Technical Information
- 'C:\tmp\Rar.exe' /pid=3528
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta Bkgrd.jpg.rAr" "%CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta Bkgrd.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day Bkgrd.jpg.rAr" "%CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day Bkgrd.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\FTP\Notes.txt.rAr" "C:\Far2\Plugins\FTP\Notes.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\FTP\Notes_rus.txt.rAr" "C:\Far2\Plugins\FTP\Notes_rus.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%CommonProgramFiles%\Microsoft Shared\Stationery\Glacier Bkgrd.jpg.rAr" "%CommonProgramFiles%\Microsoft Shared\Stationery\Glacier Bkgrd.jpg"
- 'C:\tmp\Rar.exe' /pid=1360
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%CommonProgramFiles%\Microsoft Shared\Stationery\Pie Charts Bkgrd.jpg.rAr" "%CommonProgramFiles%\Microsoft Shared\Stationery\Pie Charts Bkgrd.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%CommonProgramFiles%\Microsoft Shared\Stationery\Nature Bkgrd.jpg.rAr" "%CommonProgramFiles%\Microsoft Shared\Stationery\Nature Bkgrd.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%CommonProgramFiles%\Microsoft Shared\Stationery\Leaves Bkgrd.jpg.rAr" "%CommonProgramFiles%\Microsoft Shared\Stationery\Leaves Bkgrd.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%CommonProgramFiles%\Microsoft Shared\Stationery\Maize Bkgrd.jpg.rAr" "%CommonProgramFiles%\Microsoft Shared\Stationery\Maize Bkgrd.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp.rAr" "C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp.rAr" "C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp.rAr" "C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp.rAr" "C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp.rAr" "C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp.rAr" "C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\FTP\FtpCmds.txt.rAr" "C:\Far2\Plugins\FTP\FtpCmds.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\FTP\FtpCmds_rus.txt.rAr" "C:\Far2\Plugins\FTP\FtpCmds_rus.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP.rAr" "C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp.rAr" "C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP.rAr" "C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%CommonProgramFiles%\Microsoft Shared\Stationery\Sunflower Bkgrd.jpg.rAr" "%CommonProgramFiles%\Microsoft Shared\Stationery\Sunflower Bkgrd.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\expander.xml.rAr" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\expander.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\filefield.xml.rAr" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\filefield.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\editor.xml.rAr" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\editor.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\datetimepicker.xml.rAr" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\datetimepicker.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\dialog.xml.rAr" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\dialog.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\findbar.xml.rAr" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\findbar.xml"
- 'C:\tmp\Rar.exe' /pid=3156
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\menu.xml.rAr" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\menu.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\listbox.xml.rAr" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\listbox.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\general.xml.rAr" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\general.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\groupbox.xml.rAr" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\groupbox.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\browser-tabPreviews.xml.rAr" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\browser-tabPreviews.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\subscribe.xml.rAr" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\subscribe.xml"
- 'C:\tmp\Rar.exe' /pid=3480
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%PROGRAM_FILES%\FireFox\blocklist.xml.rAr" "%PROGRAM_FILES%\FireFox\blocklist.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\aboutSyncTabs-bindings.xml.rAr" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\aboutSyncTabs-bindings.xml"
- 'C:\tmp\Rar.exe' /pid=3844
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\checkbox.xml.rAr" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\checkbox.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\colorpicker.xml.rAr" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\colorpicker.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\button.xml.rAr" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\button.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\autocomplete.xml.rAr" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\autocomplete.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\browser.xml.rAr" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\browser.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.rAr" "C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Documents and Settings\Default User\Templates\winword2.doc.rAr" "C:\Documents and Settings\Default User\Templates\winword2.doc"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%APPDATA%\Microsoft\Internet Explorer\brndlog.txt.rAr" "%APPDATA%\Microsoft\Internet Explorer\brndlog.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Documents and Settings\Default User\Templates\winword.doc.rAr" "C:\Documents and Settings\Default User\Templates\winword.doc"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Documents and Settings\Default User\Templates\excel4.xls.rAr" "C:\Documents and Settings\Default User\Templates\excel4.xls"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Documents and Settings\Default User\Templates\powerpnt.ppt.rAr" "C:\Documents and Settings\Default User\Templates\powerpnt.ppt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "<LS_APPDATA>\Microsoft\Windows Media\9.0\WMSDKNS.XML.rAr" "<LS_APPDATA>\Microsoft\Windows Media\9.0\WMSDKNS.XML"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%HOMEPATH%\Templates\winword.doc.rAr" "%HOMEPATH%\Templates\winword.doc"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%HOMEPATH%\Templates\winword2.doc.rAr" "%HOMEPATH%\Templates\winword2.doc"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%HOMEPATH%\Templates\powerpnt.ppt.rAr" "%HOMEPATH%\Templates\powerpnt.ppt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%HOMEPATH%\Templates\excel.xls.rAr" "%HOMEPATH%\Templates\excel.xls"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%HOMEPATH%\Templates\excel4.xls.rAr" "%HOMEPATH%\Templates\excel4.xls"
- 'C:\tmp\bmrsa.exe' -mkh -mit -moh -pu -f public.cod
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.rAr" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg"
- 'C:\tmp\moar.exe'
- 'C:\tmp\zap.exe'
- 'C:\tmp\strt.exe'
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.rAr" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML.rAr" "C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Documents and Settings\Default User\Templates\excel.xls.rAr" "C:\Documents and Settings\Default User\Templates\excel.xls"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.rAr" "C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.rAr" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.rAr" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Addons\README.TXT.rAr" "C:\Far2\Addons\README.TXT"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\Colorer\hrd\catalog-console.xml.rAr" "C:\Far2\Plugins\Colorer\hrd\catalog-console.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\Colorer\hrd\catalog-rgb.xml.rAr" "C:\Far2\Plugins\Colorer\hrd\catalog-rgb.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\Colorer\hrc\changes.txt.rAr" "C:\Far2\Plugins\Colorer\hrc\changes.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\7-Zip\far7z.txt.rAr" "C:\Far2\Plugins\7-Zip\far7z.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\Colorer\catalog.xml.rAr" "C:\Far2\Plugins\Colorer\catalog.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\Colorer\hrd\catalog-text.xml.rAr" "C:\Far2\Plugins\Colorer\hrd\catalog-text.xml"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.rAr" "C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.rAr" "C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.rAr" "C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.rAr" "C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT"
- 'C:\tmp\Rar.exe' /pid=3724
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Documentation\eng\Plugins.Review.txt.rAr" "C:\Far2\Documentation\eng\Plugins.Review.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Documentation\eng\TechInfo.txt.rAr" "C:\Far2\Documentation\eng\TechInfo.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Documentation\eng\Far.FAQ.txt.rAr" "C:\Far2\Documentation\eng\Far.FAQ.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Documentation\eng\Arc.Support.txt.rAr" "C:\Far2\Documentation\eng\Arc.Support.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Documentation\eng\Bug.Report.txt.rAr" "C:\Far2\Documentation\eng\Bug.Report.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Documentation\rus\Arc.Support.txt.rAr" "C:\Far2\Documentation\rus\Arc.Support.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Documentation\rus\Plugins.Review.txt.rAr" "C:\Far2\Documentation\rus\Plugins.Review.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Documentation\rus\TechInfo.txt.rAr" "C:\Far2\Documentation\rus\TechInfo.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Documentation\rus\Plugins.Install.txt.rAr" "C:\Far2\Documentation\rus\Plugins.Install.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Documentation\rus\Bug.Report.txt.rAr" "C:\Far2\Documentation\rus\Bug.Report.txt"
- 'C:\tmp\Rar.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Documentation\rus\Far.FAQ.txt.rAr" "C:\Far2\Documentation\rus\Far.FAQ.txt"
- '<SYSTEM32>\ping.exe' -n 8 -w 1000 127.0.0.1
- '<SYSTEM32>\cmd.exe' /c bm.cmd
- '<SYSTEM32>\ping.exe' a -ep1 -dw -p01FN7b6R1tD54xW28rd4l4Wa9dm7e7BV3wj8V9M7CoP5q8W3t2N3XRfh42lU25XT "C:\Far2\Documentation\eng\Plugins.Install.txt.rAr" "C:\Far2\Documentation\eng\Plugins.Install.txt"
- '<SYSTEM32>\cmd.exe' /c driver.bat
- '<SYSTEM32>\ping.exe' -n 75 -w 1000 127.0.0.1
- '<SYSTEM32>\cmd.exe' /c c:\tmp\drv.bat
- <SYSTEM32>\ping.exe
- C:\Far2\Plugins\Colorer\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Plugins\7-Zip\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Plugins\Colorer\hrd\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Plugins\Colorer\hrc\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Documentation\rus\!!!Файлы зашифрованы!!!.txt
- %HOMEPATH%\Templates\!!!Файлы зашифрованы!!!.txt
- <LS_APPDATA>\Microsoft\Windows Media\9.0\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Documentation\eng\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Addons\!!!Файлы зашифрованы!!!.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\!!!Файлы зашифрованы!!!.txt
- %PROGRAM_FILES%\FireFox\!!!Файлы зашифрованы!!!.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\!!!Файлы зашифрованы!!!.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\!!!Файлы зашифрованы!!!.txt
- %CommonProgramFiles%\Microsoft Shared\Stationery\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Plugins\ExtSearch\sources\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Plugins\ExtSearch\doc\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Plugins\FTP\!!!Файлы зашифрованы!!!.txt
- C:\Far2\Plugins\ExtSearch\sources\RegExp\!!!Файлы зашифрованы!!!.txt
- C:\tmp\Rar.exe
- C:\tmp\public.cod
- C:\tmp\zap.exe
- C:\tmp\strt.exe
- C:\tmp\moar.exe
- C:\tmp\bmrsa.exe
- C:\tmp\bm.cmd
- C:\tmp\drv.bat
- C:\tmp\driver.bat
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\!!!Файлы зашифрованы!!!.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\!!!Файлы зашифрованы!!!.txt
- %APPDATA%\Microsoft\Internet Explorer\!!!Файлы зашифрованы!!!.txt
- C:\Documents and Settings\Default User\Templates\!!!Файлы зашифрованы!!!.txt
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\!!!Файлы зашифрованы!!!.txt
- C:\tmp\psystem
- C:\tmp\system
- C:\tmp\key
- C:\tmp\sys
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'