Trojan.Inject4.60491

Technical Information

Malicious functions

Launches a large number of processes

Modifies file system

Creates the following files

C:\Documents\user\locals~1\temp\talmaterialers\forskrivendes\samenesses\hjkommisr\impassability126\sammentraengte\vaardagen\purpuriferous.int
C:\Documents\user\locals~1\temp\nsz4.tmp\ns6d.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns6e.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns6f.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns70.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns71.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns72.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns73.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns6b.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns6c.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns74.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns77.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns78.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns79.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns7a.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns7b.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns7c.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns7d.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns75.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns76.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns7f.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns7e.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns68.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns58.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns59.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns5a.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns5b.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns5c.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns5d.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns69.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns56.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns6a.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns5e.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns62.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns63.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns64.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns65.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns66.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns67.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns5f.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns60.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns61.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns28.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns80.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns99.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns9b.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns9c.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns9d.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns9e.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns9f.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa0.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns98.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa1.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns9a.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa3.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa5.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa6.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa7.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa8.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa9.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsaa.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa2.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns97.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa4.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns96.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns95.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns82.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns84.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns85.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns86.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns87.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns88.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns89.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns8a.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns8b.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns83.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns8c.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns8e.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns8f.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns90.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns91.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns92.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns93.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns94.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns55.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns8d.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns57.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns54.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns53.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns52.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns16.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns17.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns18.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns19.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns1a.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns1b.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns13.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns11.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns15.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns1c.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns20.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns21.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns22.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns23.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns24.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns25.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns1d.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns1e.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns1f.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns12.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns10.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns26.tmp
C:\Documents\user\locals~1\temp\talmaterialers\forskrivendes\samenesses\zymosis.udm
C:\Documents\user\locals~1\temp\talmaterialers\forskrivendes\samenesses\taskernes\holdbareste\vandtaarn\handers\setehcikey.exe
C:\Documents\user\locals~1\temp\talmaterialers\forskrivendes\samenesses\taskernes\holdbareste\vandtaarn\handers\bha.dat
C:\Documents\user\locals~1\temp\talmaterialers\forskrivendes\samenesses\taskernes\holdbareste\vandtaarn\handers\document-revert-rtl.png
C:\Documents\user\locals~1\temp\talmaterialers\forskrivendes\samenesses\taskernes\holdbareste\vandtaarn\handers\lang-1026.dll
C:\Documents\user\locals~1\temp\talmaterialers\forskrivendes\samenesses\taskernes\holdbareste\vandtaarn\handers\mail-signed.png
C:\Documents\user\locals~1\temp\nsz4.tmp\nsexec.dll
C:\Documents\user\locals~1\temp\nsz4.tmp\ns5.tmp
C:\Documents\user\locals~1\temp\talmaterialers\forskrivendes\samenesses\apm_ac3.dll
C:\Documents\user\locals~1\temp\nsz4.tmp\ns6.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns8.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns9.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsb.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsc.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsd.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nse.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsf.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns7.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsab.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns81.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns27.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns2b.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns43.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns44.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns45.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns46.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns47.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns48.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns40.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns49.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns42.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns4b.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns4d.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns4e.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns4f.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\system.dll
C:\Documents\user\locals~1\temp\nsz4.tmp\ns50.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns51.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns4a.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns14.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns4c.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns41.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns3f.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns3e.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns2c.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns2d.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns2e.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns2f.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns30.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns31.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns32.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns2a.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns33.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns35.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns36.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns37.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns38.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns39.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns3a.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns3b.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns3c.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns34.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns3d.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns29.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsac.tmp

Deletes the following files

C:\Documents\user\locals~1\temp\nsz4.tmp\ns5.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns71.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns72.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns73.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns74.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns75.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns76.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns77.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns78.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns79.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns7a.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns7b.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns7c.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns7d.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns7e.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns7f.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns80.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns81.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns70.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns5a.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns6f.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns6d.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns5c.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns5d.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns5e.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns5f.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns60.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns61.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns62.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns63.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns64.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns65.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns66.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns67.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns68.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns69.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns6a.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns6b.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns6c.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns6e.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns5b.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns82.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns86.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns9b.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns9c.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns9d.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns9e.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns9f.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa0.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa1.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns39.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa2.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa4.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa5.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa6.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa7.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa8.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa9.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsaa.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns99.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns9a.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns84.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns83.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns96.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns87.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns88.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns89.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns8a.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns8b.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns8c.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns8d.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns8e.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns8f.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns90.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns91.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns92.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns93.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns94.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns95.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns97.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns85.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns98.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns59.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns58.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns57.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns1c.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns1d.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns1e.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns1f.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns20.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns21.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns22.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns23.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns24.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns25.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns26.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns27.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns28.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns29.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns2a.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns2b.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns1a.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns2c.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns19.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns17.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns6.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns7.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns8.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns9.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsb.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsc.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsd.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nse.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsf.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns10.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns11.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns12.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns13.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns14.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns15.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns16.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns18.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns2d.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns1b.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns2e.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns46.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns48.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns49.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns4a.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns4b.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns4c.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns4d.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns4e.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns4f.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns50.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns51.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns52.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns53.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns54.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns55.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns56.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns45.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns43.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns47.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns44.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns42.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns2f.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns31.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns32.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns33.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns34.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns35.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns36.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns37.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsab.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsa3.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns38.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns3b.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns3c.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns3d.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns3e.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns3f.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns40.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns41.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns30.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\ns3a.tmp
C:\Documents\user\locals~1\temp\nsz4.tmp\nsac.tmp

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''
ClassName: 'SysListView32' WindowName: ''

Creates and executes the following

'C:\Documents\user\locals~1\temp\nsz4.tmp\ns5.tmp' cmd /c sET /A "0x49^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns5c.tmp' cmd /c sET /A "0x70^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns8b.tmp' cmd /c sET /A "0x33^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns47.tmp' cmd /c sET /A "0x6B^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns48.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns8a.tmp' cmd /c sET /A "0x70^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns49.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns4a.tmp' cmd /c sET /A "0x2B^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns89.tmp' cmd /c sET /A "0x2C^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns4b.tmp' cmd /c sET /A "0x6B^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns4c.tmp' cmd /c sET /A "0x2C^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns46.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns88.tmp' cmd /c sET /A "0x72^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns4e.tmp' cmd /c sET /A "0x37^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns87.tmp' cmd /c sET /A "0x2B^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns4f.tmp' cmd /c sET /A "0x58^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns50.tmp' cmd /c sET /A "0x49^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns86.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns51.tmp' cmd /c sET /A "0x47^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns52.tmp' cmd /c sET /A "0x50^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns85.tmp' cmd /c sET /A "0x36^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns53.tmp' cmd /c sET /A "0x4C^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns54.tmp' cmd /c sET /A "0x47^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns45.tmp' cmd /c sET /A "0x2E^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns44.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns93.tmp' cmd /c sET /A "0x31^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns37.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns38.tmp' cmd /c sET /A "0x2E^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns92.tmp' cmd /c sET /A "0x4E^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns39.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns3a.tmp' cmd /c sET /A "0x6B^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns91.tmp' cmd /c sET /A "0x47^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns3b.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns3c.tmp' cmd /c sET /A "0x36^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns8c.tmp' cmd /c sET /A "0x58^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns75.tmp' cmd /c sET /A "0x2E^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns3e.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns8f.tmp' cmd /c sET /A "0x50^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns3f.tmp' cmd /c sET /A "0x6B^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns40.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns8e.tmp' cmd /c sET /A "0x47^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns4d.tmp' cmd /c sET /A "0x70^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns42.tmp' cmd /c sET /A "0x7A^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns6e.tmp' cmd /c sET /A "0x7A^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns3d.tmp' cmd /c sET /A "0x2E^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns36.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns84.tmp' cmd /c sET /A "0x7A^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns56.tmp' cmd /c sET /A "0x31^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns66.tmp' cmd /c sET /A "0x2A^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns67.tmp' cmd /c sET /A "0x6B^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns7b.tmp' cmd /c sET /A "0x31^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns43.tmp' cmd /c sET /A "0x3A^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns69.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns68.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns6c.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns7c.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns79.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns78.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns6a.tmp' cmd /c sET /A "0x2E^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns7a.tmp' cmd /c sET /A "0x7A^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns8d.tmp' cmd /c sET /A "0x49^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns81.tmp' cmd /c sET /A "0x6B^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns55.tmp' cmd /c sET /A "0x4E^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns6f.tmp' cmd /c sET /A "0x33^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns70.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns71.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns76.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns72.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns73.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns6d.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns65.tmp' cmd /c sET /A "0x61^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns7d.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns64.tmp' cmd /c sET /A "0x6D^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns83.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns58.tmp' cmd /c sET /A "0x38^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsac.tmp' cmd /c sET /A "0x6B^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns59.tmp' cmd /c sET /A "0x38^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns82.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns5a.tmp' cmd /c sET /A "0x54^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns5b.tmp' cmd /c sET /A "0x6B^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns41.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns77.tmp' cmd /c sET /A "0x6B^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns57.tmp' cmd /c sET /A "0x30^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns33.tmp' cmd /c sET /A "0x2E^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns6b.tmp' cmd /c sET /A "0x6B^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns11.tmp' cmd /c sET /A "0x67^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns5f.tmp' cmd /c sET /A "0x63^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns7f.tmp' cmd /c sET /A "0x2E^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns60.tmp' cmd /c sET /A "0x6E^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns61.tmp' cmd /c sET /A "0x43^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns7e.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns62.tmp' cmd /c sET /A "0x6E^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns63.tmp' cmd /c sET /A "0x6E^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns5d.tmp' cmd /c sET /A "0x76^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns35.tmp' cmd /c sET /A "0x72^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns90.tmp' cmd /c sET /A "0x4C^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns34.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns16.tmp' cmd /c sET /A "0x6B^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa3.tmp' cmd /c sET /A "0x67^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns17.tmp' cmd /c sET /A "0x6E^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns18.tmp' cmd /c sET /A "0x67^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa2.tmp' cmd /c sET /A "0x76^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns19.tmp' cmd /c sET /A "0x43^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns1b.tmp' cmd /c sET /A "0x6F^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa1.tmp' cmd /c sET /A "0x6C^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsaa.tmp' cmd /c sET /A "0x2E^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns8.tmp' cmd /c sET /A "0x4C^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns80.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns94.tmp' cmd /c sET /A "0x30^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns1d.tmp' cmd /c sET /A "0x70^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns1e.tmp' cmd /c sET /A "0x36^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns9f.tmp' cmd /c sET /A "0x6D^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns1f.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns20.tmp' cmd /c sET /A "0x2E^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns9e.tmp' cmd /c sET /A "0x52^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns21.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns22.tmp' cmd /c sET /A "0x6B^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns15.tmp' cmd /c sET /A "0x44^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa4.tmp' cmd /c sET /A "0x70^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns14.tmp' cmd /c sET /A "0x67^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns13.tmp' cmd /c sET /A "0x76^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns6.tmp' cmd /c sET /A "0x47^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsab.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns7.tmp' cmd /c sET /A "0x50^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns1c.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns9.tmp' cmd /c sET /A "0x47^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns1a.tmp' cmd /c sET /A "0x2A^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa9.tmp' cmd /c sET /A "0x37^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsb.tmp' cmd /c sET /A "0x31^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns9d.tmp' cmd /c sET /A "0x67^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsc.tmp' cmd /c sET /A "0x30^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsd.tmp' cmd /c sET /A "0x38^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\nse.tmp' cmd /c sET /A "0x38^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa7.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns10.tmp' cmd /c sET /A "0x70^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns5e.tmp' cmd /c sET /A "0x77^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa6.tmp' cmd /c sET /A "0x6B^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns12.tmp' cmd /c sET /A "0x63^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa5.tmp' cmd /c sET /A "0x2A^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa8.tmp' cmd /c sET /A "0x70^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns23.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa0.tmp' cmd /c sET /A "0x6B^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns74.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns2e.tmp' cmd /c sET /A "0x2E^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa.tmp' cmd /c sET /A "0x4E^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns98.tmp' cmd /c sET /A "0x67^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns97.tmp' cmd /c sET /A "0x51^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsf.tmp' cmd /c sET /A "0x41^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns2d.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns2b.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns2c.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns2a.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns30.tmp' cmd /c sET /A "0x6B^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns96.tmp' cmd /c sET /A "0x38^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns29.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns31.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns28.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns32.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns99.tmp' cmd /c sET /A "0x76^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns9b.tmp' cmd /c sET /A "0x6B^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns9a.tmp' cmd /c sET /A "0x44^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns95.tmp' cmd /c sET /A "0x38^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns26.tmp' cmd /c sET /A "0x3A^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns27.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns2f.tmp' cmd /c sET /A "0x22^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns9c.tmp' cmd /c sET /A "0x6E^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns24.tmp' cmd /c sET /A "0x32^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns25.tmp' cmd /c sET /A "0x7A^2"
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns7b.tmp' cmd /c sET /A "0x31^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa9.tmp' cmd /c sET /A "0x37^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsab.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns75.tmp' cmd /c sET /A "0x2E^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa6.tmp' cmd /c sET /A "0x6B^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns7c.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns95.tmp' cmd /c sET /A "0x38^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns93.tmp' cmd /c sET /A "0x31^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa7.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns90.tmp' cmd /c sET /A "0x4C^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns78.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns7a.tmp' cmd /c sET /A "0x7A^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns96.tmp' cmd /c sET /A "0x38^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns77.tmp' cmd /c sET /A "0x6B^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns76.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns74.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns94.tmp' cmd /c sET /A "0x30^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsaa.tmp' cmd /c sET /A "0x2E^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns91.tmp' cmd /c sET /A "0x47^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns8b.tmp' cmd /c sET /A "0x33^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns92.tmp' cmd /c sET /A "0x4E^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns8f.tmp' cmd /c sET /A "0x50^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa4.tmp' cmd /c sET /A "0x70^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa5.tmp' cmd /c sET /A "0x2A^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns87.tmp' cmd /c sET /A "0x2B^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns9d.tmp' cmd /c sET /A "0x67^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns89.tmp' cmd /c sET /A "0x2C^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns86.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns79.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns9e.tmp' cmd /c sET /A "0x52^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns85.tmp' cmd /c sET /A "0x36^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns8a.tmp' cmd /c sET /A "0x70^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns9f.tmp' cmd /c sET /A "0x6D^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns84.tmp' cmd /c sET /A "0x7A^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns9a.tmp' cmd /c sET /A "0x44^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns83.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa0.tmp' cmd /c sET /A "0x6B^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa8.tmp' cmd /c sET /A "0x70^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns9b.tmp' cmd /c sET /A "0x6B^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns82.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns23.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns8c.tmp' cmd /c sET /A "0x58^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa2.tmp' cmd /c sET /A "0x76^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns80.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns8d.tmp' cmd /c sET /A "0x49^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa3.tmp' cmd /c sET /A "0x67^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns7f.tmp' cmd /c sET /A "0x2E^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns98.tmp' cmd /c sET /A "0x67^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns88.tmp' cmd /c sET /A "0x72^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns39.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns7e.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns7d.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns97.tmp' cmd /c sET /A "0x51^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns9c.tmp' cmd /c sET /A "0x6E^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns58.tmp' cmd /c sET /A "0x38^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns73.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns21.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns22.tmp' cmd /c sET /A "0x6B^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns2d.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns99.tmp' cmd /c sET /A "0x76^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns24.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns25.tmp' cmd /c sET /A "0x7A^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns26.tmp' cmd /c sET /A "0x3A^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns28.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns29.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns2a.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns2b.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns20.tmp' cmd /c sET /A "0x2E^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns2c.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns2e.tmp' cmd /c sET /A "0x2E^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns2f.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa1.tmp' cmd /c sET /A "0x6C^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns30.tmp' cmd /c sET /A "0x6B^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns32.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns33.tmp' cmd /c sET /A "0x2E^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns34.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns35.tmp' cmd /c sET /A "0x72^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns36.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns37.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns38.tmp' cmd /c sET /A "0x2E^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns27.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns31.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns81.tmp' cmd /c sET /A "0x6B^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns45.tmp' cmd /c sET /A "0x2E^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns72.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns65.tmp' cmd /c sET /A "0x61^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns6.tmp' cmd /c sET /A "0x47^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns7.tmp' cmd /c sET /A "0x50^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns8.tmp' cmd /c sET /A "0x4C^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns9.tmp' cmd /c sET /A "0x47^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsa.tmp' cmd /c sET /A "0x4E^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsb.tmp' cmd /c sET /A "0x31^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsc.tmp' cmd /c sET /A "0x30^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns18.tmp' cmd /c sET /A "0x67^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsd.tmp' cmd /c sET /A "0x38^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsf.tmp' cmd /c sET /A "0x41^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns1e.tmp' cmd /c sET /A "0x36^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns10.tmp' cmd /c sET /A "0x70^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns12.tmp' cmd /c sET /A "0x63^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns13.tmp' cmd /c sET /A "0x76^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns14.tmp' cmd /c sET /A "0x67^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns15.tmp' cmd /c sET /A "0x44^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns17.tmp' cmd /c sET /A "0x6E^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns16.tmp' cmd /c sET /A "0x6B^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns5.tmp' cmd /c sET /A "0x49^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns5d.tmp' cmd /c sET /A "0x76^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns8e.tmp' cmd /c sET /A "0x47^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns5b.tmp' cmd /c sET /A "0x6B^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns1c.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns11.tmp' cmd /c sET /A "0x67^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns3a.tmp' cmd /c sET /A "0x6B^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns3b.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns1b.tmp' cmd /c sET /A "0x6F^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns3c.tmp' cmd /c sET /A "0x36^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns5c.tmp' cmd /c sET /A "0x70^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns60.tmp' cmd /c sET /A "0x6E^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns5e.tmp' cmd /c sET /A "0x77^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns5f.tmp' cmd /c sET /A "0x63^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns61.tmp' cmd /c sET /A "0x43^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns62.tmp' cmd /c sET /A "0x6E^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns63.tmp' cmd /c sET /A "0x6E^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns64.tmp' cmd /c sET /A "0x6D^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns1a.tmp' cmd /c sET /A "0x2A^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns19.tmp' cmd /c sET /A "0x43^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\nse.tmp' cmd /c sET /A "0x38^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns5a.tmp' cmd /c sET /A "0x54^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns55.tmp' cmd /c sET /A "0x4E^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns6a.tmp' cmd /c sET /A "0x2E^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns6b.tmp' cmd /c sET /A "0x6B^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns6c.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns6d.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns6e.tmp' cmd /c sET /A "0x7A^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns6f.tmp' cmd /c sET /A "0x33^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns70.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns66.tmp' cmd /c sET /A "0x2A^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns71.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns67.tmp' cmd /c sET /A "0x6B^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns59.tmp' cmd /c sET /A "0x38^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns57.tmp' cmd /c sET /A "0x30^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns56.tmp' cmd /c sET /A "0x31^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns3d.tmp' cmd /c sET /A "0x2E^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns3e.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns3f.tmp' cmd /c sET /A "0x6B^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns40.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns69.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns41.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns42.tmp' cmd /c sET /A "0x7A^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns43.tmp' cmd /c sET /A "0x3A^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns68.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns46.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns47.tmp' cmd /c sET /A "0x6B^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns48.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns49.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns4a.tmp' cmd /c sET /A "0x2B^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns4b.tmp' cmd /c sET /A "0x6B^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns4c.tmp' cmd /c sET /A "0x2C^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns1f.tmp' cmd /c sET /A "0x22^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns4d.tmp' cmd /c sET /A "0x70^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns4f.tmp' cmd /c sET /A "0x58^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns50.tmp' cmd /c sET /A "0x49^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns51.tmp' cmd /c sET /A "0x47^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns52.tmp' cmd /c sET /A "0x50^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns53.tmp' cmd /c sET /A "0x4C^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns54.tmp' cmd /c sET /A "0x47^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns1d.tmp' cmd /c sET /A "0x70^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns44.tmp' cmd /c sET /A "0x32^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\ns4e.tmp' cmd /c sET /A "0x37^2"' (with hidden window)
'C:\Documents\user\locals~1\temp\nsz4.tmp\nsac.tmp' cmd /c sET /A "0x6B^2"' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c sET /A "0x49^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x32^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x7A^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x3A^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x72^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x2B^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x2C^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x70^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x37^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x54^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x77^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x6D^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x61^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x33^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x51^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x36^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x2E^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x22^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x6F^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x2A^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x50^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x4C^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x4E^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x31^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x30^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x38^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x52^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x58^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x41^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x63^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x76^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x44^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x6B^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x6E^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x43^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x47^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x67^2"
'<SYSTEM32>\cmd.exe' /c sET /A "0x6C^2"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial