Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM explorer.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\sfx.ini
- C:\1.bat
- C:\2.bat
- C:\3.bat
- C:\4.bat
- C:\5.bat
- C:\6.bat
- C:\tetris.vbs
- nul
- C:\1.txt
- C:\2.txt
Deletes the following files
- %TEMP%\sfx.ini
Network activity
TCP
HTTP GET requests
- http://www.pa###racos.es/
- http://im####.others-cdn.com/videos/thumbsll/94/85/4e/94854e3e262411df14cf2a12860e90af/94854e3e262411df14cf2a12860e90af.18.jpg
- http://im####.others-cdn.com/videos/thumbsll/c2/7e/06/c27e0659fc6f7f1e7b98db7074565872/c27e0659fc6f7f1e7b98db7074565872.19.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/7c/f3/16/7cf316469b6c3d9b934b9251fdeb1ef3/7cf316469b6c3d9b934b9251fdeb1ef3.7.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/c9/ad/af/c9adaf66db022ae805ffb91dedd9f728/c9adaf66db022ae805ffb91dedd9f728.25.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/87/91/5a/87915abc3e1d1b60c0ba59931f31096e/87915abc3e1d1b60c0ba59931f31096e.26.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/84/07/10/840710946fef64e6fe1a720a6ed18a55/840710946fef64e6fe1a720a6ed18a55.6.jpg
- http://www.xn##.com/
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/fb/f8/a7/fbf8a7fb9b957734cf3c7386a1622171/fbf8a7fb9b957734cf3c7386a1622171.30.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/43/ed/28/43ed286d187a97deb4787c175fe9bae0/43ed286d187a97deb4787c175fe9bae0.2.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/6f/69/d6/6f69d67b9aeaba07b8fcdd837253658c/6f69d67b9aeaba07b8fcdd837253658c.2.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/06/01/57/060157c6bb3a537476adf16c6478df3b/060157c6bb3a537476adf16c6478df3b.11.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/8b/87/d4/8b87d4b96e019bc31cf08ab3ad6d310e/8b87d4b96e019bc31cf08ab3ad6d310e.29.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/3e/fe/e3/3efee36a5291c51ea53544135fa125a8/3efee36a5291c51ea53544135fa125a8.22.jpg
- http://st#####ss.xnxx-cdn.com/v3/img/skins/xnxx/home-cat/sexstories169ll.png
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/e8/e1/a5/e8e1a514af1733100434f79942df6407/e8e1a514af1733100434f79942df6407.19.jpg
- http://st#####ss.xnxx-cdn.com/v3/img/skins/xnxx/home-cat/games169ll.jpg
- http://vi######orno.petardas.com/archivos2/mthumbs/942/979/1979942-1.jpg
- http://vi######orno.petardas.com/archivos2/mthumbs/528/988/1988528-1.jpg
- http://vi######orno.petardas.com/archivos2/mthumbs/395/737/1737395-1.jpg
- http://vi######orno.petardas.com/archivos2/mthumbs/980/991/1991980-1.jpg
- http://im####.others-cdn.com/videos/thumbsll/fa/32/74/fa327413b265b0ce29e59807334a7530/fa327413b265b0ce29e59807334a7530.28.jpg
- http://im####.others-cdn.com/videos/thumbsll/4e/a9/ba/4ea9bab750c66d3440f39554ea99cea9/4ea9bab750c66d3440f39554ea99cea9.6.jpg
- http://im####.others-cdn.com/videos/thumbsll/5c/17/59/5c17590dba6a2c0b3873be34238b640f/5c17590dba6a2c0b3873be34238b640f.4.jpg
- http://im####.others-cdn.com/videos/thumbsll/2a/fb/2e/2afb2e3e2aa0019cab686b606a92b34e/2afb2e3e2aa0019cab686b606a92b34e.9.jpg
- http://im####.others-cdn.com/videos/thumbsll/66/4a/f7/664af7ec9624da0704eb9bc00c8fd5d0/664af7ec9624da0704eb9bc00c8fd5d0.4.jpg
- http://im####.others-cdn.com/videos/thumbsll/fb/ca/a7/fbcaa77d7289f1e737227bab34052316/fbcaa77d7289f1e737227bab34052316.20.jpg
- http://im####.others-cdn.com/videos/thumbsll/71/d1/51/71d151ec1569dd4d67a957c1715f1e84/71d151ec1569dd4d67a957c1715f1e84.11.jpg
- http://im####.others-cdn.com/videos/thumbsll/8a/67/e4/8a67e42e34b419acfd46708405c41a89/8a67e42e34b419acfd46708405c41a89.13.jpg
- http://im####.others-cdn.com/videos/thumbsll/7c/82/68/7c826821bdec42cf8d2df31d5667a1e8/7c826821bdec42cf8d2df31d5667a1e8.19.jpg
- http://im####.others-cdn.com/videos/thumbsll/ac/2e/72/ac2e726e156a074ee7539443ff8c36cc/ac2e726e156a074ee7539443ff8c36cc.16.jpg
- http://im####.others-cdn.com/videos/thumbsll/1b/23/6c/1b236c7b78f320741913ba3a54620436/1b236c7b78f320741913ba3a54620436.27.jpg
- http://vi######orno.petardashd.com/archivos3/235/235-179780-9.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/1d/82/d8/1d82d8e14ed96ba8a129e3c2b7524e21/1d82d8e14ed96ba8a129e3c2b7524e21.14.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/41/67/df/4167df7c5bb298c75bea45e7b0292a66/4167df7c5bb298c75bea45e7b0292a66.2.jpg
- http://im####.others-cdn.com/videos/thumbsll/01/28/78/012878d808c58f5fc6383269dd436ff0/012878d808c58f5fc6383269dd436ff0.22.jpg
- http://im####.others-cdn.com/videos/thumbsll/e7/e6/34/e7e634dde1f7b652e6e9f51400181412/e7e634dde1f7b652e6e9f51400181412.11.jpg
- http://im####.others-cdn.com/videos/thumbsll/4c/3f/74/4c3f746348b9cfa21f8268c5eeee9bfa/4c3f746348b9cfa21f8268c5eeee9bfa.2.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/5c/55/df/5c55df117b43a96ce4584c18d6822af7/5c55df117b43a96ce4584c18d6822af7.5.jpg
- http://st#####ss.xnxx-cdn.com/v-9f55af499ff/v3/js/skins/min/xnxx.js
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/93/76/06/937606b72c9c75e231572ce7157768ab/937606b72c9c75e231572ce7157768ab.11.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/2a/f8/1c/2af81c87be4c8fd7fb1ee73d6dd1c660/2af81c87be4c8fd7fb1ee73d6dd1c660.9.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/8e/72/11/8e7211e551127896ae61b6bcc5b0b8c2/8e7211e551127896ae61b6bcc5b0b8c2.13.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/4f/14/d9/4f14d9b675ec33d71e173da47e15ae62/4f14d9b675ec33d71e173da47e15ae62.30.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/e0/49/22/e049221ccfbc7c5cf7c7b4aff93d0fab/e049221ccfbc7c5cf7c7b4aff93d0fab.27.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/f0/c7/b4/f0c7b4ec3d8c4d8511527a8ed2008800/f0c7b4ec3d8c4d8511527a8ed2008800.3.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/ba/90/a9/ba90a9d2b042942505ef65a29aa0afc4/ba90a9d2b042942505ef65a29aa0afc4.10.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/8b/c7/bb/8bc7bb602046f680f3087afaf03a493d/8bc7bb602046f680f3087afaf03a493d.16.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/fe/63/c6/fe63c6bcc5b992ba975092a8c71f23dc/fe63c6bcc5b992ba975092a8c71f23dc.4.jpg
- http://im####.others-cdn.com/videos/thumbsll/48/e5/3b/48e53b97e10a5138d79449f882745d88/48e53b97e10a5138d79449f882745d88.28.jpg
- http://im####.others-cdn.com/videos/thumbsll/80/bb/7b/80bb7b7b4c5bd0b2a1b74f64bfde0263/80bb7b7b4c5bd0b2a1b74f64bfde0263.3.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/6d/b6/58/6db6588515f6f9e1a4af3ce577c15929/6db6588515f6f9e1a4af3ce577c15929.26.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/07/7d/ff/077dff7a7b83fa1ddfd0adededb38f7e/077dff7a7b83fa1ddfd0adededb38f7e.27.jpg
- http://im####.others-cdn.com/videos/thumbsll/0c/e0/6a/0ce06a9a2be38e4831c4d2e737746d52/0ce06a9a2be38e4831c4d2e737746d52.13.jpg
- http://im####.others-cdn.com/videos/thumbsll/a6/01/58/a60158f57ada5530f7df7386a29970fa/a60158f57ada5530f7df7386a29970fa.25.jpg
- http://im####.others-cdn.com/videos/thumbsll/cf/d0/1b/cfd01b14d614c13ba76739f6772aee79/cfd01b14d614c13ba76739f6772aee79.11.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/73/bf/22/73bf221caa0e248dca10825e821deda3/73bf221caa0e248dca10825e821deda3.16.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/69/e6/1f/69e61faa475be94542e6ca6b59134f27/69e61faa475be94542e6ca6b59134f27.21.jpg
- http://im####.others-cdn.com/videos/thumbsll/c9/de/62/c9de6284b50c3c8d6190dc579c942708/c9de6284b50c3c8d6190dc579c942708.19.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/c8/d8/ae/c8d8aed6e28291b62797a4596f03ceb2/c8d8aed6e28291b62797a4596f03ceb2.28.jpg
- http://im####.others-cdn.com/videos/thumbsll/c0/03/8d/c0038d1a9cd2269a38e73a9e97d712f0/c0038d1a9cd2269a38e73a9e97d712f0.13.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/1a/c6/74/1ac674f6d060333b49b20b658d2152df/1ac674f6d060333b49b20b658d2152df.19.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/a7/26/63/a726638e76383a3842f78095b85945fa/a726638e76383a3842f78095b85945fa.12.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/7b/91/59/7b9159da3f1faaa99301f50769965f97/7b9159da3f1faaa99301f50769965f97.5.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/40/09/9f/40099f363f0b036b9795473d7ef7ea83/40099f363f0b036b9795473d7ef7ea83.23.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/62/15/e1/6215e1e5a5c15eb33f7b92f8a7482c9c/6215e1e5a5c15eb33f7b92f8a7482c9c.13.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/fb/fb/2d/fbfb2dd54c0712562384e4decae43016/fbfb2dd54c0712562384e4decae43016.4.jpg
- http://im####.others-cdn.com/videos/thumbsll/62/a0/d5/62a0d56367d0645c5d4d0b47320c2097/62a0d56367d0645c5d4d0b47320c2097.5.jpg
- http://st#####ss.xnxx-cdn.com/v-00000000005/v3/img/skins/xnxx/icons-sprite.png
- http://st#####ss.xnxx-cdn.com/v3/js/libs/jquery.min.js
- http://www.as##all.com/
- http://vi######orno.petardashd.com/archivos3/235/235-175615-3.jpg
- http://vi######orno.petardashd.com/archivos3/235/235-176724-6.jpg
- http://vi######orno.petardashd.com/archivos3/235/235-176458-11.jpg
- http://vi######orno.petardashd.com/archivos3/235/235-175019-5.jpg
- http://vi######orno.petardashd.com/archivos3/235/235-176142-9.jpg
- http://vi######ratis.petardas.com/p/116305a42fc6227a11614cb0056e3659/somospetardas/imagenespetardas2/tiatest2grande.gif
- http://st######s.others-cdn.com/v-c74db8f9033/v3/img/flags/flat/flags-32.png
- http://st#####ss.xnxx-cdn.com/v-09b46da4327/v3/img/flags/flat/flags-16.png
- http://st#####ss.xnxx-cdn.com/v3/img/skins/xnxx/logo/xnxx-20-th-anniversary.png
- http://www.te###now.com/in.php?re######
- http://st######s.others-cdn.com/v-31fc52b6976/v3/img/flags/flat/flags-32.png
- http://st######s.others-cdn.com/img/lightbox/lightbox-blank.gif
- http://st######s.others-cdn.com/v3/img/skins/trade/teensnow-logo.gif
- http://www.as##all.com/in.php?re######
- http://www.as##all.com/function(e,t)%7Bfor(var%20n=t%7C%7C0,i=this.length;n%3Ci;n++)if(this[n]===e)return%20n;return-1%7D
- http://st#####ss.xnxx-cdn.com/v-02005140927/v3/fonts/skins/common/iconfont/iconfont.eot?7j####
- http://vi####.petardas.com/sexogratis.js
- http://www.te###now.com/function(e,t)%7Bfor(var%20n=t%7C%7C0,i=this.length;n%3Ci;n++)if(this[n]===e)return%20n;return-1%7D
- http://aj##.#oogleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js
- http://www.xn##.com/function(e,t)%7Bfor(var%20n=t%7C%7C0,i=this.length;n%3Ci;n++)if(this[n]===e)return%20n;return-1%7D
- http://st######s.others-cdn.com/v-02d159e679d/v3/js/i18n/front/english.js
- http://st#####ss.xnxx-cdn.com/v-02d159e679d/v3/js/i18n/front/english.js
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/3e/e8/54/3ee8548fcb9c471c8b16cc348038b42a/3ee8548fcb9c471c8b16cc348038b42a.19.jpg
- http://st#####ss.xnxx-cdn.com/v-b5b2d530cc0/v3/js/skins/min/xnxx.header.static.js
- http://st######s.others-cdn.com/v-90c02db4ced/v3/js/skins/min/trade.header.static.js
- http://st#####ss.xnxx-cdn.com/v-09b46da4327/v3/css/xnxx/front.css
- http://st######s.others-cdn.com/v-c74db8f9033/v3/css/trade/a4a.css
- http://st######s.others-cdn.com/v-31fc52b6976/v3/css/trade/teensnow.css
- http://www.te###now.com/
- http://www.pe###das.com/
- http://vi######orno.petardas.com/archivos2/mthumbs/400/992/1992400-1.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/6f/d6/96/6fd6964fb236a341bd12a43339af4d8f/6fd6964fb236a341bd12a43339af4d8f.18.jpg
- http://vi######orno.petardas.com/archivos2/mthumbs/515/992/1992515-1.jpg
- http://vi######orno.petardas.com/archivos2/mthumbs/752/279/2279752-1.jpg
- http://im####.others-cdn.com/videos/thumbsll/fc/42/dc/fc42dcdd1b5c921005f3d1d287666284/fc42dcdd1b5c921005f3d1d287666284.6.jpg
- http://st#####ss.xnxx-cdn.com/v3/img/skins/xnxx/home-cat/blank169ll.png
- http://st#####ss.xnxx-cdn.com/v-e91f7a2e144/v3/js/skins/min/xnxx.footer.static.js
- http://st######s.others-cdn.com/v3/js/libs/jquery.min.js
- http://st######s.others-cdn.com/v3/js/skins/min/require.static.js
- http://im####.others-cdn.com/videos/thumbsll/26/77/41/26774180d62ac2029e102c7bd66cbdbd/26774180d62ac2029e102c7bd66cbdbd.16.jpg
- http://im####.others-cdn.com/videos/thumbsll/44/ce/94/44ce94a3def859e01dd8880bc1d21da2/44ce94a3def859e01dd8880bc1d21da2.13.jpg
- http://im####.others-cdn.com/videos/thumbsll/4a/e4/38/4ae43897234e1d5e8b96b1591fb04e8e/4ae43897234e1d5e8b96b1591fb04e8e.8.jpg
- http://vi######orno.petardashd.com/archivos3/235/235-174165-17.jpg
- http://im####.others-cdn.com/videos/thumbsll/d4/6f/99/d46f9944891e1a393feb45933f29581f/d46f9944891e1a393feb45933f29581f.29.jpg
- http://im####.others-cdn.com/videos/thumbsll/49/2d/39/492d393b3ec8b4459f92f4cf98cba3e3/492d393b3ec8b4459f92f4cf98cba3e3.13.jpg
- http://im####.others-cdn.com/videos/thumbsll/c3/a8/81/c3a881fd93e6d5798aa67523f999b173/c3a881fd93e6d5798aa67523f999b173.26.jpg
- http://im####.others-cdn.com/videos/thumbsll/0e/2e/85/0e2e85e880a6debefd18f301275eb66d/0e2e85e880a6debefd18f301275eb66d.1.jpg
- http://im####.others-cdn.com/videos/thumbsll/b5/7a/1e/b57a1e0921b26f08d99ba11519693d19/b57a1e0921b26f08d99ba11519693d19.3.jpg
- http://st#####ss.xnxx-cdn.com/v3/js/skins/min/require.static.js
- http://vi######orno.petardas.com/archivos2/mthumbs/325/309/2309325-1.jpg
- http://vi######orno.petardas.com/archivos2/mthumbs/787/341/2341787-1.jpg
- http://vi######orno.petardas.com/archivos2/mthumbs/231/887/1887231-1.jpg
- http://vi######orno.petardas.com/archivos3/640/640-176142-9.jpg
- http://vi######orno.petardashd.com/archivos3/235/235-175164-3.jpg
- http://vi######orno.petardashd.com/archivos3/235/235-180458-7.jpg
- http://vi######orno.petardashd.com/archivos3/235/235-174717-5.jpg
- http://im####.others-cdn.com/videos/thumbsll/7f/23/f8/7f23f84524ca29c793d3b24519773aff/7f23f84524ca29c793d3b24519773aff.2.jpg
- http://vi######ratis.petardas.com/p/116305a42fc6227a11614cb0056e3659/static/pet/publi-smartphone.png
- http://vi######orno.petardas.com/archivos2/mthumbs/901/077/1077901-1.jpg
- http://ba#####.#dultfriendfinder.com/piclist?ba##################################################################################################################################################...
- http://94.##.215.49/1663881
- http://vi######orno.petardas.com/archivos2/mthumbs/261/979/1979261-1.jpg
- http://vi######orno.petardas.com/archivos2/mthumbs/646/078/1078646-1.jpg
- http://vi######orno.petardas.com/archivos2/mthumbs/438/970/1970438-1.jpg
- http://vi######orno.petardas.com/archivos2/mthumbs/942/346/2346942-1.jpg
- http://im####.others-cdn.com/videos/thumbsll/c8/34/27/c8342702fae82c946fb95d1bd2b9ab05/c8342702fae82c946fb95d1bd2b9ab05.17.jpg
- http://im####.xnxx-cdn.com/videos/thumbs169xnxxll/28/9c/00/289c00587b51082ddaf848a9d222d014/289c00587b51082ddaf848a9d222d014.11.jpg
UDP
- DNS ASK pa###racos.es
- DNS ASK cd#####ic.xnxx-cdn.com
- DNS ASK im####.xnxx-cdn.com
- DNS ASK cd######c.others-cdn.com
- DNS ASK im####.others-cdn.com
- DNS ASK ba#####.#dultfriendfinder.com
- DNS ASK vi######orno.petardashd.com
- DNS ASK vi######ratis.petardas.com
- DNS ASK vi####.petardas.com
- DNS ASK aj##.#oogleapis.com
- DNS ASK st#####ss.xnxx-cdn.com
- DNS ASK st######s.others-cdn.com
- DNS ASK as##all.com
- DNS ASK te###now.com
- DNS ASK xn##.com
- DNS ASK pe###das.com
- DNS ASK af#.######nglibrary.prodperfect.com
- DNS ASK se########e.securedataimages.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\tetris.vbs"
- '%WINDIR%\syswow64\wscript.exe' "C:\tetris.vbs"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\1.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\2.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\3.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\4.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\5.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\6.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\1.bat" "
- '%WINDIR%\syswow64\ping.exe' -n 5 localhost
- '%WINDIR%\syswow64\calc.exe'
- '%WINDIR%\syswow64\ping.exe' -n 5 127.0.0.1
- '%WINDIR%\syswow64\notepad.exe' C:\1.txt
- '%WINDIR%\syswow64\ping.exe' -n 60 127.0.0.1
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\6.bat" "
- '%WINDIR%\syswow64\ping.exe' -n 25 127.0.0.1
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\5.bat" "
- '%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq explorer.exe"
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\4.bat" "
- '%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq TASKMGR.EXE"
- '%WINDIR%\syswow64\findstr.exe' PID
- '%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq calc.exe"
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\3.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\2.bat" "
- '%WINDIR%\syswow64\notepad.exe' C:\2.txt
- '%WINDIR%\syswow64\ping.exe' -n 30 127.0.0.1
