'Rename Expert Pro (nichtkommerzielle Verwendung)'
ClassName: '' WindowName: 'Rename Expert Business'
ClassName: 'EDIT' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''

Создает и запускает на исполнение

'%WINDIR%\temp\temp_1\restfiles\setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-466o8.tmp\setup.tmp' /SL5="$B0216,10236443,119296,%WINDIR%\Temp\Temp_1\restfiles\setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%WINDIR%\temp\temp_1\restfiles\crack64.exe'
'%WINDIR%\syswow64\cscript.exe' /nologo "%TEMP%\20719-4972-18077-21825.vbs"

Запускает на исполнение

'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\DebenuPDFLibraryLite1011.dll"
'%WINDIR%\syswow64\regedit.exe' /S Reg64.reg
'%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Temp\Temp_1\restfiles\\short64.cmd

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней