Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\ZfHookEngSrvEx] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ZfHookEngSrvEx] 'ImagePath' = '"%ProgramFiles%\ZfHookProject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\HookEx\x86\zhp.exe"'
- [<HKLM>\System\CurrentControlSet\Services\ZfHookEngSrvEx-64] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ZfHookEngSrvEx-64] 'ImagePath' = '"%ProgramFiles%\ZfHookProject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\HookEx\x64\zhp.exe"'
- [<HKLM>\System\CurrentControlSet\Services\ChkProofAuto] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ChkProofAuto] 'ImagePath' = 'C:\ChkProof_LinJian\ChkProofRun.exe'
Creates the following services
- 'ZfHookEngSrvEx' "%ProgramFiles%\ZfHookProject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\HookEx\x86\zhp.exe"
- 'ZfHookEngSrvEx' %ProgramFiles%\ZfHookProject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\HookEx\x86\zhp.exe
- 'ZfHookEngSrvEx-64' "%ProgramFiles%\ZfHookProject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\HookEx\x64\zhp.exe"
- 'ZfHookEngSrvEx-64' %ProgramFiles%\ZfHookProject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\HookEx\x64\zhp.exe
- 'ChkProofAuto' C:\ChkProof_LinJian\ChkProofRun.exe
Modifies file system
Creates the following files
- %TEMP%\{3f6b8166-4e32-44c0-9fbb-ca07f25bc3a1}\linjiansetup.exe
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\tw_gu.dat
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\tw_ug.dat
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\ximage3b.dll
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\xpage3c.dll
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\office11\mso.dll
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\office11\riched20.dll
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\office11\2052\msointl.dll
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\proof\mslid.dll
- C:\chkproof_linjian\ocrfiles\program files\microsoft office\office11\gdiplus.dll
- C:\chkproof_linjian\ocrfiles\program files\microsoft office\office11\msostyle.dll
- C:\chkproof_linjian\ocrfiles\program files\microsoft office\office11\saext.dll
- C:\chkproof_linjian\ocrfiles\program files\microsoft office\office11\wdbimp.dll
- C:\chkproof_linjian\ocrfiles\program files\microsoft office\office11\1033\wwasum.dll
- C:\chkproof_linjian\ocrfiles\program files\microsoft office\office11\2052\mse10.xml
- C:\chkproof_linjian\ocrfiles\program files\microsoft office\office11\2052\vbetoc.xml
- C:\chkproof_linjian\ocrfiles\windows\system32\fm20.dll
- C:\chkproof_linjian\ocrfiles\windows\system32\fm20chs.dll
- C:\chkproof_linjian\ppp\getrasuser.exe
- C:\chkproof_linjian\ppp\mfc71.dll
- C:\chkproof_linjian\ppp\msvcr71.dll
- C:\chkproof_linjian\skin\login.jpg
- C:\chkproof_linjian\skin\splashnm.bmp
- C:\chkproof_linjian\skin\splashnmback.bmp
- C:\chkproof_linjian\skin\splashsm.bmp
- C:\chkproof_linjian\skin\splashsmback.bmp
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\twstruct.dll
- C:\chkproof_linjian\skin\splashsmback1.bmp
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\twrecs.dll
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\twrecc.dll
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\engdic.dat
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\engidx.dat
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\english.lng
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\form.dll
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\jfont.dat
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\lookup.dat
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\mdivwctl.dll
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\mspcore.dll
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\mspgimme.dll
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\ocrhc.dat
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\ocrvc.dat
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\psom.dll
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\reverse.dll
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\sccode.uni
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\scprint.dat
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\scprint2.dat
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\scserht.dat
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\sctree.dat
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\thocr.psp
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\thocrapi.dll
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\twcutchr.dll
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\twcutlin.dll
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\twgb32.dll
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\twlay32.dll
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\tworient.dll
- C:\chkproof_linjian\ocrfiles\program files\common files\microsoft shared\modi\11.0\twrece.dll
- C:\chkproof_linjian\skin\thumbs.db
- C:\chkproof_linjian\skin\xpgrean.smf
- C:\chkproof_linjian\skin\xpsteel.smf
- %TEMP%\is-g8iml.tmp\zhp64.exe
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x64\zhp.exe
- %TEMP%\is-g8iml.tmp\zfhookpolicy64.dll
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x64\zfhookpolicy.dll
- %TEMP%\is-g8iml.tmp\zfhookexectrlplugin64.dll
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x64\zfhookexectrlplugin.dll
- %TEMP%\is-g8iml.tmp\zfhookfilemmplugin64.dll
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x64\zfhookfilemmplugin.dll
- %TEMP%\is-g8iml.tmp\zfhookctrlex64.dll
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x64\zfhookctrlex.dll
- %TEMP%\is-g8iml.tmp\zfhookprintctrlplugin64.dll
- %WINDIR%\temp\is-8p99v.tmp\_isetup\_setup64.tmp
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x64\zfhookprintctrlplugin.dll
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x64\zfhookpluginloader.dll
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\policy\hookproject_defalut.zfpy-journal
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\policy\hookproject_defalut.zfpy
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\is-4lhh5.tmp
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\unins000.msg
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\unins000.dat
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\policy\zf-linjian-f232d505-8c5d-4454-b609-f43dc9ac056f.zfpy-journal
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\policy\zf-linjian-f232d505-8c5d-4454-b609-f43dc9ac056f.zfpy
- C:\chkproof_linjian\organization.txt
- %TEMP%\nscad6f.tmp\services.dll
- %WINDIR%\temp\_iu14d2n.tmp
- %TEMP%\is-g8iml.tmp\zfhookeng64.dll
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x64\zfhookeng.dll
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x64\zfhookctrl.dll
- %TEMP%\is-g8iml.tmp\zfhookctrl64.dll
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x86\zfhookconsole.exe
- %TEMP%\is-k2fgn.tmp\hooksetup.tmp
- %TEMP%\is-g8iml.tmp\_isetup\_setup64.tmp
- %TEMP%\is-g8iml.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-g8iml.tmp\zfhookctrlexinner.dll
- %TEMP%\is-g8iml.tmp\zfhookctrl.dll
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x86\zfhookctrl.dll
- %TEMP%\is-g8iml.tmp\zfhookeng.dll
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x86\zfhookeng.dll
- %TEMP%\is-g8iml.tmp\zhp.exe
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x86\zhp.exe
- %TEMP%\is-g8iml.tmp\zfhookpolicy.dll
- C:\chkproof_linjian\data\shlwapi.dll
- %TEMP%\is-g8iml.tmp\zfhookexectrlplugin.dll
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x86\zfhookpolicy.dll
- %TEMP%\is-g8iml.tmp\zfhookfilemmplugin.dll
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x86\zfhookfilemmplugin.dll
- %TEMP%\is-g8iml.tmp\zfhookctrlex.dll
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x86\zfhookctrlex.dll
- %TEMP%\is-g8iml.tmp\zfhookctrlext.dll
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x86\zfhookctrlext.dll
- %TEMP%\is-g8iml.tmp\zfhookprintctrlplugin.dll
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x86\zfhookprintctrlplugin.dll
- %TEMP%\is-g8iml.tmp\zfhookpluginloader.dll
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x86\zfhookpluginloader.dll
- %TEMP%\is-g8iml.tmp\zfhookconsole.exe
- C:\chkproof_linjian\skin\background1.jpg
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x86\zfhookexectrlplugin.dll
- %TEMP%\is-g8iml.tmp\zfhookpluginloader64.dll
- C:\chkproof_linjian\data\query.dll
- C:\chkproof_linjian\data\mfc42.dll
- C:\chkproof_linjian\matchinit.ini
- C:\chkproof_linjian\ntreg.dll
- C:\chkproof_linjian\netserver.dll
- C:\chkproof_linjian\netsoftwarelist.ini
- C:\chkproof_linjian\netstreamdll.dll
- C:\chkproof_linjian\newcheck.dll
- C:\chkproof_linjian\newpsp.sys
- C:\chkproof_linjian\ocr_install.reg
- C:\chkproof_linjian\ocr_install_64win7.reg
- C:\chkproof_linjian\offfilt.dll
- C:\chkproof_linjian\offfiltx.dll
- C:\chkproof_linjian\pdffilt.dll
- C:\chkproof_linjian\pptfind.dll
- C:\chkproof_linjian\packet.dll
- C:\chkproof_linjian\picfilepro.exe
- C:\chkproof_linjian\pubfunction.dll
- C:\chkproof_linjian\reportdll.dll
- C:\chkproof_linjian\rockey2.dll
- C:\chkproof_linjian\screensaver.ini
- C:\chkproof_linjian\secpolx64.exe
- C:\chkproof_linjian\skinmagic.dll
- C:\chkproof_linjian\syscheck.sys
- C:\chkproof_linjian\systemser.txt
- C:\chkproof_linjian\unzdll.dll
- C:\chkproof_linjian\uninstall.dll
- C:\chkproof_linjian\mfc71.dll
- C:\chkproof_linjian\wireless.dll
- C:\chkproof_linjian\linjianprogress.exe
- C:\chkproof_linjian\ifilterengine.dll
- %TEMP%\{3f6b8166-4e32-44c0-9fbb-ca07f25bc3a1}\organization.txt
- %TEMP%\{3f6b8166-4e32-44c0-9fbb-ca07f25bc3a1}\zfchkproofsetting.ini
- %TEMP%\nscad6f.tmp\system.dll
- %TEMP%\{3f6b8166-4e32-44c0-9fbb-ca07f25bc3a1}\linjianprogress.exe
- %TEMP%\{3f6b8166-4e32-44c0-9fbb-ca07f25bc3a1}\uninstall.dll
- %TEMP%\{3f6b8166-4e32-44c0-9fbb-ca07f25bc3a1}\hidapi.dll
- C:\chkproof_linjian\360verify.dll
- C:\chkproof_linjian\7z.dll
- C:\chkproof_linjian\7zg.exe
- C:\chkproof_linjian\cardverify.dll
- C:\chkproof_linjian\chkproofrun.exe
- C:\chkproof_linjian\chkproof_linjian.exe
- C:\chkproof_linjian\deepcheckbuffersend.dll
- C:\chkproof_linjian\deepsearch.dll
- C:\chkproof_linjian\devicelist.dll
- C:\chkproof_linjian\diskdirectory.dll
- C:\chkproof_linjian\diskspace2.dll
- C:\chkproof_linjian\excelfind.dll
- C:\chkproof_linjian\fileinfocheck.dll
- C:\chkproof_linjian\fileoperate.dll
- C:\chkproof_linjian\filesearchd.dll
- C:\chkproof_linjian\findibw.dll
- C:\chkproof_linjian\getdisktime.dll
- C:\chkproof_linjian\getfilefromsector.dll
- C:\chkproof_linjian\hookhide.dll
- C:\chkproof_linjian\iconsource.dll
- C:\chkproof_linjian\wordfind.dll
- C:\chkproof_linjian\wpsfilepro.exe
- C:\chkproof_linjian\zfchkproofsetting.ini
- C:\chkproof_linjian\zhp.exe
- C:\chkproof_linjian\data\mfc71.dll
- C:\chkproof_linjian\data\microsoft.vc80.atl.manifest
- C:\chkproof_linjian\data\microsoft.vc80.crt.manifest
- C:\chkproof_linjian\data\microsoft.vc80.mfc.manifest
- C:\chkproof_linjian\data\netsoftwarelist.ini
- C:\chkproof_linjian\data\regtoolpos.txt
- C:\chkproof_linjian\data\unzdll.dll
- C:\chkproof_linjian\data\win2000pack.txt
- C:\chkproof_linjian\data\winfindvirus.txt
- C:\chkproof_linjian\data\api2090_dll.dll
- C:\chkproof_linjian\data\msvcr80.dll
- C:\chkproof_linjian\data\atl80.dll
- C:\chkproof_linjian\data\mfc80.dll
- C:\chkproof_linjian\data\mfc80u.dll
- C:\chkproof_linjian\data\mfc90.dll
- C:\chkproof_linjian\data\mfcm80.dll
- C:\chkproof_linjian\data\mfcm80u.dll
- C:\chkproof_linjian\data\msvcm80.dll
- C:\chkproof_linjian\data\msvcp60.dll
- C:\chkproof_linjian\data\msvcp71.dll
- C:\chkproof_linjian\data\msvcp80.dll
- C:\chkproof_linjian\data\msvcp90.dll
- C:\chkproof_linjian\data\msvcr71.dll
- C:\chkproof_linjian\zfhid.dll
- C:\chkproof_linjian\zfwhook.dll
- C:\chkproof_linjian\zfprintmonitor.dll
- C:\chkproof_linjian\zfhook.dll
- C:\chkproof_linjian\zffilemonitor.dll
- C:\chkproof_linjian\zfisraauthen64.exe
- C:\chkproof_linjian\zipdll.dll
- C:\chkproof_linjian\zffilewatch.dll
- C:\chkproof_linjian\zfhookctrl.dll
- C:\chkproof_linjian\zfhookctrlext.dll
- C:\chkproof_linjian\zfhookpolicy.dll
- C:\chkproof_linjian\zhpex.exe
- C:\chkproof_linjian\api209x_dll_m.dll
- C:\chkproof_linjian\dbghelp.dll
- C:\chkproof_linjian\hid.dll
- C:\chkproof_linjian\hidapi.dll
- C:\chkproof_linjian\data\msvcr90.dll
- C:\chkproof_linjian\msvcr71.dll
- C:\chkproof_linjian\hooksetup.exe
- C:\chkproof_linjian\netclient.dll
- C:\chkproof_linjian\nlhtml.dll
- C:\chkproof_linjian\npptools.dll
- C:\chkproof_linjian\pdffilt_old.dll
- C:\chkproof_linjian\psapi.dll
- C:\chkproof_linjian\sqlite3.dll
- C:\chkproof_linjian\uninst.exe
- C:\chkproof_linjian\unrar.dll
- C:\chkproof_linjian\usbinfo.xml
- C:\chkproof_linjian\vid.ids
- C:\chkproof_linjian\wpcap.dll
- C:\chkproof_linjian\zfisraauthen.exe
- C:\chkproof_linjian\msvcr80.dll
- %WINDIR%\temp\is-8p99v.tmp\_isetup\_shfoldr.dll
Deletes the following files
- C:\chkproof_linjian\linjianprogress.exe
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\policy\hookproject_defalut.zfpy-journal
- %TEMP%\is-k2fgn.tmp\hooksetup.tmp
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\policy\zf-linjian-f232d505-8c5d-4454-b609-f43dc9ac056f.zfpy-journal
- %TEMP%\nscad6f.tmp\services.dll
- %TEMP%\nscad6f.tmp\system.dll
Moves the following files
- from %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\is-4lhh5.tmp to %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\unins000.exe
Substitutes the following files
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\policy\hookproject_defalut.zfpy-journal
- %ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\policy\zf-linjian-f232d505-8c5d-4454-b609-f43dc9ac056f.zfpy-journal
Miscellaneous
Creates and executes the following
- '%TEMP%\{3f6b8166-4e32-44c0-9fbb-ca07f25bc3a1}\linjiansetup.exe' install
- 'C:\chkproof_linjian\chkproofrun.exe' /install
- '%ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x64\zhp.exe' \gui
- '%ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\unins000.exe' /VERYSILENT /NORESTART /admin_uninstall /check_uninstall
- 'C:\chkproof_linjian\chkproof_linjian.exe'
- '%ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x64\zhp.exe'
- '%ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x86\zhp.exe'
- '%ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x86\zhp.exe' \gui
- 'C:\chkproof_linjian\chkproofrun.exe'
- '%ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x86\zhp.exe' /service
- '%TEMP%\is-k2fgn.tmp\hooksetup.tmp' /SL5="$B021C,3486902,114176,C:\ChkProof_LinJian\HookSetup.exe" /VERYSILENT /NORESTART /SP-
- 'C:\chkproof_linjian\hooksetup.exe' /VERYSILENT /NORESTART /SP-
- 'C:\chkproof_linjian\zhpex.exe' install
- '%TEMP%\{3f6b8166-4e32-44c0-9fbb-ca07f25bc3a1}\linjianprogress.exe'
- '%ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x64\zhp.exe' /service
- '%WINDIR%\temp\_iu14d2n.tmp' /SECONDPHASE="%ProgramFiles%\ZfHookProject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\HookEx\unins000.exe" /FIRSTPHASEWND=$100AC /VERYSILENT /NORESTART /admin_uninstall /check_uninstall
- 'C:\chkproof_linjian\hooksetup.exe' /VERYSILENT /NORESTART /SP-' (with hidden window)
- '%ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\unins000.exe' /VERYSILENT /NORESTART /admin_uninstall /check_uninstall' (with hidden window)
- '%ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x86\zhp.exe' /service' (with hidden window)
- '%ProgramFiles%\zfhookproject-b4f7889b-2733-4ebd-a8a7-3703572e0ff9\hookex\x64\zhp.exe' /service' (with hidden window)
