Technical Information
- <SYSTEM32>\setup.exe
- <SYSTEM32>\dllcache\setup.exe with <SYSTEM32>\dllcache\setup.exe.new
- <SYSTEM32>\setup.exe with <SYSTEM32>\setup.exe.new
- <SYSTEM32>\dllcache\setup.exe.new
- <SYSTEM32>\setup.exe.new
- <SYSTEM32>\setup.exe
- '<SYSTEM32>\cacls.exe' %WINDIR%\\system32\\cvbs.exe /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\\system32\\ft.exe /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\\system32\\n1.exe /e /d everyone
- '<SYSTEM32>\cacls.exe' +s +r +h %WINDIR%\\system32\\spcmd.sys
- '<SYSTEM32>\cacls.exe' %WINDIR%\\system32\\dvbs.vbs /e /d everyone
- '<SYSTEM32>\attrib.exe' /pid=3176
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\arphrosr1.tbl
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\xiaoyi20093.sys
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\arphrosr2.tbl
- '<SYSTEM32>\attrib.exe' %WINDIR%\\system32\\cal.exe /e /d everyone
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\setuplc.sys
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\mm.exe
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\f.exe
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\mm1.exe
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\c.txt
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\cmd.txt
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\gx.sys
- '<SYSTEM32>\cacls.exe' +s +r +h %WINDIR%\\system32\\zxxyyy.sys
- '<SYSTEM32>\cacls.exe' /pid=3272
- '<SYSTEM32>\attrib.exe' /pid=3304
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\Ls09.sys
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\tcpips.sys
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\cc.bat
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\tencent.sys
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\cc.sys
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\setupla.sys
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\G3i2Ll.sys
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\v6XXaks8.sys
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\zzjkxs.sys
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\zzxxxd.sys
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\system2.bat
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\zHZ69jR8.sys
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\system1.bat
- '<SYSTEM32>\cacls.exe' %WINDIR%\\system32\\spool\\dboy250.bat /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\\system32\\tcpyi.exe /e /d everyone
- '<SYSTEM32>\attrib.exe' /pid=1148
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\xiaoyi20092.sys
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\xiaoyi20091.sys
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\tcpyi.exe
- '<SYSTEM32>\cacls.exe' %WINDIR%\\system32\\setupla.exe /e /d everyone
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\setupla.exe
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\setuplc.exe
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\tcpyi.sys
- '<SYSTEM32>\cacls.exe' %WINDIR%\\system32\\setuplc.exe /e /d everyone
- '<SYSTEM32>\reg.exe' +s +r +h %WINDIR%\\system32\\setup.exe
- '<SYSTEM32>\reg.exe' /pid=1600
- '<SYSTEM32>\reg.exe' %WINDIR%\\AppPatch\\nvunins.bat /e /d everyone
- '<SYSTEM32>\sc.exe' stop sharedaccess
- '<SYSTEM32>\cacls.exe' %WINDIR%\\system32\\net1.exe /e /d everyone
- '<SYSTEM32>\sc.exe' delete sharedaccess
- '<SYSTEM32>\reg.exe' /pid=2696
- '<SYSTEM32>\attrib.exe' +s +r +h c:\sc.exe
- '<SYSTEM32>\attrib.exe' +s +r +h c:\gz
- '<SYSTEM32>\cacls.exe' c:\sc.exe /e /d everyone
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\AppPatch\\nvunins.bat
- '<SYSTEM32>\attrib.exe' +s +r +h c:\cc.txt
- '<SYSTEM32>\attrib.exe' +h %WINDIR%\\system32\\tpcyi.bat
- '<SYSTEM32>\attrib.exe' +h %WINDIR%\\system32\\tpcyi.sys
- '<SYSTEM32>\attrib.exe' +h %WINDIR%\\system32\\setuplo.sys
- '<SYSTEM32>\ping.exe' 127.0.0.1 -4
- '<SYSTEM32>\attrib.exe' +h %WINDIR%\\system32\\setuplo.bat
- '<SYSTEM32>\attrib.exe' /pid=2936
- '<SYSTEM32>\attrib.exe' +h +s %WINDIR%\\system32\\spool\\NetSetup2.bat
- '<SYSTEM32>\attrib.exe' /pid=2772
- '<SYSTEM32>\cacls.exe' +h +s %WINDIR%\\system32\\spool\\NetSetup1.bat
- '<SYSTEM32>\cacls.exe' +h %WINDIR%\\system32\\config\\arphroyi3.tbl
- '<SYSTEM32>\attrib.exe' /pid=2792
- '<SYSTEM32>\reg.exe' %WINDIR%\\s.exe /e /d everyone
- '<SYSTEM32>\reg.exe' /pid=3624
- '<SYSTEM32>\reg.exe' /pid=3660
- '<SYSTEM32>\reg.exe' /pid=3692
- '<SYSTEM32>\reg.exe' +s +r +h %WINDIR%\\tmd1.exe
- '<SYSTEM32>\reg.exe' +s +r +h %WINDIR%\\s.exe
- '<SYSTEM32>\reg.exe' /pid=756
- '<SYSTEM32>\reg.exe' G?pndirMG?
- '<SYSTEM32>\reg.exe' /pid=3544
- '<SYSTEM32>\reg.exe' /pid=3592
- '<SYSTEM32>\reg.exe' +s +r +h %WINDIR%\\system32\\cc1.txt
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\se.exe
- '<SYSTEM32>\reg.exe' +s +r +h %WINDIR%\\a2.exe
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\62.exe
- '<SYSTEM32>\attrib.exe' +s +r +h c:\explorer
- '<SYSTEM32>\attrib.exe' +s +r +h c:\boot.exe
- '<SYSTEM32>\reg.exe' /pid=3796
- '<SYSTEM32>\reg.exe' /pid=3724
- '<SYSTEM32>\reg.exe' +s +r +h %WINDIR%\\tmd2.exe
- '<SYSTEM32>\reg.exe' +s +r +h %WINDIR%\\tmd.exe
- '<SYSTEM32>\reg.exe' +s +r +h %WINDIR%\\a1.exe
- '<SYSTEM32>\reg.exe' /pid=3756
- '<SYSTEM32>\cacls.exe' %WINDIR%\\system32\\sysme.bat /e /d everyone
- '<SYSTEM32>\attrib.exe' +r %WINDIR%\\system32\\sc.exe
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\dllcache\\reg.exe
- '<SYSTEM32>\attrib.exe' +r %WINDIR%\\system32\\attrib.exe
- '<SYSTEM32>\attrib.exe' +r %WINDIR%\\system32\\cacls.exe
- '<SYSTEM32>\attrib.exe' +r %WINDIR%\\system32\\dllcache\\attrib.exe
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\reg.exe
- '<SYSTEM32>\cacls.exe' %WINDIR%\\system32\\regini.exe /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\\system32\\command.com /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\\system32\\xcopy.exe /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\\system32\\tftp.exe /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\\system32\\cscript.exe /e /d everyone
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 4 /t REG_SZ /d tmd2.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 3 /t REG_SZ /d tmd1.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 5 /t REG_SZ /d a.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 7 /t REG_SZ /d 88.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 6 /t REG_SZ /d s.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ /v DisallowRun /t REG_DWORD /d 1 /f
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\cmd.exe
- '<SYSTEM32>\attrib.exe' +r %WINDIR%\\system32\\dllcache\\cacls.exe
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\dllcache\\cmd.exe
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_SZ /d 0 /f
- '<SYSTEM32>\attrib.exe' +r +s +h %WINDIR%\\system32\\net1.exe
- '<SYSTEM32>\attrib.exe' +h %WINDIR%\\system32\\config\\arphrosr2.tbl
- '<SYSTEM32>\attrib.exe' +h %WINDIR%\\system32\\config\\setupyi3.bat
- '<SYSTEM32>\attrib.exe' +h %WINDIR%\\system32\\config\\setups2.bat
- '<SYSTEM32>\attrib.exe' +h +s %WINDIR%\\system32\\ras\\dels.bat
- '<SYSTEM32>\attrib.exe' +h +s %WINDIR%\\system32\\export\\nvuninm.bat
- '<SYSTEM32>\attrib.exe' +h %WINDIR%\\system32\\config\\arphroyi3.tbl
- '<SYSTEM32>\attrib.exe' +h +s +r "<Drive name for removable media>:\Program Files\Microsoft SQL Server\MSSQL\Binn\odsole70.dll"
- '<SYSTEM32>\attrib.exe' +h +s +r "%PROGRAM_FILES%\Microsoft SQL Server\MSSQL\Binn\odsole70.dll"
- '<SYSTEM32>\attrib.exe' +h +s +r "E:\Program Files\Microsoft SQL Server\MSSQL\Binn\odsole70.dll"
- '<SYSTEM32>\attrib.exe' +h +s +r "G:\Program Files\Microsoft SQL Server\MSSQL\Binn\odsole70.dll"
- '<SYSTEM32>\attrib.exe' +h +s +r "F:\Program Files\Microsoft SQL Server\MSSQL\Binn\odsole70.dll"
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\regini.exe
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\cscript.exe
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\dllcache\\regini.exe
- '<SYSTEM32>\cacls.exe' %WINDIR%\\system32\\dllcache\\ftp.exe /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\\system32\\ftp.exe /e /d everyone
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\dllcache\\doskey.exe
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\dllcache\\ftp.exe
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\ftp.exe
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\command.com
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\doskey.exe
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\dllcache\\command.com
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 8 /t REG_SZ /d 89.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 38 /t REG_SZ /d cal.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 37 /t REG_SZ /d mm1.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 39 /t REG_SZ /d ft.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 41 /t REG_SZ /d n1.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 40 /t REG_SZ /d cvbs.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 36 /t REG_SZ /d dboy250.bat /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 32 /t REG_SZ /d xiaoyi20091.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 31 /t REG_SZ /d ff.BAT /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 33 /t REG_SZ /d xiaoyi20092.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 35 /t REG_SZ /d dboysb.bat /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 34 /t REG_SZ /d xiaoyi20093.exe /f
- '<SYSTEM32>\cacls.exe' %WINDIR%\\debug\\kao.bat /e /d everyone
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\debug\\kao.bat
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\\wbem\\\a.exe
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\sysme.bat
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\system32\\\wbem\\\b.exe
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\msapps\\del.bat
- '<SYSTEM32>\attrib.exe' -s -r -h -a %WINDIR%\\ime\\imejp\\nvunins.bat
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 42 /t REG_SZ /d dvbs.vbs /f
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\\ime\\imejp\\nvunins.bat
- '<SYSTEM32>\attrib.exe' -s -r -h -a %WINDIR%\\msapps\\del.bat
- '<SYSTEM32>\cacls.exe' %WINDIR%\\ime\\imejp\\nvunins.bat /e /d everyone
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 16 /t REG_SZ /d 93.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 15 /t REG_SZ /d 92.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 17 /t REG_SZ /d 94.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 19 /t REG_SZ /d mm.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 18 /t REG_SZ /d 62.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 14 /t REG_SZ /d tcpips.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 10 /t REG_SZ /d 91.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 9 /t REG_SZ /d 90.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 11 /t REG_SZ /d mn.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 13 /t REG_SZ /d tmd.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 12 /t REG_SZ /d cc.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 27 /t REG_SZ /d aa.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 26 /t REG_SZ /d CB.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 28 /t REG_SZ /d xiaoyi.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 30 /t REG_SZ /d ARP.BAT /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 29 /t REG_SZ /d v6XXaks8.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 25 /t REG_SZ /d zzzz11.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 21 /t REG_SZ /d b.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 20 /t REG_SZ /d 520.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 22 /t REG_SZ /d 55.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 24 /t REG_SZ /d yyyy11.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 23 /t REG_SZ /d 75.exe /f
- <SYSTEM32>\reg.exe
- <SYSTEM32>\cacls.exe
- <SYSTEM32>\attrib.exe
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'DisallowRun' = '00000001'
- <SYSTEM32>\cmd.txt
- <SYSTEM32>\mm1.exe
- <SYSTEM32>\mm.exe
- %WINDIR%\tmd1.exe
- %WINDIR%\s.exe
- <SYSTEM32>\c.txt
- <SYSTEM32>\f.exe
- <SYSTEM32>\zxxyyy.sys
- <SYSTEM32>\spcmd.sys
- <SYSTEM32>\setuplc.sys
- <SYSTEM32>\gx.sys
- <SYSTEM32>\Ls09.sys
- <SYSTEM32>\tcpips.sys
- C:\sc.exe
- C:\gz
- C:\explorer
- <DRIVERS>\acpiec1.sys
- %WINDIR%\AppPatch\nvunins.bat
- C:\cc.txt
- C:\boot.exe
- %WINDIR%\a1.exe
- %WINDIR%\tmd.exe
- %WINDIR%\tmd2.exe
- %WINDIR%\62.exe
- %WINDIR%\se.exe
- %WINDIR%\a2.exe
- <SYSTEM32>\arphrosr2.tbl
- <SYSTEM32>\system2.bat
- <SYSTEM32>\zzjkxs.sys
- <SYSTEM32>\zzxxxd.sys
- <SYSTEM32>\v6XXaks8.sys
- <SYSTEM32>\zHZ69jR8.sys
- <SYSTEM32>\system1.bat
- <SYSTEM32>\sysme.bat
- %WINDIR%\msapps\del.bat
- <SYSTEM32>\export\nvuninm.bat
- %TEMP%\bt4765.bat
- <SYSTEM32>\wbem\b.exe
- <SYSTEM32>\wbem\a.exe
- %WINDIR%\Debug\kao.bat
- <SYSTEM32>\xiaoyi20091.sys
- <SYSTEM32>\tcpyi.exe
- <SYSTEM32>\tcpyi.sys
- <SYSTEM32>\arphrosr1.tbl
- <SYSTEM32>\xiaoyi20093.sys
- <SYSTEM32>\xiaoyi20092.sys
- <SYSTEM32>\setuplc.exe
- <SYSTEM32>\cc.sys
- <SYSTEM32>\cc.bat
- <SYSTEM32>\tencent.sys
- <SYSTEM32>\setupla.exe
- <SYSTEM32>\setupla.sys
- <SYSTEM32>\G3i2Ll.sys
- <SYSTEM32>\mm1.exe
- <SYSTEM32>\mm.exe
- <SYSTEM32>\f.exe
- %WINDIR%\s.exe
- <SYSTEM32>\c.txt
- <SYSTEM32>\cmd.txt
- <SYSTEM32>\gx.sys
- <SYSTEM32>\spcmd.sys
- <SYSTEM32>\setuplc.sys
- <SYSTEM32>\arphrosr2.tbl
- <SYSTEM32>\Ls09.sys
- <SYSTEM32>\tcpips.sys
- <SYSTEM32>\zxxyyy.sys
- C:\gz
- C:\explorer
- C:\boot.exe
- %WINDIR%\AppPatch\nvunins.bat
- C:\cc.txt
- C:\sc.exe
- %WINDIR%\62.exe
- %WINDIR%\tmd.exe
- %WINDIR%\tmd2.exe
- %WINDIR%\tmd1.exe
- %WINDIR%\se.exe
- %WINDIR%\a2.exe
- %WINDIR%\a1.exe
- <SYSTEM32>\system2.bat
- <SYSTEM32>\zzjkxs.sys
- <SYSTEM32>\zzxxxd.sys
- <SYSTEM32>\v6XXaks8.sys
- <SYSTEM32>\zHZ69jR8.sys
- <SYSTEM32>\system1.bat
- <SYSTEM32>\sysme.bat
- %WINDIR%\msapps\del.bat
- <SYSTEM32>\export\nvuninm.bat
- %TEMP%\bt4765.bat
- <SYSTEM32>\wbem\b.exe
- <SYSTEM32>\wbem\a.exe
- %WINDIR%\Debug\kao.bat
- <SYSTEM32>\xiaoyi20091.sys
- <SYSTEM32>\tcpyi.exe
- <SYSTEM32>\tcpyi.sys
- <SYSTEM32>\arphrosr1.tbl
- <SYSTEM32>\xiaoyi20093.sys
- <SYSTEM32>\xiaoyi20092.sys
- <SYSTEM32>\setuplc.exe
- <SYSTEM32>\cc.sys
- <SYSTEM32>\cc.bat
- <SYSTEM32>\tencent.sys
- <SYSTEM32>\setupla.exe
- <SYSTEM32>\setupla.sys
- <SYSTEM32>\G3i2Ll.sys
- %TEMP%\bt4765.bat
- <SYSTEM32>\ias\ias.mdb
- <SYSTEM32>\ias\dnary.mdb