FOR USERS

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.DownLoader34.65299

Added to the Dr.Web virus database: 2020-10-13

Virus description added:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN] 'WindowsUpdater' = '%APPDATA%\Svchost.bat'
  • [<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN] 'WindowsUpdater' = '%APPDATA%\Svchost.bat'
Modifies file system
Creates the following files
  • %TEMP%\aut86fa.tmp
  • %TEMP%\fbdmjrhz.cmdline
  • %TEMP%\fbdmjrhz.0.vb
  • %TEMP%\o5jlkqnv.out
  • %TEMP%\o5jlkqnv.cmdline
  • %TEMP%\o5jlkqnv.0.vb
  • %TEMP%\zmhr2snj.out
  • %TEMP%\zmhr2snj.cmdline
  • %TEMP%\zmhr2snj.0.vb
  • %TEMP%\o5wwpxdj.out
  • %TEMP%\o5wwpxdj.cmdline
  • %TEMP%\o5wwpxdj.0.vb
  • %TEMP%\b3cy15lt.out
  • %TEMP%\b3cy15lt.cmdline
  • %TEMP%\b3cy15lt.0.vb
  • %TEMP%\bislv241.0.vb
  • %TEMP%\wxk4fnxw.out
  • %TEMP%\wxk4fnxw.0.vb
  • %TEMP%\hd8-hei7.out
  • %TEMP%\hd8-hei7.cmdline
  • %TEMP%\hd8-hei7.0.vb
  • %TEMP%\ln6ejbyi.out
  • %TEMP%\ln6ejbyi.cmdline
  • %TEMP%\ln6ejbyi.0.vb
  • %TEMP%\aq-a43-a.out
  • %TEMP%\aq-a43-a.cmdline
  • %TEMP%\aq-a43-a.0.vb
  • %TEMP%\acibtlif.out
  • %TEMP%\acibtlif.cmdline
  • %TEMP%\acibtlif.0.vb
  • %TEMP%\bislv241.out
  • %TEMP%\wxk4fnxw.cmdline
  • %TEMP%\bislv241.cmdline
  • %TEMP%\fbdmjrhz.out
  • %TEMP%\b68_q7qb.cmdline
  • %TEMP%\soetnsio.0.vb
  • %TEMP%\soetnsio.cmdline
  • %TEMP%\soetnsio.out
  • %TEMP%\-5zsaxg6.0.vb
  • %TEMP%\-5zsaxg6.cmdline
  • %TEMP%\-5zsaxg6.out
  • %TEMP%\5_ymx8ee.cmdline
  • %TEMP%\kq_nb5rm.0.vb
  • %TEMP%\5_ymx8ee.out
  • %TEMP%\ginfubau.0.vb
  • %TEMP%\ginfubau.cmdline
  • %TEMP%\ginfubau.out
  • %TEMP%\zqptu1l9.0.vb
  • %TEMP%\zqptu1l9.cmdline
  • %TEMP%\ru7g0b3t.cmdline
  • %TEMP%\ru7g0b3t.0.vb
  • %TEMP%\b68_q7qb.0.vb
  • %TEMP%\986c2hmf.out
  • %TEMP%\986c2hmf.cmdline
  • %TEMP%\986c2hmf.0.vb
  • %TEMP%\yda4cq9g.out
  • %TEMP%\yda4cq9g.cmdline
  • %TEMP%\yda4cq9g.0.vb
  • %TEMP%\trxicp5f.out
  • %TEMP%\trxicp5f.cmdline
  • %TEMP%\trxicp5f.0.vb
  • %TEMP%\aba0addy.out
  • %TEMP%\aba0addy.cmdline
  • %TEMP%\aba0addy.0.vb
  • %TEMP%\ru7g0b3t.out
  • %TEMP%\b68_q7qb.out
  • %TEMP%\wvrlw19r.out
  • %TEMP%\wvrlw19r.cmdline
  • %TEMP%\wvrlw19r.0.vb
  • %TEMP%\mpogqxmc.out
  • %TEMP%\mpogqxmc.cmdline
  • %TEMP%\mpogqxmc.0.vb
  • %TEMP%\ccg4117k.out
  • %TEMP%\ccg4117k.cmdline
  • %TEMP%\ccg4117k.0.vb
  • %TEMP%\grztbthp.out
  • %TEMP%\grztbthp.cmdline
  • %TEMP%\grztbthp.0.vb
  • %TEMP%\bz00z67v.out
  • %TEMP%\bz00z67v.cmdline
  • %TEMP%\bz00z67v.0.vb
  • %TEMP%\8dzppvaa.out
  • %TEMP%\psgxyoql.cmdline
  • %TEMP%\8dzppvaa.cmdline
  • %TEMP%\xyr1xv3a.out
  • %TEMP%\xyr1xv3a.cmdline
  • %TEMP%\xyr1xv3a.0.vb
  • %TEMP%\mnbax_nk.out
  • %TEMP%\mnbax_nk.cmdline
  • %TEMP%\mnbax_nk.0.vb
  • %TEMP%\5kdhyduz.out
  • %TEMP%\5kdhyduz.cmdline
  • %TEMP%\5kdhyduz.0.vb
  • %TEMP%\uk0v6zj6.out
  • %TEMP%\uk0v6zj6.cmdline
  • %TEMP%\uk0v6zj6.0.vb
  • %TEMP%\ccmg3l0p.out
  • %TEMP%\ccmg3l0p.cmdline
  • %TEMP%\8dzppvaa.0.vb
  • %TEMP%\psgxyoql.out
  • %TEMP%\psgxyoql.0.vb
  • %TEMP%\hxgkohpr.0.vb
  • %TEMP%\5tdbhwm4.out
  • %TEMP%\qllsgb0k.out
  • %TEMP%\5tdbhwm4.cmdline
  • %TEMP%\5tdbhwm4.0.vb
  • %TEMP%\5eygv6bp.out
  • %TEMP%\5eygv6bp.cmdline
  • %TEMP%\5eygv6bp.0.vb
  • %TEMP%\v6_nzjpv.out
  • %TEMP%\v6_nzjpv.cmdline
  • %TEMP%\v6_nzjpv.0.vb
  • %TEMP%\brb6w1su.out
  • %TEMP%\brb6w1su.cmdline
  • %TEMP%\brb6w1su.0.vb
  • %TEMP%\rjpx3d3w.out
  • %TEMP%\rjpx3d3w.cmdline
  • %TEMP%\rjpx3d3w.0.vb
  • %TEMP%\qllsgb0k.cmdline
  • %TEMP%\hxgkohpr.cmdline
  • %TEMP%\qllsgb0k.0.vb
  • %TEMP%\vdblufj_.out
  • %TEMP%\vdblufj_.cmdline
  • %TEMP%\vdblufj_.0.vb
  • %TEMP%\kq_nb5rm.out
  • %TEMP%\kq_nb5rm.cmdline
  • %TEMP%\5_ymx8ee.0.vb
  • %TEMP%\pk2ndib7.out
  • %TEMP%\pk2ndib7.cmdline
  • %TEMP%\pk2ndib7.0.vb
  • %TEMP%\mbzm1kie.out
  • %TEMP%\mbzm1kie.cmdline
  • %TEMP%\mbzm1kie.0.vb
  • %TEMP%\hxgkohpr.out
  • %TEMP%\zqptu1l9.out
  • %TEMP%\wvmr948t.out
  • %TEMP%\4ird4cfx.cmdline
  • %TEMP%\ahyphxe0.out
  • %TEMP%\kz3yd_nl.0.vb
  • %TEMP%\poku4ztg.out
  • %TEMP%\poku4ztg.cmdline
  • %TEMP%\poku4ztg.0.vb
  • %TEMP%\hcg8hyyh.out
  • %TEMP%\hcg8hyyh.cmdline
  • %TEMP%\hcg8hyyh.0.vb
  • %TEMP%\azl7e8ee.out
  • %TEMP%\azl7e8ee.cmdline
  • %TEMP%\azl7e8ee.0.vb
  • %TEMP%\grlzztcm.out
  • %TEMP%\grlzztcm.cmdline
  • %TEMP%\grlzztcm.0.vb
  • %TEMP%\99ngqhdh.out
  • %TEMP%\9qorblz7.out
  • %TEMP%\99ngqhdh.cmdline
  • %TEMP%\zzzprfv3.out
  • %TEMP%\zzzprfv3.cmdline
  • %TEMP%\zzzprfv3.0.vb
  • %TEMP%\aaxyif-w.out
  • %TEMP%\aaxyif-w.cmdline
  • %TEMP%\aaxyif-w.0.vb
  • %TEMP%\dwrrun5s.out
  • %TEMP%\dwrrun5s.cmdline
  • %TEMP%\dwrrun5s.0.vb
  • %TEMP%\kp2em7bh.out
  • %TEMP%\kp2em7bh.cmdline
  • %TEMP%\kp2em7bh.0.vb
  • %TEMP%\2np6htew.out
  • %TEMP%\2np6htew.cmdline
  • %TEMP%\99ngqhdh.0.vb
  • %TEMP%\2np6htew.0.vb
  • %TEMP%\kz3yd_nl.cmdline
  • %TEMP%\lqjaelsh.0.vb
  • %TEMP%\lqjaelsh.out
  • %TEMP%\2w-az77p.0.vb
  • %TEMP%\2w-az77p.cmdline
  • %TEMP%\2w-az77p.out
  • %TEMP%\zlz08fcj.0.vb
  • %TEMP%\zlz08fcj.cmdline
  • %TEMP%\uvatqqmd.0.vb
  • %TEMP%\ahyphxe0.0.vb
  • %TEMP%\uvatqqmd.cmdline
  • %TEMP%\uvatqqmd.out
  • %TEMP%\bhvcvypb.0.vb
  • %TEMP%\bhvcvypb.cmdline
  • %TEMP%\bhvcvypb.out
  • %TEMP%\4ird4cfx.0.vb
  • %TEMP%\fqbu5nqi.0.vb
  • %TEMP%\kz3yd_nl.out
  • %TEMP%\gxtvfhgf.out
  • %TEMP%\gxtvfhgf.cmdline
  • %TEMP%\gxtvfhgf.0.vb
  • %TEMP%\2l--evtx.out
  • %TEMP%\2l--evtx.cmdline
  • %TEMP%\2l--evtx.0.vb
  • %TEMP%\f2u8faii.out
  • %TEMP%\f2u8faii.cmdline
  • %TEMP%\f2u8faii.0.vb
  • %TEMP%\f2sb53v1.out
  • %TEMP%\f2sb53v1.cmdline
  • %TEMP%\f2sb53v1.0.vb
  • %TEMP%\fqbu5nqi.out
  • %TEMP%\fqbu5nqi.cmdline
  • %TEMP%\lqjaelsh.cmdline
  • %TEMP%\9qorblz7.cmdline
  • %TEMP%\9qorblz7.0.vb
  • %TEMP%\qq92bkw7.out
  • %TEMP%\jeb32jjq.cmdline
  • %TEMP%\jeb32jjq.0.vb
  • %TEMP%\6tnd2ozf.out
  • %TEMP%\6tnd2ozf.cmdline
  • %TEMP%\6tnd2ozf.0.vb
  • %TEMP%\z5f24i93.out
  • %TEMP%\z5f24i93.cmdline
  • %TEMP%\z5f24i93.0.vb
  • %TEMP%\p-uujhn4.out
  • %TEMP%\p-uujhn4.cmdline
  • %TEMP%\p-uujhn4.0.vb
  • %TEMP%\olpsuuun.out
  • %TEMP%\olpsuuun.cmdline
  • %TEMP%\vxxj9vyf.0.vb
  • %TEMP%\olpsuuun.0.vb
  • %TEMP%\n69fhrcn.cmdline
  • %TEMP%\n69fhrcn.0.vb
  • %TEMP%\kq83zwlf.out
  • %TEMP%\kq83zwlf.cmdline
  • %TEMP%\kq83zwlf.0.vb
  • %TEMP%\suzi01-0.out
  • %TEMP%\suzi01-0.cmdline
  • %TEMP%\suzi01-0.0.vb
  • %TEMP%\woiqsekf.out
  • %TEMP%\woiqsekf.cmdline
  • %TEMP%\woiqsekf.0.vb
  • %TEMP%\r-6l8w5s.out
  • %TEMP%\r-6l8w5s.cmdline
  • %TEMP%\r-6l8w5s.0.vb
  • %TEMP%\n69fhrcn.out
  • %TEMP%\vxxj9vyf.cmdline
  • %TEMP%\jeb32jjq.out
  • %TEMP%\vxxj9vyf.out
  • %TEMP%\qq92bkw7.cmdline
  • %TEMP%\q2qg86xp.cmdline
  • %TEMP%\qq92bkw7.0.vb
  • %TEMP%\zwcqela1.out
  • %TEMP%\zwcqela1.cmdline
  • %TEMP%\zwcqela1.0.vb
  • %TEMP%\nqsru7qq.out
  • %TEMP%\nqsru7qq.cmdline
  • %TEMP%\nqsru7qq.0.vb
  • %TEMP%\-tzqb-im.out
  • %TEMP%\-tzqb-im.cmdline
  • %TEMP%\-tzqb-im.0.vb
  • %TEMP%\zdd_gg96.out
  • %TEMP%\zdd_gg96.cmdline
  • %TEMP%\zdd_gg96.0.vb
  • %TEMP%\q2qg86xp.out
  • %TEMP%\q2qg86xp.0.vb
  • %TEMP%\2sog3a8y.0.vb
  • %TEMP%\rgcbaxv3.out
  • %TEMP%\rgcbaxv3.cmdline
  • %TEMP%\rgcbaxv3.0.vb
  • %TEMP%\z5gr5q1a.out
  • %TEMP%\z5gr5q1a.cmdline
  • %TEMP%\z5gr5q1a.0.vb
  • %TEMP%\ccmg3l0p.0.vb
  • %TEMP%\wvmr948t.cmdline
  • %TEMP%\wvmr948t.0.vb
  • %TEMP%\64azmb8m.out
  • %TEMP%\64azmb8m.cmdline
  • %TEMP%\64azmb8m.0.vb
  • %TEMP%\2sog3a8y.out
  • %TEMP%\2sog3a8y.cmdline
  • %TEMP%\ahyphxe0.cmdline
  • %TEMP%\zlz08fcj.out
  • %TEMP%\zdqfn6qy.out
  • %TEMP%\g8oweg1h.cmdline
  • %TEMP%\yc9_tpix.0.vb
  • %TEMP%\ghbfe_w4.out
  • %TEMP%\ghbfe_w4.cmdline
  • %TEMP%\ghbfe_w4.0.vb
  • %TEMP%\bw6uzors.out
  • %TEMP%\bw6uzors.cmdline
  • %TEMP%\bw6uzors.0.vb
  • %TEMP%\7gc8vyqi.out
  • %TEMP%\7gc8vyqi.cmdline
  • %TEMP%\7gc8vyqi.0.vb
  • %TEMP%\7ppqriqc.out
  • %TEMP%\7ppqriqc.cmdline
  • %TEMP%\7ppqriqc.0.vb
  • %TEMP%\v2y9ieww.out
  • %TEMP%\9niwon9k.out
  • %TEMP%\v2y9ieww.cmdline
  • %TEMP%\8ejsiivp.out
  • %TEMP%\8ejsiivp.cmdline
  • %TEMP%\8ejsiivp.0.vb
  • %TEMP%\hz9bwam3.out
  • %TEMP%\hz9bwam3.cmdline
  • %TEMP%\hz9bwam3.0.vb
  • %TEMP%\9tccxjp0.out
  • %TEMP%\9tccxjp0.cmdline
  • %TEMP%\9tccxjp0.0.vb
  • %TEMP%\oyhz9kpm.out
  • %TEMP%\oyhz9kpm.cmdline
  • %TEMP%\oyhz9kpm.0.vb
  • %TEMP%\xpf8ezm5.out
  • %TEMP%\xpf8ezm5.cmdline
  • %TEMP%\v2y9ieww.0.vb
  • %TEMP%\xpf8ezm5.0.vb
  • %TEMP%\yc9_tpix.cmdline
  • %TEMP%\ixqdubja.0.vb
  • %TEMP%\ixqdubja.out
  • %TEMP%\8xvsjkv1.0.vb
  • %TEMP%\8xvsjkv1.cmdline
  • %TEMP%\8xvsjkv1.out
  • %TEMP%\8nncihhh.0.vb
  • %TEMP%\8nncihhh.cmdline
  • %TEMP%\owt6nacp.0.vb
  • %TEMP%\e-z4hlwm.out
  • %TEMP%\owt6nacp.cmdline
  • %TEMP%\owt6nacp.out
  • %TEMP%\wvpvajzv.0.vb
  • %TEMP%\wvpvajzv.cmdline
  • %TEMP%\wvpvajzv.out
  • %TEMP%\xah_len4.0.vb
  • %TEMP%\j8ue1flq.0.vb
  • %TEMP%\yc9_tpix.out
  • %TEMP%\gkudjyqc.out
  • %TEMP%\gkudjyqc.cmdline
  • %TEMP%\gkudjyqc.0.vb
  • %TEMP%\enbq7zvy.out
  • %TEMP%\enbq7zvy.cmdline
  • %TEMP%\enbq7zvy.0.vb
  • %TEMP%\3-g61mru.out
  • %TEMP%\3-g61mru.cmdline
  • %TEMP%\3-g61mru.0.vb
  • %TEMP%\zjoihbpi.out
  • %TEMP%\zjoihbpi.cmdline
  • %TEMP%\zjoihbpi.0.vb
  • %TEMP%\j8ue1flq.out
  • %TEMP%\j8ue1flq.cmdline
  • %TEMP%\ixqdubja.cmdline
  • %TEMP%\9niwon9k.cmdline
  • %TEMP%\9niwon9k.0.vb
  • %TEMP%\z9wzbfhd.out
  • %TEMP%\itirmjgd.cmdline
  • %TEMP%\itirmjgd.0.vb
  • %TEMP%\bxujftko.out
  • %TEMP%\bxujftko.cmdline
  • %TEMP%\bxujftko.0.vb
  • %TEMP%\nmnl-khe.out
  • %TEMP%\nmnl-khe.cmdline
  • %TEMP%\nmnl-khe.0.vb
  • %TEMP%\-yeazcox.out
  • %TEMP%\-yeazcox.cmdline
  • %TEMP%\-yeazcox.0.vb
  • %TEMP%\hpaintfd.out
  • %TEMP%\hpaintfd.cmdline
  • %TEMP%\5ahym7ao.0.vb
  • %TEMP%\hpaintfd.0.vb
  • %TEMP%\furwyymz.cmdline
  • %TEMP%\furwyymz.0.vb
  • %TEMP%\xlwsvvqv.out
  • %TEMP%\xlwsvvqv.cmdline
  • %TEMP%\xlwsvvqv.0.vb
  • %TEMP%\e0ffrzfd.out
  • %TEMP%\e0ffrzfd.cmdline
  • %TEMP%\e0ffrzfd.0.vb
  • %APPDATA%\svchost.bat
  • %TEMP%\$lokalsysВ§temp\clonedvdkeyen.exe
  • %TEMP%\aut873a.tmp
  • %TEMP%\$lokalsysВ§temp\keygeninf.exe
  • %TEMP%\aut870b.tmp
  • %TEMP%\$lokalsysВ§temp\binder.cfg
  • %TEMP%\furwyymz.out
  • %TEMP%\5ahym7ao.cmdline
  • %TEMP%\itirmjgd.out
  • %TEMP%\5ahym7ao.out
  • %TEMP%\z9wzbfhd.cmdline
  • %TEMP%\5de-qora.cmdline
  • %TEMP%\z9wzbfhd.0.vb
  • %TEMP%\9e3i575k.out
  • %TEMP%\9e3i575k.cmdline
  • %TEMP%\9e3i575k.0.vb
  • %TEMP%\wcn6hc1f.out
  • %TEMP%\wcn6hc1f.cmdline
  • %TEMP%\wcn6hc1f.0.vb
  • %TEMP%\desn0h0q.out
  • %TEMP%\desn0h0q.cmdline
  • %TEMP%\desn0h0q.0.vb
  • %TEMP%\-sa9bfnb.out
  • %TEMP%\-sa9bfnb.cmdline
  • %TEMP%\-sa9bfnb.0.vb
  • %TEMP%\5de-qora.out
  • %TEMP%\5de-qora.0.vb
  • %TEMP%\rxili9wk.0.vb
  • %TEMP%\jrnfl0xf.out
  • %TEMP%\jrnfl0xf.cmdline
  • %TEMP%\jrnfl0xf.0.vb
  • %TEMP%\nbstqs_x.out
  • %TEMP%\nbstqs_x.cmdline
  • %TEMP%\nbstqs_x.0.vb
  • %TEMP%\8nncihhh.out
  • %TEMP%\e-z4hlwm.cmdline
  • %TEMP%\e-z4hlwm.0.vb
  • %TEMP%\c9h_fmjk.out
  • %TEMP%\c9h_fmjk.cmdline
  • %TEMP%\c9h_fmjk.0.vb
  • %TEMP%\rxili9wk.out
  • %TEMP%\rxili9wk.cmdline
  • %TEMP%\xah_len4.cmdline
  • %TEMP%\ijyh65p-.cmdline
  • %TEMP%\zdqfn6qy.0.vb
  • %TEMP%\m5yxekx1.cmdline
  • %TEMP%\maicnvrx.out
  • %TEMP%\maicnvrx.cmdline
  • %TEMP%\maicnvrx.0.vb
  • %TEMP%\zq4phj0j.out
  • %TEMP%\zq4phj0j.cmdline
  • %TEMP%\zq4phj0j.0.vb
  • %TEMP%\f0egmhrt.out
  • %TEMP%\f0egmhrt.cmdline
  • %TEMP%\f0egmhrt.0.vb
  • %TEMP%\iyuk9zgv.out
  • %TEMP%\iyuk9zgv.cmdline
  • %TEMP%\iyuk9zgv.0.vb
  • %TEMP%\en-v_moa.out
  • %TEMP%\en-v_moa.cmdline
  • %TEMP%\llhu1eln.cmdline
  • %TEMP%\en-v_moa.0.vb
  • %TEMP%\uod9l3co.cmdline
  • %TEMP%\uod9l3co.0.vb
  • %TEMP%\zn6bv1uk.out
  • %TEMP%\zn6bv1uk.cmdline
  • %TEMP%\zn6bv1uk.0.vb
  • %TEMP%\xkut3wlv.out
  • %TEMP%\xkut3wlv.cmdline
  • %TEMP%\xkut3wlv.0.vb
  • %TEMP%\k3mkovlx.out
  • %TEMP%\k3mkovlx.cmdline
  • %TEMP%\k3mkovlx.0.vb
  • %TEMP%\wux-ylj_.out
  • %TEMP%\wux-ylj_.cmdline
  • %TEMP%\wux-ylj_.0.vb
  • %TEMP%\uod9l3co.out
  • %TEMP%\llhu1eln.out
  • %TEMP%\s8rc3glf.0.vb
  • %TEMP%\tjs6lpix.out
  • %TEMP%\dtk2hxkm.cmdline
  • %TEMP%\dtk2hxkm.out
  • %TEMP%\2wyb1z-8.0.vb
  • %TEMP%\2wyb1z-8.cmdline
  • %TEMP%\2wyb1z-8.out
  • %TEMP%\g8oweg1h.0.vb
  • %TEMP%\g8oweg1h.out
  • %TEMP%\xah_len4.out
  • %TEMP%\pwnrazz-.0.vb
  • %TEMP%\pwnrazz-.cmdline
  • %TEMP%\pwnrazz-.out
  • %TEMP%\r-7gkarm.0.vb
  • %TEMP%\r-7gkarm.cmdline
  • %TEMP%\r-7gkarm.out
  • %TEMP%\s8rc3glf.out
  • %TEMP%\s8rc3glf.cmdline
  • %TEMP%\tjs6lpix.cmdline
  • %TEMP%\tjs6lpix.0.vb
  • %TEMP%\abngrz4h.out
  • %TEMP%\abngrz4h.cmdline
  • %TEMP%\abngrz4h.0.vb
  • %TEMP%\bzzypbnr.out
  • %TEMP%\bzzypbnr.cmdline
  • %TEMP%\bzzypbnr.0.vb
  • %TEMP%\_rl3bqkz.out
  • %TEMP%\_rl3bqkz.cmdline
  • %TEMP%\_rl3bqkz.0.vb
  • %TEMP%\zoejb2lh.out
  • %TEMP%\zoejb2lh.cmdline
  • %TEMP%\zoejb2lh.0.vb
  • %TEMP%\dtk2hxkm.0.vb
  • %TEMP%\llhu1eln.0.vb
  • %TEMP%\e1k9oaq8.out
  • %TEMP%\e1k9oaq8.cmdline
  • %TEMP%\hqknxog-.0.vb
  • %TEMP%\eulq39hn.out
  • %TEMP%\eulq39hn.cmdline
  • %TEMP%\eulq39hn.0.vb
  • %TEMP%\avguoh9j.out
  • %TEMP%\avguoh9j.cmdline
  • %TEMP%\avguoh9j.0.vb
  • %TEMP%\czwizwax.out
  • %TEMP%\czwizwax.cmdline
  • %TEMP%\czwizwax.0.vb
  • %TEMP%\kn2e1zm1.out
  • %TEMP%\kn2e1zm1.cmdline
  • %TEMP%\kn2e1zm1.0.vb
  • %TEMP%\hqknxog-.out
  • %TEMP%\pa2o6ys5.out
  • %TEMP%\pa2o6ys5.0.vb
  • %TEMP%\114emtli.out
  • %TEMP%\114emtli.cmdline
  • %TEMP%\114emtli.0.vb
  • %TEMP%\njpftdpb.out
  • %TEMP%\njpftdpb.cmdline
  • %TEMP%\njpftdpb.0.vb
  • %TEMP%\dkzazl4n.out
  • %TEMP%\dkzazl4n.cmdline
  • %TEMP%\dkzazl4n.0.vb
  • %TEMP%\3mji5d5e.out
  • %TEMP%\3mji5d5e.cmdline
  • %TEMP%\3mji5d5e.0.vb
  • %TEMP%\m5yxekx1.out
  • %TEMP%\pa2o6ys5.cmdline
  • %TEMP%\rxsbkczd.0.vb
  • %TEMP%\hqknxog-.cmdline
  • %TEMP%\rxsbkczd.cmdline
  • %TEMP%\e1k9oaq8.0.vb
  • %TEMP%\x94qnymd.0.vb
  • %TEMP%\7wueyflk.out
  • %TEMP%\7wueyflk.cmdline
  • %TEMP%\7wueyflk.0.vb
  • %TEMP%\re3xf2jp.out
  • %TEMP%\re3xf2jp.cmdline
  • %TEMP%\re3xf2jp.0.vb
  • %TEMP%\asaltb8a.out
  • %TEMP%\asaltb8a.cmdline
  • %TEMP%\asaltb8a.0.vb
  • %TEMP%\vhxexhpa.out
  • %TEMP%\vhxexhpa.cmdline
  • %TEMP%\vhxexhpa.0.vb
  • %TEMP%\x94qnymd.out
  • %TEMP%\x94qnymd.cmdline
  • %TEMP%\grna1kyf.out
  • %TEMP%\rxsbkczd.out
  • %TEMP%\grna1kyf.cmdline
  • %TEMP%\grna1kyf.0.vb
  • %TEMP%\-byymgzl.out
  • %TEMP%\-byymgzl.cmdline
  • %TEMP%\-byymgzl.0.vb
  • %TEMP%\ijyh65p-.out
  • %TEMP%\zdqfn6qy.cmdline
  • %TEMP%\ijyh65p-.0.vb
  • %TEMP%\jfvr6r45.out
  • %TEMP%\jfvr6r45.cmdline
  • %TEMP%\jfvr6r45.0.vb
  • %TEMP%\xozt4tlq.out
  • %TEMP%\xozt4tlq.cmdline
  • %TEMP%\xozt4tlq.0.vb
  • %TEMP%\m5yxekx1.0.vb
  • %TEMP%\4ird4cfx.out
Sets the 'hidden' attribute to the following files
  • %APPDATA%\svchost.bat
Deletes the following files
  • %TEMP%\aut86fa.tmp
  • %TEMP%\fbdmjrhz.0.vb
  • %TEMP%\fbdmjrhz.cmdline
  • %TEMP%\o5jlkqnv.cmdline
  • %TEMP%\o5jlkqnv.0.vb
  • %TEMP%\o5jlkqnv.out
  • %TEMP%\zmhr2snj.0.vb
  • %TEMP%\zmhr2snj.cmdline
  • %TEMP%\zmhr2snj.out
  • %TEMP%\o5wwpxdj.0.vb
  • %TEMP%\o5wwpxdj.cmdline
  • %TEMP%\o5wwpxdj.out
  • %TEMP%\b3cy15lt.0.vb
  • %TEMP%\b3cy15lt.cmdline
  • %TEMP%\b3cy15lt.out
  • %TEMP%\fbdmjrhz.out
  • %TEMP%\wxk4fnxw.0.vb
  • %TEMP%\wxk4fnxw.out
  • %TEMP%\hd8-hei7.cmdline
  • %TEMP%\hd8-hei7.out
  • %TEMP%\hd8-hei7.0.vb
  • %TEMP%\ln6ejbyi.0.vb
  • %TEMP%\ln6ejbyi.cmdline
  • %TEMP%\ln6ejbyi.out
  • %TEMP%\aq-a43-a.out
  • %TEMP%\aq-a43-a.0.vb
  • %TEMP%\aq-a43-a.cmdline
  • %TEMP%\acibtlif.cmdline
  • %TEMP%\acibtlif.out
  • %TEMP%\acibtlif.0.vb
  • %TEMP%\bislv241.0.vb
  • %TEMP%\wxk4fnxw.cmdline
  • %TEMP%\b68_q7qb.0.vb
  • %TEMP%\ahyphxe0.cmdline
  • %TEMP%\ru7g0b3t.0.vb
  • %TEMP%\zqptu1l9.cmdline
  • %TEMP%\zqptu1l9.0.vb
  • %TEMP%\zqptu1l9.out
  • %TEMP%\ginfubau.0.vb
  • %TEMP%\ginfubau.out
  • %TEMP%\ginfubau.cmdline
  • %TEMP%\5_ymx8ee.cmdline
  • %TEMP%\5_ymx8ee.out
  • %TEMP%\5_ymx8ee.0.vb
  • %TEMP%\-5zsaxg6.0.vb
  • %TEMP%\-5zsaxg6.cmdline
  • %TEMP%\-5zsaxg6.out
  • %TEMP%\soetnsio.out
  • %TEMP%\soetnsio.cmdline
  • %TEMP%\bislv241.cmdline
  • %TEMP%\soetnsio.0.vb
  • %TEMP%\b68_q7qb.out
  • %TEMP%\b68_q7qb.cmdline
  • %TEMP%\986c2hmf.0.vb
  • %TEMP%\986c2hmf.cmdline
  • %TEMP%\986c2hmf.out
  • %TEMP%\yda4cq9g.out
  • %TEMP%\yda4cq9g.0.vb
  • %TEMP%\yda4cq9g.cmdline
  • %TEMP%\trxicp5f.0.vb
  • %TEMP%\trxicp5f.cmdline
  • %TEMP%\trxicp5f.out
  • %TEMP%\aba0addy.0.vb
  • %TEMP%\aba0addy.cmdline
  • %TEMP%\aba0addy.out
  • %TEMP%\ru7g0b3t.cmdline
  • %TEMP%\ru7g0b3t.out
  • %TEMP%\bislv241.out
  • %TEMP%\hxgkohpr.0.vb
  • %TEMP%\psgxyoql.0.vb
  • %TEMP%\psgxyoql.cmdline
  • %TEMP%\psgxyoql.out
  • %TEMP%\mpogqxmc.cmdline
  • %TEMP%\mpogqxmc.0.vb
  • %TEMP%\mpogqxmc.out
  • %TEMP%\ccg4117k.cmdline
  • %TEMP%\ccg4117k.out
  • %TEMP%\ccg4117k.0.vb
  • %TEMP%\grztbthp.0.vb
  • %TEMP%\grztbthp.out
  • %TEMP%\grztbthp.cmdline
  • %TEMP%\bz00z67v.0.vb
  • %TEMP%\bz00z67v.out
  • %TEMP%\hxgkohpr.out
  • %TEMP%\bz00z67v.cmdline
  • %TEMP%\8dzppvaa.cmdline
  • %TEMP%\8dzppvaa.out
  • %TEMP%\xyr1xv3a.0.vb
  • %TEMP%\xyr1xv3a.cmdline
  • %TEMP%\xyr1xv3a.out
  • %TEMP%\mnbax_nk.0.vb
  • %TEMP%\mnbax_nk.out
  • %TEMP%\mnbax_nk.cmdline
  • %TEMP%\5kdhyduz.0.vb
  • %TEMP%\5kdhyduz.cmdline
  • %TEMP%\5kdhyduz.out
  • %TEMP%\uk0v6zj6.out
  • %TEMP%\uk0v6zj6.0.vb
  • %TEMP%\uk0v6zj6.cmdline
  • %TEMP%\8dzppvaa.0.vb
  • %TEMP%\rjpx3d3w.0.vb
  • %TEMP%\wvrlw19r.cmdline
  • %TEMP%\mbzm1kie.out
  • %TEMP%\wvrlw19r.0.vb
  • %TEMP%\5tdbhwm4.cmdline
  • %TEMP%\5tdbhwm4.0.vb
  • %TEMP%\5tdbhwm4.out
  • %TEMP%\5eygv6bp.out
  • %TEMP%\5eygv6bp.0.vb
  • %TEMP%\5eygv6bp.cmdline
  • %TEMP%\v6_nzjpv.cmdline
  • %TEMP%\v6_nzjpv.out
  • %TEMP%\v6_nzjpv.0.vb
  • %TEMP%\brb6w1su.cmdline
  • %TEMP%\brb6w1su.out
  • %TEMP%\brb6w1su.0.vb
  • %TEMP%\rjpx3d3w.cmdline
  • %TEMP%\wvrlw19r.out
  • %TEMP%\rjpx3d3w.out
  • %TEMP%\qllsgb0k.0.vb
  • %TEMP%\qllsgb0k.cmdline
  • %TEMP%\qllsgb0k.out
  • %TEMP%\vdblufj_.out
  • %TEMP%\vdblufj_.cmdline
  • %TEMP%\vdblufj_.0.vb
  • %TEMP%\kq_nb5rm.cmdline
  • %TEMP%\kq_nb5rm.0.vb
  • %TEMP%\kq_nb5rm.out
  • %TEMP%\pk2ndib7.0.vb
  • %TEMP%\pk2ndib7.out
  • %TEMP%\pk2ndib7.cmdline
  • %TEMP%\mbzm1kie.cmdline
  • %TEMP%\mbzm1kie.0.vb
  • %TEMP%\hxgkohpr.cmdline
  • %TEMP%\q2qg86xp.cmdline
  • %TEMP%\4ird4cfx.cmdline
  • %TEMP%\r-6l8w5s.cmdline
  • %TEMP%\poku4ztg.0.vb
  • %TEMP%\poku4ztg.cmdline
  • %TEMP%\poku4ztg.out
  • %TEMP%\hcg8hyyh.out
  • %TEMP%\hcg8hyyh.cmdline
  • %TEMP%\hcg8hyyh.0.vb
  • %TEMP%\azl7e8ee.0.vb
  • %TEMP%\azl7e8ee.cmdline
  • %TEMP%\azl7e8ee.out
  • %TEMP%\grlzztcm.cmdline
  • %TEMP%\grlzztcm.out
  • %TEMP%\grlzztcm.0.vb
  • %TEMP%\99ngqhdh.cmdline
  • %TEMP%\99ngqhdh.out
  • %TEMP%\kz3yd_nl.out
  • %TEMP%\99ngqhdh.0.vb
  • %TEMP%\zzzprfv3.cmdline
  • %TEMP%\zzzprfv3.out
  • %TEMP%\aaxyif-w.cmdline
  • %TEMP%\aaxyif-w.0.vb
  • %TEMP%\aaxyif-w.out
  • %TEMP%\dwrrun5s.0.vb
  • %TEMP%\dwrrun5s.out
  • %TEMP%\dwrrun5s.cmdline
  • %TEMP%\kp2em7bh.out
  • %TEMP%\kp2em7bh.cmdline
  • %TEMP%\kp2em7bh.0.vb
  • %TEMP%\2np6htew.cmdline
  • %TEMP%\2np6htew.out
  • %TEMP%\2np6htew.0.vb
  • %TEMP%\zzzprfv3.0.vb
  • %TEMP%\lqjaelsh.out
  • %TEMP%\ahyphxe0.0.vb
  • %TEMP%\fqbu5nqi.cmdline
  • %TEMP%\4ird4cfx.0.vb
  • %TEMP%\bhvcvypb.cmdline
  • %TEMP%\bhvcvypb.0.vb
  • %TEMP%\bhvcvypb.out
  • %TEMP%\uvatqqmd.0.vb
  • %TEMP%\uvatqqmd.cmdline
  • %TEMP%\uvatqqmd.out
  • %TEMP%\zlz08fcj.0.vb
  • %TEMP%\zlz08fcj.cmdline
  • %TEMP%\zlz08fcj.out
  • %TEMP%\2w-az77p.cmdline
  • %TEMP%\2w-az77p.out
  • %TEMP%\2w-az77p.0.vb
  • %TEMP%\lqjaelsh.cmdline
  • %TEMP%\9qorblz7.out
  • %TEMP%\lqjaelsh.0.vb
  • %TEMP%\gxtvfhgf.out
  • %TEMP%\gxtvfhgf.cmdline
  • %TEMP%\gxtvfhgf.0.vb
  • %TEMP%\2l--evtx.out
  • %TEMP%\2l--evtx.cmdline
  • %TEMP%\2l--evtx.0.vb
  • %TEMP%\f2u8faii.cmdline
  • %TEMP%\f2u8faii.0.vb
  • %TEMP%\f2u8faii.out
  • %TEMP%\f2sb53v1.0.vb
  • %TEMP%\f2sb53v1.out
  • %TEMP%\f2sb53v1.cmdline
  • %TEMP%\fqbu5nqi.out
  • %TEMP%\fqbu5nqi.0.vb
  • %TEMP%\kz3yd_nl.cmdline
  • %TEMP%\ccmg3l0p.out
  • %TEMP%\9qorblz7.cmdline
  • %TEMP%\2sog3a8y.out
  • %TEMP%\vxxj9vyf.0.vb
  • %TEMP%\jeb32jjq.cmdline
  • %TEMP%\jeb32jjq.0.vb
  • %TEMP%\jeb32jjq.out
  • %TEMP%\6tnd2ozf.0.vb
  • %TEMP%\6tnd2ozf.cmdline
  • %TEMP%\6tnd2ozf.out
  • %TEMP%\z5f24i93.out
  • %TEMP%\z5f24i93.0.vb
  • %TEMP%\z5f24i93.cmdline
  • %TEMP%\p-uujhn4.out
  • %TEMP%\p-uujhn4.cmdline
  • %TEMP%\p-uujhn4.0.vb
  • %TEMP%\olpsuuun.cmdline
  • %TEMP%\vxxj9vyf.cmdline
  • %TEMP%\olpsuuun.out
  • %TEMP%\n69fhrcn.0.vb
  • %TEMP%\n69fhrcn.cmdline
  • %TEMP%\n69fhrcn.out
  • %TEMP%\kq83zwlf.0.vb
  • %TEMP%\kq83zwlf.cmdline
  • %TEMP%\kq83zwlf.out
  • %TEMP%\suzi01-0.out
  • %TEMP%\suzi01-0.cmdline
  • %TEMP%\suzi01-0.0.vb
  • %TEMP%\woiqsekf.out
  • %TEMP%\woiqsekf.cmdline
  • %TEMP%\woiqsekf.0.vb
  • %TEMP%\r-6l8w5s.out
  • %TEMP%\r-6l8w5s.0.vb
  • %TEMP%\olpsuuun.0.vb
  • %TEMP%\ahyphxe0.out
  • %TEMP%\qq92bkw7.out
  • %TEMP%\2sog3a8y.0.vb
  • %TEMP%\qq92bkw7.cmdline
  • %TEMP%\qq92bkw7.0.vb
  • %TEMP%\zwcqela1.out
  • %TEMP%\zwcqela1.cmdline
  • %TEMP%\zwcqela1.0.vb
  • %TEMP%\nqsru7qq.out
  • %TEMP%\nqsru7qq.0.vb
  • %TEMP%\nqsru7qq.cmdline
  • %TEMP%\-tzqb-im.out
  • %TEMP%\-tzqb-im.0.vb
  • %TEMP%\-tzqb-im.cmdline
  • %TEMP%\zdd_gg96.0.vb
  • %TEMP%\zdd_gg96.out
  • %TEMP%\zdd_gg96.cmdline
  • %TEMP%\9qorblz7.0.vb
  • %TEMP%\q2qg86xp.0.vb
  • %TEMP%\q2qg86xp.out
  • %TEMP%\rgcbaxv3.out
  • %TEMP%\rgcbaxv3.cmdline
  • %TEMP%\rgcbaxv3.0.vb
  • %TEMP%\z5gr5q1a.0.vb
  • %TEMP%\z5gr5q1a.out
  • %TEMP%\z5gr5q1a.cmdline
  • %TEMP%\wvmr948t.out
  • %TEMP%\wvmr948t.cmdline
  • %TEMP%\wvmr948t.0.vb
  • %TEMP%\64azmb8m.cmdline
  • %TEMP%\64azmb8m.0.vb
  • %TEMP%\64azmb8m.out
  • %TEMP%\2sog3a8y.cmdline
  • %TEMP%\vxxj9vyf.out
  • %TEMP%\kz3yd_nl.0.vb
  • %TEMP%\ccmg3l0p.cmdline
  • %TEMP%\zoejb2lh.out
  • %TEMP%\yc9_tpix.cmdline
  • %TEMP%\yc9_tpix.out
  • %TEMP%\yc9_tpix.0.vb
  • %TEMP%\ghbfe_w4.0.vb
  • %TEMP%\ghbfe_w4.out
  • %TEMP%\ghbfe_w4.cmdline
  • %TEMP%\bw6uzors.out
  • %TEMP%\bw6uzors.cmdline
  • %TEMP%\bw6uzors.0.vb
  • %TEMP%\7gc8vyqi.0.vb
  • %TEMP%\7gc8vyqi.cmdline
  • %TEMP%\7gc8vyqi.out
  • %TEMP%\7ppqriqc.out
  • %TEMP%\7ppqriqc.0.vb
  • %TEMP%\j8ue1flq.0.vb
  • %TEMP%\7ppqriqc.cmdline
  • %TEMP%\v2y9ieww.out
  • %TEMP%\v2y9ieww.0.vb
  • %TEMP%\8ejsiivp.0.vb
  • %TEMP%\8ejsiivp.cmdline
  • %TEMP%\8ejsiivp.out
  • %TEMP%\hz9bwam3.cmdline
  • %TEMP%\hz9bwam3.out
  • %TEMP%\hz9bwam3.0.vb
  • %TEMP%\9tccxjp0.cmdline
  • %TEMP%\9tccxjp0.0.vb
  • %TEMP%\9tccxjp0.out
  • %TEMP%\oyhz9kpm.0.vb
  • %TEMP%\oyhz9kpm.out
  • %TEMP%\oyhz9kpm.cmdline
  • %TEMP%\v2y9ieww.cmdline
  • %TEMP%\8xvsjkv1.out
  • %TEMP%\m5yxekx1.out
  • %TEMP%\zjoihbpi.0.vb
  • %TEMP%\m5yxekx1.cmdline
  • %TEMP%\xah_len4.0.vb
  • %TEMP%\xah_len4.cmdline
  • %TEMP%\xah_len4.out
  • %TEMP%\wvpvajzv.cmdline
  • %TEMP%\wvpvajzv.0.vb
  • %TEMP%\wvpvajzv.out
  • %TEMP%\owt6nacp.0.vb
  • %TEMP%\owt6nacp.cmdline
  • %TEMP%\owt6nacp.out
  • %TEMP%\8nncihhh.cmdline
  • %TEMP%\8nncihhh.0.vb
  • %TEMP%\8nncihhh.out
  • %TEMP%\8xvsjkv1.0.vb
  • %TEMP%\xpf8ezm5.0.vb
  • %TEMP%\8xvsjkv1.cmdline
  • %TEMP%\ixqdubja.0.vb
  • %TEMP%\ixqdubja.out
  • %TEMP%\ixqdubja.cmdline
  • %TEMP%\gkudjyqc.0.vb
  • %TEMP%\gkudjyqc.cmdline
  • %TEMP%\gkudjyqc.out
  • %TEMP%\enbq7zvy.0.vb
  • %TEMP%\enbq7zvy.cmdline
  • %TEMP%\enbq7zvy.out
  • %TEMP%\3-g61mru.cmdline
  • %TEMP%\3-g61mru.out
  • %TEMP%\3-g61mru.0.vb
  • %TEMP%\zjoihbpi.cmdline
  • %TEMP%\zjoihbpi.out
  • %TEMP%\j8ue1flq.cmdline
  • %TEMP%\j8ue1flq.out
  • %TEMP%\xpf8ezm5.out
  • %TEMP%\c9h_fmjk.0.vb
  • %TEMP%\rxili9wk.cmdline
  • %TEMP%\5ahym7ao.cmdline
  • %TEMP%\5ahym7ao.out
  • %TEMP%\5ahym7ao.0.vb
  • %TEMP%\itirmjgd.0.vb
  • %TEMP%\itirmjgd.cmdline
  • %TEMP%\itirmjgd.out
  • %TEMP%\bxujftko.0.vb
  • %TEMP%\bxujftko.out
  • %TEMP%\bxujftko.cmdline
  • %TEMP%\nmnl-khe.0.vb
  • %TEMP%\nmnl-khe.cmdline
  • %TEMP%\nmnl-khe.out
  • %TEMP%\-yeazcox.out
  • %TEMP%\rxili9wk.0.vb
  • %TEMP%\-yeazcox.cmdline
  • %TEMP%\hpaintfd.0.vb
  • %TEMP%\hpaintfd.out
  • %TEMP%\hpaintfd.cmdline
  • %TEMP%\furwyymz.out
  • %TEMP%\furwyymz.0.vb
  • %TEMP%\furwyymz.cmdline
  • %TEMP%\xlwsvvqv.0.vb
  • %TEMP%\xlwsvvqv.out
  • %TEMP%\xlwsvvqv.cmdline
  • %TEMP%\e0ffrzfd.0.vb
  • %TEMP%\e0ffrzfd.out
  • %TEMP%\e0ffrzfd.cmdline
  • %TEMP%\aut873a.tmp
  • %TEMP%\aut870b.tmp
  • %TEMP%\-yeazcox.0.vb
  • %TEMP%\-sa9bfnb.out
  • %TEMP%\9niwon9k.0.vb
  • %TEMP%\c9h_fmjk.cmdline
  • %TEMP%\9niwon9k.out
  • %TEMP%\9niwon9k.cmdline
  • %TEMP%\z9wzbfhd.cmdline
  • %TEMP%\z9wzbfhd.0.vb
  • %TEMP%\z9wzbfhd.out
  • %TEMP%\9e3i575k.0.vb
  • %TEMP%\9e3i575k.out
  • %TEMP%\9e3i575k.cmdline
  • %TEMP%\wcn6hc1f.out
  • %TEMP%\wcn6hc1f.0.vb
  • %TEMP%\wcn6hc1f.cmdline
  • %TEMP%\desn0h0q.cmdline
  • %TEMP%\desn0h0q.out
  • %TEMP%\desn0h0q.0.vb
  • %TEMP%\xpf8ezm5.cmdline
  • %TEMP%\-sa9bfnb.0.vb
  • %TEMP%\-sa9bfnb.cmdline
  • %TEMP%\5de-qora.0.vb
  • %TEMP%\5de-qora.cmdline
  • %TEMP%\5de-qora.out
  • %TEMP%\jrnfl0xf.cmdline
  • %TEMP%\jrnfl0xf.out
  • %TEMP%\jrnfl0xf.0.vb
  • %TEMP%\nbstqs_x.cmdline
  • %TEMP%\nbstqs_x.out
  • %TEMP%\nbstqs_x.0.vb
  • %TEMP%\e-z4hlwm.0.vb
  • %TEMP%\e-z4hlwm.cmdline
  • %TEMP%\e-z4hlwm.out
  • %TEMP%\c9h_fmjk.out
  • %TEMP%\rxili9wk.out
  • %TEMP%\x94qnymd.cmdline
  • %TEMP%\zdqfn6qy.cmdline
  • %TEMP%\3mji5d5e.cmdline
  • %TEMP%\s8rc3glf.cmdline
  • %TEMP%\maicnvrx.cmdline
  • %TEMP%\maicnvrx.out
  • %TEMP%\maicnvrx.0.vb
  • %TEMP%\zq4phj0j.0.vb
  • %TEMP%\zq4phj0j.out
  • %TEMP%\zq4phj0j.cmdline
  • %TEMP%\f0egmhrt.cmdline
  • %TEMP%\f0egmhrt.out
  • %TEMP%\f0egmhrt.0.vb
  • %TEMP%\iyuk9zgv.cmdline
  • %TEMP%\iyuk9zgv.out
  • %TEMP%\iyuk9zgv.0.vb
  • %TEMP%\en-v_moa.cmdline
  • %TEMP%\s8rc3glf.0.vb
  • %TEMP%\en-v_moa.out
  • %TEMP%\uod9l3co.out
  • %TEMP%\uod9l3co.0.vb
  • %TEMP%\uod9l3co.cmdline
  • %TEMP%\zn6bv1uk.out
  • %TEMP%\zn6bv1uk.0.vb
  • %TEMP%\zn6bv1uk.cmdline
  • %TEMP%\xkut3wlv.out
  • %TEMP%\xkut3wlv.0.vb
  • %TEMP%\xkut3wlv.cmdline
  • %TEMP%\k3mkovlx.out
  • %TEMP%\k3mkovlx.0.vb
  • %TEMP%\k3mkovlx.cmdline
  • %TEMP%\wux-ylj_.cmdline
  • %TEMP%\wux-ylj_.0.vb
  • %TEMP%\en-v_moa.0.vb
  • %TEMP%\dtk2hxkm.0.vb
  • %TEMP%\3mji5d5e.out
  • %TEMP%\zoejb2lh.0.vb
  • %TEMP%\zdqfn6qy.0.vb
  • %TEMP%\zdqfn6qy.out
  • %TEMP%\r-7gkarm.cmdline
  • %TEMP%\r-7gkarm.out
  • %TEMP%\r-7gkarm.0.vb
  • %TEMP%\pwnrazz-.0.vb
  • %TEMP%\pwnrazz-.out
  • %TEMP%\pwnrazz-.cmdline
  • %TEMP%\g8oweg1h.0.vb
  • %TEMP%\g8oweg1h.out
  • %TEMP%\g8oweg1h.cmdline
  • %TEMP%\2wyb1z-8.0.vb
  • %TEMP%\2wyb1z-8.cmdline
  • %TEMP%\2wyb1z-8.out
  • %TEMP%\wux-ylj_.out
  • %TEMP%\dtk2hxkm.cmdline
  • %TEMP%\dtk2hxkm.out
  • %TEMP%\tjs6lpix.0.vb
  • %TEMP%\tjs6lpix.out
  • %TEMP%\tjs6lpix.cmdline
  • %TEMP%\abngrz4h.cmdline
  • %TEMP%\abngrz4h.0.vb
  • %TEMP%\abngrz4h.out
  • %TEMP%\bzzypbnr.0.vb
  • %TEMP%\bzzypbnr.cmdline
  • %TEMP%\bzzypbnr.out
  • %TEMP%\_rl3bqkz.cmdline
  • %TEMP%\_rl3bqkz.out
  • %TEMP%\_rl3bqkz.0.vb
  • %TEMP%\zoejb2lh.cmdline
  • %TEMP%\s8rc3glf.out
  • %TEMP%\ccmg3l0p.0.vb
  • %TEMP%\llhu1eln.cmdline
  • %TEMP%\xozt4tlq.out
  • %TEMP%\rxsbkczd.cmdline
  • %TEMP%\rxsbkczd.0.vb
  • %TEMP%\hqknxog-.0.vb
  • %TEMP%\hqknxog-.cmdline
  • %TEMP%\hqknxog-.out
  • %TEMP%\eulq39hn.out
  • %TEMP%\eulq39hn.0.vb
  • %TEMP%\eulq39hn.cmdline
  • %TEMP%\avguoh9j.out
  • %TEMP%\avguoh9j.0.vb
  • %TEMP%\avguoh9j.cmdline
  • %TEMP%\czwizwax.out
  • %TEMP%\czwizwax.0.vb
  • %TEMP%\czwizwax.cmdline
  • %TEMP%\rxsbkczd.out
  • %TEMP%\kn2e1zm1.0.vb
  • %TEMP%\kn2e1zm1.out
  • %TEMP%\pa2o6ys5.out
  • %TEMP%\pa2o6ys5.0.vb
  • %TEMP%\pa2o6ys5.cmdline
  • %TEMP%\114emtli.cmdline
  • %TEMP%\114emtli.out
  • %TEMP%\114emtli.0.vb
  • %TEMP%\njpftdpb.cmdline
  • %TEMP%\njpftdpb.0.vb
  • %TEMP%\njpftdpb.out
  • %TEMP%\dkzazl4n.0.vb
  • %TEMP%\dkzazl4n.out
  • %TEMP%\dkzazl4n.cmdline
  • %TEMP%\3mji5d5e.0.vb
  • %TEMP%\kn2e1zm1.cmdline
  • %TEMP%\m5yxekx1.0.vb
  • %TEMP%\llhu1eln.out
  • %TEMP%\xozt4tlq.0.vb
  • %TEMP%\e1k9oaq8.cmdline
  • %TEMP%\e1k9oaq8.out
  • %TEMP%\e1k9oaq8.0.vb
  • %TEMP%\7wueyflk.0.vb
  • %TEMP%\7wueyflk.cmdline
  • %TEMP%\7wueyflk.out
  • %TEMP%\re3xf2jp.0.vb
  • %TEMP%\re3xf2jp.cmdline
  • %TEMP%\re3xf2jp.out
  • %TEMP%\asaltb8a.out
  • %TEMP%\asaltb8a.cmdline
  • %TEMP%\asaltb8a.0.vb
  • %TEMP%\vhxexhpa.0.vb
  • %TEMP%\vhxexhpa.cmdline
  • %TEMP%\llhu1eln.0.vb
  • %TEMP%\vhxexhpa.out
  • %TEMP%\x94qnymd.0.vb
  • %TEMP%\x94qnymd.out
  • %TEMP%\grna1kyf.out
  • %TEMP%\grna1kyf.cmdline
  • %TEMP%\grna1kyf.0.vb
  • %TEMP%\-byymgzl.0.vb
  • %TEMP%\-byymgzl.out
  • %TEMP%\-byymgzl.cmdline
  • %TEMP%\ijyh65p-.cmdline
  • %TEMP%\ijyh65p-.out
  • %TEMP%\ijyh65p-.0.vb
  • %TEMP%\jfvr6r45.cmdline
  • %TEMP%\jfvr6r45.0.vb
  • %TEMP%\jfvr6r45.out
  • %TEMP%\xozt4tlq.cmdline
  • %TEMP%\4ird4cfx.out
Moves the following files
  • from %TEMP%\$lokalsysВ§temp\keygeninf.exe to %TEMP%\tmpg588.tmp
Network activity
Connects to
  • 'wa####st.zapto.org':7777
UDP
  • DNS ASK wa####st.zapto.org
Miscellaneous
Creates and executes the following
  • '%TEMP%\$lokalsysВ§temp\clonedvdkeyen.exe'
  • '%TEMP%\$lokalsysВ§temp\keygeninf.exe'
  • '%APPDATA%\svchost.bat'
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zvb7clco.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qko16l8a.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\swmeayys.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\q2fxuy4s.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uzqqraqx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kuuuwsjg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\q_s5wamf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\oo0e7epj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\v2tqskn4.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qhdl6a-v.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nr28mper.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nxdca8gd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5i4gv8zp.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vf54hqml.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\e06xypvb.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\poku4ztg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jlarp7xg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pzcezaba.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cu5qsa0e.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\opttlikg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gasazwp1.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ucu2xq3k.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\osldic7y.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4ny5zcxs.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\reqrtrcv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uhxwwhuq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nekx9gu2.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\j1o2ldob.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2inrkgbk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zd-hc2jo.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7tyftv_w.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yj9n-pq-.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ju127jv7.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\znz2wzdy.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uk5lllp6.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\srurh_og.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ihtza2cx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9qorblz7.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\99ngqhdh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zzzprfv3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\aaxyif-w.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dwrrun5s.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kp2em7bh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2np6htew.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qq92bkw7.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\azl7e8ee.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zwcqela1.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nqsru7qq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-tzqb-im.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zdd_gg96.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\q2qg86xp.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rgcbaxv3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\recen-ud.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\oybkwudf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hcg8hyyh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fqbu5nqi.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\grlzztcm.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kbg6xssu.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3ct7ywsr.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nw4bzghm.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ub0tlqps.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4ird4cfx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bhvcvypb.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uvatqqmd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zlz08fcj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2w-az77p.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lqjaelsh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gxtvfhgf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2l--evtx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\f2u8faii.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\f2sb53v1.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kz3yd_nl.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fx-_wawq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\z5gr5q1a.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7zcbb0g4.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qejthqqs.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ry_12ml-.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ekfsw4te.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\431bnubu.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tmxve46_.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\inmsp9sq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qftpghkh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kfcusw5a.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mnbwbjry.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cmpa0wzk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bwwz_3j8.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\scur5zcm.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tvej9d4f.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mapfexvd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2-0en282.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9wpnl-xv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lxdahvvd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kfs6b5t5.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3caqnh-o.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rrdj3d3a.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\y49jcl36.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fiqivlwy.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dr6whdle.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5ibs4-dc.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dstjamfi.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kjlwjlir.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ufeyv2vw.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\a4bbi7rv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\db5ljp7s.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ck6zmm4p.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\t1mu222v.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yd_hsnok.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_qkorbqm.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tafk0n_i.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4m09a_uw.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dwnucz07.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4q7isbqy.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ym9-7suj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\knjfcqo6.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fp-spwvd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nnlmrcjj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mxsvu-ps.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mizpwepo.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ghcikal_.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bk6oiq-_.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5shop8h6.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\b974e4uo.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rpo_jcue.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\h7-g7psv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3zqoncs7.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\97zsngjg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uif9sfbn.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ox6svz9m.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5py-unwp.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5kdhyduz.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yuor2uc-.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nbdaqbfy.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\er30ariy.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7meqet5j.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lxxp31xk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vhxd4n0p.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5gxforlx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sbgjgd16.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ahitzwpj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\i7scyxco.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ksmrqrvx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\oqktp3sc.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\aixbeobx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fktufczg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cuplynkf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tenx74dl.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wzli3iio.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bbsfxdpl.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wvmr948t.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\64azmb8m.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\b68_q7qb.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\czwizwax.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kn2e1zm1.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pa2o6ys5.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\114emtli.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\njpftdpb.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dkzazl4n.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\eulq39hn.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\avguoh9j.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xah_len4.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wvpvajzv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\owt6nacp.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8nncihhh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8xvsjkv1.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ixqdubja.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3mji5d5e.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3-g61mru.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hqknxog-.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xkut3wlv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\k3mkovlx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wux-ylj_.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\llhu1eln.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\e1k9oaq8.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7wueyflk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\re3xf2jp.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\asaltb8a.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vhxexhpa.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\x94qnymd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\grna1kyf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-byymgzl.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ijyh65p-.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jfvr6r45.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xozt4tlq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gkudjyqc.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\m5yxekx1.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\desn0h0q.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\enbq7zvy.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zjoihbpi.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5de-qora.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nbstqs_x.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\e-z4hlwm.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\c9h_fmjk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rxili9wk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5ahym7ao.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\itirmjgd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bxujftko.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nmnl-khe.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-yeazcox.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hpaintfd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\furwyymz.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xlwsvvqv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\e0ffrzfd.cmdline"' (with hidden window)
  • '%APPDATA%\svchost.bat' ' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zn6bv1uk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rxsbkczd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wcn6hc1f.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9e3i575k.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-sa9bfnb.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\j8ue1flq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yc9_tpix.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ghbfe_w4.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bw6uzors.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7gc8vyqi.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7ppqriqc.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\v2y9ieww.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8ejsiivp.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hz9bwam3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9tccxjp0.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\oyhz9kpm.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xpf8ezm5.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9niwon9k.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\z9wzbfhd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jrnfl0xf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uod9l3co.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\iyuk9zgv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2sog3a8y.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yda4cq9g.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\trxicp5f.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\aba0addy.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ru7g0b3t.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fbdmjrhz.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\o5jlkqnv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zmhr2snj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\o5wwpxdj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\b3cy15lt.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wxk4fnxw.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hd8-hei7.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ln6ejbyi.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\aq-a43-a.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\acibtlif.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bislv241.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\986c2hmf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\soetnsio.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\alttfnkd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-5zsaxg6.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vxxj9vyf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jeb32jjq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6tnd2ozf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\z5f24i93.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\p-uujhn4.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\olpsuuun.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\n69fhrcn.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kq83zwlf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\suzi01-0.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\woiqsekf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\r-6l8w5s.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ahyphxe0.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zqptu1l9.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ginfubau.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5_ymx8ee.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wvrlw19r.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rkss-dm5.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5tdbhwm4.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uk0v6zj6.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zdqfn6qy.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\r-7gkarm.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pwnrazz-.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\g8oweg1h.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2wyb1z-8.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dtk2hxkm.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tjs6lpix.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\abngrz4h.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bzzypbnr.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_rl3bqkz.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zoejb2lh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\s8rc3glf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\maicnvrx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zq4phj0j.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\f0egmhrt.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ccmg3l0p.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\en-v_moa.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\v6_nzjpv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mnbax_nk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\brb6w1su.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rjpx3d3w.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qllsgb0k.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vdblufj_.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kq_nb5rm.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pk2ndib7.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mbzm1kie.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hxgkohpr.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\psgxyoql.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mpogqxmc.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ccg4117k.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\grztbthp.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bz00z67v.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8dzppvaa.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xyr1xv3a.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5eygv6bp.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\njx7t7iv.cmdline"' (with hidden window)
Executes the following
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\e0ffrzfd.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pzcezaba.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zvb7clco.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qko16l8a.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\swmeayys.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\q2fxuy4s.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uzqqraqx.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ju127jv7.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\e06xypvb.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\oo0e7epj.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\v2tqskn4.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qhdl6a-v.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nr28mper.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nxdca8gd.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5i4gv8zp.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kuuuwsjg.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kz3yd_nl.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\znz2wzdy.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\srurh_og.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jlarp7xg.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cu5qsa0e.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\opttlikg.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gasazwp1.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ucu2xq3k.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\osldic7y.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4ny5zcxs.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\reqrtrcv.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uhxwwhuq.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nekx9gu2.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\j1o2ldob.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2inrkgbk.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zd-hc2jo.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7tyftv_w.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vf54hqml.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\q_s5wamf.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ihtza2cx.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uk5lllp6.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\recen-ud.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2np6htew.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\grlzztcm.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\99ngqhdh.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zzzprfv3.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\aaxyif-w.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dwrrun5s.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kp2em7bh.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9qorblz7.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hcg8hyyh.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qq92bkw7.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zwcqela1.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nqsru7qq.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-tzqb-im.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zdd_gg96.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\q2qg86xp.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fx-_wawq.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yj9n-pq-.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\poku4ztg.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\f2sb53v1.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\azl7e8ee.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\oybkwudf.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kbg6xssu.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3ct7ywsr.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nw4bzghm.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ub0tlqps.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4ird4cfx.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bhvcvypb.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uvatqqmd.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zlz08fcj.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2w-az77p.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lqjaelsh.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gxtvfhgf.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2l--evtx.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\f2u8faii.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fqbu5nqi.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nbdaqbfy.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\alttfnkd.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ox6svz9m.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qejthqqs.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ry_12ml-.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ekfsw4te.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\431bnubu.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tmxve46_.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\inmsp9sq.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rkss-dm5.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9wpnl-xv.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mnbwbjry.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cmpa0wzk.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bwwz_3j8.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\scur5zcm.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tvej9d4f.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mapfexvd.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qftpghkh.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kfs6b5t5.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lxdahvvd.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rrdj3d3a.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\y49jcl36.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fiqivlwy.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dr6whdle.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5ibs4-dc.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dstjamfi.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kjlwjlir.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ufeyv2vw.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\a4bbi7rv.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\db5ljp7s.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ck6zmm4p.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\t1mu222v.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yd_hsnok.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_qkorbqm.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tafk0n_i.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2-0en282.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kfcusw5a.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4m09a_uw.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4q7isbqy.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bbsfxdpl.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bk6oiq-_.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\knjfcqo6.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fp-spwvd.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nnlmrcjj.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mxsvu-ps.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mizpwepo.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ghcikal_.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5shop8h6.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ym9-7suj.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\b974e4uo.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rpo_jcue.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\h7-g7psv.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3zqoncs7.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\97zsngjg.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uif9sfbn.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dwnucz07.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rgcbaxv3.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7zcbb0g4.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tenx74dl.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5py-unwp.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yuor2uc-.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\er30ariy.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7meqet5j.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lxxp31xk.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vhxd4n0p.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5gxforlx.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sbgjgd16.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ahitzwpj.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\i7scyxco.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ksmrqrvx.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\oqktp3sc.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\aixbeobx.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fktufczg.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cuplynkf.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wzli3iio.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3caqnh-o.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\z5gr5q1a.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5_ymx8ee.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\eulq39hn.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\avguoh9j.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\czwizwax.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kn2e1zm1.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pa2o6ys5.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\114emtli.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rxsbkczd.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hqknxog-.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3mji5d5e.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\m5yxekx1.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xah_len4.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wvpvajzv.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\owt6nacp.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8nncihhh.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\njpftdpb.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9e3i575k.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xozt4tlq.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uod9l3co.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zn6bv1uk.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xkut3wlv.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\k3mkovlx.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wux-ylj_.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\llhu1eln.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\e1k9oaq8.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7wueyflk.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\re3xf2jp.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\asaltb8a.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vhxexhpa.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\x94qnymd.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\grna1kyf.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-byymgzl.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ijyh65p-.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8xvsjkv1.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dkzazl4n.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ixqdubja.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gkudjyqc.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\enbq7zvy.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5ahym7ao.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5de-qora.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jrnfl0xf.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nbstqs_x.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\e-z4hlwm.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\c9h_fmjk.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rxili9wk.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\itirmjgd.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\desn0h0q.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bxujftko.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nmnl-khe.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-yeazcox.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hpaintfd.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\furwyymz.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xlwsvvqv.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\en-v_moa.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jfvr6r45.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wcn6hc1f.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9niwon9k.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-sa9bfnb.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3-g61mru.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zjoihbpi.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\j8ue1flq.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yc9_tpix.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ghbfe_w4.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bw6uzors.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7gc8vyqi.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7ppqriqc.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\v2y9ieww.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8ejsiivp.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hz9bwam3.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9tccxjp0.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\oyhz9kpm.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xpf8ezm5.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\z9wzbfhd.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xyr1xv3a.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\64azmb8m.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zq4phj0j.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\986c2hmf.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yda4cq9g.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\trxicp5f.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\aba0addy.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ru7g0b3t.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fbdmjrhz.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\soetnsio.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\b68_q7qb.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\o5wwpxdj.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\b3cy15lt.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wxk4fnxw.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hd8-hei7.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ln6ejbyi.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\aq-a43-a.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\o5jlkqnv.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\iyuk9zgv.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-5zsaxg6.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2sog3a8y.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vxxj9vyf.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jeb32jjq.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6tnd2ozf.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\z5f24i93.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\p-uujhn4.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\olpsuuun.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\n69fhrcn.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kq83zwlf.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\suzi01-0.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\woiqsekf.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\r-6l8w5s.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ahyphxe0.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zqptu1l9.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ginfubau.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\acibtlif.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zmhr2snj.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bislv241.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wvrlw19r.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5tdbhwm4.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dtk2hxkm.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ccmg3l0p.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zdqfn6qy.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\r-7gkarm.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pwnrazz-.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\g8oweg1h.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2wyb1z-8.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tjs6lpix.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5kdhyduz.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\abngrz4h.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bzzypbnr.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_rl3bqkz.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zoejb2lh.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\s8rc3glf.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\maicnvrx.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\f0egmhrt.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wvmr948t.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mnbax_nk.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bz00z67v.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uk0v6zj6.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5eygv6bp.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\v6_nzjpv.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\brb6w1su.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rjpx3d3w.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qllsgb0k.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vdblufj_.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kq_nb5rm.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pk2ndib7.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mbzm1kie.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hxgkohpr.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\psgxyoql.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mpogqxmc.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ccg4117k.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\grztbthp.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8dzppvaa.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\njx7t7iv.cmdline"

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

The Russian developer of Dr.Web anti-viruses
Doctor Web has been developing anti-virus software since 1992
Dr.Web is trusted by users around the world in 200+ countries
The company has delivered an anti-virus as a service since 2007
24/7 tech support

Dr.Web © Doctor Web
2003 — 2021

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125124