Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\photshoop.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\photshop.url
- %APPDATA%\photshop.exe
- %TEMP%\4zbn4fe4.out
- %TEMP%\4zbn4fe4.cmdline
- %TEMP%\4zbn4fe4.0.vb
- %APPDATA%\random\optional\winamp.exe
- %TEMP%\resfbe7.tmp
- %TEMP%\vbcfbe6.tmp
- %TEMP%\cuer02te.out
- %TEMP%\cuer02te.cmdline
- %TEMP%\cuer02te.0.vb
- %APPDATA%\random\optional\qip 2012.exe
- %TEMP%\resf85d.tmp
- %TEMP%\vbcf83d.tmp
- %TEMP%\vbcff51.tmp
- %TEMP%\a_c78pw6.out
- %TEMP%\a_c78pw6.0.vb
- %APPDATA%\random\optional\mozilla thunderbird.exe
- %TEMP%\resf484.tmp
- %TEMP%\vbcf474.tmp
- %TEMP%\jj4dovzz.out
- %TEMP%\jj4dovzz.cmdline
- %TEMP%\jj4dovzz.0.vb
- %APPDATA%\random\optional\mail.ru agent.exe
- %TEMP%\resf119.tmp
- %TEMP%\vbcf118.tmp
- %TEMP%\vehmx6wi.out
- %TEMP%\vehmx6wi.cmdline
- %TEMP%\a_c78pw6.cmdline
- %TEMP%\resff52.tmp
- %APPDATA%\random\default\icq.exe
- %TEMP%\-31jyoyc.0.vb
- %TEMP%\vbc10f5.tmp
- %TEMP%\g7ygmnpa.out
- %TEMP%\g7ygmnpa.cmdline
- %TEMP%\g7ygmnpa.0.vb
- %APPDATA%\random\default\total commander 64 bit.exe
- %TEMP%\resdba.tmp
- %TEMP%\vbcdb9.tmp
- %TEMP%\xi2jqkaz.out
- %TEMP%\xi2jqkaz.cmdline
- %TEMP%\xi2jqkaz.0.vb
- %APPDATA%\random\default\telegram.exe
- %TEMP%\resa5e.tmp
- %TEMP%\vbca4e.tmp
- %TEMP%\uyngotah.out
- %TEMP%\uyngotah.cmdline
- %TEMP%\uyngotah.0.vb
- %APPDATA%\random\default\qip 2012.exe
- %TEMP%\res6f3.tmp
- %TEMP%\vbc6f2.tmp
- %TEMP%\tjiqdhis.out
- %TEMP%\tjiqdhis.cmdline
- %TEMP%\tjiqdhis.0.vb
- %APPDATA%\random\default\mail.ru agent.exe
- %TEMP%\res359.tmp
- %TEMP%\vbc358.tmp
- %TEMP%\-31jyoyc.out
- %TEMP%\-31jyoyc.cmdline
- %TEMP%\vehmx6wi.0.vb
- %TEMP%\res10f6.tmp
- %APPDATA%\random\optional\launch internet explorer browser.exe
- %TEMP%\vbcedbd.tmp
- %TEMP%\wigcg0dv.cmdline
- %TEMP%\wigcg0dv.0.vb
- %APPDATA%\random\mail.ru agent.exe
- %TEMP%\resd5a2.tmp
- %TEMP%\vbcd592.tmp
- %TEMP%\co_k4p_t.out
- %TEMP%\co_k4p_t.cmdline
- %TEMP%\co_k4p_t.0.vb
- %APPDATA%\random\internet explorer.exe
- %TEMP%\resd1ca.tmp
- %TEMP%\vbcd1c9.tmp
- %TEMP%\g1gbjxrs.out
- %TEMP%\wigcg0dv.out
- %TEMP%\g1gbjxrs.cmdline
- %APPDATA%\random\icq.exe
- %TEMP%\rescdc3.tmp
- %TEMP%\vbccdb2.tmp
- %TEMP%\dxlmbbzn.out
- %TEMP%\dxlmbbzn.cmdline
- %TEMP%\dxlmbbzn.0.vb
- %APPDATA%\random\google chrome.exe
- %TEMP%\resc95e.tmp
- %TEMP%\vbcc95d.tmp
- %TEMP%\30cg5q6m.out
- %TEMP%\30cg5q6m.cmdline
- %TEMP%\30cg5q6m.0.vb
- %TEMP%\g1gbjxrs.0.vb
- %TEMP%\vbcd94b.tmp
- %TEMP%\resd94c.tmp
- %APPDATA%\random\opera.exe
- %TEMP%\1xebgvzl.out
- %TEMP%\1xebgvzl.cmdline
- %TEMP%\1xebgvzl.0.vb
- %APPDATA%\random\optional\icq.exe
- %TEMP%\resea63.tmp
- %TEMP%\vbcea62.tmp
- %TEMP%\2add_5n4.out
- %TEMP%\2add_5n4.cmdline
- %TEMP%\2add_5n4.0.vb
- %APPDATA%\random\optional\google chrome.exe
- %TEMP%\rese5b0.tmp
- %TEMP%\vbce59f.tmp
- %TEMP%\wdamhkqm.out
- %TEMP%\wdamhkqm.cmdline
- %TEMP%\wdamhkqm.0.vb
- %APPDATA%\random\windows media player.exe
- %TEMP%\rese1c8.tmp
- %TEMP%\vbce1c7.tmp
- %TEMP%\k08d8xgk.out
- %TEMP%\k08d8xgk.cmdline
- %TEMP%\k08d8xgk.0.vb
- %APPDATA%\random\windows explorer.exe
- %TEMP%\resdd24.tmp
- %TEMP%\vbcdd23.tmp
- %TEMP%\_qtbpstu.out
- %TEMP%\_qtbpstu.cmdline
- %TEMP%\_qtbpstu.0.vb
- %TEMP%\resedbe.tmp
- %APPDATA%\random\default\acrobat reader dc.exe
- %TEMP%\resc95e.tmp
- %TEMP%\4zbn4fe4.cmdline
- %TEMP%\4zbn4fe4.out
- %TEMP%\vbcff51.tmp
- %TEMP%\resff52.tmp
- %TEMP%\cuer02te.0.vb
- %TEMP%\cuer02te.out
- %TEMP%\cuer02te.cmdline
- %TEMP%\vbcfbe6.tmp
- %TEMP%\resfbe7.tmp
- %TEMP%\a_c78pw6.out
- %TEMP%\a_c78pw6.cmdline
- %TEMP%\a_c78pw6.0.vb
- %TEMP%\vbcf83d.tmp
- %TEMP%\resf85d.tmp
- %TEMP%\jj4dovzz.cmdline
- %TEMP%\jj4dovzz.out
- %TEMP%\jj4dovzz.0.vb
- %TEMP%\vbcf474.tmp
- %TEMP%\resf484.tmp
- %TEMP%\vehmx6wi.0.vb
- %TEMP%\vehmx6wi.out
- %TEMP%\vbcf118.tmp
- %TEMP%\vehmx6wi.cmdline
- %TEMP%\4zbn4fe4.0.vb
- %TEMP%\res359.tmp
- %TEMP%\g7ygmnpa.cmdline
- %TEMP%\vbc10f5.tmp
- %TEMP%\res10f6.tmp
- %TEMP%\xi2jqkaz.cmdline
- %TEMP%\xi2jqkaz.out
- %TEMP%\xi2jqkaz.0.vb
- %TEMP%\vbcdb9.tmp
- %TEMP%\resdba.tmp
- %TEMP%\uyngotah.0.vb
- %TEMP%\uyngotah.out
- %TEMP%\vbca4e.tmp
- %TEMP%\vbce59f.tmp
- %TEMP%\resa5e.tmp
- %TEMP%\tjiqdhis.out
- %TEMP%\tjiqdhis.cmdline
- %TEMP%\tjiqdhis.0.vb
- %TEMP%\vbc6f2.tmp
- %TEMP%\res6f3.tmp
- %TEMP%\-31jyoyc.out
- %TEMP%\-31jyoyc.0.vb
- %TEMP%\-31jyoyc.cmdline
- %TEMP%\vbc358.tmp
- %TEMP%\resf119.tmp
- %TEMP%\1xebgvzl.out
- %TEMP%\1xebgvzl.cmdline
- %TEMP%\resd94c.tmp
- %TEMP%\co_k4p_t.0.vb
- %TEMP%\co_k4p_t.cmdline
- %TEMP%\co_k4p_t.out
- %TEMP%\vbcd592.tmp
- %TEMP%\resd5a2.tmp
- %TEMP%\g1gbjxrs.out
- %TEMP%\g1gbjxrs.0.vb
- %TEMP%\g1gbjxrs.cmdline
- %TEMP%\vbcd1c9.tmp
- %TEMP%\resd1ca.tmp
- %TEMP%\dxlmbbzn.cmdline
- %TEMP%\dxlmbbzn.0.vb
- %TEMP%\dxlmbbzn.out
- %TEMP%\vbccdb2.tmp
- %TEMP%\rescdc3.tmp
- %TEMP%\30cg5q6m.cmdline
- %TEMP%\30cg5q6m.0.vb
- %TEMP%\30cg5q6m.out
- %TEMP%\vbcc95d.tmp
- %TEMP%\wigcg0dv.0.vb
- %TEMP%\wigcg0dv.cmdline
- %TEMP%\vbcd94b.tmp
- %TEMP%\wigcg0dv.out
- %TEMP%\1xebgvzl.0.vb
- %TEMP%\resdd24.tmp
- %TEMP%\vbcedbd.tmp
- %TEMP%\resedbe.tmp
- %TEMP%\2add_5n4.out
- %TEMP%\2add_5n4.0.vb
- %TEMP%\2add_5n4.cmdline
- %TEMP%\vbcea62.tmp
- %TEMP%\resea63.tmp
- %TEMP%\wdamhkqm.cmdline
- %TEMP%\wdamhkqm.out
- %TEMP%\uyngotah.cmdline
- %TEMP%\g7ygmnpa.0.vb
- %TEMP%\rese5b0.tmp
- %TEMP%\k08d8xgk.0.vb
- %TEMP%\k08d8xgk.cmdline
- %TEMP%\k08d8xgk.out
- %TEMP%\vbce1c7.tmp
- %TEMP%\rese1c8.tmp
- %TEMP%\_qtbpstu.0.vb
- %TEMP%\_qtbpstu.cmdline
- %TEMP%\_qtbpstu.out
- %TEMP%\vbcdd23.tmp
- %TEMP%\wdamhkqm.0.vb
- %TEMP%\g7ygmnpa.out
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk to %APPDATA%\random\google chrome.lnk
- from C:\users\public\desktop\opera.lnk to %APPDATA%\random\default\opera.lnk
- from C:\users\public\desktop\mozilla thunderbird.lnk to %APPDATA%\random\default\mozilla thunderbird.lnk
- from C:\users\public\desktop\mozilla firefox.lnk to %APPDATA%\random\default\mozilla firefox.lnk
- from C:\users\public\desktop\mirc.lnk to %APPDATA%\random\default\mirc.lnk
- from C:\users\public\desktop\google chrome.lnk to %APPDATA%\random\default\google chrome.lnk
- from C:\users\public\desktop\acrobat reader dc.lnk to %APPDATA%\random\default\acrobat reader dc.lnk
- from %HOMEPATH%\desktop\total commander 64 bit.lnk to %APPDATA%\random\default\total commander 64 bit.lnk
- from %HOMEPATH%\desktop\telegram.lnk to %APPDATA%\random\default\telegram.lnk
- from %HOMEPATH%\desktop\qip 2012.lnk to %APPDATA%\random\default\qip 2012.lnk
- from %HOMEPATH%\desktop\mail.ru agent.lnk to %APPDATA%\random\default\mail.ru agent.lnk
- from %HOMEPATH%\desktop\icq.lnk to %APPDATA%\random\default\icq.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk to %APPDATA%\random\optional\window switcher.lnk
- from C:\users\public\desktop\steam.lnk to %APPDATA%\random\default\steam.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\winamp.lnk to %APPDATA%\random\optional\winamp.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\qip 2012.lnk to %APPDATA%\random\optional\qip 2012.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\mozilla thunderbird.lnk to %APPDATA%\random\optional\mozilla thunderbird.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\mail.ru agent.lnk to %APPDATA%\random\optional\mail.ru agent.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk to %APPDATA%\random\optional\launch internet explorer browser.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\icq.lnk to %APPDATA%\random\optional\icq.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk to %APPDATA%\random\optional\google chrome.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk to %APPDATA%\random\windows media player.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk to %APPDATA%\random\windows explorer.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk to %APPDATA%\random\opera.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\mail.ru agent.lnk to %APPDATA%\random\mail.ru agent.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk to %APPDATA%\random\internet explorer.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\icq.lnk to %APPDATA%\random\icq.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk to %APPDATA%\random\optional\shows desktop.lnk
- from C:\users\public\desktop\winamp.lnk to %APPDATA%\random\default\winamp.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
- %HOMEPATH%\Desktop\Telegram.lnk
- %HOMEPATH%\Desktop\QIP 2012.lnk
- %HOMEPATH%\Desktop\Mail.Ru Agent.lnk
- %HOMEPATH%\Desktop\ICQ.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Winamp.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\QIP 2012.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Mozilla Thunderbird.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Mail.Ru Agent.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\ICQ.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Opera.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mail.Ru Agent.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\ICQ.lnk
- %HOMEPATH%\Desktop\Total Commander 64 bit.lnk
- C:\Users\Public\Desktop\Acrobat Reader DC.lnk
- DNS ASK my###9.ddns.net
- DNS ASK my###8.ddns.net
- '%APPDATA%\photshop.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4zbn4fe4.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFF52.tmp" "%TEMP%\vbcFF51.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-31jyoyc.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES359.tmp" "%TEMP%\vbc358.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tjiqdhis.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6F3.tmp" "%TEMP%\vbc6F2.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uyngotah.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA5E.tmp" "%TEMP%\vbcA4E.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xi2jqkaz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDBA.tmp" "%TEMP%\vbcDB9.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\g7ygmnpa.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kkdkfnqu.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hxuepe-y.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES16C2.tmp" "%TEMP%\vbc16C1.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hr7lbjph.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1868.tmp" "%TEMP%\vbc1867.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3vwfe0ax.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES19EF.tmp" "%TEMP%\vbc19DE.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1xkqk4xx.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1EA2.tmp" "%TEMP%\vbc1EA1.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bqwtq4h0.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2057.tmp" "%TEMP%\vbc2056.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zrkcqlec.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES21CE.tmp" "%TEMP%\vbc21CD.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFBE7.tmp" "%TEMP%\vbcFBE6.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES10F6.tmp" "%TEMP%\vbc10F5.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cuer02te.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDD24.tmp" "%TEMP%\vbcDD23.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\30cg5q6m.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC95E.tmp" "%TEMP%\vbcC95D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dxlmbbzn.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCDC3.tmp" "%TEMP%\vbcCDB2.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\g1gbjxrs.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD1CA.tmp" "%TEMP%\vbcD1C9.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\co_k4p_t.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD5A2.tmp" "%TEMP%\vbcD592.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wigcg0dv.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD94C.tmp" "%TEMP%\vbcD94B.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_qtbpstu.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\k08d8xgk.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\a_c78pw6.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE1C8.tmp" "%TEMP%\vbcE1C7.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wdamhkqm.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE5B0.tmp" "%TEMP%\vbcE59F.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2add_5n4.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEA63.tmp" "%TEMP%\vbcEA62.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1xebgvzl.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEDBE.tmp" "%TEMP%\vbcEDBD.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vehmx6wi.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF119.tmp" "%TEMP%\vbcF118.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jj4dovzz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF484.tmp" "%TEMP%\vbcF474.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF85D.tmp" "%TEMP%\vbcF83D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2345.tmp" "%TEMP%\vbc2344.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\30cg5q6m.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-31jyoyc.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES359.tmp" "%TEMP%\vbc358.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tjiqdhis.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6F3.tmp" "%TEMP%\vbc6F2.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uyngotah.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA5E.tmp" "%TEMP%\vbcA4E.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xi2jqkaz.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDBA.tmp" "%TEMP%\vbcDB9.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\g7ygmnpa.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES10F6.tmp" "%TEMP%\vbc10F5.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE1C8.tmp" "%TEMP%\vbcE1C7.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kkdkfnqu.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hr7lbjph.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1868.tmp" "%TEMP%\vbc1867.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3vwfe0ax.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES19EF.tmp" "%TEMP%\vbc19DE.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1xkqk4xx.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1EA2.tmp" "%TEMP%\vbc1EA1.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bqwtq4h0.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2057.tmp" "%TEMP%\vbc2056.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zrkcqlec.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES21CE.tmp" "%TEMP%\vbc21CD.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4zbn4fe4.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFF52.tmp" "%TEMP%\vbcFF51.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFBE7.tmp" "%TEMP%\vbcFBE6.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cuer02te.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF85D.tmp" "%TEMP%\vbcF83D.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dxlmbbzn.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCDC3.tmp" "%TEMP%\vbcCDB2.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\g1gbjxrs.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD1CA.tmp" "%TEMP%\vbcD1C9.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\co_k4p_t.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD5A2.tmp" "%TEMP%\vbcD592.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wigcg0dv.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD94C.tmp" "%TEMP%\vbcD94B.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_qtbpstu.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDD24.tmp" "%TEMP%\vbcDD23.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hxuepe-y.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES16C2.tmp" "%TEMP%\vbc16C1.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\k08d8xgk.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE5B0.tmp" "%TEMP%\vbcE59F.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2add_5n4.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEA63.tmp" "%TEMP%\vbcEA62.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1xebgvzl.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEDBE.tmp" "%TEMP%\vbcEDBD.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vehmx6wi.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF119.tmp" "%TEMP%\vbcF118.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jj4dovzz.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF484.tmp" "%TEMP%\vbcF474.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\a_c78pw6.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC95E.tmp" "%TEMP%\vbcC95D.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wdamhkqm.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2345.tmp" "%TEMP%\vbc2344.tmp"