Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.DownLoader6.42483

Added to the Dr.Web virus database: 2012-08-14

Virus description added:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN] 'WindowsUpdater' = '%APPDATA%\Svchost.bat'
Modifies file system
Creates the following files
  • %APPDATA%\svchost.bat
  • %TEMP%\2ewvyjar.out
  • %TEMP%\k7a8jucs.0.vb
  • %TEMP%\k7a8jucs.cmdline
  • %TEMP%\k7a8jucs.out
  • %TEMP%\fcjydjxs.out
  • %TEMP%\5mv6qdtm.0.vb
  • %TEMP%\2ewvyjar.cmdline
  • %TEMP%\5mv6qdtm.out
  • %TEMP%\tkp2sglc.cmdline
  • %TEMP%\tkp2sglc.out
  • %TEMP%\lbq3pwux.0.vb
  • %TEMP%\lbq3pwux.cmdline
  • %TEMP%\5mv6qdtm.cmdline
  • %TEMP%\lbq3pwux.out
  • %TEMP%\tkp2sglc.0.vb
  • %TEMP%\2ewvyjar.0.vb
  • %TEMP%\fcjydjxs.cmdline
  • %TEMP%\fcjydjxs.0.vb
  • %TEMP%\qpffpvlg.cmdline
  • %TEMP%\qpffpvlg.out
  • %TEMP%\af71hbem.0.vb
  • %TEMP%\af71hbem.cmdline
  • %TEMP%\af71hbem.out
  • %TEMP%\r_c3tey3.out
  • %TEMP%\mxdyral-.0.vb
  • %TEMP%\mxdyral-.out
  • %TEMP%\cni50prq.0.vb
  • %TEMP%\cni50prq.cmdline
  • %TEMP%\cni50prq.out
  • %TEMP%\p9uunna2.0.vb
  • %TEMP%\p9uunna2.cmdline
  • %TEMP%\mxdyral-.cmdline
  • %TEMP%\p9uunna2.out
  • %TEMP%\p2njaopu.0.vb
  • %TEMP%\qpffpvlg.0.vb
  • %TEMP%\r_c3tey3.cmdline
  • %TEMP%\mb0infke.cmdline
  • %TEMP%\cm0h7use.0.vb
  • %TEMP%\cm0h7use.cmdline
  • %TEMP%\cm0h7use.out
  • %TEMP%\c-xgt1yt.0.vb
  • %TEMP%\tvook5yx.0.vb
  • %TEMP%\c-xgt1yt.cmdline
  • %TEMP%\tvook5yx.out
  • %TEMP%\og7m1210.0.vb
  • %TEMP%\og7m1210.out
  • %TEMP%\r4ckkr4v.0.vb
  • %TEMP%\r4ckkr4v.cmdline
  • %TEMP%\r4ckkr4v.out
  • %TEMP%\c-xgt1yt.out
  • %TEMP%\ivz72foz.0.vb
  • %TEMP%\og7m1210.cmdline
  • %TEMP%\tvook5yx.cmdline
  • %TEMP%\c2mwj70p.out
  • %TEMP%\c2mwj70p.cmdline
  • %TEMP%\mb0infke.out
  • %TEMP%\wuei7xrw.0.vb
  • %TEMP%\wuei7xrw.cmdline
  • %TEMP%\wuei7xrw.out
  • %TEMP%\y1fs-t-h.0.vb
  • %TEMP%\mb0infke.0.vb
  • %TEMP%\y1fs-t-h.cmdline
  • %TEMP%\uu3jbuen.0.vb
  • %TEMP%\uu3jbuen.cmdline
  • %TEMP%\uu3jbuen.out
  • %TEMP%\u0z7f_cf.0.vb
  • %TEMP%\u0z7f_cf.cmdline
  • %TEMP%\u0z7f_cf.out
  • %TEMP%\y1fs-t-h.out
  • %TEMP%\c2mwj70p.0.vb
  • %TEMP%\ivz72foz.out
  • %TEMP%\v2ncus7j.out
  • %TEMP%\ivz72foz.cmdline
  • %TEMP%\hwaxbdbo.out
  • %TEMP%\zm5wwjvz.0.vb
  • %TEMP%\zm5wwjvz.cmdline
  • %TEMP%\zm5wwjvz.out
  • %TEMP%\dtph2v0n.0.vb
  • %TEMP%\hy1zavxl.0.vb
  • %TEMP%\dtph2v0n.cmdline
  • %TEMP%\hy1zavxl.out
  • %TEMP%\do6nhdsj.0.vb
  • %TEMP%\do6nhdsj.out
  • %TEMP%\ajwdo6cr.0.vb
  • %TEMP%\ajwdo6cr.cmdline
  • %TEMP%\ajwdo6cr.out
  • %TEMP%\dtph2v0n.out
  • %TEMP%\hwaxbdbo.0.vb
  • %TEMP%\do6nhdsj.cmdline
  • %TEMP%\hy1zavxl.cmdline
  • %TEMP%\qtmuexs_.out
  • %TEMP%\qtmuexs_.cmdline
  • %TEMP%\ogziawch.out
  • %TEMP%\2fnhawnp.0.vb
  • %TEMP%\2fnhawnp.cmdline
  • %TEMP%\2fnhawnp.out
  • %TEMP%\tb2lgkoo.0.vb
  • %TEMP%\ogziawch.0.vb
  • %TEMP%\tb2lgkoo.cmdline
  • %TEMP%\yyilodnf.0.vb
  • %TEMP%\yyilodnf.cmdline
  • %TEMP%\yyilodnf.out
  • %TEMP%\ymba6lxl.0.vb
  • %TEMP%\ymba6lxl.cmdline
  • %TEMP%\ymba6lxl.out
  • %TEMP%\tb2lgkoo.out
  • %TEMP%\qtmuexs_.0.vb
  • %TEMP%\czahqgay.cmdline
  • %TEMP%\r_c3tey3.0.vb
  • %TEMP%\czahqgay.out
  • %TEMP%\rfulwzsd.out
  • %TEMP%\0_2n7te2.cmdline
  • %TEMP%\0_2n7te2.out
  • %TEMP%\dp8o-kig.0.vb
  • %TEMP%\dp8o-kig.cmdline
  • %TEMP%\20eyg9fj.cmdline
  • %TEMP%\dp8o-kig.out
  • %TEMP%\0_2n7te2.0.vb
  • %TEMP%\zk_jph_3.cmdline
  • %TEMP%\lhko5d3u.0.vb
  • %TEMP%\lhko5d3u.cmdline
  • %TEMP%\lhko5d3u.out
  • %TEMP%\czahqgay.0.vb
  • %TEMP%\zk_jph_3.0.vb
  • %TEMP%\hwaxbdbo.cmdline
  • %TEMP%\zk_jph_3.out
  • %TEMP%\20eyg9fj.out
  • %TEMP%\20eyg9fj.0.vb
  • %TEMP%\_qubm2rz.out
  • %TEMP%\wojp4cvu.0.vb
  • %TEMP%\wojp4cvu.cmdline
  • %TEMP%\wojp4cvu.out
  • %TEMP%\znhqcert.0.vb
  • %TEMP%\znhqcert.cmdline
  • %TEMP%\rfulwzsd.cmdline
  • %TEMP%\znhqcert.out
  • %TEMP%\xxmju8gh.cmdline
  • %TEMP%\xxmju8gh.out
  • %TEMP%\mkwde2ti.0.vb
  • %TEMP%\mkwde2ti.cmdline
  • %TEMP%\mkwde2ti.out
  • %TEMP%\_qubm2rz.0.vb
  • %TEMP%\xxmju8gh.0.vb
  • %TEMP%\_qubm2rz.cmdline
  • %TEMP%\rfulwzsd.0.vb
  • %TEMP%\ogziawch.cmdline
  • %TEMP%\p2njaopu.cmdline
  • %TEMP%\8cz4nlpo.0.vb
  • %TEMP%\rstxqioy.0.vb
  • %TEMP%\rstxqioy.cmdline
  • %TEMP%\rstxqioy.out
  • %TEMP%\adxpsk2e.0.vb
  • %TEMP%\eozv46-f.0.vb
  • %TEMP%\adxpsk2e.cmdline
  • %TEMP%\eozv46-f.out
  • %TEMP%\mqdjy4tk.0.vb
  • %TEMP%\mqdjy4tk.out
  • %TEMP%\akdmyz0w.0.vb
  • %TEMP%\akdmyz0w.cmdline
  • %TEMP%\akdmyz0w.out
  • %TEMP%\adxpsk2e.out
  • %TEMP%\ziktjyx3.0.vb
  • %TEMP%\mqdjy4tk.cmdline
  • %TEMP%\eozv46-f.cmdline
  • %TEMP%\9afmc-nw.out
  • %TEMP%\9afmc-nw.cmdline
  • %TEMP%\jdiovudv.out
  • %TEMP%\xuvvf7nf.0.vb
  • %TEMP%\xuvvf7nf.cmdline
  • %TEMP%\xuvvf7nf.out
  • %TEMP%\iqedrwbk.0.vb
  • %TEMP%\jdiovudv.0.vb
  • %TEMP%\iqedrwbk.cmdline
  • %TEMP%\6ga3qtgd.0.vb
  • %TEMP%\6ga3qtgd.cmdline
  • %TEMP%\6ga3qtgd.out
  • %TEMP%\upcee7h0.0.vb
  • %TEMP%\upcee7h0.cmdline
  • %TEMP%\upcee7h0.out
  • %TEMP%\iqedrwbk.out
  • %TEMP%\9afmc-nw.0.vb
  • %TEMP%\zoj4j4bf.out
  • %TEMP%\jdiovudv.cmdline
  • %TEMP%\ziktjyx3.cmdline
  • %TEMP%\mj40r5jr.out
  • %TEMP%\wmb5e2v3.0.vb
  • %TEMP%\wmb5e2v3.cmdline
  • %TEMP%\wmb5e2v3.out
  • %TEMP%\gaxoem23.0.vb
  • %TEMP%\gaxoem23.cmdline
  • %TEMP%\_tkqczdx.cmdline
  • %TEMP%\_tkqczdx.out
  • %TEMP%\gaxoem23.out
  • %TEMP%\fg9nycun.out
  • %TEMP%\ycrjaryv.0.vb
  • %TEMP%\ycrjaryv.cmdline
  • %TEMP%\ycrjaryv.out
  • %TEMP%\mcsk4qwk.0.vb
  • %TEMP%\fg9nycun.0.vb
  • %TEMP%\fg9nycun.cmdline
  • %TEMP%\_tkqczdx.0.vb
  • %TEMP%\0dr7fcgq.cmdline
  • %TEMP%\-7fmyek_.0.vb
  • %TEMP%\65k0y-om.0.vb
  • %TEMP%\65k0y-om.cmdline
  • %TEMP%\65k0y-om.out
  • %TEMP%\qb5jrgqm.0.vb
  • %TEMP%\qb5jrgqm.cmdline
  • %TEMP%\qb5jrgqm.out
  • %TEMP%\pbufc5ov.0.vb
  • %TEMP%\pbufc5ov.cmdline
  • %TEMP%\pbufc5ov.out
  • %TEMP%\5n-zrbum.0.vb
  • %TEMP%\5n-zrbum.cmdline
  • %TEMP%\5n-zrbum.out
  • %TEMP%\0dr7fcgq.0.vb
  • %TEMP%\ziktjyx3.out
  • %TEMP%\mj40r5jr.cmdline
  • %TEMP%\mj40r5jr.0.vb
  • %TEMP%\jdmref4x.0.vb
  • %TEMP%\p2njaopu.out
  • %TEMP%\waonvyfg.out
  • %TEMP%\u-93zcwo.out
  • %TEMP%\kqf8fyuh.0.vb
  • %TEMP%\kqf8fyuh.cmdline
  • %TEMP%\d3tngh2h.cmdline
  • %TEMP%\kqf8fyuh.out
  • %TEMP%\4ep2kcbt.cmdline
  • %TEMP%\u-93zcwo.cmdline
  • %TEMP%\4ep2kcbt.out
  • %TEMP%\nz0yywyc.cmdline
  • %TEMP%\nz0yywyc.out
  • %TEMP%\7sb57xxv.0.vb
  • %TEMP%\4ep2kcbt.0.vb
  • %TEMP%\d3tngh2h.0.vb
  • %TEMP%\zoj4j4bf.0.vb
  • %TEMP%\nz0yywyc.0.vb
  • %TEMP%\u-93zcwo.0.vb
  • %TEMP%\wa4hjvd6.out
  • %TEMP%\wa4hjvd6.cmdline
  • %TEMP%\8cz4nlpo.cmdline
  • %TEMP%\8cz4nlpo.out
  • %TEMP%\5lmnjcqv.0.vb
  • %TEMP%\5lmnjcqv.cmdline
  • %TEMP%\5lmnjcqv.out
  • %TEMP%\jdmref4x.out
  • %TEMP%\cyqb7veq.0.vb
  • %TEMP%\cyqb7veq.out
  • %TEMP%\kktbts8y.0.vb
  • %TEMP%\kktbts8y.cmdline
  • %TEMP%\kktbts8y.out
  • %TEMP%\wa4hjvd6.0.vb
  • %TEMP%\7sb57xxv.cmdline
  • %TEMP%\cyqb7veq.cmdline
  • %TEMP%\jdmref4x.cmdline
  • %TEMP%\d3tngh2h.out
  • %TEMP%\zoj4j4bf.cmdline
  • %TEMP%\7sb57xxv.out
  • %TEMP%\kboztemg.cmdline
  • %TEMP%\xqpyz1v9.0.vb
  • %TEMP%\xqpyz1v9.cmdline
  • %TEMP%\xqpyz1v9.out
  • %TEMP%\om9sdtj2.out
  • %TEMP%\0dnse7ac.0.vb
  • %TEMP%\0dnse7ac.out
  • %TEMP%\lstlrhq5.out
  • %TEMP%\pr4m64wr.0.vb
  • %TEMP%\pr4m64wr.out
  • %TEMP%\waonvyfg.0.vb
  • %TEMP%\waonvyfg.cmdline
  • %TEMP%\0dnse7ac.cmdline
  • %TEMP%\om9sdtj2.cmdline
  • %TEMP%\ifkulud8.cmdline
  • %TEMP%\pr4m64wr.cmdline
  • %TEMP%\lstlrhq5.cmdline
  • %TEMP%\om9sdtj2.0.vb
  • %TEMP%\1nrb-fl7.out
  • %TEMP%\kboztemg.out
  • %TEMP%\3hpqyfoh.0.vb
  • %TEMP%\3hpqyfoh.cmdline
  • %TEMP%\3hpqyfoh.out
  • %TEMP%\zoqlz9je.0.vb
  • %TEMP%\kboztemg.0.vb
  • %TEMP%\zoqlz9je.cmdline
  • %TEMP%\p3oslbc0.0.vb
  • %TEMP%\p3oslbc0.cmdline
  • %TEMP%\p3oslbc0.out
  • %TEMP%\1nrb-fl7.0.vb
  • %TEMP%\1nrb-fl7.cmdline
  • %TEMP%\ifkulud8.0.vb
  • %TEMP%\zoqlz9je.out
  • %TEMP%\ifkulud8.out
  • %TEMP%\lstlrhq5.0.vb
  • %TEMP%\v2ncus7j.cmdline
  • %TEMP%\v2ncus7j.0.vb
  • %TEMP%\1aijhxm8.out
  • %TEMP%\tglz6psr.out
  • %TEMP%\zrqo8n9z.0.vb
  • %TEMP%\zrqo8n9z.cmdline
  • %TEMP%\zrqo8n9z.out
  • %TEMP%\4tfoxlgx.out
  • %TEMP%\h-hyqt-k.0.vb
  • %TEMP%\tglz6psr.cmdline
  • %TEMP%\h-hyqt-k.out
  • %TEMP%\pl-f6dkq.cmdline
  • %TEMP%\pl-f6dkq.out
  • %TEMP%\uhwbolvo.0.vb
  • %TEMP%\uhwbolvo.cmdline
  • %TEMP%\h-hyqt-k.cmdline
  • %TEMP%\4tfoxlgx.cmdline
  • %TEMP%\pl-f6dkq.0.vb
  • %TEMP%\4tfoxlgx.0.vb
  • %TEMP%\q-ibiypn.out
  • %TEMP%\z4rle15k.out
  • %TEMP%\0dksilw-.cmdline
  • %TEMP%\0dksilw-.out
  • %TEMP%\uecijdwq.0.vb
  • %TEMP%\uecijdwq.cmdline
  • %TEMP%\uecijdwq.out
  • %TEMP%\shjq0vag.0.vb
  • %TEMP%\0dksilw-.0.vb
  • %TEMP%\shjq0vag.cmdline
  • %TEMP%\dft-keau.0.vb
  • %TEMP%\dft-keau.cmdline
  • %TEMP%\dft-keau.out
  • %TEMP%\q-ibiypn.0.vb
  • %TEMP%\q-ibiypn.cmdline
  • %TEMP%\uhwbolvo.out
  • %TEMP%\shjq0vag.out
  • %TEMP%\z4rle15k.cmdline
  • %TEMP%\gjffy8a4.0.vb
  • %TEMP%\z4rle15k.0.vb
  • %TEMP%\pf_cy_s2.cmdline
  • %TEMP%\etx0ttnf.0.vb
  • %TEMP%\etx0ttnf.cmdline
  • %TEMP%\etx0ttnf.out
  • %TEMP%\uswxarwv.0.vb
  • %TEMP%\pf_cy_s2.0.vb
  • %TEMP%\uswxarwv.cmdline
  • %TEMP%\pf_cy_s2.out
  • %TEMP%\qhl37kbj.0.vb
  • %TEMP%\qhl37kbj.out
  • %TEMP%\y9ylce_a.0.vb
  • %TEMP%\y9ylce_a.cmdline
  • %TEMP%\y9ylce_a.out
  • %TEMP%\uswxarwv.out
  • %TEMP%\7nllsumh.out
  • %TEMP%\qhl37kbj.cmdline
  • %TEMP%\7nllsumh.cmdline
  • %TEMP%\7nllsumh.0.vb
  • %TEMP%\-mlfpylb.0.vb
  • %TEMP%\-mlfpylb.out
  • %TEMP%\putsg3lv.0.vb
  • %TEMP%\putsg3lv.cmdline
  • %TEMP%\putsg3lv.out
  • %TEMP%\sxj3uonl.0.vb
  • %TEMP%\sxj3uonl.cmdline
  • %TEMP%\-mlfpylb.cmdline
  • %TEMP%\sxj3uonl.out
  • %TEMP%\edmmgnxq.cmdline
  • %TEMP%\edmmgnxq.out
  • %TEMP%\i16dwndr.0.vb
  • %TEMP%\i16dwndr.cmdline
  • %TEMP%\i16dwndr.out
  • %TEMP%\ncsjsqcy.cmdline
  • %TEMP%\edmmgnxq.0.vb
  • %TEMP%\ncsjsqcy.0.vb
  • %TEMP%\ncsjsqcy.out
  • %TEMP%\yqqrygai.cmdline
  • %TEMP%\rgc0nnpo.0.vb
  • %TEMP%\-xuamb_d.0.vb
  • %TEMP%\-xuamb_d.cmdline
  • %TEMP%\-xuamb_d.out
  • %TEMP%\xvxtjn2j.0.vb
  • %TEMP%\pfzuje69.0.vb
  • %TEMP%\xvxtjn2j.cmdline
  • %TEMP%\pfzuje69.out
  • %TEMP%\cnz1am0m.0.vb
  • %TEMP%\cnz1am0m.out
  • %TEMP%\d_5utwwg.0.vb
  • %TEMP%\d_5utwwg.cmdline
  • %TEMP%\d_5utwwg.out
  • %TEMP%\xvxtjn2j.out
  • %TEMP%\2wmmml5d.out
  • %TEMP%\cnz1am0m.cmdline
  • %TEMP%\2wmmml5d.cmdline
  • %TEMP%\2wmmml5d.0.vb
  • %TEMP%\jwwmccb9.0.vb
  • %TEMP%\jwwmccb9.out
  • %TEMP%\6t7r8vse.0.vb
  • %TEMP%\6t7r8vse.cmdline
  • %TEMP%\6t7r8vse.out
  • %TEMP%\ohsar06y.0.vb
  • %TEMP%\ohsar06y.cmdline
  • %TEMP%\jwwmccb9.cmdline
  • %TEMP%\ohsar06y.out
  • %TEMP%\ov7vwjlz.cmdline
  • %TEMP%\ov7vwjlz.out
  • %TEMP%\tcc1lnb5.0.vb
  • %TEMP%\tcc1lnb5.cmdline
  • %TEMP%\tcc1lnb5.out
  • %TEMP%\iwjriuhp.0.vb
  • %TEMP%\ov7vwjlz.0.vb
  • %TEMP%\yqqrygai.out
  • %TEMP%\gjffy8a4.cmdline
  • %TEMP%\pfzuje69.cmdline
  • %TEMP%\ubjmzjhx.out
  • %TEMP%\gzwkl6ax.cmdline
  • %TEMP%\gzwkl6ax.out
  • %TEMP%\mgk8wv2n.0.vb
  • %TEMP%\mgk8wv2n.cmdline
  • %TEMP%\ubjmzjhx.cmdline
  • %TEMP%\mgk8wv2n.out
  • %TEMP%\gzwkl6ax.0.vb
  • %TEMP%\t6uth4re.cmdline
  • %TEMP%\6fssndcs.0.vb
  • %TEMP%\6fssndcs.cmdline
  • %TEMP%\6fssndcs.out
  • %TEMP%\yqqrygai.0.vb
  • %TEMP%\t6uth4re.0.vb
  • %TEMP%\ubjmzjhx.0.vb
  • %TEMP%\t6uth4re.out
  • %TEMP%\fszwzhtg.out
  • %TEMP%\fszwzhtg.cmdline
  • %TEMP%\rgc0nnpo.cmdline
  • %TEMP%\shmgx5b4.0.vb
  • %TEMP%\shmgx5b4.cmdline
  • %TEMP%\shmgx5b4.out
  • %TEMP%\0jx0i-z7.0.vb
  • %TEMP%\0jx0i-z7.cmdline
  • %TEMP%\0jx0i-z7.out
  • %TEMP%\rgc0nnpo.out
  • %TEMP%\10csa2mv.0.vb
  • %TEMP%\10csa2mv.out
  • %TEMP%\pz-bcvfr.0.vb
  • %TEMP%\pz-bcvfr.cmdline
  • %TEMP%\pz-bcvfr.out
  • %TEMP%\fszwzhtg.0.vb
  • %TEMP%\iwjriuhp.out
  • %TEMP%\10csa2mv.cmdline
  • %TEMP%\iwjriuhp.cmdline
  • %TEMP%\tglz6psr.0.vb
  • %TEMP%\gjffy8a4.out
  • %TEMP%\ddtkremq.out
  • %TEMP%\d4d2k84_.out
  • %TEMP%\tasitzhq.0.vb
  • %TEMP%\tasitzhq.cmdline
  • %TEMP%\ddtkremq.cmdline
  • %TEMP%\tasitzhq.out
  • %TEMP%\spijepgx.cmdline
  • %TEMP%\d4d2k84_.cmdline
  • %TEMP%\spijepgx.out
  • %TEMP%\ow2rt-pc.cmdline
  • %TEMP%\ow2rt-pc.out
  • %TEMP%\2bt2p105.0.vb
  • %TEMP%\spijepgx.0.vb
  • %TEMP%\ddtkremq.0.vb
  • %TEMP%\5r1ii5xc.0.vb
  • %TEMP%\ow2rt-pc.0.vb
  • %TEMP%\d4d2k84_.0.vb
  • %TEMP%\0z4azxsq.out
  • %TEMP%\0z4azxsq.cmdline
  • %TEMP%\4gckcbl2.cmdline
  • %TEMP%\4gckcbl2.out
  • %TEMP%\mno4-gex.0.vb
  • %TEMP%\mno4-gex.cmdline
  • %TEMP%\mno4-gex.out
  • %TEMP%\5r1ii5xc.out
  • %TEMP%\e30pifw1.0.vb
  • %TEMP%\e30pifw1.out
  • %TEMP%\w1htpyov.0.vb
  • %TEMP%\w1htpyov.cmdline
  • %TEMP%\w1htpyov.out
  • %TEMP%\0z4azxsq.0.vb
  • %TEMP%\2bt2p105.cmdline
  • %TEMP%\e30pifw1.cmdline
  • %TEMP%\5r1ii5xc.cmdline
  • %TEMP%\vfq1sfup.cmdline
  • %TEMP%\4gckcbl2.0.vb
  • %TEMP%\2bt2p105.out
  • %TEMP%\k0ibobdx.cmdline
  • %TEMP%\gzrj7wea.0.vb
  • %TEMP%\gzrj7wea.cmdline
  • %TEMP%\gzrj7wea.out
  • %TEMP%\6guvhugw.out
  • %TEMP%\tiezdjrk.0.vb
  • %TEMP%\tiezdjrk.out
  • %TEMP%\0fha8l5k.out
  • %TEMP%\b7yr100j.0.vb
  • %TEMP%\b7yr100j.out
  • %TEMP%\1aijhxm8.0.vb
  • %TEMP%\1aijhxm8.cmdline
  • %TEMP%\tiezdjrk.cmdline
  • %TEMP%\6guvhugw.cmdline
  • %TEMP%\kmyub2wo.cmdline
  • %TEMP%\b7yr100j.cmdline
  • %TEMP%\0fha8l5k.cmdline
  • %TEMP%\6guvhugw.0.vb
  • %TEMP%\yslo5xcr.out
  • %TEMP%\k0ibobdx.out
  • %TEMP%\f9yohtxf.0.vb
  • %TEMP%\f9yohtxf.cmdline
  • %TEMP%\f9yohtxf.out
  • %TEMP%\6br0mlhd.0.vb
  • %TEMP%\k0ibobdx.0.vb
  • %TEMP%\6br0mlhd.cmdline
  • %TEMP%\fqqmkvjq.0.vb
  • %TEMP%\fqqmkvjq.cmdline
  • %TEMP%\fqqmkvjq.out
  • %TEMP%\yslo5xcr.0.vb
  • %TEMP%\yslo5xcr.cmdline
  • %TEMP%\kmyub2wo.0.vb
  • %TEMP%\6br0mlhd.out
  • %TEMP%\kmyub2wo.out
  • %TEMP%\0fha8l5k.0.vb
  • %TEMP%\vfq1sfup.out
  • %TEMP%\vfq1sfup.0.vb
  • %TEMP%\msu9e3wv.0.vb
  • %TEMP%\-irpkkoo.cmdline
  • %TEMP%\-irpkkoo.out
  • %TEMP%\ozhywnvt.0.vb
  • %TEMP%\ozhywnvt.cmdline
  • %TEMP%\lsdpobqp.cmdline
  • %TEMP%\ozhywnvt.out
  • %TEMP%\-irpkkoo.0.vb
  • %TEMP%\mgolk4l_.cmdline
  • %TEMP%\sdcblo1e.0.vb
  • %TEMP%\sdcblo1e.cmdline
  • %TEMP%\sdcblo1e.out
  • %TEMP%\viugoprm.0.vb
  • %TEMP%\mgolk4l_.0.vb
  • %TEMP%\lsdpobqp.0.vb
  • %TEMP%\mgolk4l_.out
  • %TEMP%\ws_xxf1_.out
  • %TEMP%\ws_xxf1_.cmdline
  • %TEMP%\msu9e3wv.cmdline
  • %TEMP%\sh99vish.0.vb
  • %TEMP%\sh99vish.cmdline
  • %TEMP%\sh99vish.out
  • %TEMP%\9he3ho45.0.vb
  • %TEMP%\9he3ho45.cmdline
  • %TEMP%\9he3ho45.out
  • %TEMP%\msu9e3wv.out
  • %TEMP%\66cklkz9.0.vb
  • %TEMP%\66cklkz9.out
  • %TEMP%\-2wsk6hb.0.vb
  • %TEMP%\-2wsk6hb.cmdline
  • %TEMP%\-2wsk6hb.out
  • %TEMP%\ws_xxf1_.0.vb
  • %TEMP%\viugoprm.cmdline
  • %TEMP%\66cklkz9.cmdline
  • %TEMP%\viugoprm.out
  • %TEMP%\lsdpobqp.out
  • %TEMP%\wl7qrvtf.0.vb
  • %TEMP%\lkxzuvkn.0.vb
  • %TEMP%\lkxzuvkn.out
  • %TEMP%\rysng8lu.0.vb
  • %TEMP%\rysng8lu.cmdline
  • %TEMP%\rysng8lu.out
  • %TEMP%\jan6h8na.0.vb
  • %TEMP%\jan6h8na.cmdline
  • %TEMP%\jan6h8na.out
  • %TEMP%\wgmjfxh2.0.vb
  • %TEMP%\wgmjfxh2.cmdline
  • %TEMP%\wgmjfxh2.out
  • %TEMP%\mrwztinh.0.vb
  • %TEMP%\mrwztinh.cmdline
  • %TEMP%\mrwztinh.out
  • %TEMP%\-7fmyek_.out
  • %TEMP%\wl7qrvtf.cmdline
  • %TEMP%\lkxzuvkn.cmdline
  • %TEMP%\0dr7fcgq.out
  • %TEMP%\mcsk4qwk.cmdline
  • %TEMP%\oltqjely.out
  • %TEMP%\h5lutgno.0.vb
  • %TEMP%\h5lutgno.cmdline
  • %TEMP%\h5lutgno.out
  • %TEMP%\_oge-ls9.0.vb
  • %TEMP%\_oge-ls9.cmdline
  • %TEMP%\_oge-ls9.out
  • %TEMP%\wl7qrvtf.out
  • %TEMP%\waxv4tc4.0.vb
  • %TEMP%\waxv4tc4.out
  • %TEMP%\gefikr5l.0.vb
  • %TEMP%\gefikr5l.cmdline
  • %TEMP%\gefikr5l.out
  • %TEMP%\oltqjely.0.vb
  • %TEMP%\oltqjely.cmdline
  • %TEMP%\waxv4tc4.cmdline
  • %TEMP%\-7fmyek_.cmdline
  • %TEMP%\mcsk4qwk.out
Deletes the following files
  • %TEMP%\jwwmccb9.out
  • %TEMP%\2ewvyjar.cmdline
  • %TEMP%\2ewvyjar.out
  • %TEMP%\k7a8jucs.0.vb
  • %TEMP%\k7a8jucs.out
  • %TEMP%\k7a8jucs.cmdline
  • %TEMP%\fcjydjxs.0.vb
  • %TEMP%\2ewvyjar.0.vb
  • %TEMP%\5mv6qdtm.cmdline
  • %TEMP%\tkp2sglc.out
  • %TEMP%\tkp2sglc.0.vb
  • %TEMP%\tkp2sglc.cmdline
  • %TEMP%\lbq3pwux.0.vb
  • %TEMP%\lbq3pwux.out
  • %TEMP%\5mv6qdtm.out
  • %TEMP%\5mv6qdtm.0.vb
  • %TEMP%\fcjydjxs.cmdline
  • %TEMP%\fcjydjxs.out
  • %TEMP%\p9uunna2.out
  • %TEMP%\qpffpvlg.0.vb
  • %TEMP%\qpffpvlg.out
  • %TEMP%\qpffpvlg.cmdline
  • %TEMP%\af71hbem.out
  • %TEMP%\af71hbem.cmdline
  • %TEMP%\af71hbem.0.vb
  • %TEMP%\r_c3tey3.out
  • %TEMP%\mxdyral-.cmdline
  • %TEMP%\mxdyral-.0.vb
  • %TEMP%\cni50prq.out
  • %TEMP%\cni50prq.cmdline
  • %TEMP%\cni50prq.0.vb
  • %TEMP%\p9uunna2.cmdline
  • %TEMP%\p9uunna2.0.vb
  • %TEMP%\mxdyral-.out
  • %TEMP%\lbq3pwux.cmdline
  • %TEMP%\ivz72foz.out
  • %TEMP%\p2njaopu.out
  • %TEMP%\ivz72foz.0.vb
  • %TEMP%\tvook5yx.out
  • %TEMP%\cm0h7use.0.vb
  • %TEMP%\cm0h7use.cmdline
  • %TEMP%\cm0h7use.out
  • %TEMP%\c-xgt1yt.cmdline
  • %TEMP%\tvook5yx.cmdline
  • %TEMP%\tvook5yx.0.vb
  • %TEMP%\c-xgt1yt.out
  • %TEMP%\og7m1210.cmdline
  • %TEMP%\og7m1210.out
  • %TEMP%\r4ckkr4v.out
  • %TEMP%\r4ckkr4v.cmdline
  • %TEMP%\r4ckkr4v.0.vb
  • %TEMP%\c-xgt1yt.0.vb
  • %TEMP%\og7m1210.0.vb
  • %TEMP%\c2mwj70p.0.vb
  • %TEMP%\c2mwj70p.out
  • %TEMP%\c2mwj70p.cmdline
  • %TEMP%\mb0infke.0.vb
  • %TEMP%\mb0infke.out
  • %TEMP%\wuei7xrw.0.vb
  • %TEMP%\wuei7xrw.cmdline
  • %TEMP%\wuei7xrw.out
  • %TEMP%\y1fs-t-h.out
  • %TEMP%\mb0infke.cmdline
  • %TEMP%\y1fs-t-h.cmdline
  • %TEMP%\uu3jbuen.cmdline
  • %TEMP%\uu3jbuen.0.vb
  • %TEMP%\uu3jbuen.out
  • %TEMP%\u0z7f_cf.out
  • %TEMP%\u0z7f_cf.cmdline
  • %TEMP%\u0z7f_cf.0.vb
  • %TEMP%\y1fs-t-h.0.vb
  • %TEMP%\r_c3tey3.cmdline
  • %TEMP%\ivz72foz.cmdline
  • %TEMP%\r_c3tey3.0.vb
  • %TEMP%\hwaxbdbo.0.vb
  • %TEMP%\hy1zavxl.0.vb
  • %TEMP%\zm5wwjvz.0.vb
  • %TEMP%\zm5wwjvz.cmdline
  • %TEMP%\zm5wwjvz.out
  • %TEMP%\dtph2v0n.0.vb
  • %TEMP%\hy1zavxl.out
  • %TEMP%\hy1zavxl.cmdline
  • %TEMP%\dtph2v0n.cmdline
  • %TEMP%\do6nhdsj.0.vb
  • %TEMP%\do6nhdsj.out
  • %TEMP%\ajwdo6cr.cmdline
  • %TEMP%\ajwdo6cr.0.vb
  • %TEMP%\ajwdo6cr.out
  • %TEMP%\dtph2v0n.out
  • %TEMP%\do6nhdsj.cmdline
  • %TEMP%\qtmuexs_.cmdline
  • %TEMP%\qtmuexs_.out
  • %TEMP%\qtmuexs_.0.vb
  • %TEMP%\ogziawch.out
  • %TEMP%\ogziawch.cmdline
  • %TEMP%\2fnhawnp.out
  • %TEMP%\2fnhawnp.0.vb
  • %TEMP%\2fnhawnp.cmdline
  • %TEMP%\tb2lgkoo.cmdline
  • %TEMP%\ogziawch.0.vb
  • %TEMP%\tb2lgkoo.out
  • %TEMP%\yyilodnf.out
  • %TEMP%\yyilodnf.0.vb
  • %TEMP%\yyilodnf.cmdline
  • %TEMP%\ymba6lxl.cmdline
  • %TEMP%\ymba6lxl.0.vb
  • %TEMP%\ymba6lxl.out
  • %TEMP%\tb2lgkoo.0.vb
  • %TEMP%\hwaxbdbo.cmdline
  • %TEMP%\hwaxbdbo.out
  • %TEMP%\czahqgay.0.vb
  • %TEMP%\rfulwzsd.0.vb
  • %TEMP%\0_2n7te2.0.vb
  • %TEMP%\0_2n7te2.cmdline
  • %TEMP%\0_2n7te2.out
  • %TEMP%\dp8o-kig.0.vb
  • %TEMP%\dp8o-kig.out
  • %TEMP%\20eyg9fj.cmdline
  • %TEMP%\20eyg9fj.out
  • %TEMP%\dp8o-kig.cmdline
  • %TEMP%\zk_jph_3.out
  • %TEMP%\lhko5d3u.cmdline
  • %TEMP%\lhko5d3u.0.vb
  • %TEMP%\lhko5d3u.out
  • %TEMP%\czahqgay.out
  • %TEMP%\zk_jph_3.0.vb
  • %TEMP%\zk_jph_3.cmdline
  • %TEMP%\20eyg9fj.0.vb
  • %TEMP%\_qubm2rz.out
  • %TEMP%\_qubm2rz.cmdline
  • %TEMP%\rfulwzsd.cmdline
  • %TEMP%\wojp4cvu.cmdline
  • %TEMP%\wojp4cvu.out
  • %TEMP%\wojp4cvu.0.vb
  • %TEMP%\znhqcert.cmdline
  • %TEMP%\znhqcert.0.vb
  • %TEMP%\rfulwzsd.out
  • %TEMP%\znhqcert.out
  • %TEMP%\xxmju8gh.cmdline
  • %TEMP%\xxmju8gh.0.vb
  • %TEMP%\mkwde2ti.out
  • %TEMP%\mkwde2ti.0.vb
  • %TEMP%\mkwde2ti.cmdline
  • %TEMP%\_qubm2rz.0.vb
  • %TEMP%\xxmju8gh.out
  • %TEMP%\czahqgay.cmdline
  • %TEMP%\ifkulud8.cmdline
  • %TEMP%\mcsk4qwk.out
  • %TEMP%\jdmref4x.cmdline
  • %TEMP%\eozv46-f.cmdline
  • %TEMP%\rstxqioy.out
  • %TEMP%\rstxqioy.cmdline
  • %TEMP%\rstxqioy.0.vb
  • %TEMP%\adxpsk2e.out
  • %TEMP%\eozv46-f.out
  • %TEMP%\eozv46-f.0.vb
  • %TEMP%\adxpsk2e.cmdline
  • %TEMP%\mqdjy4tk.0.vb
  • %TEMP%\mqdjy4tk.out
  • %TEMP%\akdmyz0w.cmdline
  • %TEMP%\akdmyz0w.out
  • %TEMP%\akdmyz0w.0.vb
  • %TEMP%\adxpsk2e.0.vb
  • %TEMP%\mqdjy4tk.cmdline
  • %TEMP%\9afmc-nw.out
  • %TEMP%\9afmc-nw.cmdline
  • %TEMP%\9afmc-nw.0.vb
  • %TEMP%\jdiovudv.out
  • %TEMP%\jdiovudv.0.vb
  • %TEMP%\xuvvf7nf.out
  • %TEMP%\xuvvf7nf.cmdline
  • %TEMP%\xuvvf7nf.0.vb
  • %TEMP%\iqedrwbk.out
  • %TEMP%\jdiovudv.cmdline
  • %TEMP%\iqedrwbk.cmdline
  • %TEMP%\6ga3qtgd.cmdline
  • %TEMP%\6ga3qtgd.0.vb
  • %TEMP%\6ga3qtgd.out
  • %TEMP%\upcee7h0.cmdline
  • %TEMP%\upcee7h0.out
  • %TEMP%\upcee7h0.0.vb
  • %TEMP%\iqedrwbk.0.vb
  • %TEMP%\ziktjyx3.out
  • %TEMP%\ziktjyx3.0.vb
  • %TEMP%\p2njaopu.cmdline
  • %TEMP%\mj40r5jr.0.vb
  • %TEMP%\wmb5e2v3.cmdline
  • %TEMP%\wmb5e2v3.out
  • %TEMP%\wmb5e2v3.0.vb
  • %TEMP%\gaxoem23.cmdline
  • %TEMP%\gaxoem23.0.vb
  • %TEMP%\_tkqczdx.0.vb
  • %TEMP%\_tkqczdx.out
  • %TEMP%\gaxoem23.out
  • %TEMP%\fg9nycun.0.vb
  • %TEMP%\ycrjaryv.0.vb
  • %TEMP%\ycrjaryv.out
  • %TEMP%\ycrjaryv.cmdline
  • %TEMP%\mcsk4qwk.0.vb
  • %TEMP%\fg9nycun.out
  • %TEMP%\fg9nycun.cmdline
  • %TEMP%\_tkqczdx.cmdline
  • %TEMP%\0dr7fcgq.cmdline
  • %TEMP%\0dr7fcgq.0.vb
  • %TEMP%\mj40r5jr.out
  • %TEMP%\65k0y-om.cmdline
  • %TEMP%\65k0y-om.0.vb
  • %TEMP%\65k0y-om.out
  • %TEMP%\qb5jrgqm.out
  • %TEMP%\qb5jrgqm.cmdline
  • %TEMP%\mj40r5jr.cmdline
  • %TEMP%\qb5jrgqm.0.vb
  • %TEMP%\pbufc5ov.0.vb
  • %TEMP%\pbufc5ov.out
  • %TEMP%\5n-zrbum.cmdline
  • %TEMP%\5n-zrbum.0.vb
  • %TEMP%\5n-zrbum.out
  • %TEMP%\0dr7fcgq.out
  • %TEMP%\pbufc5ov.cmdline
  • %TEMP%\zoj4j4bf.out
  • %TEMP%\v2ncus7j.out
  • %TEMP%\zoj4j4bf.0.vb
  • %TEMP%\7sb57xxv.out
  • %TEMP%\u-93zcwo.out
  • %TEMP%\u-93zcwo.cmdline
  • %TEMP%\u-93zcwo.0.vb
  • %TEMP%\kqf8fyuh.out
  • %TEMP%\kqf8fyuh.cmdline
  • %TEMP%\d3tngh2h.out
  • %TEMP%\d3tngh2h.cmdline
  • %TEMP%\kqf8fyuh.0.vb
  • %TEMP%\4ep2kcbt.0.vb
  • %TEMP%\nz0yywyc.0.vb
  • %TEMP%\nz0yywyc.cmdline
  • %TEMP%\nz0yywyc.out
  • %TEMP%\7sb57xxv.cmdline
  • %TEMP%\4ep2kcbt.cmdline
  • %TEMP%\4ep2kcbt.out
  • %TEMP%\d3tngh2h.0.vb
  • %TEMP%\wa4hjvd6.out
  • %TEMP%\wa4hjvd6.0.vb
  • %TEMP%\jdmref4x.out
  • %TEMP%\8cz4nlpo.0.vb
  • %TEMP%\8cz4nlpo.cmdline
  • %TEMP%\8cz4nlpo.out
  • %TEMP%\5lmnjcqv.cmdline
  • %TEMP%\5lmnjcqv.0.vb
  • %TEMP%\jdmref4x.0.vb
  • %TEMP%\5lmnjcqv.out
  • %TEMP%\cyqb7veq.0.vb
  • %TEMP%\cyqb7veq.out
  • %TEMP%\kktbts8y.cmdline
  • %TEMP%\kktbts8y.0.vb
  • %TEMP%\kktbts8y.out
  • %TEMP%\wa4hjvd6.cmdline
  • %TEMP%\cyqb7veq.cmdline
  • %TEMP%\7sb57xxv.0.vb
  • %TEMP%\p2njaopu.0.vb
  • %TEMP%\waonvyfg.cmdline
  • %TEMP%\ifkulud8.0.vb
  • %TEMP%\lstlrhq5.0.vb
  • %TEMP%\lstlrhq5.cmdline
  • %TEMP%\xqpyz1v9.cmdline
  • %TEMP%\xqpyz1v9.out
  • %TEMP%\xqpyz1v9.0.vb
  • %TEMP%\om9sdtj2.out
  • %TEMP%\lstlrhq5.out
  • %TEMP%\0dnse7ac.out
  • %TEMP%\pr4m64wr.0.vb
  • %TEMP%\pr4m64wr.cmdline
  • %TEMP%\pr4m64wr.out
  • %TEMP%\waonvyfg.0.vb
  • %TEMP%\waonvyfg.out
  • %TEMP%\0dnse7ac.cmdline
  • %TEMP%\0dnse7ac.0.vb
  • %TEMP%\om9sdtj2.cmdline
  • %TEMP%\om9sdtj2.0.vb
  • %TEMP%\1nrb-fl7.0.vb
  • %TEMP%\kboztemg.cmdline
  • %TEMP%\kboztemg.out
  • %TEMP%\kboztemg.0.vb
  • %TEMP%\3hpqyfoh.0.vb
  • %TEMP%\3hpqyfoh.out
  • %TEMP%\3hpqyfoh.cmdline
  • %TEMP%\ifkulud8.out
  • %TEMP%\zoqlz9je.cmdline
  • %TEMP%\zoqlz9je.0.vb
  • %TEMP%\p3oslbc0.out
  • %TEMP%\p3oslbc0.cmdline
  • %TEMP%\p3oslbc0.0.vb
  • %TEMP%\1nrb-fl7.cmdline
  • %TEMP%\1nrb-fl7.out
  • %TEMP%\zoqlz9je.out
  • %TEMP%\zoj4j4bf.cmdline
  • %TEMP%\ziktjyx3.cmdline
  • %TEMP%\v2ncus7j.0.vb
  • %TEMP%\2bt2p105.0.vb
  • %TEMP%\tglz6psr.0.vb
  • %TEMP%\zrqo8n9z.out
  • %TEMP%\zrqo8n9z.cmdline
  • %TEMP%\zrqo8n9z.0.vb
  • %TEMP%\h-hyqt-k.out
  • %TEMP%\tglz6psr.cmdline
  • %TEMP%\tglz6psr.out
  • %TEMP%\h-hyqt-k.cmdline
  • %TEMP%\pl-f6dkq.0.vb
  • %TEMP%\pl-f6dkq.cmdline
  • %TEMP%\uhwbolvo.cmdline
  • %TEMP%\uhwbolvo.0.vb
  • %TEMP%\uhwbolvo.out
  • %TEMP%\h-hyqt-k.0.vb
  • %TEMP%\pl-f6dkq.out
  • %TEMP%\4tfoxlgx.out
  • %TEMP%\4tfoxlgx.cmdline
  • %TEMP%\4tfoxlgx.0.vb
  • %TEMP%\0dksilw-.out
  • %TEMP%\0dksilw-.cmdline
  • %TEMP%\uecijdwq.cmdline
  • %TEMP%\uecijdwq.out
  • %TEMP%\uecijdwq.0.vb
  • %TEMP%\shjq0vag.out
  • %TEMP%\0dksilw-.0.vb
  • %TEMP%\shjq0vag.cmdline
  • %TEMP%\dft-keau.cmdline
  • %TEMP%\dft-keau.0.vb
  • %TEMP%\dft-keau.out
  • %TEMP%\q-ibiypn.0.vb
  • %TEMP%\q-ibiypn.cmdline
  • %TEMP%\q-ibiypn.out
  • %TEMP%\shjq0vag.0.vb
  • %TEMP%\ncsjsqcy.cmdline
  • %TEMP%\ncsjsqcy.0.vb
  • %TEMP%\gjffy8a4.out
  • %TEMP%\-mlfpylb.out
  • %TEMP%\etx0ttnf.out
  • %TEMP%\etx0ttnf.0.vb
  • %TEMP%\etx0ttnf.cmdline
  • %TEMP%\uswxarwv.cmdline
  • %TEMP%\uswxarwv.out
  • %TEMP%\pf_cy_s2.cmdline
  • %TEMP%\pf_cy_s2.0.vb
  • %TEMP%\uswxarwv.0.vb
  • %TEMP%\qhl37kbj.cmdline
  • %TEMP%\y9ylce_a.0.vb
  • %TEMP%\y9ylce_a.out
  • %TEMP%\y9ylce_a.cmdline
  • %TEMP%\gjffy8a4.cmdline
  • %TEMP%\qhl37kbj.0.vb
  • %TEMP%\qhl37kbj.out
  • %TEMP%\pf_cy_s2.out
  • %TEMP%\7nllsumh.0.vb
  • %TEMP%\7nllsumh.cmdline
  • %TEMP%\-mlfpylb.0.vb
  • %TEMP%\putsg3lv.cmdline
  • %TEMP%\putsg3lv.out
  • %TEMP%\putsg3lv.0.vb
  • %TEMP%\sxj3uonl.out
  • %TEMP%\sxj3uonl.0.vb
  • %TEMP%\-mlfpylb.cmdline
  • %TEMP%\sxj3uonl.cmdline
  • %TEMP%\edmmgnxq.cmdline
  • %TEMP%\edmmgnxq.out
  • %TEMP%\i16dwndr.cmdline
  • %TEMP%\i16dwndr.0.vb
  • %TEMP%\i16dwndr.out
  • %TEMP%\7nllsumh.out
  • %TEMP%\edmmgnxq.0.vb
  • %TEMP%\z4rle15k.out
  • %TEMP%\ncsjsqcy.out
  • %TEMP%\z4rle15k.cmdline
  • %TEMP%\iwjriuhp.out
  • %TEMP%\-xuamb_d.0.vb
  • %TEMP%\-xuamb_d.cmdline
  • %TEMP%\-xuamb_d.out
  • %TEMP%\xvxtjn2j.0.vb
  • %TEMP%\xvxtjn2j.cmdline
  • %TEMP%\pfzuje69.cmdline
  • %TEMP%\pfzuje69.out
  • %TEMP%\xvxtjn2j.out
  • %TEMP%\cnz1am0m.out
  • %TEMP%\d_5utwwg.0.vb
  • %TEMP%\d_5utwwg.cmdline
  • %TEMP%\d_5utwwg.out
  • %TEMP%\iwjriuhp.cmdline
  • %TEMP%\cnz1am0m.0.vb
  • %TEMP%\cnz1am0m.cmdline
  • %TEMP%\pfzuje69.0.vb
  • %TEMP%\2wmmml5d.cmdline
  • %TEMP%\2wmmml5d.0.vb
  • %TEMP%\jwwmccb9.cmdline
  • %TEMP%\6t7r8vse.out
  • %TEMP%\6t7r8vse.0.vb
  • %TEMP%\6t7r8vse.cmdline
  • %TEMP%\ohsar06y.out
  • %TEMP%\ohsar06y.0.vb
  • %TEMP%\jwwmccb9.0.vb
  • %TEMP%\ohsar06y.cmdline
  • %TEMP%\ov7vwjlz.out
  • %TEMP%\ov7vwjlz.0.vb
  • %TEMP%\tcc1lnb5.cmdline
  • %TEMP%\tcc1lnb5.out
  • %TEMP%\tcc1lnb5.0.vb
  • %TEMP%\2wmmml5d.out
  • %TEMP%\ov7vwjlz.cmdline
  • %TEMP%\iwjriuhp.0.vb
  • %TEMP%\rgc0nnpo.0.vb
  • %TEMP%\yqqrygai.0.vb
  • %TEMP%\rgc0nnpo.cmdline
  • %TEMP%\gzwkl6ax.0.vb
  • %TEMP%\gzwkl6ax.out
  • %TEMP%\mgk8wv2n.cmdline
  • %TEMP%\mgk8wv2n.0.vb
  • %TEMP%\mgk8wv2n.out
  • %TEMP%\ubjmzjhx.0.vb
  • %TEMP%\gzwkl6ax.cmdline
  • %TEMP%\t6uth4re.cmdline
  • %TEMP%\6fssndcs.out
  • %TEMP%\6fssndcs.cmdline
  • %TEMP%\6fssndcs.0.vb
  • %TEMP%\yqqrygai.out
  • %TEMP%\yqqrygai.cmdline
  • %TEMP%\t6uth4re.0.vb
  • %TEMP%\t6uth4re.out
  • %TEMP%\ubjmzjhx.out
  • %TEMP%\ubjmzjhx.cmdline
  • %TEMP%\fszwzhtg.out
  • %TEMP%\shmgx5b4.0.vb
  • %TEMP%\shmgx5b4.out
  • %TEMP%\shmgx5b4.cmdline
  • %TEMP%\0jx0i-z7.cmdline
  • %TEMP%\0jx0i-z7.0.vb
  • %TEMP%\0jx0i-z7.out
  • %TEMP%\rgc0nnpo.out
  • %TEMP%\10csa2mv.cmdline
  • %TEMP%\10csa2mv.0.vb
  • %TEMP%\pz-bcvfr.out
  • %TEMP%\pz-bcvfr.cmdline
  • %TEMP%\pz-bcvfr.0.vb
  • %TEMP%\fszwzhtg.0.vb
  • %TEMP%\fszwzhtg.cmdline
  • %TEMP%\10csa2mv.out
  • %TEMP%\z4rle15k.0.vb
  • %TEMP%\wl7qrvtf.out
  • %TEMP%\1aijhxm8.out
  • %TEMP%\msu9e3wv.0.vb
  • %TEMP%\d4d2k84_.cmdline
  • %TEMP%\d4d2k84_.0.vb
  • %TEMP%\d4d2k84_.out
  • %TEMP%\tasitzhq.0.vb
  • %TEMP%\tasitzhq.cmdline
  • %TEMP%\ddtkremq.0.vb
  • %TEMP%\ddtkremq.cmdline
  • %TEMP%\tasitzhq.out
  • %TEMP%\spijepgx.out
  • %TEMP%\ow2rt-pc.out
  • %TEMP%\ow2rt-pc.0.vb
  • %TEMP%\ow2rt-pc.cmdline
  • %TEMP%\2bt2p105.cmdline
  • %TEMP%\spijepgx.cmdline
  • %TEMP%\spijepgx.0.vb
  • %TEMP%\ddtkremq.out
  • %TEMP%\0z4azxsq.cmdline
  • %TEMP%\0z4azxsq.0.vb
  • %TEMP%\5r1ii5xc.out
  • %TEMP%\4gckcbl2.cmdline
  • %TEMP%\4gckcbl2.0.vb
  • %TEMP%\4gckcbl2.out
  • %TEMP%\mno4-gex.cmdline
  • %TEMP%\mno4-gex.out
  • %TEMP%\5r1ii5xc.0.vb
  • %TEMP%\mno4-gex.0.vb
  • %TEMP%\e30pifw1.out
  • %TEMP%\e30pifw1.cmdline
  • %TEMP%\w1htpyov.0.vb
  • %TEMP%\w1htpyov.out
  • %TEMP%\w1htpyov.cmdline
  • %TEMP%\0z4azxsq.out
  • %TEMP%\e30pifw1.0.vb
  • %TEMP%\2bt2p105.out
  • %TEMP%\kmyub2wo.0.vb
  • %TEMP%\msu9e3wv.out
  • %TEMP%\kmyub2wo.cmdline
  • %TEMP%\0fha8l5k.out
  • %TEMP%\0fha8l5k.cmdline
  • %TEMP%\gzrj7wea.0.vb
  • %TEMP%\gzrj7wea.out
  • %TEMP%\gzrj7wea.cmdline
  • %TEMP%\6guvhugw.cmdline
  • %TEMP%\0fha8l5k.0.vb
  • %TEMP%\tiezdjrk.0.vb
  • %TEMP%\b7yr100j.out
  • %TEMP%\b7yr100j.0.vb
  • %TEMP%\b7yr100j.cmdline
  • %TEMP%\1aijhxm8.0.vb
  • %TEMP%\1aijhxm8.cmdline
  • %TEMP%\tiezdjrk.cmdline
  • %TEMP%\tiezdjrk.out
  • %TEMP%\6guvhugw.0.vb
  • %TEMP%\6guvhugw.out
  • %TEMP%\yslo5xcr.cmdline
  • %TEMP%\k0ibobdx.0.vb
  • %TEMP%\k0ibobdx.cmdline
  • %TEMP%\k0ibobdx.out
  • %TEMP%\f9yohtxf.cmdline
  • %TEMP%\f9yohtxf.0.vb
  • %TEMP%\f9yohtxf.out
  • %TEMP%\kmyub2wo.out
  • %TEMP%\6br0mlhd.0.vb
  • %TEMP%\6br0mlhd.cmdline
  • %TEMP%\fqqmkvjq.0.vb
  • %TEMP%\fqqmkvjq.out
  • %TEMP%\fqqmkvjq.cmdline
  • %TEMP%\yslo5xcr.out
  • %TEMP%\yslo5xcr.0.vb
  • %TEMP%\6br0mlhd.out
  • %TEMP%\5r1ii5xc.cmdline
  • %TEMP%\v2ncus7j.cmdline
  • %TEMP%\vfq1sfup.out
  • %TEMP%\wl7qrvtf.cmdline
  • %TEMP%\-irpkkoo.0.vb
  • %TEMP%\-irpkkoo.out
  • %TEMP%\ozhywnvt.out
  • %TEMP%\ozhywnvt.0.vb
  • %TEMP%\ozhywnvt.cmdline
  • %TEMP%\lsdpobqp.0.vb
  • %TEMP%\-irpkkoo.cmdline
  • %TEMP%\mgolk4l_.0.vb
  • %TEMP%\sdcblo1e.out
  • %TEMP%\sdcblo1e.0.vb
  • %TEMP%\sdcblo1e.cmdline
  • %TEMP%\viugoprm.out
  • %TEMP%\viugoprm.cmdline
  • %TEMP%\mgolk4l_.out
  • %TEMP%\mgolk4l_.cmdline
  • %TEMP%\lsdpobqp.out
  • %TEMP%\lsdpobqp.cmdline
  • %TEMP%\ws_xxf1_.out
  • %TEMP%\sh99vish.0.vb
  • %TEMP%\sh99vish.cmdline
  • %TEMP%\sh99vish.out
  • %TEMP%\9he3ho45.cmdline
  • %TEMP%\9he3ho45.out
  • %TEMP%\9he3ho45.0.vb
  • %TEMP%\msu9e3wv.cmdline
  • %TEMP%\66cklkz9.0.vb
  • %TEMP%\66cklkz9.cmdline
  • %TEMP%\-2wsk6hb.0.vb
  • %TEMP%\-2wsk6hb.out
  • %TEMP%\-2wsk6hb.cmdline
  • %TEMP%\ws_xxf1_.0.vb
  • %TEMP%\ws_xxf1_.cmdline
  • %TEMP%\66cklkz9.out
  • %TEMP%\viugoprm.0.vb
  • %TEMP%\gjffy8a4.0.vb
  • %TEMP%\vfq1sfup.cmdline
  • %TEMP%\wl7qrvtf.0.vb
  • %TEMP%\lkxzuvkn.out
  • %TEMP%\rysng8lu.out
  • %TEMP%\rysng8lu.0.vb
  • %TEMP%\rysng8lu.cmdline
  • %TEMP%\jan6h8na.0.vb
  • %TEMP%\lkxzuvkn.0.vb
  • %TEMP%\lkxzuvkn.cmdline
  • %TEMP%\jan6h8na.out
  • %TEMP%\wgmjfxh2.out
  • %TEMP%\wgmjfxh2.0.vb
  • %TEMP%\mrwztinh.cmdline
  • %TEMP%\mrwztinh.out
  • %TEMP%\mrwztinh.0.vb
  • %TEMP%\jan6h8na.cmdline
  • %TEMP%\wgmjfxh2.cmdline
  • %TEMP%\-7fmyek_.out
  • %TEMP%\-7fmyek_.cmdline
  • %TEMP%\-7fmyek_.0.vb
  • %TEMP%\h5lutgno.cmdline
  • %TEMP%\h5lutgno.0.vb
  • %TEMP%\_oge-ls9.out
  • %TEMP%\_oge-ls9.0.vb
  • %TEMP%\_oge-ls9.cmdline
  • %TEMP%\waxv4tc4.0.vb
  • %TEMP%\h5lutgno.out
  • %TEMP%\waxv4tc4.out
  • %TEMP%\gefikr5l.cmdline
  • %TEMP%\gefikr5l.out
  • %TEMP%\gefikr5l.0.vb
  • %TEMP%\oltqjely.0.vb
  • %TEMP%\oltqjely.cmdline
  • %TEMP%\oltqjely.out
  • %TEMP%\waxv4tc4.cmdline
  • %TEMP%\vfq1sfup.0.vb
  • %TEMP%\mcsk4qwk.cmdline
Network activity
UDP
  • DNS ASK da####n53.no-ip.org
Miscellaneous
Creates and executes the following
  • '%APPDATA%\svchost.bat'
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cm0h7use.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\c-xgt1yt.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\og7m1210.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\r4ckkr4v.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\p2njaopu.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jdmref4x.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8cz4nlpo.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5lmnjcqv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cyqb7veq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kktbts8y.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\c2mwj70p.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tvook5yx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wa4hjvd6.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kqf8fyuh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4ep2kcbt.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nz0yywyc.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7sb57xxv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ifkulud8.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kboztemg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3hpqyfoh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zoqlz9je.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\p3oslbc0.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1nrb-fl7.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\d3tngh2h.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\u-93zcwo.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\u0z7f_cf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uu3jbuen.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\y1fs-t-h.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xxmju8gh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mkwde2ti.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_qubm2rz.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\20eyg9fj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0_2n7te2.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dp8o-kig.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zk_jph_3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lhko5d3u.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\czahqgay.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\r_c3tey3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qpffpvlg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\znhqcert.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\af71hbem.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cni50prq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\p9uunna2.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fcjydjxs.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2ewvyjar.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\k7a8jucs.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5mv6qdtm.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tkp2sglc.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lbq3pwux.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ivz72foz.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mb0infke.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wuei7xrw.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mxdyral-.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\om9sdtj2.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xqpyz1v9.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xkzmnjmn.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0dnse7ac.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7mxntq9z.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hndkpy1w.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wduwraul.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ttdphsca.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qinjorym.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\t5k8nl3u.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fyeujogx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\z-fo-we2.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\urapitig.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2iewqzi0.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\py9oqzhb.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1vdigzqy.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fdmchvse.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\x_a9xc3p.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ijwnnbug.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\e51jt3s4.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1bogwsls.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1waro5g9.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hmx1pqcg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wqf6iukj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vbot3mlc.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zlsozbdo.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_5_kjoxi.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gtmzweyr.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\toczq65s.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_u_wc3uj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mcsk4qwk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ycrjaryv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\waonvyfg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zoj4j4bf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jdiovudv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xuvvf7nf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\iqedrwbk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6ga3qtgd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\upcee7h0.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9afmc-nw.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\eozv46-f.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rstxqioy.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\adxpsk2e.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pr4m64wr.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mqdjy4tk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ziktjyx3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mj40r5jr.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\65k0y-om.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qb5jrgqm.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pbufc5ov.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5n-zrbum.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0dr7fcgq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_tkqczdx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wmb5e2v3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gaxoem23.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fg9nycun.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\akdmyz0w.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wojp4cvu.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lstlrhq5.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rfulwzsd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-2wsk6hb.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\q-ibiypn.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4tfoxlgx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tglz6psr.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zrqo8n9z.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\h-hyqt-k.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pl-f6dkq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uhwbolvo.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ncsjsqcy.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-mlfpylb.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\putsg3lv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\shjq0vag.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dft-keau.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sxj3uonl.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7nllsumh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pf_cy_s2.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\etx0ttnf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uswxarwv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qhl37kbj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\y9ylce_a.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gjffy8a4.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\msu9e3wv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sh99vish.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9he3ho45.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\edmmgnxq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\i16dwndr.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uecijdwq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0dksilw-.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\z4rle15k.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jwwmccb9.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6t7r8vse.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ohsar06y.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ov7vwjlz.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tcc1lnb5.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2wmmml5d.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pfzuje69.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-xuamb_d.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xvxtjn2j.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cnz1am0m.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\d_5utwwg.cmdline"' (with hidden window)
  • '%APPDATA%\svchost.bat' ' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\iwjriuhp.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\shmgx5b4.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0jx0i-z7.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\10csa2mv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pz-bcvfr.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fszwzhtg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ubjmzjhx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gzwkl6ax.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mgk8wv2n.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\t6uth4re.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6fssndcs.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yqqrygai.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rgc0nnpo.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\66cklkz9.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ws_xxf1_.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ajwdo6cr.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lsdpobqp.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kmyub2wo.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\k0ibobdx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\f9yohtxf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6br0mlhd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fqqmkvjq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yslo5xcr.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6guvhugw.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0fha8l5k.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gzrj7wea.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tiezdjrk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ow2rt-pc.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2bt2p105.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\b7yr100j.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ogziawch.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2fnhawnp.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tb2lgkoo.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yyilodnf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ymba6lxl.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qtmuexs_.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hy1zavxl.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zm5wwjvz.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dtph2v0n.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\do6nhdsj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1aijhxm8.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\v2ncus7j.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\spijepgx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tasitzhq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\d4d2k84_.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ozhywnvt.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mgolk4l_.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sdcblo1e.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\viugoprm.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wl7qrvtf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\h5lutgno.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_oge-ls9.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\waxv4tc4.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gefikr5l.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\oltqjely.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-7fmyek_.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-irpkkoo.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lkxzuvkn.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jan6h8na.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wgmjfxh2.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mrwztinh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vfq1sfup.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5r1ii5xc.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4gckcbl2.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mno4-gex.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\e30pifw1.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\w1htpyov.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0z4azxsq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ddtkremq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rysng8lu.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hwaxbdbo.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8_e--6xm.cmdline"' (with hidden window)
Executes the following
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jwwmccb9.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tvook5yx.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cm0h7use.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\c-xgt1yt.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\og7m1210.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\r4ckkr4v.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\p2njaopu.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jdmref4x.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8cz4nlpo.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5lmnjcqv.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cyqb7veq.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kktbts8y.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\d3tngh2h.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\om9sdtj2.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\u-93zcwo.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kqf8fyuh.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4ep2kcbt.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nz0yywyc.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7sb57xxv.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ifkulud8.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kboztemg.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3hpqyfoh.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zoqlz9je.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\p3oslbc0.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1nrb-fl7.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\c2mwj70p.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wa4hjvd6.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\u0z7f_cf.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\af71hbem.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xxmju8gh.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mkwde2ti.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_qubm2rz.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\20eyg9fj.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0_2n7te2.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dp8o-kig.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zk_jph_3.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lhko5d3u.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\czahqgay.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\r_c3tey3.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qpffpvlg.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mxdyral-.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\y1fs-t-h.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cni50prq.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\p9uunna2.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fcjydjxs.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2ewvyjar.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\k7a8jucs.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5mv6qdtm.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tkp2sglc.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lbq3pwux.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ivz72foz.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mb0infke.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wuei7xrw.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uu3jbuen.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lstlrhq5.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xqpyz1v9.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0dnse7ac.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7mxntq9z.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hndkpy1w.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wduwraul.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ttdphsca.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qinjorym.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\t5k8nl3u.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fyeujogx.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\z-fo-we2.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\urapitig.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2iewqzi0.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\py9oqzhb.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1vdigzqy.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fdmchvse.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\x_a9xc3p.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ijwnnbug.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\e51jt3s4.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1bogwsls.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1waro5g9.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hmx1pqcg.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wqf6iukj.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vbot3mlc.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zlsozbdo.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_5_kjoxi.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gtmzweyr.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\toczq65s.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_u_wc3uj.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mcsk4qwk.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ycrjaryv.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\waonvyfg.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zoj4j4bf.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jdiovudv.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xuvvf7nf.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\iqedrwbk.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6ga3qtgd.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\upcee7h0.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9afmc-nw.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\eozv46-f.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rstxqioy.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\adxpsk2e.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pr4m64wr.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mqdjy4tk.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ziktjyx3.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mj40r5jr.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\65k0y-om.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qb5jrgqm.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pbufc5ov.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5n-zrbum.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0dr7fcgq.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_tkqczdx.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wmb5e2v3.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gaxoem23.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fg9nycun.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\akdmyz0w.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\znhqcert.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xkzmnjmn.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wojp4cvu.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hwaxbdbo.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\q-ibiypn.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4tfoxlgx.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tglz6psr.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zrqo8n9z.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\h-hyqt-k.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pl-f6dkq.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uhwbolvo.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ncsjsqcy.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-mlfpylb.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\putsg3lv.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sxj3uonl.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\i16dwndr.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-2wsk6hb.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7nllsumh.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pf_cy_s2.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\etx0ttnf.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uswxarwv.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qhl37kbj.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\y9ylce_a.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gjffy8a4.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\msu9e3wv.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sh99vish.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9he3ho45.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\66cklkz9.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dft-keau.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\edmmgnxq.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\shjq0vag.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rgc0nnpo.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6t7r8vse.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ohsar06y.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ov7vwjlz.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tcc1lnb5.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2wmmml5d.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pfzuje69.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-xuamb_d.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xvxtjn2j.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cnz1am0m.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\d_5utwwg.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\iwjriuhp.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\shmgx5b4.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0dksilw-.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0jx0i-z7.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\10csa2mv.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pz-bcvfr.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fszwzhtg.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ubjmzjhx.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gzwkl6ax.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mgk8wv2n.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\t6uth4re.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6fssndcs.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yqqrygai.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\z4rle15k.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uecijdwq.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ws_xxf1_.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lsdpobqp.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-irpkkoo.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\k0ibobdx.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\f9yohtxf.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6br0mlhd.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fqqmkvjq.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yslo5xcr.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6guvhugw.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0fha8l5k.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gzrj7wea.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tiezdjrk.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\b7yr100j.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2bt2p105.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kmyub2wo.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1aijhxm8.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2fnhawnp.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tb2lgkoo.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yyilodnf.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ymba6lxl.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qtmuexs_.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hy1zavxl.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zm5wwjvz.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dtph2v0n.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\do6nhdsj.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ajwdo6cr.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\v2ncus7j.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ogziawch.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ow2rt-pc.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\spijepgx.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tasitzhq.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mgolk4l_.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sdcblo1e.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\viugoprm.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wl7qrvtf.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\h5lutgno.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_oge-ls9.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\waxv4tc4.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gefikr5l.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\oltqjely.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-7fmyek_.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lkxzuvkn.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ozhywnvt.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rysng8lu.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wgmjfxh2.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mrwztinh.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vfq1sfup.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5r1ii5xc.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4gckcbl2.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mno4-gex.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\e30pifw1.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\w1htpyov.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0z4azxsq.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ddtkremq.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\d4d2k84_.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jan6h8na.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rfulwzsd.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8_e--6xm.cmdline"

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android