Trojan.MulDrop24.47518

Technical Information

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /IM "IDMan.exe" /F
'%WINDIR%\syswow64\taskkill.exe' /IM "IEMonitor.exe" /F
'%WINDIR%\syswow64\taskkill.exe' /IM "IDMGrHlp.exe" /F
'%WINDIR%\syswow64\taskkill.exe' /IM "idmBroker.exe" /F
'%WINDIR%\syswow64\taskkill.exe' /IM "IDMMsgHost.exe" /F
'%WINDIR%\syswow64\taskkill.exe' /IM "MediumILStart.exe" /F

Launches a large number of processes

Modifies file system

Creates the following files

C:\kinghaze\fixer.bat
C:\kinghaze\kur\idm56.tmp
C:\kinghaze\kur\idm57.tmp
C:\kinghaze\kur\idm58.tmp
C:\kinghaze\kur\idm59.tmp
C:\kinghaze\kur\idm6.tmp
C:\kinghaze\kur\idm60.tmp
C:\kinghaze\kur\idm61.tmp
C:\kinghaze\kur\idm62.tmp
C:\kinghaze\kur\idm63.tmp
C:\kinghaze\kur\idm41.tmp
C:\kinghaze\kur\idm64.tmp
C:\kinghaze\kur\idm66.tmp
C:\kinghaze\kur\idm67.tmp
C:\kinghaze\kur\idm68.tmp
C:\kinghaze\kur\idm69.tmp
C:\kinghaze\kur\idm7.tmp
C:\kinghaze\kur\idm70.tmp
C:\kinghaze\kur\idm71.tmp
C:\kinghaze\kur\idm72.tmp
C:\kinghaze\kur\idm73.tmp
C:\kinghaze\kur\idm54.tmp
C:\kinghaze\kur\idm55.tmp
C:\kinghaze\kur\idm53.tmp
C:\kinghaze\kur\idm52.tmp
C:\kinghaze\kur\idm51.tmp
C:\kinghaze\kur\idm32.tmp
C:\kinghaze\kur\idm33.tmp
C:\kinghaze\kur\idm34.tmp
C:\kinghaze\kur\idm35.tmp
C:\kinghaze\kur\idm36.tmp
C:\kinghaze\kur\idm37.tmp
C:\kinghaze\kur\idm38.tmp
C:\kinghaze\kur\idm39.tmp
C:\kinghaze\kur\idm4.tmp
C:\kinghaze\kur\idm74.tmp
C:\kinghaze\kur\idm65.tmp
C:\kinghaze\kur\idm40.tmp
C:\kinghaze\kur\idm43.tmp
C:\kinghaze\kur\idm44.tmp
C:\kinghaze\kur\idm45.tmp
C:\kinghaze\kur\idm46.tmp
C:\kinghaze\kur\idm47.tmp
C:\kinghaze\kur\idm48.tmp
C:\kinghaze\kur\idm49.tmp
C:\kinghaze\kur\idm5.tmp
C:\kinghaze\kur\idm50.tmp
C:\kinghaze\kur\idm31.tmp
C:\kinghaze\kur\idm42.tmp
C:\kinghaze\kur\idm88.tmp
C:\kinghaze\kur.exe
C:\kinghaze\kur\idm77.tmp
C:\kinghaze\toolbar\office flat\office flat-small_disabled.bmp
C:\kinghaze\toolbar\office flat\office flat-small_hot.bmp
C:\kinghaze\toolbar\office flat\office flat-small_normal.bmp
C:\kinghaze\toolbar\office flat dark\office flat dark-large_disabled.bmp
C:\kinghaze\toolbar\office flat dark\office flat dark-large_hot.bmp
C:\kinghaze\toolbar\office flat dark\office flat dark-large_normal.bmp
C:\kinghaze\toolbar\office flat dark\office flat dark-small_disabled.bmp
C:\kinghaze\toolbar\office flat dark\office flat dark-small_hot.bmp
C:\kinghaze\toolbar\office flat dark\office flat dark-small_normal.bmp
C:\kinghaze\kur\idm75.tmp
C:\kinghaze\toolbar\office flat dark.tbi
C:\kinghaze\toolbar\windows 10\windows10.bmp
C:\kinghaze\toolbar\windows 10.tbi
C:\kinghaze\toolbar\windows 11\windows 11-large_disabled.bmp
C:\kinghaze\toolbar\windows 11\windows 11-large_hot.bmp
C:\kinghaze\toolbar\windows 11\windows 11-large_normal.bmp
C:\kinghaze\toolbar\windows 11\windows 11-small_disabled.bmp
C:\kinghaze\toolbar\windows 11\windows 11-small_hot.bmp
C:\kinghaze\toolbar\windows 11\windows 11-small_normal.bmp
C:\kinghaze\toolbar\windows 11.tbi
C:\kinghaze\toolbar\office flat\office flat-large_hot.bmp
C:\kinghaze\toolbar\office flat\office flat-large_normal.bmp
C:\kinghaze\toolbar\office flat\office flat-large_disabled.bmp
C:\kinghaze\kur\idm99.tmp
C:\kinghaze\kur\idm98.tmp
C:\kinghaze\kur\idm79.tmp
C:\kinghaze\kur\idm8.tmp
C:\kinghaze\kur\idm80.tmp
C:\kinghaze\kur\idm81.tmp
C:\kinghaze\kur\idm82.tmp
C:\kinghaze\kur\idm83.tmp
C:\kinghaze\kur\idm84.tmp
C:\kinghaze\kur\idm85.tmp
C:\kinghaze\kur\idm86.tmp
C:\kinghaze\kur\idm76.tmp
C:\kinghaze\kur\idm30.tmp
C:\kinghaze\kur\idm87.tmp
C:\kinghaze\kur\idm9.tmp
C:\kinghaze\kur\idm90.tmp
C:\kinghaze\kur\idm91.tmp
C:\kinghaze\kur\idm92.tmp
C:\kinghaze\kur\idm93.tmp
C:\kinghaze\kur\idm94.tmp
C:\kinghaze\kur\idm95.tmp
C:\kinghaze\kur\idm96.tmp
C:\kinghaze\kur\idm97.tmp
C:\kinghaze\kur\idm78.tmp
C:\kinghaze\kur\idm89.tmp
C:\kinghaze\toolbar\office flat.tbi
C:\kinghaze\kur\idm3.tmp
C:\kinghaze\kur\idm19.tmp
C:\kinghaze\kur\idm122.tmp
C:\kinghaze\kur\idm123.tmp
C:\kinghaze\kur\idm124.tmp
C:\kinghaze\kur\idm125.tmp
C:\kinghaze\kur\idm126.tmp
C:\kinghaze\kur\idm127.tmp
C:\kinghaze\kur\idm128.tmp
C:\kinghaze\kur\idm129.tmp
C:\kinghaze\kur\idm13.tmp
C:\kinghaze\kur\idm108.tmp
C:\kinghaze\kur\idm130.tmp
C:\kinghaze\kur\idm132.tmp
C:\kinghaze\kur\idm133.tmp
C:\kinghaze\kur\idm134.tmp
C:\kinghaze\kur\idm135.tmp
C:\kinghaze\kur\idm136.tmp
C:\kinghaze\kur\idm137.tmp
C:\kinghaze\kur\idm138.tmp
C:\kinghaze\kur\idm139.tmp
C:\kinghaze\kur\idm14.tmp
C:\kinghaze\kur\idm120.tmp
C:\kinghaze\kur\idm121.tmp
C:\kinghaze\kur\idm12.tmp
C:\kinghaze\kur\idm119.tmp
C:\kinghaze\kur\idm118.tmp
C:\kinghaze\kur\idm1.tmp
C:\kinghaze\kur\idm10.tmp
C:\kinghaze\kur\idm100.tmp
C:\kinghaze\kur\idm101.tmp
C:\kinghaze\kur\idm102.tmp
C:\kinghaze\kur\idm103.tmp
C:\kinghaze\kur\idm104.tmp
C:\kinghaze\kur\idm105.tmp
C:\kinghaze\kur\idm106.tmp
C:\kinghaze\kur\idm140.tmp
C:\kinghaze\kur\idm131.tmp
C:\kinghaze\kur\idm107.tmp
C:\kinghaze\kur\idm11.tmp
C:\kinghaze\kur\idm110.tmp
C:\kinghaze\kur\idm111.tmp
C:\kinghaze\kur\idm112.tmp
C:\kinghaze\kur\idm113.tmp
C:\kinghaze\kur\idm114.tmp
C:\kinghaze\kur\idm115.tmp
C:\kinghaze\kur\idm116.tmp
C:\kinghaze\kur\idm117.tmp
C:\kinghaze\kur\idm0.tmp
C:\kinghaze\kur\idm109.tmp
C:\kinghaze\kur\idm154.tmp
C:\kinghaze\kur\idm28.tmp
C:\kinghaze\kur\idm143.tmp
C:\kinghaze\kur\idm169.tmp
C:\kinghaze\kur\idm17.tmp
C:\kinghaze\kur\idm170.tmp
C:\kinghaze\kur\idm171.tmp
C:\kinghaze\kur\idm172.tmp
C:\kinghaze\kur\idm173.tmp
C:\kinghaze\kur\idm174.tmp
C:\kinghaze\kur\idm175.tmp
C:\kinghaze\kur\idm176.tmp
C:\kinghaze\kur\idm141.tmp
C:\kinghaze\kur\idm18.tmp
C:\kinghaze\kur\idm2.tmp
C:\kinghaze\kur\idm20.tmp
C:\kinghaze\kur\idm21.tmp
C:\kinghaze\kur\idm22.tmp
C:\kinghaze\kur\idm23.tmp
C:\kinghaze\kur\idm24.tmp
C:\kinghaze\kur\idm25.tmp
C:\kinghaze\kur\idm26.tmp
C:\kinghaze\kur\idm27.tmp
C:\kinghaze\kur\idm167.tmp
C:\kinghaze\kur\idm168.tmp
C:\kinghaze\kur\idm166.tmp
C:\kinghaze\kur\idm165.tmp
C:\kinghaze\kur\idm164.tmp
C:\kinghaze\kur\idm145.tmp
C:\kinghaze\kur\idm146.tmp
C:\kinghaze\kur\idm147.tmp
C:\kinghaze\kur\idm148.tmp
C:\kinghaze\kur\idm149.tmp
C:\kinghaze\kur\idm15.tmp
C:\kinghaze\kur\idm150.tmp
C:\kinghaze\kur\idm151.tmp
C:\kinghaze\kur\idm152.tmp
C:\kinghaze\kur\idm142.tmp
C:\kinghaze\kur\idm29.tmp
C:\kinghaze\kur\idm153.tmp
C:\kinghaze\kur\idm156.tmp
C:\kinghaze\kur\idm157.tmp
C:\kinghaze\kur\idm158.tmp
C:\kinghaze\kur\idm159.tmp
C:\kinghaze\kur\idm16.tmp
C:\kinghaze\kur\idm160.tmp
C:\kinghaze\kur\idm161.tmp
C:\kinghaze\kur\idm162.tmp
C:\kinghaze\kur\idm163.tmp
C:\kinghaze\kur\idm144.tmp
C:\kinghaze\kur\idm155.tmp
nul

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'C:\kinghaze\kur.exe'

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""C:\Kinghaze\Fixer.bat" "
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}"
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}"
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}"
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
'%WINDIR%\syswow64\reg.exe' query HKU\S-1-5-19
'%WINDIR%\syswow64\whoami.exe' /user /fo list
'%WINDIR%\syswow64\cmd.exe' /c whoami /user /fo list
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней