Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MyApp' = '%APPDATA%\MyApp\MyApp.exe'
- <SYSTEM32>\tasks\updates\plxzxb
- <Drive name for removable media>:\scr.exe
- <Drive name for removable media>:\trivial-merge.htm.lnk
- <Drive name for removable media>:\64bit_notes.htm.lnk
- <Drive name for removable media>:\adadsi.html.lnk
- <Drive name for removable media>:\api-hashmap.html.lnk
- <Drive name for removable media>:\trivial-merge.html.lnk
- <Drive name for removable media>:\tree_view.html.lnk
- <Drive name for removable media>:\browse.html.lnk
- <Drive name for removable media>:\13.jpeg.lnk
- <Drive name for removable media>:\1189.jpeg.lnk
- <Drive name for removable media>:\region-north-karelia.jpeg.lnk
- <Drive name for removable media>:\parnas_01.jpeg.lnk
- <Drive name for removable media>:\168.jpeg.lnk
- <Drive name for removable media>:\210252809.jpeg.lnk
- <Drive name for removable media>:\4f0bf7ff71f28.jpg.lnk
- <Drive name for removable media>:\210252809.jpg.lnk
- <Drive name for removable media>:\168.jpg.lnk
- <Drive name for removable media>:\pushkin.jpg.lnk
- <Drive name for removable media>:\parnas_01.jpg.lnk
- <Drive name for removable media>:\video.mp4.lnk
- <Drive name for removable media>:\d0068197bb5a41fea16a220c45390606.mp4.lnk
- <Drive name for removable media>:\clip_480_5sec_6mbps_h264.mp4.lnk
- <Drive name for removable media>:\10thingscondoms.pdf.lnk
- <Drive name for removable media>:\2015-02-worms-nanoparticle-toxicity.pdf.lnk
- <Drive name for removable media>:\tree_view.htm.lnk
- <Drive name for removable media>:\spib_pima.pdf.lnk
- <Drive name for removable media>:\dotnetfx45_full_setup.exe.lnk
- <Drive name for removable media>:\wrar520.exe.lnk
- <Drive name for removable media>:\correct.avi.lnk
- <Drive name for removable media>:\dashborder_96.bmp.lnk
- <Drive name for removable media>:\tileimage.bmp.lnk
- <Drive name for removable media>:\dashborder_192.bmp.lnk
- <Drive name for removable media>:\default.bmp.lnk
- <Drive name for removable media>:\coffee.bmp.lnk
- <Drive name for removable media>:\sdkfailsafeemulator.cer.lnk
- <Drive name for removable media>:\pmd.cer.lnk
- <Drive name for removable media>:\contosoroot.cer.lnk
- <Drive name for removable media>:\contoso.cer.lnk
- <Drive name for removable media>:\contosoroot_1.cer.lnk
- <Drive name for removable media>:\contoso_1.cer.lnk
- <Drive name for removable media>:\fi51.doc.lnk
- <Drive name for removable media>:\hanni_umami_chapter.doc.lnk
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc.lnk
- <Drive name for removable media>:\applicantform_en.doc.lnk
- <Drive name for removable media>:\february_catalogue__2015.doc.lnk
- <Drive name for removable media>:\508softwareandos.doc.lnk
- <Drive name for removable media>:\glidescope_review_rev_010.docx.lnk
- <Drive name for removable media>:\nwfieldnotes1966.docx.lnk
- <Drive name for removable media>:\tcm851ax32.exe.lnk
- <Drive name for removable media>:\chromesetup.exe.lnk
- <Drive name for removable media>:\winmine.exe.lnk
- <Drive name for removable media>:\utorrent.exe.lnk
- <Drive name for removable media>:\fil_20060629111052.pdf.lnk
- %APPDATA%\thunderbird\profiles.ini
- %APPDATA%\plxzxb.exe
- %TEMP%\tmp398.tmp
- %APPDATA%\myapp\myapp.exe
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %APPDATA%\plxzxb.exe
- <Drive name for removable media>:\scr.exe
- %TEMP%\tmp398.tmp
- <Drive name for removable media>:\trivial-merge.htm.lnk
- <Drive name for removable media>:\64bit_notes.htm.lnk
- <Drive name for removable media>:\adadsi.html.lnk
- <Drive name for removable media>:\api-hashmap.html.lnk
- <Drive name for removable media>:\trivial-merge.html.lnk
- <Drive name for removable media>:\tree_view.html.lnk
- <Drive name for removable media>:\browse.html.lnk
- <Drive name for removable media>:\13.jpeg.lnk
- <Drive name for removable media>:\1189.jpeg.lnk
- <Drive name for removable media>:\region-north-karelia.jpeg.lnk
- <Drive name for removable media>:\parnas_01.jpeg.lnk
- <Drive name for removable media>:\168.jpeg.lnk
- <Drive name for removable media>:\210252809.jpeg.lnk
- <Drive name for removable media>:\4f0bf7ff71f28.jpg.lnk
- <Drive name for removable media>:\210252809.jpg.lnk
- <Drive name for removable media>:\168.jpg.lnk
- <Drive name for removable media>:\pushkin.jpg.lnk
- <Drive name for removable media>:\parnas_01.jpg.lnk
- <Drive name for removable media>:\video.mp4.lnk
- <Drive name for removable media>:\d0068197bb5a41fea16a220c45390606.mp4.lnk
- <Drive name for removable media>:\clip_480_5sec_6mbps_h264.mp4.lnk
- <Drive name for removable media>:\10thingscondoms.pdf.lnk
- <Drive name for removable media>:\2015-02-worms-nanoparticle-toxicity.pdf.lnk
- <Drive name for removable media>:\tree_view.htm.lnk
- <Drive name for removable media>:\spib_pima.pdf.lnk
- <Drive name for removable media>:\dotnetfx45_full_setup.exe.lnk
- <Drive name for removable media>:\wrar520.exe.lnk
- <Drive name for removable media>:\correct.avi.lnk
- <Drive name for removable media>:\dashborder_96.bmp.lnk
- <Drive name for removable media>:\tileimage.bmp.lnk
- <Drive name for removable media>:\dashborder_192.bmp.lnk
- <Drive name for removable media>:\default.bmp.lnk
- <Drive name for removable media>:\coffee.bmp.lnk
- <Drive name for removable media>:\sdkfailsafeemulator.cer.lnk
- <Drive name for removable media>:\pmd.cer.lnk
- <Drive name for removable media>:\contosoroot.cer.lnk
- <Drive name for removable media>:\contoso.cer.lnk
- <Drive name for removable media>:\contosoroot_1.cer.lnk
- <Drive name for removable media>:\contoso_1.cer.lnk
- <Drive name for removable media>:\fi51.doc.lnk
- <Drive name for removable media>:\hanni_umami_chapter.doc.lnk
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc.lnk
- <Drive name for removable media>:\applicantform_en.doc.lnk
- <Drive name for removable media>:\february_catalogue__2015.doc.lnk
- <Drive name for removable media>:\508softwareandos.doc.lnk
- <Drive name for removable media>:\glidescope_review_rev_010.docx.lnk
- <Drive name for removable media>:\nwfieldnotes1966.docx.lnk
- <Drive name for removable media>:\tcm851ax32.exe.lnk
- <Drive name for removable media>:\chromesetup.exe.lnk
- <Drive name for removable media>:\winmine.exe.lnk
- <Drive name for removable media>:\utorrent.exe.lnk
- <Drive name for removable media>:\fil_20060629111052.pdf.lnk
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\PLxZXb" /XML "%TEMP%\tmp398.tmp"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\PLxZXb" /XML "%TEMP%\tmp398.tmp"