Technical Information
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Synaptics Pointing Device Driver' = '%ALLUSERSPROFILE%\Synaptics\Synaptics.exe'
- <SYSTEM32>\tasks\cmdc
- <SYSTEM32>\tasks\cmd
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\webdhcpw
- <SYSTEM32>\tasks\webdhcp
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\wininitw
- <SYSTEM32>\tasks\conhost
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\winlogonw
- %HOMEPATH%\desktop\dotnetfx45_full_setup.exe
- %HOMEPATH%\desktop\jre-7u75-windows-i586-iftw.exe
- %HOMEPATH%\desktop\notepad.exe
- %HOMEPATH%\desktop\skypesetup.exe
- %HOMEPATH%\desktop\winmine.exe
- %HOMEPATH%\downloads\chromesetup.exe
- %HOMEPATH%\downloads\icq_rfrset.exe
- %HOMEPATH%\downloads\k-lite_codec_pack_1110_mega.exe
- %HOMEPATH%\downloads\k-lite_codec_pack_1110_mega_dlm.exe
- %HOMEPATH%\downloads\magent_rfrset.exe
- %HOMEPATH%\downloads\mirc741.exe
- %HOMEPATH%\downloads\opera_ni_stable.exe
- %HOMEPATH%\downloads\pidgin-2.10.11.exe
- %HOMEPATH%\downloads\steamsetup.exe
- %HOMEPATH%\downloads\thunderbird setup 31.6.0.exe
- %HOMEPATH%\downloads\winamp5666_full_all.exe
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
- <Current directory>\._cache_<File name>.exe
- %TEMP%\vpbi8mas.exe
- %TEMP%\rcxf7cf.tmp
- %TEMP%\f8tlwr2z.ico
- C:\far2\encyclopedia\tap\088424020bedd6
- C:\far2\encyclopedia\tap\conhost.exe
- %TEMP%\rcxf484.tmp
- %TEMP%\f8tlwr2z.exe
- C:\far2\documentation\eng\9db6e019d4f04e
- C:\far2\documentation\eng\iexplore.exe
- %TEMP%\vpbi8mas.ico
- %TEMP%\rcxfe94.tmp
- %TEMP%\rcxeab2.tmp
- %TEMP%\v1lwvv7l.exe
- %TEMP%\rcxe2b6.tmp
- %TEMP%\crjfeowb.ico
- %TEMP%\rcxdf6a.tmp
- %TEMP%\crjfeowb.exe
- %ProgramFiles%\luinit\56085415360792
- %ProgramFiles%\spidernt\39173848c502cc
- %ProgramFiles%\spidernt\webdhcp.exe
- %TEMP%\rcxeeb9.tmp
- %TEMP%\74miygqb.ico
- %TEMP%\rcx356.tmp
- %ProgramFiles(x86)%\reference assemblies\microsoft\framework\v3.5\subsetlist\088424020bedd6
- %ProgramFiles(x86)%\reference assemblies\microsoft\framework\v3.5\subsetlist\conhost.exe
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\9db6e019d4f04e
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\iexplore.exe
- C:\hyperwebbrokerdllnet\6ccacd8608530f
- C:\hyperwebbrokerdllnet\idle.exe
- <Current directory>\480b7989c529f6
- <Current directory>\wudfhost.exe
- %TEMP%\rcx34d5.tmp
- %TEMP%\1u96jxk2.ico
- C:\far2\addons\shell\69ddcba757bf72
- C:\far2\addons\shell\smss.exe
- %TEMP%\rcx297e.tmp
- %TEMP%\1u96jxk2.exe
- %TEMP%\rcx19c5.tmp
- %TEMP%\cswa7vlu.ico
- %TEMP%\rcxdf1.tmp
- C:\far2\encyclopedia\42af1c969fbb7b
- C:\far2\encyclopedia\audiodg.exe
- %TEMP%\cswa7vlu.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\ebf1f9fa8afd6d
- %ProgramFiles%\luinit\wininit.exe
- %TEMP%\v1lwvv7l.ico
- %TEMP%\rcxb992.tmp
- %TEMP%\p63meslr.ico
- %HOMEPATH%\music\cc11b995f2a76d
- %TEMP%\rcx3ce2.tmp
- %TEMP%\k1pi3cim.ico
- %TEMP%\rcx656c.tmp
- %TEMP%\k1pi3cim.exe
- %TEMP%\rcx5f15.tmp
- %TEMP%\8dhieylm.ico
- %TEMP%\rcx5b3d.tmp
- %TEMP%\8dhieylm.exe
- %TEMP%\rcx4617.tmp
- %TEMP%\jlkonvzi.ico
- %TEMP%\jlkonvzi.exe
- %TEMP%\74miygqb.exe
- %TEMP%\rcx366c.tmp
- %TEMP%\mq4ugyaf.ico
- %TEMP%\rcx2f78.tmp
- %TEMP%\mq4ugyaf.exe
- <Current directory>\._cache_synaptics.exe
- C:\hyperwebbrokerdllnet\z896j9.vbe
- C:\hyperwebbrokerdllnet\webdhcp.exe
- C:\hyperwebbrokerdllnet\kkc2yahn.bat
- %ALLUSERSPROFILE%\synaptics\synaptics.exe
- C:\users\default user\taskhost.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\cmd.exe
- %TEMP%\rcx6b0a.tmp
- %TEMP%\df9lvoka.exe
- %TEMP%\rcx6879.tmp
- %HOMEPATH%\music\winlogon.exe
- <Current directory>\ebf1f9fa8afd6d
- <Current directory>\cmd.exe
- %TEMP%\rcxb1b4.tmp
- %TEMP%\p63meslr.exe
- %TEMP%\rcxad6f.tmp
- %TEMP%\kkamxqgt.ico
- %TEMP%\rcxab4c.tmp
- %TEMP%\kkamxqgt.exe
- %TEMP%\rcxa0e0.tmp
- %TEMP%\hcnsf1k7.ico
- %TEMP%\rcx9ac7.tmp
- %TEMP%\hcnsf1k7.exe
- %TEMP%\rcx8237.tmp
- %TEMP%\q7kyot6j.ico
- %TEMP%\rcx7d75.tmp
- %TEMP%\q7kyot6j.exe
- %TEMP%\rcx778b.tmp
- %TEMP%\df9lvoka.ico
- %TEMP%\rcx72c9.tmp
- %TEMP%\rcx6c71.tmp
- C:\users\default user\b75386f1303e64
- <Current directory>\._cache_<File name>.exe
- %ALLUSERSPROFILE%\synaptics\synaptics.exe
- <Current directory>\._cache_synaptics.exe
- %TEMP%\mq4ugyaf.exe
- %TEMP%\cswa7vlu.ico
- %TEMP%\cswa7vlu.exe
- %TEMP%\vpbi8mas.ico
- %TEMP%\vpbi8mas.exe
- %TEMP%\f8tlwr2z.ico
- %TEMP%\f8tlwr2z.exe
- %TEMP%\v1lwvv7l.ico
- %TEMP%\v1lwvv7l.exe
- %TEMP%\crjfeowb.ico
- %TEMP%\crjfeowb.exe
- %TEMP%\p63meslr.ico
- %TEMP%\p63meslr.exe
- %TEMP%\kkamxqgt.ico
- %TEMP%\kkamxqgt.exe
- %TEMP%\hcnsf1k7.ico
- %TEMP%\hcnsf1k7.exe
- %TEMP%\q7kyot6j.ico
- %TEMP%\q7kyot6j.exe
- %TEMP%\df9lvoka.ico
- %TEMP%\df9lvoka.exe
- %TEMP%\74miygqb.ico
- %TEMP%\74miygqb.exe
- %TEMP%\k1pi3cim.ico
- %TEMP%\k1pi3cim.exe
- %TEMP%\8dhieylm.ico
- %TEMP%\8dhieylm.exe
- %TEMP%\jlkonvzi.ico
- %TEMP%\jlkonvzi.exe
- %TEMP%\mq4ugyaf.ico
- %TEMP%\1u96jxk2.exe
- %TEMP%\1u96jxk2.ico
- from %TEMP%\rcx2f78.tmp to %TEMP%\mq4ugyaf.exe
- from %TEMP%\rcx19c5.tmp to %TEMP%\cswa7vlu.exe
- from %TEMP%\rcxdf1.tmp to %TEMP%\cswa7vlu.exe
- from %TEMP%\rcx356.tmp to %TEMP%\vpbi8mas.exe
- from %TEMP%\rcxfe94.tmp to %TEMP%\vpbi8mas.exe
- from %TEMP%\rcxf7cf.tmp to %TEMP%\f8tlwr2z.exe
- from %TEMP%\rcxf484.tmp to %TEMP%\f8tlwr2z.exe
- from %TEMP%\rcxeeb9.tmp to %TEMP%\v1lwvv7l.exe
- from %TEMP%\rcxeab2.tmp to %TEMP%\v1lwvv7l.exe
- from %TEMP%\rcxe2b6.tmp to %TEMP%\crjfeowb.exe
- from %TEMP%\rcxdf6a.tmp to %TEMP%\crjfeowb.exe
- from %TEMP%\rcxb992.tmp to %TEMP%\p63meslr.exe
- from %TEMP%\rcxb1b4.tmp to %TEMP%\p63meslr.exe
- from %TEMP%\rcxad6f.tmp to %TEMP%\kkamxqgt.exe
- from %TEMP%\rcxab4c.tmp to %TEMP%\kkamxqgt.exe
- from %TEMP%\rcxa0e0.tmp to %TEMP%\hcnsf1k7.exe
- from %TEMP%\rcx9ac7.tmp to %TEMP%\hcnsf1k7.exe
- from %TEMP%\rcx8237.tmp to %TEMP%\q7kyot6j.exe
- from %TEMP%\rcx7d75.tmp to %TEMP%\q7kyot6j.exe
- from %TEMP%\rcx778b.tmp to %TEMP%\df9lvoka.exe
- from %TEMP%\rcx72c9.tmp to %TEMP%\df9lvoka.exe
- from %TEMP%\rcx6c71.tmp to %TEMP%\74miygqb.exe
- from %TEMP%\rcx6b0a.tmp to %TEMP%\74miygqb.exe
- from %TEMP%\rcx6879.tmp to %TEMP%\k1pi3cim.exe
- from %TEMP%\rcx656c.tmp to %TEMP%\k1pi3cim.exe
- from %TEMP%\rcx5f15.tmp to %TEMP%\8dhieylm.exe
- from %TEMP%\rcx5b3d.tmp to %TEMP%\8dhieylm.exe
- from %TEMP%\rcx4617.tmp to %TEMP%\jlkonvzi.exe
- from %TEMP%\rcx3ce2.tmp to %TEMP%\jlkonvzi.exe
- from %TEMP%\rcx366c.tmp to %TEMP%\mq4ugyaf.exe
- from %TEMP%\rcx297e.tmp to %TEMP%\1u96jxk2.exe
- from %TEMP%\rcx34d5.tmp to %TEMP%\1u96jxk2.exe
- 'fr####s.afraid.org':80
- http://fr####s.afraid.org/api/?ac###########################################################
- DNS ASK xr##.mooo.com
- DNS ASK fr####s.afraid.org
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
- '<Current directory>\._cache_<File name>.exe'
- '%ALLUSERSPROFILE%\synaptics\synaptics.exe' InjUpdate
- '%WINDIR%\syswow64\wscript.exe' "C:\hyperwebBrokerdllNet\Z896j9.vbe"
- '<Current directory>\._cache_synaptics.exe' InjUpdate
- 'C:\hyperwebbrokerdllnet\webdhcp.exe'
- 'C:\far2\documentation\eng\iexplore.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\hyperwebBrokerdllNet\kkC2YahN.bat" "' (with hidden window)
- 'C:\far2\documentation\eng\iexplore.exe' ' (with hidden window)
- 'C:\hyperwebbrokerdllnet\webdhcp.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\hyperwebBrokerdllNet\kkC2YahN.bat" "
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 5 /tr "'C:\Far2\Encyclopedia\tap\schtasks.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "schtasks" /sc ONLOGON /tr "'C:\Far2\Encyclopedia\tap\schtasks.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 14 /tr "'C:\Far2\Encyclopedia\tap\schtasks.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\totalcmd\LANGUAGE\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\totalcmd\LANGUAGE\conhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 6 /tr "'%ProgramFiles%\swAgent\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%ProgramFiles%\swAgent\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 6 /tr "'%ProgramFiles%\swAgent\firefox.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\totalcmd\LANGUAGE\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\totalcmd\LANGUAGE\Idle.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\hyperwebBrokerdllNet\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\hyperwebBrokerdllNet\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\hyperwebBrokerdllNet\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 5 /tr "'%ProgramFiles%\YahooSync\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%ProgramFiles%\YahooSync\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 7 /tr "'%ProgramFiles%\YahooSync\firefox.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'%WINDIR%\debug\WIA\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%WINDIR%\debug\WIA\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'%WINDIR%\debug\WIA\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 13 /tr "'C:\Far2\Addons\SetUp\schtasks.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 12 /tr "'%ProgramFiles%\sporder\schtasks.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 13 /tr "'%ProgramFiles%\MpEng\schtasks.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "schtasks" /sc ONLOGON /tr "'%ProgramFiles%\MpEng\schtasks.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 14 /tr "'%ProgramFiles%\MpEng\schtasks.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Far2\PluginSDK\Headers.pas\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'C:\Far2\PluginSDK\Headers.pas\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Far2\PluginSDK\Headers.pas\explorer.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 6 /tr "'C:\hyperwebBrokerdllNet\schtasks.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "schtasks" /sc ONLOGON /tr "'C:\hyperwebBrokerdllNet\schtasks.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 14 /tr "'C:\hyperwebBrokerdllNet\schtasks.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 13 /tr "'C:\Far2\Addons\SetUp\schtasks.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Far2\Documentation\eng\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "schtasks" /sc ONLOGON /tr "'C:\Far2\Addons\SetUp\schtasks.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\totalcmd\LANGUAGE\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\totalcmd\LANGUAGE\audiodg.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 6 /tr "'%ALLUSERSPROFILE%\Microsoft Toolkit\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Microsoft Toolkit\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 8 /tr "'%ALLUSERSPROFILE%\Microsoft Toolkit\services.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 9 /tr "'<Current directory>\schtasks.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "schtasks" /sc ONLOGON /tr "'<Current directory>\schtasks.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 10 /tr "'<Current directory>\schtasks.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\Far2\Documentation\eng\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Far2\Addons\Shell\smss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\Far2\Encyclopedia\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\cmd.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Far2\Encyclopedia\audiodg.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\cmd.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Far2\Encyclopedia\tap\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 11 /tr "'C:\Far2\Documentation\eng\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc ONLOGON /tr "'C:\Far2\Encyclopedia\tap\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Far2\Documentation\eng\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Far2\Encyclopedia\tap\conhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 9 /tr "'C:\Far2\Documentation\eng\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\cmd.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'%ProgramFiles%\LUInit\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'%ProgramFiles%\LUInit\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "webdhcp" /sc ONLOGON /tr "'%ProgramFiles%\spidernt\webdhcp.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'%ProgramFiles%\LUInit\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "webdhcpw" /sc MINUTE /mo 6 /tr "'%ProgramFiles%\spidernt\webdhcp.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'%HOMEPATH%\Music\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'<Current directory>\cmd.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%HOMEPATH%\Music\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cmd" /sc ONLOGON /tr "'<Current directory>\cmd.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'%HOMEPATH%\Music\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'<Current directory>\cmd.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "webdhcpw" /sc MINUTE /mo 6 /tr "'%ProgramFiles%\spidernt\webdhcp.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'%ProgramFiles(x86)%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\conhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\hyperwebBrokerdllNet\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'C:\Far2\Addons\Shell\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\hyperwebBrokerdllNet\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\hyperwebBrokerdllNet\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 6 /tr "'%ProgramFiles(x86)%\Windows Sidebar\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Sidebar\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 14 /tr "'%ProgramFiles(x86)%\Windows Sidebar\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'%ProgramFiles(x86)%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Far2\Documentation\eng\Idle.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\hyperwebBrokerdllNet\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\hyperwebBrokerdllNet\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\hyperwebBrokerdllNet\Idle.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 8 /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 5 /tr "'<Current directory>\WUDFHost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Far2\Addons\Shell\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Far2\Encyclopedia\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "schtasks" /sc ONLOGON /tr "'%ProgramFiles%\sporder\schtasks.exe'" /rl HIGHEST /f