System Startup details for 1b293560a2d677394e2358afdd16e9ea

Location

Registry Key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\

Display Name

SpybotDeletingC2891

Filename

cmd.exe

File MD5 Hash

75132CCE06FB4E8728BA0C81E509A985

Command

cmd /c del "C:\WINDOWS\system32\qoMDWNhe.dll_old"