Trojan.MulDrop11.26190

Technical Information

Modifies file system

Creates the following files

<LS_APPDATA>\中国电力技术装备有限公司簡介.doc
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_user pinned_startmenu_icq.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_user pinned_startmenu_icq.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_total commander_total commander 64 bit.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_total commander_total commander 64 bit.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_total commander_total commander help.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_total commander_total commander help.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_total commander_uninstall or repair total commander.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_total commander_uninstall or repair total commander.lnk
%TEMP%\c__users_user_desktop_total commander 64 bit.lnk.tmp
%TEMP%\c__users_user_desktop_total commander 64 bit.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_winamp.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_winamp.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_mail.ru_mail.ru agent.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_mail.ru_mail.ru agent.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_mail.ru_uninstall mail.ru agent.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_user pinned_taskbar_icq.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_user pinned_taskbar_icq.lnk.tmp
%TEMP%\c__users_user_desktop_icq.lnk
%TEMP%\c__users_user_desktop_icq.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_accessories_accessibility_ease of access.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_accessories_run.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_accessories_notepad.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_accessories_notepad.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_window switcher.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_shows desktop.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_accessories_system tools_control panel.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_icq_icq.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_icq_icq.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_icq_uninstall icq.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_icq_uninstall icq.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_icq_icq.com.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_icq.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_icq.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_icq.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_icq.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_accessories_accessibility_ease of access.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_mail.ru_uninstall mail.ru agent.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_mail.ru_mail.ru portal.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_mail.ru agent.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_winrar_console rar manual.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_winrar_console rar manual.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_mozilla thunderbird.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_mozilla thunderbird.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_telegram desktop_telegram.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_telegram desktop_telegram.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_telegram desktop_uninstall telegram.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_telegram desktop_uninstall telegram.lnk
%TEMP%\c__users_user_desktop_telegram.lnk.tmp
%TEMP%\c__users_user_desktop_telegram.lnk
<LS_APPDATA>\acrobat.bat
<LS_APPDATA>\~$电力技术装备有限公司簡介.doc
<LS_APPDATA>\aecom.dat
<LS_APPDATA>\hadgj.dll
%TEMP%\中国电力技术装备有限公司簡介.doc
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_winrar_what is new in the latest version.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_winrar_what is new in the latest version.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_winrar_winrar help.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_winrar_winrar help.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_mail.ru agent.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_mail.ru agent.lnk
%TEMP%\c__users_user_desktop_mail.ru agent.lnk.tmp
%TEMP%\c__users_user_desktop_mail.ru agent.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_user pinned_taskbar_mail.ru agent.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_user pinned_taskbar_mail.ru agent.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_user pinned_startmenu_mail.ru agent.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_qip 2012.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_user pinned_startmenu_mail.ru agent.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_qip 2012.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_qip 2012.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_qip 2012.lnk
%TEMP%\c__users_user_desktop_qip 2012.lnk.tmp
%TEMP%\c__users_user_desktop_qip 2012.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_winrar_winrar.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_winrar_winrar.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_mail.ru agent.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_accessories_accessibility_magnify.lnk

Deletes the following files

%TEMP%\c__users_user_desktop_telegram.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_user pinned_taskbar_icq.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_user pinned_taskbar_icq.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_user pinned_startmenu_icq.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_user pinned_startmenu_icq.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_total commander_total commander 64 bit.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_total commander_total commander 64 bit.lnk.tmp
%TEMP%\c__users_user_desktop_icq.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_total commander_total commander help.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_total commander_uninstall or repair total commander.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_total commander_uninstall or repair total commander.lnk.tmp
%TEMP%\c__users_user_desktop_total commander 64 bit.lnk
%TEMP%\c__users_user_desktop_total commander 64 bit.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_winamp.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_winamp.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_total commander_total commander help.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_icq_icq.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_accessories_accessibility_ease of access.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_icq.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_accessories_accessibility_ease of access.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_accessories_run.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_accessories_notepad.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_accessories_notepad.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_window switcher.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_shows desktop.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_mail.ru_mail.ru agent.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_accessories_system tools_control panel.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_icq_icq.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_icq_uninstall icq.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_icq_uninstall icq.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_icq_icq.com.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_icq.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_icq.lnk.tmp
%TEMP%\c__users_user_desktop_icq.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_icq.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_mail.ru_mail.ru agent.lnk.tmp
%TEMP%\c__users_user_desktop_qip 2012.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_winrar_winrar.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_winrar_winrar help.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_winrar_winrar help.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_winrar_what is new in the latest version.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_winrar_what is new in the latest version.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_winrar_console rar manual.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_winrar_winrar.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_winrar_console rar manual.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_mozilla thunderbird.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_telegram desktop_telegram.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_telegram desktop_telegram.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_telegram desktop_uninstall telegram.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_telegram desktop_uninstall telegram.lnk.tmp
%TEMP%\c__users_user_desktop_telegram.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_mozilla thunderbird.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_user pinned_taskbar_mail.ru agent.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_mail.ru_uninstall mail.ru agent.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_qip 2012.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_mail.ru_mail.ru portal.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_mail.ru agent.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_mail.ru agent.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_mail.ru agent.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_mail.ru agent.lnk.tmp
%TEMP%\c__users_user_desktop_mail.ru agent.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_mail.ru_uninstall mail.ru agent.lnk
%TEMP%\c__users_user_desktop_mail.ru agent.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_user pinned_taskbar_mail.ru agent.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_user pinned_startmenu_mail.ru agent.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_user pinned_startmenu_mail.ru agent.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_qip 2012.lnk
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_qip 2012.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_internet explorer_quick launch_qip 2012.lnk
%TEMP%\c__users_user_desktop_qip 2012.lnk.tmp
%TEMP%\c__users_user_appdata_roaming_microsoft_windows_start menu_programs_accessories_accessibility_magnify.lnk

Moves itself

from <Full path to file> to <Current directory>\中国电力技术装备有限公司簡介.doc

Network activity

Connects to

'17#.#7.172.114':80

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /c del /s /f /q "%TEMP%\..\Application Data\Kingsoft\WPS Office\wpsupdate.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c del /s /f /q "%TEMP%\..\Application Data\Kingsoft\WPS Office\wpsnotify.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c del /s /f /q "%TEMP%\..\Application Data\Kingsoft\WPS Office\desktoptip.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c del /s /f /q "%TEMP%\..\Application Data\Kingsoft\WPS Office\updateself.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c del /s /f /q "%LOCALAPPDATA%\Kingsoft\WPS Office\wpsupdate.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c del /s /f /q "%LOCALAPPDATA%\Kingsoft\WPS Office\wpsnotify.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c del /s /f /q "%LOCALAPPDATA%\Kingsoft\WPS Office\desktoptip.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c del /s /f /q "%LOCALAPPDATA%\Kingsoft\WPS Office\updateself.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c rundll32.exe "<LS_APPDATA>\hadgj.dll",DllUninstall' (with hidden window)

Executes the following

'%ProgramFiles%\microsoft office\office14\winword.exe' /n "<LS_APPDATA>\中国电力技术装备有限公司簡介.doc"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_ICQ_icq.com.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_ICQ_icq.com.lnk.tmp" "%APPDATA%\Microsoft\Windows\Start Menu\Programs\IC...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\ICQ\Uninstall ICQ.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_ICQ_Uninstall ICQ.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_ICQ_Uninstall ICQ.lnk.tmp" "%APPDATA%\Microsoft\Windows\Start Menu\Progr...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\ICQ\ICQ.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_ICQ_ICQ.ln...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\ICQ.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_ICQ.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_ICQ_ICQ.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Control Panel.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_System Tools_Control Panel.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_System Tools_Control Panel.lnk.tmp" "%APPDATA%\Microsoft\Win...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launc...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_Shows Desktop.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_Shows Desktop.lnk.tmp" "%APPDATA%\Microsoft\Internet Explorer\Quick L...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_ICQ.lnk.tmp" "%APPDATA%\Microsoft\Windows\Start Menu\ICQ.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\ICQ\icq.com.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_ICQ_ic...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_ICQ.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_ICQ.lnk.tmp" "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\ICQ....
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_Window Switcher.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Total Commander\Total Commander 64 bit.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Total Commander_Total Commander 64 bit.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Total Commander_Total Commander 64 bit.lnk.tmp" "%APPDATA%\Microsoft\Win...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\ICQ.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_User Pinned_StartMenu_ICQ.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Lau...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Total Commander_Total Commander Help.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_ICQ_ICQ.lnk.tmp" "%APPDATA%\Microsoft\Windows\Start Menu\Programs\ICQ\IC...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_User Pinned_StartMenu_ICQ.lnk.tmp" "%APPDATA%\Microsoft\Internet Expl...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%HOMEPATH%\Desktop\ICQ.lnk" "%TEMP%\C__Users_user_Desktop_ICQ.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_Desktop_ICQ.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_Desktop_ICQ.lnk.tmp" "%HOMEPATH%\Desktop\ICQ.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\ICQ.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_ICQ.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_ICQ.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\ICQ.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Q...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_User Pinned_TaskBar_ICQ.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_User Pinned_TaskBar_ICQ.lnk.tmp" "%APPDATA%\Microsoft\Internet Explor...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_User Pinned_StartMenu_Mail.Ru Agent.lnk.tmp" "%APPDATA%\Microsoft\Int...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_Window Switcher.lnk.tmp" "%APPDATA%\Microsoft\Internet Explorer\Quick...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\computer.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Star...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_System Tools_computer.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_System Tools_computer.lnk.tmp" "%APPDATA%\Microsoft\Windows\...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_Command Prompt.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_Command Prompt.lnk.tmp" "%APPDATA%\Microsoft\Windows\Start M...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Men...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_Accessibility_On-Screen Keyboard.lnk.tmp" "%APPDATA%\Microso...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Total Commander\Total Commander Help.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_S...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_Accessibility_On-Screen Keyboard.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Maintenance_Help.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Maintenance_Help.lnk.tmp" "%APPDATA%\Microsoft\Windows\Start Menu\Progra...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_In...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_User Pinned_TaskBar_Windows Media Player.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_User Pinned_TaskBar_Windows Media Player.lnk.tmp" "%APPDATA%\Microsof...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Intern...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_Windows Explorer.lnk.tmp" "%APPDATA%\Microsoft\Windows\Start...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_Windows Explorer.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Total Commander_Total Commander Help.lnk.tmp" "%APPDATA%\Microsoft\Windo...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_Accessibility_Narrator.lnk.tmp" "%APPDATA%\Microsoft\Windows...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_Accessibility_Magnify.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_Notepad.lnk.tmp" "%APPDATA%\Microsoft\Windows\Start Menu\Pro...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Run.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Ac...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_Run.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_Run.lnk.tmp" "%APPDATA%\Microsoft\Windows\Start Menu\Program...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windo...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_Accessibility_Ease of Access.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_W...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Program...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_Notepad.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_Accessibility_Magnify.lnk.tmp" "%APPDATA%\Microsoft\Windows\...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Private Character Editor.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Micros...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_System Tools_Private Character Editor.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_System Tools_Private Character Editor.lnk.tmp" "%APPDATA%\Mi...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Sta...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_Accessibility_Narrator.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Star...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Accessories_Accessibility_Ease of Access.lnk.tmp" "%APPDATA%\Microsoft\W...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Total Commander_Uninstall or Repair Total Commander.lnk.tmp" "%APPDATA%\...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Total Commander_Uninstall or Repair Total Commander.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Total Commander\Uninstall or Repair Total Commander.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Micr...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Mozilla Thunderbird.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_Mozilla Thunderbird.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_Mozilla Thunderbird.lnk.tmp" "%APPDATA%\Microsoft\Internet Explorer\Q...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_P...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_WinRAR_Console RAR manual.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Telegram.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_P...
'%WINDIR%\syswow64\cmd.exe' /c del /s /f /q "%LOCALAPPDATA%\Kingsoft\WPS Office\desktoptip.exe"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Telegram Desktop_Telegram.lnk.tmp" "%APPDATA%\Microsoft\Windows\Start Me...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_WinRAR_Console RAR manual.lnk.tmp" "%APPDATA%\Microsoft\Windows\Start Me...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_WinRAR_WinRAR help.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_WinRAR_WinRAR help.lnk.tmp" "%APPDATA%\Microsoft\Windows\Start Menu\Prog...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_WinR...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_WinRAR_WinRAR.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\What is new in the latest version.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windo...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_WinRAR_What is new in the latest version.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_WinRAR_What is new in the latest version.lnk.tmp" "%APPDATA%\Microsoft\W...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_User Pinned_TaskBar_Windows Explorer.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_WinRAR_WinRAR.lnk.tmp" "%APPDATA%\Microsoft\Windows\Start Menu\Programs\...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Uninstall Telegram.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_St...
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\..\hadgj.dll",DllMoveClassObject "%TEMP%\中国电力技术装备有限公司簡介.doc" "<Full path to file>" "<Current directory>\中国电力技术装备有限公司簡介.doc"
'%WINDIR%\syswow64\cmd.exe' /c del /s /f /q "%TEMP%\..\Application Data\Kingsoft\WPS Office\wpsupdate.exe"
'%WINDIR%\syswow64\cmd.exe' /c del /s /f /q "%TEMP%\..\Application Data\Kingsoft\WPS Office\wpsnotify.exe"
'%WINDIR%\syswow64\cmd.exe' /c del /s /f /q "%TEMP%\..\Application Data\Kingsoft\WPS Office\desktoptip.exe"
'%WINDIR%\syswow64\cmd.exe' /c del /s /f /q "%TEMP%\..\Application Data\Kingsoft\WPS Office\updateself.exe"
'%WINDIR%\syswow64\cmd.exe' /c del /s /f /q "%LOCALAPPDATA%\Kingsoft\WPS Office\wpsupdate.exe"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Telegram Desktop_Uninstall Telegram.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Telegram Desktop_Uninstall Telegram.lnk.tmp" "%APPDATA%\Microsoft\Window...
'%WINDIR%\syswow64\cmd.exe' /c del /s /f /q "%LOCALAPPDATA%\Kingsoft\WPS Office\wpsnotify.exe"
'%WINDIR%\syswow64\cmd.exe' /c rundll32.exe "<LS_APPDATA>\hadgj.dll",DllUninstall
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllUninstall
'%WINDIR%\syswow64\cmd.exe' /c "<LS_APPDATA>\acrobat.bat"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%HOMEPATH%\Desktop\Telegram.lnk" "%TEMP%\C__Users_user_Desktop_Telegram.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_Desktop_Telegram.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_Desktop_Telegram.lnk.tmp" "%HOMEPATH%\Desktop\Telegram.lnk"
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\..\hadgj.dll",DllEntry DllRegisterServer
'%WINDIR%\syswow64\cmd.exe' /c del /s /f /q "%LOCALAPPDATA%\Kingsoft\WPS Office\updateself.exe"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Maintenance\Help.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_M...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%HOMEPATH%\Desktop\QIP 2012.lnk" "%TEMP%\C__Users_user_Desktop_QIP 2012.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\QIP 2012.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_QIP...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Mail.Ru\Mail.Ru Portal.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Prog...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Mail.Ru_Mail.Ru Portal.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Mail.Ru_Mail.Ru Portal.lnk.tmp" "%APPDATA%\Microsoft\Windows\Start Menu\...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Mail.Ru\Uninstall Mail.Ru Agent.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start ...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Mail.Ru_Uninstall Mail.Ru Agent.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Mail.Ru_Uninstall Mail.Ru Agent.lnk.tmp" "%APPDATA%\Microsoft\Windows\St...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_Desktop_QIP 2012.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Mail.Ru Agent.lnk.tmp" "%APPDATA%\Microsoft\Windows\Start Menu\Mail.Ru Agent.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Mail.Ru Agent.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Winamp.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_Winam...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_Winamp.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_Winamp.lnk.tmp" "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\W...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%HOMEPATH%\Desktop\Total Commander 64 bit.lnk" "%TEMP%\C__Users_user_Desktop_Total Commander 64 bit.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_Desktop_Total Commander 64 bit.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_Desktop_Total Commander 64 bit.lnk.tmp" "%HOMEPATH%\Desktop\Total Commander 64 bit.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Mail.Ru\Mail.Ru Agent.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Progr...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Mail.Ru_Mail.Ru Agent.lnk.tmp" "%APPDATA%\Microsoft\Windows\Start Menu\P...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_Desktop_QIP 2012.lnk.tmp" "%HOMEPATH%\Desktop\QIP 2012.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Mail.Ru_Mail.Ru Agent.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Telegram Desktop_Telegram.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_QIP 2012.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_QIP 2012.lnk.tmp" "%APPDATA%\Microsoft\Internet Explorer\Quick Launch...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\QIP 2012.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_QIP 2012.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_QIP 2012.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_QIP 2012.lnk.tmp" "%APPDATA%\Microsoft\Windows\Start Menu\QIP 2012.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mail.Ru Agent.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Interne...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_Mail.Ru Agent.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Windows\Start Menu\Mail.Ru Agent.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Windows_Start Menu_Mail.Ru Agent.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_Mail.Ru Agent.lnk.tmp" "%APPDATA%\Microsoft\Internet Explorer\Quick L...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_User Pinned_TaskBar_Mail.Ru Agent.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_User Pinned_TaskBar_Mail.Ru Agent.lnk.tmp" "%APPDATA%\Microsoft\Inter...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%HOMEPATH%\Desktop\Mail.Ru Agent.lnk" "%TEMP%\C__Users_user_Desktop_Mail.Ru Agent.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_Desktop_Mail.Ru Agent.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_Desktop_Mail.Ru Agent.lnk.tmp" "%HOMEPATH%\Desktop\Mail.Ru Agent.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Mail.Ru Agent.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launc...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllSetClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_User Pinned_StartMenu_Mail.Ru Agent.lnk"
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mail.Ru Agent.lnk" "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet ...
'%WINDIR%\syswow64\rundll32.exe' "<LS_APPDATA>\hadgj.dll",DllCopyClassObject "%TEMP%\C__Users_user_AppData_Roaming_Microsoft_Internet Explorer_Quick Launch_User Pinned_TaskBar_Windows Explorer.lnk.tmp" "%APPDATA%\Microsoft\In...

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial