Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im "RejSpacer72.exe" /f
Modifies file system
Creates the following files
- %TEMP%\is-92amv.tmp\is-49tk9.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-mvqnv.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-mi7lq.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-6th6q.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-9ivmm.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-8gqi3.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-igc2r.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-2e7er.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-9adhm.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-jqcnp.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-21fn2.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-tsuh1.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-isk8a.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-uvb6q.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-0r006.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-6k72m.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-c2rur.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-k3vru.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-ck090.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-dnfra.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-4l5g0.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-unali.tmp
- %ProgramFiles(x86)%\rejspacer72\unins000.dat
- %ProgramFiles(x86)%\rejspacer72\is-ehof2.tmp
- %ProgramFiles(x86)%\rejspacer72\is-ta934.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-ao4dp.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-9jd35.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-5m8o3.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-j8phh.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-ivi19.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-l9vus.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-68pvr.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-rfvm3.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-u2rfj.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-ljmmb.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-io93h.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-rbit1.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-tpa7v.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-k8nvq.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-fu2ke.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-tldmj.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-3ltd2.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-cdb2s.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-ljrth.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-72tls.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-svdfj.tmp
- %ProgramFiles(x86)%\rejspacer72\is-am9d5.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-70oqa.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-ah8l6.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-m89bj.tmp
- %ProgramFiles(x86)%\rejspacer72\config\is-fk644.tmp
- %ProgramFiles(x86)%\rejspacer72\config\is-4een9.tmp
- %ProgramFiles(x86)%\rejspacer72\config\is-pgq15.tmp
- %ProgramFiles(x86)%\rejspacer72\config\is-idm9r.tmp
- %ProgramFiles(x86)%\rejspacer72\config\is-8ae47.tmp
- %ProgramFiles(x86)%\rejspacer72\is-kockp.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-9ln4s.tmp
- %ProgramFiles(x86)%\rejspacer72\is-h0t5i.tmp
- %ProgramFiles(x86)%\rejspacer72\is-78dic.tmp
- %ProgramFiles(x86)%\rejspacer72\is-qqgj0.tmp
- %ProgramFiles(x86)%\rejspacer72\is-qv59o.tmp
- %TEMP%\is-h0jhi.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-h0jhi.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-h0jhi.tmp\_isetup\_setup64.tmp
- %TEMP%\is-h0jhi.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\rejspacer72\rejspacer72.exe
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-qc8dm.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-ivp6g.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-tj6hn.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-5oju6.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-gljdc.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-9lsgj.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-1ib3s.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-el7a6.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-1vqkt.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-2pp89.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-ccv97.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-0jtj2.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-cue8s.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-3f2os.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-v2rt4.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-6n28e.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-m9t2i.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-v10qk.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-lv7as.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-gurcj.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-hnjf6.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-cck9o.tmp
- %ProgramFiles(x86)%\rejspacer72\skins\blue\is-3ol5o.tmp
- %APPDATA%\{846ee340-7039-11de-9d20-806e6f6e6963}\ibjm7irexdw.exe
Deletes the following files
- %ProgramFiles(x86)%\rejspacer72\readme.txt
- %TEMP%\is-92amv.tmp\is-49tk9.tmp
- %ProgramFiles(x86)%\rejspacer72\rejspacer72.exe
Moves the following files
- from %ProgramFiles(x86)%\rejspacer72\is-qv59o.tmp to %ProgramFiles(x86)%\rejspacer72\unins000.exe
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-6th6q.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\label.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-9ivmm.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\info_usual.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-8gqi3.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\info_hover.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-igc2r.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\info_disabled.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-2e7er.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\hvost.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-9adhm.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\gradient_vert.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-dnfra.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\gradient_horiz.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-mi7lq.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\label_a_1.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-cdb2s.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\fon_statistic_hover.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-isk8a.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\fon.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-uvb6q.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\edit_usual.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-0r006.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\edit_hover.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-6k72m.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\edit_disabled.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-c2rur.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\delete_usual.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-k3vru.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\delete_hover.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-ck090.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\delete_disabled.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-tsuh1.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\fon_statistic.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-mvqnv.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\label_a_2.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-21fn2.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\label_sel.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-jqcnp.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\leftandright.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-9jd35.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\unselect_disabled.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-5m8o3.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\ugol_left_top.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-j8phh.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\ugol2_right_top.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-ivi19.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\ugol2_right_bottom.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-l9vus.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\ugol2_left_top.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-68pvr.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\ugol2_left_bottom.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-rfvm3.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\topanddown2.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-u2rfj.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\topanddown.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-ljmmb.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\select_usual.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-io93h.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\select_hover.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-rbit1.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\select_disabled.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-tpa7v.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\progress.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-k8nvq.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\point3.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-fu2ke.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\point2.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-tldmj.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\point.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-qc8dm.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\logo.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-unali.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\leftandright2.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-3ltd2.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btn_ok_usual.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-ao4dp.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\unselect_hover.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-ljrth.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btn_ok_hover.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-svdfj.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btn_cancel_hover.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-ivp6g.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btncleanstop_hover.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-9ln4s.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnabout_usual.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-5oju6.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnabout_hover.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-70oqa.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnabout_disabled.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-ah8l6.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\add_usual.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-m89bj.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\add_hover.jpg
- from %ProgramFiles(x86)%\rejspacer72\config\is-fk644.tmp to %ProgramFiles(x86)%\rejspacer72\config\usrtempdirs.dat
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-4l5g0.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btncleanstop_usual.jpg
- from %ProgramFiles(x86)%\rejspacer72\config\is-4een9.tmp to %ProgramFiles(x86)%\rejspacer72\config\settings.dat
- from %ProgramFiles(x86)%\rejspacer72\config\is-idm9r.tmp to %ProgramFiles(x86)%\rejspacer72\config\exclusions.dat
- from %ProgramFiles(x86)%\rejspacer72\config\is-8ae47.tmp to %ProgramFiles(x86)%\rejspacer72\config\exclusiondirs.dat
- from %ProgramFiles(x86)%\rejspacer72\is-am9d5.tmp to %ProgramFiles(x86)%\rejspacer72\readme.txt
- from %ProgramFiles(x86)%\rejspacer72\is-kockp.tmp to %ProgramFiles(x86)%\rejspacer72\notify.wav
- from %ProgramFiles(x86)%\rejspacer72\is-h0t5i.tmp to %ProgramFiles(x86)%\rejspacer72\history.txt
- from %ProgramFiles(x86)%\rejspacer72\is-78dic.tmp to %ProgramFiles(x86)%\rejspacer72\backup_u.dll
- from %ProgramFiles(x86)%\rejspacer72\is-qqgj0.tmp to %ProgramFiles(x86)%\rejspacer72\backup_c.dll
- from %ProgramFiles(x86)%\rejspacer72\config\is-pgq15.tmp to %ProgramFiles(x86)%\rejspacer72\config\filemask.dat
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-3ol5o.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnclean_disabled.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-tj6hn.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnclean_hover.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-cck9o.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnclean_usual.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-gljdc.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnstop_usual.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-9lsgj.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnstop_hover.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-1ib3s.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnstatistic_usual.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-el7a6.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnstatistic_hover.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-1vqkt.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnstatistic_disabled.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-2pp89.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnsettings_usual.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-ccv97.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnsettings_hover.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-0jtj2.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnsettings_disabled.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-cue8s.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnsearch_usual.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-3f2os.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnsearch_hover.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-v2rt4.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnsearch_disabled.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-6n28e.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnexit_usual.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-m9t2i.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnexit_hover.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-v10qk.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnexclus_usual.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-lv7as.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnexclus_hover.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-gurcj.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnclose_usual.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-hnjf6.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btnclose_hover.jpg
- from %ProgramFiles(x86)%\rejspacer72\skins\blue\is-72tls.tmp to %ProgramFiles(x86)%\rejspacer72\skins\blue\btn_cancel_usual.jpg
- from %ProgramFiles(x86)%\rejspacer72\is-ehof2.tmp to %ProgramFiles(x86)%\rejspacer72\rejspacer72.exe
Substitutes the following files
- %ProgramFiles(x86)%\rejspacer72\readme.txt
Network activity
Connects to
- '45.##.253.56':80
- '45.##.253.72':80
- '45.##.253.75':80
TCP
HTTP GET requests
- http://45.##.253.56/advertisting/plus.php?s=###############################
- http://45.##.253.72/default/stuk.php
- http://45.##.253.72/default/puk.php
- http://45.##.253.75/dll.php
Miscellaneous
Searches for the following windows
- ClassName: 'n81e4d_RejSpacer72Class_n81e4d' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\is-92amv.tmp\is-49tk9.tmp' /SL4 $A0214 "<Full path to file>" 924361 73728
- '%ProgramFiles(x86)%\rejspacer72\rejspacer72.exe'
- '%APPDATA%\{846ee340-7039-11de-9d20-806e6f6e6963}\ibjm7irexdw.exe'
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "RejSpacer72.exe" /f & erase "%ProgramFiles(x86)%\RejSpacer72\RejSpacer72.exe" & exit' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\net.exe' helpmsg 2
- '%WINDIR%\syswow64\net1.exe' helpmsg 2
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "RejSpacer72.exe" /f & erase "%ProgramFiles(x86)%\RejSpacer72\RejSpacer72.exe" & exit
