Technical Information
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.rAr" "C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.rAr" "C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.rAr" "C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.rAr" "C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT"
- 'C:\tmp\Rar.exe' /pid=3332
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp.rAr" "C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp.rAr" "C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp.rAr" "C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\Colorer\catalog.xml.rAr" "C:\Far2\Plugins\Colorer\catalog.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\Colorer\hrc\changes.txt.rAr" "C:\Far2\Plugins\Colorer\hrc\changes.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Documentation\rus\TechInfo.txt.rAr" "C:\Far2\Documentation\rus\TechInfo.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\7-Zip\far7z.txt.rAr" "C:\Far2\Plugins\7-Zip\far7z.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\Colorer\hrd\catalog-text.xml.rAr" "C:\Far2\Plugins\Colorer\hrd\catalog-text.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.rAr" "C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\Colorer\hrd\catalog-console.xml.rAr" "C:\Far2\Plugins\Colorer\hrd\catalog-console.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\Colorer\hrd\catalog-rgb.xml.rAr" "C:\Far2\Plugins\Colorer\hrd\catalog-rgb.xml"
- 'C:\tmp\Rar.exe' /pid=3516
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "%CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta Bkgrd.jpg.rAr" "%CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta Bkgrd.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "%CommonProgramFiles%\Microsoft Shared\Stationery\Glacier Bkgrd.jpg.rAr" "%CommonProgramFiles%\Microsoft Shared\Stationery\Glacier Bkgrd.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\FTP\Notes_rus.txt.rAr" "C:\Far2\Plugins\FTP\Notes_rus.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "%CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day Bkgrd.jpg.rAr" "%CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day Bkgrd.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "%CommonProgramFiles%\Microsoft Shared\Stationery\Maize Bkgrd.jpg.rAr" "%CommonProgramFiles%\Microsoft Shared\Stationery\Maize Bkgrd.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "%CommonProgramFiles%\Microsoft Shared\Stationery\Nature Bkgrd.jpg.rAr" "%CommonProgramFiles%\Microsoft Shared\Stationery\Nature Bkgrd.jpg"
- 'C:\tmp\Rar.exe' /pid=4080
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "%CommonProgramFiles%\Microsoft Shared\Stationery\Leaves Bkgrd.jpg.rAr" "%CommonProgramFiles%\Microsoft Shared\Stationery\Leaves Bkgrd.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp.rAr" "C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp.rAr" "C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp.rAr" "C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp.rAr" "C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\FTP\FtpCmds.txt.rAr" "C:\Far2\Plugins\FTP\FtpCmds.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\FTP\Notes.txt.rAr" "C:\Far2\Plugins\FTP\Notes.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP.rAr" "C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP.rAr" "C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Documents and Settings\Default User\Templates\excel.xls.rAr" "C:\Documents and Settings\Default User\Templates\excel.xls"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Documents and Settings\Default User\Templates\excel4.xls.rAr" "C:\Documents and Settings\Default User\Templates\excel4.xls"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.rAr" "C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML.rAr" "C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Documents and Settings\Default User\Templates\winword2.doc.rAr" "C:\Documents and Settings\Default User\Templates\winword2.doc"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "<LS_APPDATA>\Microsoft\Windows Media\9.0\WMSDKNS.XML.rAr" "<LS_APPDATA>\Microsoft\Windows Media\9.0\WMSDKNS.XML"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Documents and Settings\Default User\Templates\powerpnt.ppt.rAr" "C:\Documents and Settings\Default User\Templates\powerpnt.ppt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Documents and Settings\Default User\Templates\winword.doc.rAr" "C:\Documents and Settings\Default User\Templates\winword.doc"
- 'C:\tmp\moar.exe'
- 'C:\tmp\bmrsa.exe' -mkh -mit -moh -pu -f public.cod
- 'C:\tmp\zap.exe'
- 'C:\tmp\strt.exe'
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.rAr" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.rAr" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.rAr" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.rAr" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "%HOMEPATH%\Templates\excel.xls.rAr" "%HOMEPATH%\Templates\excel.xls"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Documentation\rus\Arc.Support.txt.rAr" "C:\Far2\Documentation\rus\Arc.Support.txt"
- 'C:\tmp\Rar.exe' /pid=3556
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Documentation\eng\Plugins.Review.txt.rAr" "C:\Far2\Documentation\eng\Plugins.Review.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Documentation\eng\TechInfo.txt.rAr" "C:\Far2\Documentation\eng\TechInfo.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Documentation\rus\Plugins.Install.txt.rAr" "C:\Far2\Documentation\rus\Plugins.Install.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Documentation\rus\Plugins.Review.txt.rAr" "C:\Far2\Documentation\rus\Plugins.Review.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Documentation\rus\Bug.Report.txt.rAr" "C:\Far2\Documentation\rus\Bug.Report.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Documentation\rus\Far.FAQ.txt.rAr" "C:\Far2\Documentation\rus\Far.FAQ.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "%HOMEPATH%\Templates\winword.doc.rAr" "%HOMEPATH%\Templates\winword.doc"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "%HOMEPATH%\Templates\winword2.doc.rAr" "%HOMEPATH%\Templates\winword2.doc"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "%HOMEPATH%\Templates\excel4.xls.rAr" "%HOMEPATH%\Templates\excel4.xls"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "%HOMEPATH%\Templates\powerpnt.ppt.rAr" "%HOMEPATH%\Templates\powerpnt.ppt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Documentation\eng\Bug.Report.txt.rAr" "C:\Far2\Documentation\eng\Bug.Report.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Documentation\eng\Far.FAQ.txt.rAr" "C:\Far2\Documentation\eng\Far.FAQ.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Addons\README.TXT.rAr" "C:\Far2\Addons\README.TXT"
- 'C:\tmp\Rar.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "C:\Far2\Documentation\eng\Arc.Support.txt.rAr" "C:\Far2\Documentation\eng\Arc.Support.txt"
- '<SYSTEM32>\cmd.exe' /c bm.cmd
- '<SYSTEM32>\ping.exe' a -ep1 -dw -pG5RtK8P83fSk26yRmtcLS86pgF2PaF9ZAQyWyGe0j5CW55nVBp0YwG138gy5o980 "%APPDATA%\Microsoft\Internet Explorer\brndlog.txt.rAr" "%APPDATA%\Microsoft\Internet Explorer\brndlog.txt"
- '<SYSTEM32>\ping.exe' /pid=2980
- '<SYSTEM32>\ping.exe' -n 8 -w 1000 127.0.0.1
- '<SYSTEM32>\cmd.exe' /c driver.bat
- '<SYSTEM32>\ping.exe' -n 75 -w 1000 127.0.0.1
- '<SYSTEM32>\cmd.exe' /c c:\tmp\drv.bat
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\ping.exe
- C:\Far2\Documentation\eng\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Addons\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Plugins\7-Zip\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Documentation\rus\!!!Файлы зашифрованы!!!.txt
- %APPDATA%\Microsoft\Internet Explorer\!!!Файлы зашифрованы!!!.txt
- C:\Documents and Settings\Default User\Templates\!!!Файлы зашифрованы!!!.txt
- %HOMEPATH%\Templates\!!!Файлы зашифрованы!!!.txt
- <LS_APPDATA>\Microsoft\Windows Media\9.0\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Plugins\ExtSearch\sources\RegExp\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Plugins\ExtSearch\sources\!!!Файлы зашифрованы!!!.txt
- %CommonProgramFiles%\Microsoft Shared\Stationery\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Plugins\FTP\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Plugins\Colorer\hrc\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Plugins\Colorer\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Plugins\ExtSearch\doc\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Plugins\Colorer\hrd\!!!Файлы зашифрованы!!!.txt
- C:\tmp\public.cod
- C:\tmp\moar.exe
- C:\tmp\strt.exe
- C:\tmp\Rar.exe
- C:\tmp\bmrsa.exe
- C:\tmp\bm.cmd
- C:\tmp\drv.bat
- C:\tmp\driver.bat
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\!!!Файлы зашифрованы!!!.txt
- C:\tmp\key
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\!!!Файлы зашифрованы!!!.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\!!!Файлы зашифрованы!!!.txt
- C:\tmp\system
- C:\tmp\zap.exe
- C:\tmp\sys
- C:\tmp\psystem
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'