Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'spoolsv' = '"C:\Far2\Documentation\eng\spoolsv.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"%ProgramFiles(x86)%\Uninstall Information\WUDFHost.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"C:\Far2\Addons\Shell\wininit.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'cmd' = '"%ProgramFiles%\BackWeb-4476822\cmd.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"C:\MSOCache\All Users\csrss.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'Idle' = '"C:\totalcmd\LANGUAGE\Idle.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss' = '"%ProgramFiles(x86)%\Mozilla Thunderbird\dictionaries\smss.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'Idle' = '"C:\Far2\PluginSDK\Headers.pas\Idle.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '"C:\totalcmd\LANGUAGE\winlogon.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'conhost' = '"C:\fontreviewHost\conhost.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\WUDFHost.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'services' = '"%WINDIR%\LiveKernelReports\services.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '"%ProgramFiles%\gcasServ\winlogon.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'conhost' = '"%WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\conhost.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe"'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Far2\Documentation\eng\spoolsv.exe", "%WINDIR%\IME\en-US\WUDFHost.exe", "C:\Recovery\1195d5a8-f371-11...
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '"C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe"'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Far2\Documentation\eng\spoolsv.exe", "%WINDIR%\IME\en-US\WUDFHost.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"%WINDIR%\IME\en-US\WUDFHost.exe"'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Far2\Documentation\eng\spoolsv.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\iexplore.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"C:\Far2\Encyclopedia\iexplore.exe"'
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\spoolsv
- <SYSTEM32>\tasks\cmd
- <SYSTEM32>\tasks\cmdc
- <SYSTEM32>\tasks\csrssc
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\smsss
- <SYSTEM32>\tasks\idlei
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\idle
- <SYSTEM32>\tasks\servicess
- <SYSTEM32>\tasks\winlogonw
- <SYSTEM32>\tasks\services
- <SYSTEM32>\tasks\conhostc
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\conhost
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\explorere
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\wudfhostw
- <SYSTEM32>\tasks\wudfhost
- <SYSTEM32>\tasks\spoolsvs
- <SYSTEM32>\tasks\wininitw
- <SYSTEM32>\tasks\wininit
Изменения в файловой системе
Создает следующие файлы
- C:\fontreviewhost\vlx92pqimewcggdztifhvr.bat
- C:\totalcmd\language\cc11b995f2a76d
- C:\far2\pluginsdk\headers.pas\idle.exe
- C:\far2\pluginsdk\headers.pas\6ccacd8608530f
- %ProgramFiles(x86)%\mozilla thunderbird\dictionaries\smss.exe
- %ProgramFiles(x86)%\mozilla thunderbird\dictionaries\69ddcba757bf72
- C:\totalcmd\language\idle.exe
- C:\totalcmd\language\6ccacd8608530f
- C:\msocache\all users\csrss.exe
- C:\msocache\all users\886983d96e3d3e
- %ProgramFiles%\backweb-4476822\cmd.exe
- %ProgramFiles%\backweb-4476822\ebf1f9fa8afd6d
- C:\far2\addons\shell\wininit.exe
- C:\far2\addons\shell\56085415360792
- %ProgramFiles(x86)%\uninstall information\wudfhost.exe
- %ProgramFiles(x86)%\uninstall information\480b7989c529f6
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\iexplore.exe
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\9db6e019d4f04e
- C:\totalcmd\language\winlogon.exe
- C:\far2\encyclopedia\iexplore.exe
- C:\fontreviewhost\088424020bedd6
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\480b7989c529f6
- C:\fontreviewhost\fontreviewhostsavesperf.exe
- C:\fontreviewhost\jtrsiz6s3t272xfwen29tsonfg3nb.vbe
- C:\far2\documentation\eng\spoolsv.exe
- C:\far2\documentation\eng\f3b6ecef712a24
- %WINDIR%\ime\en-us\wudfhost.exe
- %WINDIR%\ime\en-us\480b7989c529f6
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\7a0fd90576e088
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\9db6e019d4f04e
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\microsoft-windows-h#\a46df77acafec60e31859608625e6354\conhost.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\microsoft-windows-h#\a46df77acafec60e31859608625e6354\088424020bedd6
- %ProgramFiles%\gcasserv\winlogon.exe
- %ProgramFiles%\gcasserv\cc11b995f2a76d
- %WINDIR%\livekernelreports\services.exe
- %WINDIR%\livekernelreports\c5b4cb5e9653cc
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wudfhost.exe
- C:\fontreviewhost\conhost.exe
- C:\far2\encyclopedia\9db6e019d4f04e
Сетевая активность
Подключается к
- '83.##0.173.194':80
TCP
Запросы HTTP GET
- http://83.##0.173.194/1external/00Low/Javascript4public/Publictouniversal/wordpress/Php0GameAsync/Better/Better0proton7/Apitrack_/FlowerTest/53multiJs/wordpresscentraldownloads.php?c3##########...
- http://83.##0.173.194/1external/00Low/Javascript4public/Publictouniversal/wordpress/Php0GameAsync/Better/Better0proton7/Apitrack_/FlowerTest/53multiJs/wordpresscentraldownloads.php?l7##########...
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
Создает и запускает на исполнение
- '%WINDIR%\syswow64\wscript.exe' "C:\fontreviewHost\JtrsIz6S3t272Xfwen29TsoNfg3nB.vbe"
- 'C:\fontreviewhost\fontreviewhostsavesperf.exe'
- '%WINDIR%\livekernelreports\services.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\fontreviewHost\vLx92pQImEwcgGDzTIfHVR.bat" "' (со скрытым окном)
- '%WINDIR%\livekernelreports\services.exe' ' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\fontreviewHost\vLx92pQImEwcgGDzTIfHVR.bat" "
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\totalcmd\LANGUAGE\Idle.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONSTART /tr "'C:\totalcmd\LANGUAGE\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc MINUTE /mo 6 /tr "'C:\totalcmd\LANGUAGE\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 9 /tr "'%ProgramFiles(x86)%\Mozilla Thunderbird\dictionaries\smss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONSTART /tr "'%ProgramFiles(x86)%\Mozilla Thunderbird\dictionaries\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Mozilla Thunderbird\dictionaries\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc MINUTE /mo 11 /tr "'%ProgramFiles(x86)%\Mozilla Thunderbird\dictionaries\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Far2\PluginSDK\Headers.pas\Idle.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONSTART /tr "'C:\Far2\PluginSDK\Headers.pas\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\Far2\PluginSDK\Headers.pas\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc MINUTE /mo 10 /tr "'C:\Far2\PluginSDK\Headers.pas\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\totalcmd\LANGUAGE\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONSTART /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cmd" /sc MINUTE /mo 6 /tr "'%ProgramFiles%\BackWeb-4476822\cmd.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cmd" /sc ONLOGON /tr "'%ProgramFiles%\BackWeb-4476822\cmd.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Far2\Encyclopedia\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc MINUTE /mo 14 /tr "'C:\Far2\Encyclopedia\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONSTART /tr "'C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 10 /tr "'%ProgramFiles(x86)%\Uninstall Information\WUDFHost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Uninstall Information\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONSTART /tr "'%ProgramFiles(x86)%\Uninstall Information\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc MINUTE /mo 10 /tr "'%ProgramFiles(x86)%\Uninstall Information\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Far2\Addons\Shell\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONSTART /tr "'C:\Far2\Addons\Shell\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'C:\Far2\Addons\Shell\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc MINUTE /mo 12 /tr "'C:\Far2\Addons\Shell\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'%ProgramFiles%\BackWeb-4476822\cmd.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cmd" /sc ONSTART /tr "'%ProgramFiles%\BackWeb-4476822\cmd.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONSTART /tr "'C:\Far2\Encyclopedia\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONSTART /tr "'C:\totalcmd\LANGUAGE\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc MINUTE /mo 7 /tr "'C:\totalcmd\LANGUAGE\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONSTART /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc MINUTE /mo 8 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONSTART /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc MINUTE /mo 13 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 10 /tr "'%WINDIR%\IME\en-US\WUDFHost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONSTART /tr "'%WINDIR%\IME\en-US\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'%WINDIR%\IME\en-US\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc MINUTE /mo 14 /tr "'%WINDIR%\IME\en-US\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Far2\Documentation\eng\spoolsv.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONSTART /tr "'C:\Far2\Documentation\eng\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Far2\Documentation\eng\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc MINUTE /mo 7 /tr "'C:\Far2\Documentation\eng\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 7 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc MINUTE /mo 7 /tr "'%WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc ONLOGON /tr "'%WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc ONSTART /tr "'%WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc ONSTART /tr "'C:\fontreviewHost\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc ONLOGON /tr "'C:\fontreviewHost\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc MINUTE /mo 14 /tr "'C:\fontreviewHost\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 10 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\WUDFHost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONSTART /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc MINUTE /mo 9 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONSTART /tr "'%WINDIR%\LiveKernelReports\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 6 /tr "'%WINDIR%\LiveKernelReports\services.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'%WINDIR%\LiveKernelReports\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc MINUTE /mo 6 /tr "'%WINDIR%\LiveKernelReports\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'%ProgramFiles%\gcasServ\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONSTART /tr "'%ProgramFiles%\gcasServ\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%ProgramFiles%\gcasServ\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc MINUTE /mo 10 /tr "'%ProgramFiles%\gcasServ\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'%WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\conhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\fontreviewHost\conhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 13 /tr "'C:\Far2\Encyclopedia\iexplore.exe'" /f
