Техническая информация
- %TEMP%\RarSFX0\start.exe
- <SYSTEM32>\attrib.exe f:\autorun.inf +s +h +r
- <SYSTEM32>\attrib.exe f:\autorun.inf -s -h -r
- <SYSTEM32>\attrib.exe e:\autorun.inf +s +h +r
- <SYSTEM32>\attrib.exe g:\autorun.inf -s -h -r
- <SYSTEM32>\attrib.exe h:\autorun.inf +s +h +r
- <SYSTEM32>\attrib.exe h:\autorun.inf -s -h -r
- <SYSTEM32>\attrib.exe g:\autorun.inf +s +h +r
- <SYSTEM32>\attrib.exe e:\autorun.inf -s -h -r
- <SYSTEM32>\attrib.exe n:\yeyinhi.exe +s +h +r
- <SYSTEM32>\attrib.exe n:\yeyinhi.exe -s -h -r
- <SYSTEM32>\attrib.exe m:\yeyinhi.exe +s +h +r
- <SYSTEM32>\attrib.exe c:\autorun.inf -s -h -r
- <SYSTEM32>\attrib.exe <Имя диска съемного носителя>:\autorun.inf +s +h +r
- <SYSTEM32>\attrib.exe <Имя диска съемного носителя>:\autorun.inf -s -h -r
- <SYSTEM32>\attrib.exe c:\autorun.inf +s +h +r
- <SYSTEM32>\attrib.exe i:\autorun.inf -s -h -r
- <SYSTEM32>\attrib.exe o:\autorun.inf +s +h +r
- <SYSTEM32>\attrib.exe o:\autorun.inf -s -h -r
- <SYSTEM32>\attrib.exe n:\autorun.inf +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\zaq.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\gamesetup.exe +s +h +r
- <SYSTEM32>\attrib.exe <SYSTEM32>\msstart.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\uninstall\rundl132.exe +s +h +r
- <SYSTEM32>\attrib.exe n:\autorun.inf -s -h -r
- <SYSTEM32>\attrib.exe k:\autorun.inf +s +h +r
- <SYSTEM32>\attrib.exe k:\autorun.inf -s -h -r
- <SYSTEM32>\attrib.exe i:\autorun.inf +s +h +r
- <SYSTEM32>\attrib.exe l:\autorun.inf -s -h -r
- <SYSTEM32>\attrib.exe m:\autorun.inf +s +h +r
- <SYSTEM32>\attrib.exe m:\autorun.inf -s -h -r
- <SYSTEM32>\attrib.exe l:\autorun.inf +s +h +r
- <SYSTEM32>\attrib.exe m:\yeyinhi.exe -s -h -r
- <SYSTEM32>\attrib.exe e:\tubjsoe.exe +s +h +r
- <SYSTEM32>\attrib.exe e:\tubjsoe.exe -s -h -r
- <SYSTEM32>\attrib.exe e:\yeyinhi.exe +s +h +r
- <SYSTEM32>\attrib.exe f:\yeyinhi.exe -s -h -r
- <SYSTEM32>\attrib.exe f:\tubjsoe.exe +s +h +r
- <SYSTEM32>\attrib.exe f:\tubjsoe.exe -s -h -r
- <SYSTEM32>\attrib.exe f:\yeyinhi.exe +s +h +r
- <SYSTEM32>\attrib.exe e:\yeyinhi.exe -s -h -r
- <SYSTEM32>\attrib.exe c:\tubjsoe.exe +s +h +r
- <SYSTEM32>\attrib.exe c:\tubjsoe.exe -s -h -r
- <SYSTEM32>\attrib.exe c:\yeyinhi.exe +s +h +r
- <SYSTEM32>\attrib.exe <Имя диска съемного носителя>:\yeyinhi.exe -s -h -r
- <SYSTEM32>\attrib.exe <Имя диска съемного носителя>:\tubjsoe.exe +s +h +r
- <SYSTEM32>\attrib.exe <Имя диска съемного носителя>:\tubjsoe.exe -s -h -r
- <SYSTEM32>\attrib.exe <Имя диска съемного носителя>:\yeyinhi.exe +s +h +r
- <SYSTEM32>\attrib.exe g:\yeyinhi.exe -s -h -r
- <SYSTEM32>\attrib.exe j:\yeyinhi.exe +s +h +r
- <SYSTEM32>\attrib.exe j:\yeyinhi.exe -s -h -r
- <SYSTEM32>\attrib.exe i:\yeyinhi.exe +s +h +r
- <SYSTEM32>\attrib.exe k:\yeyinhi.exe -s -h -r
- <SYSTEM32>\attrib.exe l:\yeyinhi.exe +s +h +r
- <SYSTEM32>\attrib.exe l:\yeyinhi.exe -s -h -r
- <SYSTEM32>\attrib.exe k:\yeyinhi.exe +s +h +r
- <SYSTEM32>\attrib.exe i:\yeyinhi.exe -s -h -r
- <SYSTEM32>\attrib.exe g:\tubjsoe.exe +s +h +r
- <SYSTEM32>\attrib.exe g:\tubjsoe.exe -s -h -r
- <SYSTEM32>\attrib.exe g:\yeyinhi.exe +s +h +r
- <SYSTEM32>\attrib.exe h:\yeyinhi.exe -s -h -r
- <SYSTEM32>\attrib.exe h:\tubjsoe.exe +s +h +r
- <SYSTEM32>\attrib.exe h:\tubjsoe.exe -s -h -r
- <SYSTEM32>\attrib.exe h:\yeyinhi.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\fonts\gjfhbzc.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\fonts\gjfhbzc.exe -s -h -r
- <SYSTEM32>\attrib.exe %WINDIR%\fonts\jsqxczc.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\fonts\wsmsgzx.dll -s -h -r
- <SYSTEM32>\attrib.exe %WINDIR%\fonts\wsmsgax.dll +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\fonts\wsmsgax.dll -s -h -r
- <SYSTEM32>\attrib.exe %WINDIR%\fonts\wsmsgzx.dll +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\fonts\jsqxczc.exe -s -h -r
- <SYSTEM32>\attrib.exe <SYSTEM32>\wzlauncher.exe +s +h +r
- <SYSTEM32>\attrib.exe <SYSTEM32>\wzlauncher.exe -s -h -r
- <SYSTEM32>\attrib.exe %WINDIR%\ooepqk.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\fonts\jsqxcss.dll -s -h -r
- <SYSTEM32>\attrib.exe %WINDIR%\fonts\gjfhbss.dll +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\fonts\gjfhbss.dll -s -h -r
- <SYSTEM32>\attrib.exe %WINDIR%\fonts\jsqxcss.dll +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\fonts\wsmsgzx.exe -s -h -r
- <SYSTEM32>\attrib.exe "%ALLUSERSPROFILE%\application data\microsoft\office\userdata\nsl22_4d9d75cd.dll" +s +h +r
- <SYSTEM32>\attrib.exe "%ALLUSERSPROFILE%\application data\microsoft\office\userdata\nsl22_4d9d75cd.dll" -s -h -r
- <SYSTEM32>\attrib.exe <DRIVERS>\msacpe.sys +s +h +r
- <SYSTEM32>\attrib.exe "%ALLUSERSPROFILE%\application data\microsoft\pctools\pctools.dll" -s -h -r
- <SYSTEM32>\attrib.exe "%PROGRAM_FILES%\microsoft office\system\dodolook_7005.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%PROGRAM_FILES%\microsoft office\system\dodolook_7005.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%ALLUSERSPROFILE%\application data\microsoft\pctools\pctools.dll" +s +h +r
- <SYSTEM32>\attrib.exe <DRIVERS>\msacpe.sys -s -h -r
- <SYSTEM32>\attrib.exe %WINDIR%\fonts\wsmsgax.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\fonts\wsmsgax.exe -s -h -r
- <SYSTEM32>\attrib.exe %WINDIR%\fonts\wsmsgzx.exe +s +h +r
- <SYSTEM32>\attrib.exe <SYSTEM32>\helps.dll -s -h -r
- <SYSTEM32>\attrib.exe "%PROGRAM_FILES%\internet explorer\signup\instali.sys" +s +h +r
- <SYSTEM32>\attrib.exe "%PROGRAM_FILES%\internet explorer\signup\instali.sys" -s -h -r
- <SYSTEM32>\attrib.exe <SYSTEM32>\helps.dll +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\ooepqk.exe -s -h -r
- <SYSTEM32>\attrib.exe %WINDIR%\svchost.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\logo1_.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\lsass.exe +h +s +r
- <SYSTEM32>\attrib.exe %WINDIR%\services.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\rundl132.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\systemt.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\csrss.exe +s +h +r
- <SYSTEM32>\attrib.exe <SYSTEM32>\hgvhtn.exe +s +h +r
- <SYSTEM32>\attrib.exe <DRIVERS>\ctfmont.exe +s +h +r
- <SYSTEM32>\attrib.exe <DRIVERS>\spoclsv.exe +s +h +r
- <SYSTEM32>\attrib.exe <DRIVERS>\usbme.sys +s +h +r
- <SYSTEM32>\attrib.exe <DRIVERS>\sppoolsv.exe +s +h +r
- <SYSTEM32>\attrib.exe <SYSTEM32>\fuckjacks.exe +s +h +r
- <SYSTEM32>\attrib.exe <DRIVERS>\spo0lsv.exe +s +h +r
- <SYSTEM32>\attrib.exe <DRIVERS>\nvscv32.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\winlogon.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\75976l.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\75976l.exe -s -h -r
- <SYSTEM32>\attrib.exe %WINDIR%\duyoyl.exe +s +h +r
- <SYSTEM32>\attrib.exe <SYSTEM32>\wscript32.exe -s -h -r
- <SYSTEM32>\attrib.exe %WINDIR%\wsockdrv32.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\wsockdrv32.exe -s -h -r
- <SYSTEM32>\attrib.exe <SYSTEM32>\wscript32.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\duyoyl.exe -s -h -r
- <SYSTEM32>\attrib.exe %WINDIR%\rundll32.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\iexpl0re.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\winlog0n.exe +s +h +r
- <SYSTEM32>\attrib.exe <SYSTEM32>\svsh0st.exe -s -h -r
- <SYSTEM32>\attrib.exe %WINDIR%\yoddlp.exe +s +h +r
- <SYSTEM32>\attrib.exe %WINDIR%\yoddlp.exe -s -h -r
- <SYSTEM32>\attrib.exe <SYSTEM32>\svsh0st.exe +s +h +r
- <SYSTEM32>\attrib.exe f:\udnnnvq.exe -s -h -r
- <SYSTEM32>\attrib.exe e:\udnnnvq.exe +s +h +r
- <SYSTEM32>\attrib.exe e:\udnnnvq.exe -s -h -r
- <SYSTEM32>\attrib.exe f:\udnnnvq.exe +s +h +r
- <SYSTEM32>\attrib.exe h:\udnnnvq.exe -s -h -r
- <SYSTEM32>\attrib.exe g:\udnnnvq.exe +s +h +r
- <SYSTEM32>\attrib.exe g:\udnnnvq.exe -s -h -r
- <SYSTEM32>\attrib.exe <Имя диска съемного носителя>:\udnnnvq.exe +s +h +r
- <SYSTEM32>\attrib.exe <SYSTEM32>\meex.com -s -h -r
- <SYSTEM32>\taskkill.exe /im meex.com /f
- <SYSTEM32>\attrib.exe <SYSTEM32>\suvtufx.exe +s +h +r
- <SYSTEM32>\attrib.exe <SYSTEM32>\meex.com +s +h +r
- <SYSTEM32>\attrib.exe <Имя диска съемного носителя>:\udnnnvq.exe -s -h -r
- <SYSTEM32>\attrib.exe c:\udnnnvq.exe +s +h +r
- <SYSTEM32>\attrib.exe c:\udnnnvq.exe -s -h -r
- <SYSTEM32>\attrib.exe h:\udnnnvq.exe +s +h +r
- <SYSTEM32>\attrib.exe n:\udnnnvq.exe -s -h -r
- <SYSTEM32>\attrib.exe m:\udnnnvq.exe +s +h +r
- <SYSTEM32>\attrib.exe m:\udnnnvq.exe -s -h -r
- <SYSTEM32>\attrib.exe n:\udnnnvq.exe +s +h +r
- <SYSTEM32>\attrib.exe "<SYSTEM32>\iexplorer.exe" -s -h -r
- <SYSTEM32>\attrib.exe o:\udnnnvq.exe +s +h +r
- <SYSTEM32>\attrib.exe o:\udnnnvq.exe -s -h -r
- <SYSTEM32>\attrib.exe l:\udnnnvq.exe +s +h +r
- <SYSTEM32>\attrib.exe j:\udnnnvq.exe -s -h -r
- <SYSTEM32>\attrib.exe i:\udnnnvq.exe +s +h +r
- <SYSTEM32>\attrib.exe i:\udnnnvq.exe -s -h -r
- <SYSTEM32>\attrib.exe j:\udnnnvq.exe +s +h +r
- <SYSTEM32>\attrib.exe l:\udnnnvq.exe -s -h -r
- <SYSTEM32>\attrib.exe k:\udnnnvq.exe +s +h +r
- <SYSTEM32>\attrib.exe k:\udnnnvq.exe -s -h -r
- <SYSTEM32>\attrib.exe <SYSTEM32>\suvtufx.exe -s -h -r
- <SYSTEM32>\taskkill.exe /f /im iqwfobe.exe
- <SYSTEM32>\taskkill.exe /f /im wkhawlu.exe
- <SYSTEM32>\taskkill.exe /f /im ikcswon.exe
- <SYSTEM32>\taskkill.exe /f /im ehjalrp.exe
- <SYSTEM32>\taskkill.exe /f /im rujrmue.exe
- <SYSTEM32>\taskkill.exe /f /im upxdnd.exe
- <SYSTEM32>\taskkill.exe /f /im quqnrtl.exe
- <SYSTEM32>\taskkill.exe /f /im owupxei.exe
- <SYSTEM32>\taskkill.exe /f /im iexplorer.exe
- <SYSTEM32>\taskkill.exe /f /im kpldkdu.exe
- <SYSTEM32>\taskkill.exe /f /im wrtgesp.exe
- <SYSTEM32>\taskkill.exe /f /im eqrdrnr.exe
- <SYSTEM32>\taskkill.exe /f /im tbrurvx.exe
- <SYSTEM32>\taskkill.exe /f /im norachc.exe
- <SYSTEM32>\taskkill.exe /f /im websrdu.exe
- <SYSTEM32>\taskkill.exe /f /im meex.exe
- <SYSTEM32>\attrib.exe <SYSTEM32>\com\smss.exe -s -h -r
- <SYSTEM32>\attrib.exe <SYSTEM32>\com\lsass.exe +s +h +r
- <SYSTEM32>\attrib.exe <SYSTEM32>\com\lsass.exe -s -h -r
- <SYSTEM32>\attrib.exe <SYSTEM32>\com\smss.exe +s +h +r
- <SYSTEM32>\taskkill.exe /im suvtufx.exe /f
- <SYSTEM32>\attrib.exe <SYSTEM32>\lnmwiid.exe +s +h +r
- <SYSTEM32>\attrib.exe <SYSTEM32>\lnmwiid.exe -s -h -r
- <SYSTEM32>\attrib.exe <SYSTEM32>\wsctf.exe +s +h +r
- <SYSTEM32>\taskkill.exe /f /im lnmwiid.exe
- <SYSTEM32>\taskkill.exe /f /im wsctf.exe
- <SYSTEM32>\taskkill.exe /f /im pumthsg.exe
- <SYSTEM32>\taskkill.exe /f /im suvtufx.exe
- <SYSTEM32>\attrib.exe <SYSTEM32>\wsctf.exe -s -h -r
- <SYSTEM32>\attrib.exe <SYSTEM32>\explorer.exe -s -h -r
- <SYSTEM32>\taskkill.exe /f /im meex.com
- <SYSTEM32>\attrib.exe "%PROGRAM_FILES%\meex.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%PROGRAM_FILES%\meex.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\quqnrtl.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%PROGRAM_FILES%\ehjalrp.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%PROGRAM_FILES%\quqnrtl.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%PROGRAM_FILES%\quqnrtl.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%PROGRAM_FILES%\ehjalrp.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\quqnrtl.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\rujrmue.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\rujrmue.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\websrdu.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\owupxei.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\ehjalrp.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\ehjalrp.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\owupxei.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%PROGRAM_FILES%\ykubdte.inf" -s -h -r
- <SYSTEM32>\attrib.exe "<SYSTEM32>\wsctf.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%WINDIR%\upxdnd.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\iqwfobe.exe" +s +h +r
- <SYSTEM32>\attrib.exe "<SYSTEM32>\wsctf.exe" +s +h +r
- <SYSTEM32>\attrib.exe c:\yeyinhi.exe -s -h -r
- <SYSTEM32>\attrib.exe "%WINDIR%\wsctf.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%WINDIR%\wsctf.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\iqwfobe.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\pumthsg.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\pumthsg.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%PROGRAM_FILES%\ykubdte.inf" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\ehjalrp.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\quqnrtl.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\quqnrtl.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\ehjalrp.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\websrdu.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\websrdu.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\websrdu.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\eqrdrnr.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\norachc.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\tbrurvx.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\tbrurvx.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\norachc.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\eqrdrnr.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\wrtgesp.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\wrtgesp.exe" -s -h -r
- <SYSTEM32>\attrib.exe "<SYSTEM32>\iexplorer.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\kpldkdu.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\ikcswon.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\ikcswon.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\kpldkdu.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\wkhawlu.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\tbrurvx.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\tbrurvx.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\norachc.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\wkhawlu.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\eqrdrnr.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\eqrdrnr.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\wkhawlu.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\norachc.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\ikcswon.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\ikcswon.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\system\wkhawlu.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\wrtgesp.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\kpldkdu.exe" +s +h +r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\kpldkdu.exe" -s -h -r
- <SYSTEM32>\attrib.exe "%CommonProgramFiles%\microsoft shared\wrtgesp.exe" +s +h +r
- %TEMP%\a55120.bat
- %TEMP%\RarSFX0\mian.exe
- %TEMP%\RarSFX0\start.exe
- %TEMP%\a55120.bat
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''