Підтримка
Цілодобова підтримка | Правила звернення

Зателефонуйте

Глобальна підтримка:
+7 (495) 789-45-86

Поширені запитання |  Форум |  Бот самопідтримки Telegram

Ваші запити

  • Всі: -
  • Незакриті: -
  • Останій: -

Зателефонуйте

Глобальна підтримка:
+7 (495) 789-45-86

Зв'яжіться з нами Незакриті запити: 

Профіль

Профіль

Trojan.MulDrop9.36501

Добавлен в вирусную базу Dr.Web: 2019-07-27

Описание добавлено:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN] 'Java Update Center' = '%TEMP%\Svchost.bat'
  • [<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN] 'Java Update Center' = '%TEMP%\Svchost.bat'
Modifies file system
Creates the following files
  • %TEMP%\svchost.bat
  • %TEMP%\d9cplva4.0.vb
  • %TEMP%\d9cplva4.cmdline
  • %TEMP%\d9cplva4.out
  • %TEMP%\ul_bip3g.0.vb
  • %TEMP%\ul_bip3g.cmdline
  • %TEMP%\ul_bip3g.out
  • %TEMP%\iqkiygvq.0.vb
  • %TEMP%\iqkiygvq.cmdline
  • %TEMP%\iqkiygvq.out
  • %TEMP%\5kgw_gwr.0.vb
  • %TEMP%\5kgw_gwr.cmdline
  • %TEMP%\5kgw_gwr.out
  • %TEMP%\yzoefkmk.0.vb
  • %TEMP%\yzoefkmk.cmdline
  • %TEMP%\yzoefkmk.out
  • %TEMP%\eecjdsab.0.vb
  • %TEMP%\eecjdsab.cmdline
  • %TEMP%\eecjdsab.out
  • %TEMP%\uau74djt.0.vb
  • %TEMP%\exds2tvf.out
  • %TEMP%\l4dgytjn.out
  • %TEMP%\exds2tvf.cmdline
  • %TEMP%\65rtc9-3.out
  • %TEMP%\0v33sibj.cmdline
  • %TEMP%\0v33sibj.out
  • %TEMP%\l2k3cpun.0.vb
  • %TEMP%\l2k3cpun.cmdline
  • %TEMP%\l2k3cpun.out
  • %TEMP%\ucv3q0du.0.vb
  • %TEMP%\ucv3q0du.cmdline
  • %TEMP%\ucv3q0du.out
  • %TEMP%\rrb059lb.0.vb
  • %TEMP%\rrb059lb.cmdline
  • %TEMP%\rrb059lb.out
  • %TEMP%\0m8uftth.0.vb
  • %TEMP%\0m8uftth.cmdline
  • %TEMP%\0m8uftth.out
  • %TEMP%\hvrz9mai.0.vb
  • %TEMP%\hvrz9mai.cmdline
  • %TEMP%\hvrz9mai.out
  • %TEMP%\65rtc9-3.0.vb
  • %TEMP%\65rtc9-3.cmdline
  • %TEMP%\exds2tvf.0.vb
  • %TEMP%\0v33sibj.0.vb
  • %TEMP%\uau74djt.cmdline
  • %TEMP%\7u_sr_ih.out
  • %TEMP%\k3_-nn3_.cmdline
  • %TEMP%\k3_-nn3_.out
  • %TEMP%\gaqy4mdv.0.vb
  • %TEMP%\gaqy4mdv.cmdline
  • %TEMP%\gaqy4mdv.out
  • %TEMP%\mokyxxoy.0.vb
  • %TEMP%\mokyxxoy.cmdline
  • %TEMP%\mokyxxoy.out
  • %TEMP%\l4dgytjn.0.vb
  • %TEMP%\n5lt_y29.0.vb
  • %TEMP%\n5lt_y29.out
  • %TEMP%\ol0cvzqd.0.vb
  • %TEMP%\ol0cvzqd.cmdline
  • %TEMP%\ol0cvzqd.out
  • %TEMP%\7zogzdwj.0.vb
  • %TEMP%\7zogzdwj.cmdline
  • %TEMP%\7zogzdwj.out
  • %TEMP%\f5a9neru.0.vb
  • %TEMP%\qpzawkam.out
  • %TEMP%\k3_-nn3_.0.vb
  • %TEMP%\7u_sr_ih.0.vb
  • %TEMP%\uau74djt.out
  • %TEMP%\n82ff1og.out
  • %TEMP%\fac1apnq.0.vb
  • %TEMP%\fac1apnq.cmdline
  • %TEMP%\fac1apnq.out
  • %TEMP%\idwaygu4.0.vb
  • %TEMP%\idwaygu4.cmdline
  • %TEMP%\idwaygu4.out
  • %TEMP%\cdcmlmcf.0.vb
  • %TEMP%\cdcmlmcf.cmdline
  • %TEMP%\cdcmlmcf.out
  • %TEMP%\ss2w_aio.0.vb
  • %TEMP%\ss2w_aio.cmdline
  • %TEMP%\ss2w_aio.out
  • %TEMP%\fuylyjrc.0.vb
  • %TEMP%\fuylyjrc.cmdline
  • %TEMP%\fuylyjrc.out
  • %TEMP%\n82ff1og.0.vb
  • %TEMP%\n82ff1og.cmdline
  • %TEMP%\qpzawkam.0.vb
  • %TEMP%\7u_sr_ih.cmdline
  • %TEMP%\qpzawkam.cmdline
  • %TEMP%\l4dgytjn.cmdline
  • %TEMP%\qe_qu9jj.out
  • %TEMP%\f5a9neru.out
  • %TEMP%\-8jszjhk.cmdline
  • %TEMP%\-8jszjhk.out
  • %TEMP%\mhrndqg9.0.vb
  • %TEMP%\mhrndqg9.cmdline
  • %TEMP%\mhrndqg9.out
  • %TEMP%\yzznd-g_.0.vb
  • %TEMP%\yzznd-g_.cmdline
  • %TEMP%\yzznd-g_.out
  • %TEMP%\rrrksnty.0.vb
  • %TEMP%\rrrksnty.cmdline
  • %TEMP%\rrrksnty.out
  • %TEMP%\gmbfzfvh.0.vb
  • %TEMP%\gmbfzfvh.cmdline
  • %TEMP%\gmbfzfvh.out
  • %TEMP%\ndhumc7d.0.vb
  • %TEMP%\ndhumc7d.cmdline
  • %TEMP%\ndhumc7d.out
  • %TEMP%\ttqre0n5.cmdline
  • %TEMP%\ttqre0n5.0.vb
  • %TEMP%\-8jszjhk.0.vb
  • %TEMP%\jvcipmte.out
  • %TEMP%\jvcipmte.0.vb
  • %TEMP%\jvcipmte.cmdline
  • %TEMP%\l-wbh_fw.out
  • %TEMP%\gjt_fx8r.0.vb
  • %TEMP%\gjt_fx8r.cmdline
  • %TEMP%\gjt_fx8r.out
  • %TEMP%\q-whn_ln.0.vb
  • %TEMP%\q-whn_ln.cmdline
  • %TEMP%\q-whn_ln.out
  • %TEMP%\vwfyhr20.0.vb
  • %TEMP%\vwfyhr20.cmdline
  • %TEMP%\vwfyhr20.out
  • %TEMP%\4qi5-spk.0.vb
  • %TEMP%\4qi5-spk.cmdline
  • %TEMP%\4qi5-spk.out
  • %TEMP%\9dfpd_fc.0.vb
  • %TEMP%\9dfpd_fc.cmdline
  • %TEMP%\9dfpd_fc.out
  • %TEMP%\zzqgqqfv.0.vb
  • %TEMP%\zzqgqqfv.out
  • %TEMP%\l-wbh_fw.0.vb
  • %TEMP%\zzqgqqfv.cmdline
  • %TEMP%\pr1tsdkk.0.vb
  • %TEMP%\q-itzovx.cmdline
  • %TEMP%\vphaysdq.0.vb
  • %TEMP%\kba1iqi6.cmdline
  • %TEMP%\kba1iqi6.out
  • %TEMP%\ntgm2thn.0.vb
  • %TEMP%\ntgm2thn.cmdline
  • %TEMP%\ntgm2thn.out
  • %TEMP%\sy9rzxok.0.vb
  • %TEMP%\sy9rzxok.cmdline
  • %TEMP%\ttqre0n5.out
  • %TEMP%\sy9rzxok.out
  • %TEMP%\heqpuvc9.cmdline
  • %TEMP%\heqpuvc9.out
  • %TEMP%\indcyp2r.0.vb
  • %TEMP%\indcyp2r.cmdline
  • %TEMP%\indcyp2r.out
  • %TEMP%\qe_qu9jj.0.vb
  • %TEMP%\qe_qu9jj.cmdline
  • %TEMP%\q-itzovx.0.vb
  • %TEMP%\ludhsmvg.out
  • %TEMP%\heqpuvc9.0.vb
  • %TEMP%\kba1iqi6.0.vb
  • %TEMP%\q-itzovx.out
  • %TEMP%\ludhsmvg.cmdline
  • %TEMP%\ludhsmvg.0.vb
  • %TEMP%\vphaysdq.cmdline
  • %TEMP%\vphaysdq.out
  • %TEMP%\aenod4_m.0.vb
  • %TEMP%\aenod4_m.cmdline
  • %TEMP%\aenod4_m.out
  • %TEMP%\7ubfmqhp.0.vb
  • %TEMP%\f5a9neru.cmdline
  • %TEMP%\7ubfmqhp.cmdline
  • %TEMP%\3ykkqwfv.0.vb
  • %TEMP%\n5lt_y29.cmdline
  • %TEMP%\3ykkqwfv.cmdline
  • %TEMP%\gs6cxvnp.0.vb
  • %TEMP%\gs6cxvnp.cmdline
  • %TEMP%\gs6cxvnp.out
  • %TEMP%\kf1nrxk_.0.vb
  • %TEMP%\kf1nrxk_.cmdline
  • %TEMP%\kf1nrxk_.out
  • %TEMP%\7ubfmqhp.out
  • %TEMP%\pr1tsdkk.out
  • %TEMP%\pr1tsdkk.cmdline
  • %TEMP%\3ykkqwfv.out
  • %TEMP%\oyenfjil.out
  • %TEMP%\x-lvklco.0.vb
  • %TEMP%\65xiakg6.cmdline
  • %TEMP%\65xiakg6.out
  • %TEMP%\r_epowcf.0.vb
  • %TEMP%\r_epowcf.cmdline
  • %TEMP%\r_epowcf.out
  • %TEMP%\plt57gix.0.vb
  • %TEMP%\plt57gix.cmdline
  • %TEMP%\plt57gix.out
  • %TEMP%\ftekd5cb.0.vb
  • %TEMP%\ftekd5cb.cmdline
  • %TEMP%\ftekd5cb.out
  • %TEMP%\v3b5k5zs.0.vb
  • %TEMP%\v3b5k5zs.cmdline
  • %TEMP%\v3b5k5zs.out
  • %TEMP%\hyv0egyw.0.vb
  • %TEMP%\hyv0egyw.cmdline
  • %TEMP%\hyv0egyw.out
  • %TEMP%\c4jokujp.0.vb
  • %TEMP%\c4jokujp.cmdline
  • %TEMP%\65xiakg6.0.vb
  • %TEMP%\c4jokujp.out
  • %TEMP%\dzveu7yk.out
  • %TEMP%\dzveu7yk.0.vb
  • %TEMP%\enwqkbuj.out
  • %TEMP%\8xn4qkmu.0.vb
  • %TEMP%\8xn4qkmu.cmdline
  • %TEMP%\8xn4qkmu.out
  • %TEMP%\2r67uefr.0.vb
  • %TEMP%\2r67uefr.cmdline
  • %TEMP%\2r67uefr.out
  • %TEMP%\ftztnvly.0.vb
  • %TEMP%\ftztnvly.cmdline
  • %TEMP%\ftztnvly.out
  • %TEMP%\31ohrykn.0.vb
  • %TEMP%\31ohrykn.cmdline
  • %TEMP%\31ohrykn.out
  • %TEMP%\i2_6trcl.0.vb
  • %TEMP%\i2_6trcl.cmdline
  • %TEMP%\i2_6trcl.out
  • %TEMP%\_f7y9nt3.0.vb
  • %TEMP%\_f7y9nt3.cmdline
  • %TEMP%\_f7y9nt3.out
  • %TEMP%\dzveu7yk.cmdline
  • %TEMP%\t1qpo8de.0.vb
  • %TEMP%\t1qpo8de.cmdline
  • %TEMP%\t1qpo8de.out
  • %TEMP%\4xmvcdee.0.vb
  • %TEMP%\4xmvcdee.out
  • %TEMP%\kigrm-id.0.vb
  • %TEMP%\kigrm-id.cmdline
  • %TEMP%\kigrm-id.out
  • %TEMP%\ft3zkb6n.0.vb
  • %TEMP%\ft3zkb6n.cmdline
  • %TEMP%\ft3zkb6n.out
  • %TEMP%\tp5n78ug.0.vb
  • %TEMP%\enwqkbuj.0.vb
  • %TEMP%\tp5n78ug.cmdline
  • %TEMP%\uh56xxb9.0.vb
  • %TEMP%\uh56xxb9.cmdline
  • %TEMP%\uh56xxb9.out
  • %TEMP%\mgpiridx.0.vb
  • %TEMP%\mgpiridx.cmdline
  • %TEMP%\mgpiridx.out
  • %TEMP%\8cyhgln9.0.vb
  • %TEMP%\mvbowkmh.out
  • %TEMP%\mvbowkmh.cmdline
  • %TEMP%\4xmvcdee.cmdline
  • %TEMP%\mvbowkmh.0.vb
  • %TEMP%\mr5nvlgr.out
  • %TEMP%\nxyhy710.0.vb
  • %TEMP%\nxyhy710.out
  • %TEMP%\wlifbfe-.0.vb
  • %TEMP%\wlifbfe-.cmdline
  • %TEMP%\wlifbfe-.out
  • %TEMP%\qekq92cu.0.vb
  • %TEMP%\qekq92cu.cmdline
  • %TEMP%\qekq92cu.out
  • %TEMP%\enwqkbuj.cmdline
  • %TEMP%\kntbcosu.0.vb
  • %TEMP%\yd3ltrka.out
  • %TEMP%\kntbcosu.out
  • %TEMP%\sbs6xvbn.cmdline
  • %TEMP%\sbs6xvbn.out
  • %TEMP%\seqtuirc.0.vb
  • %TEMP%\seqtuirc.cmdline
  • %TEMP%\seqtuirc.out
  • %TEMP%\mr5nvlgr.0.vb
  • %TEMP%\mr5nvlgr.cmdline
  • %TEMP%\kntbcosu.cmdline
  • %TEMP%\nxyhy710.cmdline
  • %TEMP%\sbs6xvbn.0.vb
  • %TEMP%\l-wbh_fw.cmdline
  • %TEMP%\rf3hms3t.cmdline
  • %TEMP%\cosiseox.out
  • %TEMP%\sa6sl_dx.out
  • %TEMP%\gsgb-t9m.0.vb
  • %TEMP%\gsgb-t9m.cmdline
  • %TEMP%\gsgb-t9m.out
  • %TEMP%\cd_9gvgo.0.vb
  • %TEMP%\cd_9gvgo.cmdline
  • %TEMP%\cd_9gvgo.out
  • %TEMP%\bcsm1ejl.0.vb
  • %TEMP%\bcsm1ejl.cmdline
  • %TEMP%\bcsm1ejl.out
  • %TEMP%\zusafykf.0.vb
  • %TEMP%\zusafykf.cmdline
  • %TEMP%\zusafykf.out
  • %TEMP%\jznudiii.0.vb
  • %TEMP%\jznudiii.cmdline
  • %TEMP%\jznudiii.out
  • %TEMP%\eo_vvvwl.0.vb
  • %TEMP%\eo_vvvwl.cmdline
  • %TEMP%\sa6sl_dx.0.vb
  • %TEMP%\eo_vvvwl.out
  • %TEMP%\gqxj08kl.out
  • %TEMP%\gqxj08kl.0.vb
  • %TEMP%\x-lvklco.out
  • %TEMP%\s8xufieg.0.vb
  • %TEMP%\s8xufieg.cmdline
  • %TEMP%\s8xufieg.out
  • %TEMP%\9li4pq-r.0.vb
  • %TEMP%\9li4pq-r.cmdline
  • %TEMP%\9li4pq-r.out
  • %TEMP%\av155unz.0.vb
  • %TEMP%\av155unz.cmdline
  • %TEMP%\av155unz.out
  • %TEMP%\om27wpef.0.vb
  • %TEMP%\om27wpef.cmdline
  • %TEMP%\om27wpef.out
  • %TEMP%\tn7hpvd3.0.vb
  • %TEMP%\tn7hpvd3.cmdline
  • %TEMP%\tn7hpvd3.out
  • %TEMP%\88qozk-4.0.vb
  • %TEMP%\88qozk-4.cmdline
  • %TEMP%\88qozk-4.out
  • %TEMP%\gqxj08kl.cmdline
  • %TEMP%\4mjdvbp4.0.vb
  • %TEMP%\4mjdvbp4.cmdline
  • %TEMP%\4mjdvbp4.out
  • %TEMP%\gwt8tjtp.0.vb
  • %TEMP%\gwt8tjtp.out
  • %TEMP%\9bqp-1yj.0.vb
  • %TEMP%\9bqp-1yj.cmdline
  • %TEMP%\9bqp-1yj.out
  • %TEMP%\rk8nmxxz.0.vb
  • %TEMP%\rk8nmxxz.cmdline
  • %TEMP%\rk8nmxxz.out
  • %TEMP%\cosiseox.0.vb
  • %TEMP%\sa6sl_dx.cmdline
  • %TEMP%\cosiseox.cmdline
  • %TEMP%\jzdfcfdl.0.vb
  • %TEMP%\jzdfcfdl.cmdline
  • %TEMP%\jzdfcfdl.out
  • %TEMP%\vfn1zklw.0.vb
  • %TEMP%\vfn1zklw.cmdline
  • %TEMP%\vfn1zklw.out
  • %TEMP%\rf3hms3t.0.vb
  • %TEMP%\1rmfhoft.out
  • %TEMP%\1rmfhoft.cmdline
  • %TEMP%\gwt8tjtp.cmdline
  • %TEMP%\1rmfhoft.0.vb
  • %TEMP%\w7j4z5uh.out
  • %TEMP%\yuv4qjx8.0.vb
  • %TEMP%\yuv4qjx8.out
  • %TEMP%\mrxgsog-.0.vb
  • %TEMP%\mrxgsog-.cmdline
  • %TEMP%\mrxgsog-.out
  • %TEMP%\l02_jvr3.0.vb
  • %TEMP%\l02_jvr3.cmdline
  • %TEMP%\l02_jvr3.out
  • %TEMP%\rf3hms3t.out
  • %TEMP%\d_um9n-v.0.vb
  • %TEMP%\x-lvklco.cmdline
  • %TEMP%\d_um9n-v.out
  • %TEMP%\felkjeoe.cmdline
  • %TEMP%\felkjeoe.out
  • %TEMP%\kwjo7vt3.0.vb
  • %TEMP%\kwjo7vt3.cmdline
  • %TEMP%\kwjo7vt3.out
  • %TEMP%\w7j4z5uh.0.vb
  • %TEMP%\w7j4z5uh.cmdline
  • %TEMP%\d_um9n-v.cmdline
  • %TEMP%\yuv4qjx8.cmdline
  • %TEMP%\felkjeoe.0.vb
  • %TEMP%\yd3ltrka.cmdline
  • %TEMP%\yd3ltrka.0.vb
  • %TEMP%\uw7h3mge.out
  • %TEMP%\pqalhrlh.cmdline
  • %TEMP%\pqalhrlh.out
  • %TEMP%\vrqp5nyq.0.vb
  • %TEMP%\vrqp5nyq.cmdline
  • %TEMP%\vrqp5nyq.out
  • %TEMP%\eznyrp8t.0.vb
  • %TEMP%\eznyrp8t.cmdline
  • %TEMP%\eznyrp8t.out
  • %TEMP%\5c2n2ymb.0.vb
  • %TEMP%\5c2n2ymb.cmdline
  • %TEMP%\5c2n2ymb.out
  • %TEMP%\yfdszmsp.0.vb
  • %TEMP%\yfdszmsp.cmdline
  • %TEMP%\yfdszmsp.out
  • %TEMP%\-kwx2w5y.0.vb
  • %TEMP%\-kwx2w5y.cmdline
  • %TEMP%\-kwx2w5y.out
  • %TEMP%\-ozsjgz9.cmdline
  • %TEMP%\-ozsjgz9.0.vb
  • %TEMP%\pqalhrlh.0.vb
  • %TEMP%\vg7xpnfg.out
  • %TEMP%\vg7xpnfg.0.vb
  • %TEMP%\vg7xpnfg.cmdline
  • %TEMP%\bgi96sdh.out
  • %TEMP%\cdy-iran.0.vb
  • %TEMP%\cdy-iran.cmdline
  • %TEMP%\cdy-iran.out
  • %TEMP%\f5z5oaiy.0.vb
  • %TEMP%\f5z5oaiy.cmdline
  • %TEMP%\f5z5oaiy.out
  • %TEMP%\algclaod.0.vb
  • %TEMP%\algclaod.cmdline
  • %TEMP%\algclaod.out
  • %TEMP%\407cto6r.0.vb
  • %TEMP%\407cto6r.cmdline
  • %TEMP%\407cto6r.out
  • %TEMP%\7hxgozib.0.vb
  • %TEMP%\7hxgozib.cmdline
  • %TEMP%\7hxgozib.out
  • %TEMP%\00ivouno.0.vb
  • %TEMP%\00ivouno.out
  • %TEMP%\bgi96sdh.0.vb
  • %TEMP%\00ivouno.cmdline
  • %TEMP%\felhyj2u.0.vb
  • %TEMP%\3n0wx-mh.cmdline
  • %TEMP%\wgvavpis.0.vb
  • %TEMP%\_usr4gek.cmdline
  • %TEMP%\_usr4gek.out
  • %TEMP%\4id1dtk2.0.vb
  • %TEMP%\4id1dtk2.cmdline
  • %TEMP%\4id1dtk2.out
  • %TEMP%\711hsohc.0.vb
  • %TEMP%\711hsohc.cmdline
  • %TEMP%\3rua_yq1.out
  • %TEMP%\711hsohc.out
  • %TEMP%\6-8qlh7q.cmdline
  • %TEMP%\6-8qlh7q.out
  • %TEMP%\ldrfhlic.0.vb
  • %TEMP%\ldrfhlic.cmdline
  • %TEMP%\ldrfhlic.out
  • %TEMP%\c73nfutz.0.vb
  • %TEMP%\c73nfutz.cmdline
  • %TEMP%\3n0wx-mh.0.vb
  • %TEMP%\wyo8e7pb.out
  • %TEMP%\6-8qlh7q.0.vb
  • %TEMP%\_usr4gek.0.vb
  • %TEMP%\3n0wx-mh.out
  • %TEMP%\wyo8e7pb.cmdline
  • %TEMP%\wyo8e7pb.0.vb
  • %TEMP%\wgvavpis.cmdline
  • %TEMP%\wgvavpis.out
  • %TEMP%\1fhmrhzq.0.vb
  • %TEMP%\1fhmrhzq.cmdline
  • %TEMP%\1fhmrhzq.out
  • %TEMP%\ksuwg8s7.0.vb
  • %TEMP%\jqsg8g_o.out
  • %TEMP%\ksuwg8s7.cmdline
  • %TEMP%\ke_jw2l_.0.vb
  • %TEMP%\bgi96sdh.cmdline
  • %TEMP%\ke_jw2l_.cmdline
  • %TEMP%\k_3jf2zk.0.vb
  • %TEMP%\k_3jf2zk.cmdline
  • %TEMP%\k_3jf2zk.out
  • %TEMP%\ajns6heh.0.vb
  • %TEMP%\ajns6heh.cmdline
  • %TEMP%\ajns6heh.out
  • %TEMP%\ksuwg8s7.out
  • %TEMP%\felhyj2u.out
  • %TEMP%\felhyj2u.cmdline
  • %TEMP%\ke_jw2l_.out
  • %TEMP%\8cyhgln9.cmdline
  • %TEMP%\c73nfutz.out
  • %TEMP%\j3tgc2an.out
  • %TEMP%\-58cyadw.0.vb
  • %TEMP%\-58cyadw.cmdline
  • %TEMP%\-58cyadw.out
  • %TEMP%\lpdri2vu.0.vb
  • %TEMP%\lpdri2vu.cmdline
  • %TEMP%\lpdri2vu.out
  • %TEMP%\ekgrs1uj.0.vb
  • %TEMP%\ekgrs1uj.cmdline
  • %TEMP%\ekgrs1uj.out
  • %TEMP%\78ybi_pi.0.vb
  • %TEMP%\78ybi_pi.cmdline
  • %TEMP%\78ybi_pi.out
  • %TEMP%\pgobg255.0.vb
  • %TEMP%\pgobg255.cmdline
  • %TEMP%\pgobg255.out
  • %TEMP%\lblvrf63.0.vb
  • %TEMP%\lblvrf63.cmdline
  • %TEMP%\lblvrf63.out
  • %TEMP%\dl5w-1_g.cmdline
  • %TEMP%\ll42kzja.0.vb
  • %TEMP%\dl5w-1_g.0.vb
  • %TEMP%\90dngrvz.cmdline
  • %TEMP%\bpkh9qag.0.vb
  • %TEMP%\bpkh9qag.cmdline
  • %TEMP%\bpkh9qag.out
  • %TEMP%\0i7-ddm4.0.vb
  • %TEMP%\0i7-ddm4.cmdline
  • %TEMP%\0i7-ddm4.out
  • %TEMP%\8yspj4oh.0.vb
  • %TEMP%\8yspj4oh.cmdline
  • %TEMP%\8yspj4oh.out
  • %TEMP%\_zwvu_rl.0.vb
  • %TEMP%\_zwvu_rl.cmdline
  • %TEMP%\_zwvu_rl.out
  • %TEMP%\o3anxtcl.0.vb
  • %TEMP%\o3anxtcl.cmdline
  • %TEMP%\o3anxtcl.out
  • %TEMP%\ief7rkdn.0.vb
  • %TEMP%\ief7rkdn.cmdline
  • %TEMP%\ief7rkdn.out
  • %TEMP%\90dngrvz.0.vb
  • %TEMP%\90dngrvz.out
  • %TEMP%\ll42kzja.cmdline
  • %TEMP%\dl5w-1_g.out
  • %TEMP%\ll42kzja.out
  • %TEMP%\5w2dsfr3.cmdline
  • %TEMP%\y4emxvhx.0.vb
  • %TEMP%\y4emxvhx.cmdline
  • %TEMP%\y4emxvhx.out
  • %TEMP%\xabrlj1-.0.vb
  • %TEMP%\xabrlj1-.cmdline
  • %TEMP%\xabrlj1-.out
  • %TEMP%\hixpfvc1.0.vb
  • %TEMP%\hixpfvc1.cmdline
  • %TEMP%\hixpfvc1.out
  • %TEMP%\mpkrs3jt.0.vb
  • %TEMP%\mpkrs3jt.cmdline
  • %TEMP%\mpkrs3jt.out
  • %TEMP%\epz6qon9.0.vb
  • %TEMP%\epz6qon9.cmdline
  • %TEMP%\epz6qon9.out
  • %TEMP%\j3tgc2an.0.vb
  • %TEMP%\j3tgc2an.cmdline
  • %TEMP%\5w2dsfr3.0.vb
  • %TEMP%\iril_uyd.cmdline
  • %TEMP%\5w2dsfr3.out
  • %TEMP%\iril_uyd.out
  • %TEMP%\iril_uyd.0.vb
  • %TEMP%\wnewuwef.0.vb
  • %TEMP%\wnewuwef.out
  • %TEMP%\stehchkg.0.vb
  • %TEMP%\stehchkg.cmdline
  • %TEMP%\stehchkg.out
  • %TEMP%\ezllbfmb.0.vb
  • %TEMP%\ezllbfmb.cmdline
  • %TEMP%\ezllbfmb.out
  • %TEMP%\3rua_yq1.0.vb
  • %TEMP%\jqsg8g_o.0.vb
  • %TEMP%\jqsg8g_o.cmdline
  • %TEMP%\3rua_yq1.cmdline
  • %TEMP%\qg_5ic2p.cmdline
  • %TEMP%\qg_5ic2p.out
  • %TEMP%\xusfsfel.0.vb
  • %TEMP%\xusfsfel.cmdline
  • %TEMP%\xusfsfel.out
  • %TEMP%\9j6vwrer.0.vb
  • %TEMP%\9j6vwrer.cmdline
  • %TEMP%\9j6vwrer.out
  • %TEMP%\wnewuwef.cmdline
  • %TEMP%\qg_5ic2p.0.vb
  • %TEMP%\tp5n78ug.out
  • %TEMP%\jomm_sk7.0.vb
  • %TEMP%\88ghq9bz.0.vb
  • %TEMP%\yunvlbau.0.vb
  • %TEMP%\yunvlbau.cmdline
  • %TEMP%\yunvlbau.out
  • %TEMP%\gv9r8nit.0.vb
  • %TEMP%\gv9r8nit.cmdline
  • %TEMP%\gv9r8nit.out
  • %TEMP%\0ibxdzi-.0.vb
  • %TEMP%\0ibxdzi-.cmdline
  • %TEMP%\0ibxdzi-.out
  • %TEMP%\r9xbzz6c.0.vb
  • %TEMP%\r9xbzz6c.cmdline
  • %TEMP%\r9xbzz6c.out
  • %TEMP%\vwbidk_7.0.vb
  • %TEMP%\vwbidk_7.cmdline
  • %TEMP%\vwbidk_7.out
  • %TEMP%\frp8gje9.0.vb
  • %TEMP%\frp8gje9.cmdline
  • %TEMP%\frp8gje9.out
  • %TEMP%\jb5dbl75.0.vb
  • %TEMP%\z4855k1x.out
  • %TEMP%\jb5dbl75.cmdline
  • %TEMP%\z4855k1x.cmdline
  • %TEMP%\-j-dd1bt.out
  • %TEMP%\kob0fgao.cmdline
  • %TEMP%\kob0fgao.out
  • %TEMP%\kmvimm2p.0.vb
  • %TEMP%\kmvimm2p.cmdline
  • %TEMP%\kmvimm2p.out
  • %TEMP%\nzmtz9mk.0.vb
  • %TEMP%\nzmtz9mk.cmdline
  • %TEMP%\nzmtz9mk.out
  • %TEMP%\o-ttuyqg.0.vb
  • %TEMP%\o-ttuyqg.cmdline
  • %TEMP%\o-ttuyqg.out
  • %TEMP%\8ntf7tgh.0.vb
  • %TEMP%\8ntf7tgh.cmdline
  • %TEMP%\8ntf7tgh.out
  • %TEMP%\ohkaagxr.0.vb
  • %TEMP%\ohkaagxr.cmdline
  • %TEMP%\ohkaagxr.out
  • %TEMP%\-j-dd1bt.0.vb
  • %TEMP%\-j-dd1bt.cmdline
  • %TEMP%\z4855k1x.0.vb
  • %TEMP%\jb5dbl75.out
  • %TEMP%\l4jlgvlx.0.vb
  • %TEMP%\l4jlgvlx.out
  • %TEMP%\x2m15q6m.0.vb
  • %TEMP%\x2m15q6m.cmdline
  • %TEMP%\x2m15q6m.out
  • %TEMP%\xizatq8-.0.vb
  • %TEMP%\xizatq8-.cmdline
  • %TEMP%\xizatq8-.out
  • %TEMP%\wmqonjka.0.vb
  • %TEMP%\jomm_sk7.cmdline
  • %TEMP%\wmqonjka.cmdline
  • %TEMP%\q_malbnu.0.vb
  • %TEMP%\q_malbnu.cmdline
  • %TEMP%\q_malbnu.out
  • %TEMP%\pwwiswpz.0.vb
  • %TEMP%\pwwiswpz.cmdline
  • %TEMP%\pwwiswpz.out
  • %TEMP%\uw7h3mge.0.vb
  • %TEMP%\uw7h3mge.cmdline
  • %TEMP%\mvcyhyvr.0.vb
  • %TEMP%\wmqonjka.out
  • %TEMP%\mvcyhyvr.out
  • %TEMP%\mvcyhyvr.cmdline
  • %TEMP%\stckybpr.out
  • %TEMP%\stckybpr.cmdline
  • %TEMP%\dczruohn.0.vb
  • %TEMP%\dczruohn.cmdline
  • %TEMP%\dczruohn.out
  • %TEMP%\lrsk0f83.0.vb
  • %TEMP%\lrsk0f83.cmdline
  • %TEMP%\lrsk0f83.out
  • %TEMP%\ps3q8nj6.0.vb
  • %TEMP%\zpk7qtx5.out
  • %TEMP%\ps3q8nj6.cmdline
  • %TEMP%\kob0fgao.0.vb
  • %TEMP%\2pk_m_tk.0.vb
  • %TEMP%\2pk_m_tk.out
  • %TEMP%\qbedgfvs.0.vb
  • %TEMP%\qbedgfvs.cmdline
  • %TEMP%\qbedgfvs.out
  • %TEMP%\x7prgie3.0.vb
  • %TEMP%\x7prgie3.cmdline
  • %TEMP%\x7prgie3.out
  • %TEMP%\l4jlgvlx.cmdline
  • %TEMP%\stckybpr.0.vb
  • %TEMP%\2pk_m_tk.cmdline
  • %TEMP%\jomm_sk7.out
  • %TEMP%\ps3q8nj6.out
  • %TEMP%\-ozsjgz9.out
  • %TEMP%\ccg6qjgh.0.vb
  • %TEMP%\ccg6qjgh.cmdline
  • %TEMP%\ccg6qjgh.out
  • %TEMP%\u6eabrc1.0.vb
  • %TEMP%\u6eabrc1.cmdline
  • %TEMP%\u6eabrc1.out
  • %TEMP%\9hxc_5iw.0.vb
  • %TEMP%\9hxc_5iw.cmdline
  • %TEMP%\9hxc_5iw.out
  • %TEMP%\i5txtoxk.0.vb
  • %TEMP%\i5txtoxk.cmdline
  • %TEMP%\i5txtoxk.out
  • %TEMP%\hi2wsdyf.0.vb
  • %TEMP%\hi2wsdyf.cmdline
  • %TEMP%\hi2wsdyf.out
  • %TEMP%\nj8yelvi.0.vb
  • %TEMP%\nj8yelvi.cmdline
  • %TEMP%\nj8yelvi.out
  • %TEMP%\y-xsm1ls.0.vb
  • %TEMP%\tjuwypnw.out
  • %TEMP%\y-xsm1ls.cmdline
  • %TEMP%\tjuwypnw.cmdline
  • %TEMP%\txm1vx4a.out
  • %TEMP%\88ghq9bz.cmdline
  • %TEMP%\88ghq9bz.out
  • %TEMP%\sihha2fj.0.vb
  • %TEMP%\sihha2fj.cmdline
  • %TEMP%\sihha2fj.out
  • %TEMP%\1sihlc_e.0.vb
  • %TEMP%\1sihlc_e.cmdline
  • %TEMP%\1sihlc_e.out
  • %TEMP%\mqxuyphq.0.vb
  • %TEMP%\mqxuyphq.cmdline
  • %TEMP%\mqxuyphq.out
  • %TEMP%\l2kgisg5.0.vb
  • %TEMP%\l2kgisg5.cmdline
  • %TEMP%\l2kgisg5.out
  • %TEMP%\lxjifzgt.0.vb
  • %TEMP%\lxjifzgt.cmdline
  • %TEMP%\lxjifzgt.out
  • %TEMP%\txm1vx4a.0.vb
  • %TEMP%\txm1vx4a.cmdline
  • %TEMP%\tjuwypnw.0.vb
  • %TEMP%\y-xsm1ls.out
  • %TEMP%\uxpiasdq.0.vb
  • %TEMP%\uxpiasdq.out
  • %TEMP%\m2i-1jro.0.vb
  • %TEMP%\m2i-1jro.cmdline
  • %TEMP%\m2i-1jro.out
  • %TEMP%\tkifbevn.0.vb
  • %TEMP%\tkifbevn.cmdline
  • %TEMP%\tkifbevn.out
  • %TEMP%\zs2azvms.0.vb
  • %TEMP%\lakgh0mf.out
  • %TEMP%\zs2azvms.cmdline
  • %TEMP%\9oc8g5la.0.vb
  • %TEMP%\9oc8g5la.cmdline
  • %TEMP%\9oc8g5la.out
  • %TEMP%\hyvk5e9r.0.vb
  • %TEMP%\hyvk5e9r.cmdline
  • %TEMP%\hyvk5e9r.out
  • %TEMP%\lakgh0mf.0.vb
  • %TEMP%\lakgh0mf.cmdline
  • %TEMP%\a7pe8wya.0.vb
  • %TEMP%\zs2azvms.out
  • %TEMP%\a7pe8wya.out
  • %TEMP%\a7pe8wya.cmdline
  • %TEMP%\bpvqrtia.out
  • %TEMP%\bpvqrtia.cmdline
  • %TEMP%\f0t8mnz0.0.vb
  • %TEMP%\f0t8mnz0.cmdline
  • %TEMP%\f0t8mnz0.out
  • %TEMP%\vb0ogjre.0.vb
  • %TEMP%\vb0ogjre.cmdline
  • %TEMP%\vb0ogjre.out
  • %TEMP%\oyenfjil.0.vb
  • %TEMP%\zpk7qtx5.0.vb
  • %TEMP%\oyenfjil.cmdline
  • %TEMP%\zpk7qtx5.cmdline
  • %TEMP%\1tcm5pgj.0.vb
  • %TEMP%\1tcm5pgj.out
  • %TEMP%\r3bcvprd.0.vb
  • %TEMP%\r3bcvprd.cmdline
  • %TEMP%\r3bcvprd.out
  • %TEMP%\iqymujfa.0.vb
  • %TEMP%\iqymujfa.cmdline
  • %TEMP%\iqymujfa.out
  • %TEMP%\uxpiasdq.cmdline
  • %TEMP%\bpvqrtia.0.vb
  • %TEMP%\1tcm5pgj.cmdline
  • %TEMP%\8cyhgln9.out
Sets the 'hidden' attribute to the following files
  • %TEMP%\svchost.bat
Deletes the following files
  • %TEMP%\bpkh9qag.0.vb
  • %TEMP%\exds2tvf.cmdline
  • %TEMP%\exds2tvf.0.vb
  • %TEMP%\d9cplva4.0.vb
  • %TEMP%\d9cplva4.out
  • %TEMP%\d9cplva4.cmdline
  • %TEMP%\ul_bip3g.0.vb
  • %TEMP%\ul_bip3g.cmdline
  • %TEMP%\ul_bip3g.out
  • %TEMP%\iqkiygvq.cmdline
  • %TEMP%\iqkiygvq.out
  • %TEMP%\iqkiygvq.0.vb
  • %TEMP%\5kgw_gwr.0.vb
  • %TEMP%\5kgw_gwr.out
  • %TEMP%\5kgw_gwr.cmdline
  • %TEMP%\yzoefkmk.cmdline
  • %TEMP%\yzoefkmk.0.vb
  • %TEMP%\yzoefkmk.out
  • %TEMP%\eecjdsab.out
  • %TEMP%\eecjdsab.0.vb
  • %TEMP%\exds2tvf.out
  • %TEMP%\l4dgytjn.out
  • %TEMP%\65rtc9-3.cmdline
  • %TEMP%\65rtc9-3.out
  • %TEMP%\l4dgytjn.0.vb
  • %TEMP%\0v33sibj.0.vb
  • %TEMP%\0v33sibj.out
  • %TEMP%\0v33sibj.cmdline
  • %TEMP%\l2k3cpun.0.vb
  • %TEMP%\l2k3cpun.out
  • %TEMP%\l2k3cpun.cmdline
  • %TEMP%\ucv3q0du.out
  • %TEMP%\ucv3q0du.cmdline
  • %TEMP%\ucv3q0du.0.vb
  • %TEMP%\rrb059lb.cmdline
  • %TEMP%\rrb059lb.out
  • %TEMP%\rrb059lb.0.vb
  • %TEMP%\0m8uftth.out
  • %TEMP%\0m8uftth.0.vb
  • %TEMP%\0m8uftth.cmdline
  • %TEMP%\hvrz9mai.0.vb
  • %TEMP%\hvrz9mai.out
  • %TEMP%\hvrz9mai.cmdline
  • %TEMP%\65rtc9-3.0.vb
  • %TEMP%\l4dgytjn.cmdline
  • %TEMP%\eecjdsab.cmdline
  • %TEMP%\7u_sr_ih.0.vb
  • %TEMP%\qpzawkam.cmdline
  • %TEMP%\k3_-nn3_.out
  • %TEMP%\k3_-nn3_.0.vb
  • %TEMP%\k3_-nn3_.cmdline
  • %TEMP%\gaqy4mdv.cmdline
  • %TEMP%\gaqy4mdv.0.vb
  • %TEMP%\gaqy4mdv.out
  • %TEMP%\mokyxxoy.cmdline
  • %TEMP%\f5a9neru.0.vb
  • %TEMP%\mokyxxoy.out
  • %TEMP%\n5lt_y29.out
  • %TEMP%\n5lt_y29.cmdline
  • %TEMP%\n5lt_y29.0.vb
  • %TEMP%\ol0cvzqd.0.vb
  • %TEMP%\ol0cvzqd.cmdline
  • %TEMP%\ol0cvzqd.out
  • %TEMP%\7zogzdwj.out
  • %TEMP%\7zogzdwj.cmdline
  • %TEMP%\qpzawkam.out
  • %TEMP%\qpzawkam.0.vb
  • %TEMP%\uau74djt.cmdline
  • %TEMP%\uau74djt.0.vb
  • %TEMP%\n82ff1og.cmdline
  • %TEMP%\7u_sr_ih.cmdline
  • %TEMP%\7u_sr_ih.out
  • %TEMP%\fac1apnq.0.vb
  • %TEMP%\fac1apnq.out
  • %TEMP%\fac1apnq.cmdline
  • %TEMP%\idwaygu4.cmdline
  • %TEMP%\idwaygu4.0.vb
  • %TEMP%\idwaygu4.out
  • %TEMP%\cdcmlmcf.out
  • %TEMP%\cdcmlmcf.0.vb
  • %TEMP%\cdcmlmcf.cmdline
  • %TEMP%\ss2w_aio.out
  • %TEMP%\ss2w_aio.0.vb
  • %TEMP%\ss2w_aio.cmdline
  • %TEMP%\fuylyjrc.out
  • %TEMP%\fuylyjrc.0.vb
  • %TEMP%\fuylyjrc.cmdline
  • %TEMP%\n82ff1og.0.vb
  • %TEMP%\uau74djt.out
  • %TEMP%\n82ff1og.out
  • %TEMP%\mokyxxoy.0.vb
  • %TEMP%\7zogzdwj.0.vb
  • %TEMP%\qe_qu9jj.0.vb
  • %TEMP%\-8jszjhk.cmdline
  • %TEMP%\-8jszjhk.0.vb
  • %TEMP%\-8jszjhk.out
  • %TEMP%\mhrndqg9.cmdline
  • %TEMP%\mhrndqg9.out
  • %TEMP%\mhrndqg9.0.vb
  • %TEMP%\yzznd-g_.0.vb
  • %TEMP%\yzznd-g_.out
  • %TEMP%\yzznd-g_.cmdline
  • %TEMP%\rrrksnty.cmdline
  • %TEMP%\rrrksnty.out
  • %TEMP%\rrrksnty.0.vb
  • %TEMP%\gmbfzfvh.0.vb
  • %TEMP%\gmbfzfvh.cmdline
  • %TEMP%\gmbfzfvh.out
  • %TEMP%\ndhumc7d.out
  • %TEMP%\ndhumc7d.cmdline
  • %TEMP%\ttqre0n5.out
  • %TEMP%\zzqgqqfv.0.vb
  • %TEMP%\ttqre0n5.0.vb
  • %TEMP%\ttqre0n5.cmdline
  • %TEMP%\ndhumc7d.0.vb
  • %TEMP%\qe_qu9jj.cmdline
  • %TEMP%\l-wbh_fw.0.vb
  • %TEMP%\l-wbh_fw.cmdline
  • %TEMP%\gjt_fx8r.cmdline
  • %TEMP%\gjt_fx8r.0.vb
  • %TEMP%\gjt_fx8r.out
  • %TEMP%\q-whn_ln.out
  • %TEMP%\q-whn_ln.cmdline
  • %TEMP%\q-whn_ln.0.vb
  • %TEMP%\vwfyhr20.cmdline
  • %TEMP%\vwfyhr20.out
  • %TEMP%\vwfyhr20.0.vb
  • %TEMP%\4qi5-spk.0.vb
  • %TEMP%\4qi5-spk.cmdline
  • %TEMP%\4qi5-spk.out
  • %TEMP%\9dfpd_fc.out
  • %TEMP%\9dfpd_fc.cmdline
  • %TEMP%\9dfpd_fc.0.vb
  • %TEMP%\zzqgqqfv.cmdline
  • %TEMP%\yd3ltrka.out
  • %TEMP%\zzqgqqfv.out
  • %TEMP%\qe_qu9jj.out
  • %TEMP%\jvcipmte.cmdline
  • %TEMP%\pr1tsdkk.0.vb
  • %TEMP%\q-itzovx.0.vb
  • %TEMP%\q-itzovx.out
  • %TEMP%\kba1iqi6.out
  • %TEMP%\kba1iqi6.cmdline
  • %TEMP%\kba1iqi6.0.vb
  • %TEMP%\ntgm2thn.0.vb
  • %TEMP%\ntgm2thn.out
  • %TEMP%\ntgm2thn.cmdline
  • %TEMP%\sy9rzxok.out
  • %TEMP%\sy9rzxok.0.vb
  • %TEMP%\sy9rzxok.cmdline
  • %TEMP%\heqpuvc9.out
  • %TEMP%\heqpuvc9.0.vb
  • %TEMP%\heqpuvc9.cmdline
  • %TEMP%\indcyp2r.0.vb
  • %TEMP%\indcyp2r.cmdline
  • %TEMP%\indcyp2r.out
  • %TEMP%\ludhsmvg.out
  • %TEMP%\ludhsmvg.cmdline
  • %TEMP%\q-itzovx.cmdline
  • %TEMP%\ludhsmvg.0.vb
  • %TEMP%\jvcipmte.0.vb
  • %TEMP%\jvcipmte.out
  • %TEMP%\pr1tsdkk.cmdline
  • %TEMP%\vphaysdq.out
  • %TEMP%\vphaysdq.0.vb
  • %TEMP%\vphaysdq.cmdline
  • %TEMP%\aenod4_m.out
  • %TEMP%\aenod4_m.cmdline
  • %TEMP%\aenod4_m.0.vb
  • %TEMP%\7ubfmqhp.0.vb
  • %TEMP%\7ubfmqhp.cmdline
  • %TEMP%\7ubfmqhp.out
  • %TEMP%\3ykkqwfv.0.vb
  • %TEMP%\3ykkqwfv.cmdline
  • %TEMP%\3ykkqwfv.out
  • %TEMP%\gs6cxvnp.0.vb
  • %TEMP%\gs6cxvnp.cmdline
  • %TEMP%\gs6cxvnp.out
  • %TEMP%\kf1nrxk_.out
  • %TEMP%\kf1nrxk_.0.vb
  • %TEMP%\pr1tsdkk.out
  • %TEMP%\kf1nrxk_.cmdline
  • %TEMP%\oyenfjil.cmdline
  • %TEMP%\f5a9neru.out
  • %TEMP%\dzveu7yk.0.vb
  • %TEMP%\65xiakg6.cmdline
  • %TEMP%\65xiakg6.out
  • %TEMP%\r_epowcf.out
  • %TEMP%\r_epowcf.cmdline
  • %TEMP%\r_epowcf.0.vb
  • %TEMP%\plt57gix.out
  • %TEMP%\plt57gix.cmdline
  • %TEMP%\plt57gix.0.vb
  • %TEMP%\ftekd5cb.out
  • %TEMP%\ftekd5cb.0.vb
  • %TEMP%\ftekd5cb.cmdline
  • %TEMP%\v3b5k5zs.0.vb
  • %TEMP%\v3b5k5zs.cmdline
  • %TEMP%\v3b5k5zs.out
  • %TEMP%\hyv0egyw.0.vb
  • %TEMP%\hyv0egyw.out
  • %TEMP%\hyv0egyw.cmdline
  • %TEMP%\dzveu7yk.out
  • %TEMP%\dzveu7yk.cmdline
  • %TEMP%\65xiakg6.0.vb
  • %TEMP%\c4jokujp.0.vb
  • %TEMP%\c4jokujp.cmdline
  • %TEMP%\rf3hms3t.cmdline
  • %TEMP%\enwqkbuj.out
  • %TEMP%\8xn4qkmu.out
  • %TEMP%\8xn4qkmu.cmdline
  • %TEMP%\8xn4qkmu.0.vb
  • %TEMP%\2r67uefr.0.vb
  • %TEMP%\2r67uefr.cmdline
  • %TEMP%\2r67uefr.out
  • %TEMP%\ftztnvly.0.vb
  • %TEMP%\ftztnvly.out
  • %TEMP%\ftztnvly.cmdline
  • %TEMP%\31ohrykn.cmdline
  • %TEMP%\31ohrykn.out
  • %TEMP%\31ohrykn.0.vb
  • %TEMP%\i2_6trcl.0.vb
  • %TEMP%\i2_6trcl.cmdline
  • %TEMP%\i2_6trcl.out
  • %TEMP%\_f7y9nt3.out
  • %TEMP%\_f7y9nt3.cmdline
  • %TEMP%\enwqkbuj.0.vb
  • %TEMP%\_f7y9nt3.0.vb
  • %TEMP%\enwqkbuj.cmdline
  • %TEMP%\t1qpo8de.0.vb
  • %TEMP%\nxyhy710.out
  • %TEMP%\mvbowkmh.0.vb
  • %TEMP%\4xmvcdee.out
  • %TEMP%\4xmvcdee.0.vb
  • %TEMP%\4xmvcdee.cmdline
  • %TEMP%\kigrm-id.cmdline
  • %TEMP%\kigrm-id.out
  • %TEMP%\kigrm-id.0.vb
  • %TEMP%\ft3zkb6n.cmdline
  • %TEMP%\f5a9neru.cmdline
  • %TEMP%\ft3zkb6n.out
  • %TEMP%\tp5n78ug.out
  • %TEMP%\tp5n78ug.0.vb
  • %TEMP%\tp5n78ug.cmdline
  • %TEMP%\uh56xxb9.cmdline
  • %TEMP%\uh56xxb9.0.vb
  • %TEMP%\uh56xxb9.out
  • %TEMP%\mgpiridx.out
  • %TEMP%\mr5nvlgr.cmdline
  • %TEMP%\c4jokujp.out
  • %TEMP%\mvbowkmh.cmdline
  • %TEMP%\mvbowkmh.out
  • %TEMP%\mr5nvlgr.out
  • %TEMP%\t1qpo8de.out
  • %TEMP%\nxyhy710.0.vb
  • %TEMP%\nxyhy710.cmdline
  • %TEMP%\wlifbfe-.0.vb
  • %TEMP%\wlifbfe-.cmdline
  • %TEMP%\wlifbfe-.out
  • %TEMP%\qekq92cu.out
  • %TEMP%\qekq92cu.cmdline
  • %TEMP%\qekq92cu.0.vb
  • %TEMP%\kntbcosu.0.vb
  • %TEMP%\kntbcosu.cmdline
  • %TEMP%\kntbcosu.out
  • %TEMP%\sbs6xvbn.cmdline
  • %TEMP%\sbs6xvbn.0.vb
  • %TEMP%\sbs6xvbn.out
  • %TEMP%\seqtuirc.out
  • %TEMP%\seqtuirc.0.vb
  • %TEMP%\mr5nvlgr.0.vb
  • %TEMP%\rf3hms3t.0.vb
  • %TEMP%\t1qpo8de.cmdline
  • %TEMP%\seqtuirc.cmdline
  • %TEMP%\rf3hms3t.out
  • %TEMP%\vfn1zklw.cmdline
  • %TEMP%\gqxj08kl.out
  • %TEMP%\sa6sl_dx.out
  • %TEMP%\sa6sl_dx.0.vb
  • %TEMP%\gsgb-t9m.out
  • %TEMP%\gsgb-t9m.0.vb
  • %TEMP%\gsgb-t9m.cmdline
  • %TEMP%\cd_9gvgo.out
  • %TEMP%\cd_9gvgo.cmdline
  • %TEMP%\cd_9gvgo.0.vb
  • %TEMP%\bcsm1ejl.out
  • %TEMP%\bcsm1ejl.0.vb
  • %TEMP%\bcsm1ejl.cmdline
  • %TEMP%\zusafykf.cmdline
  • %TEMP%\zusafykf.0.vb
  • %TEMP%\zusafykf.out
  • %TEMP%\jznudiii.out
  • %TEMP%\jznudiii.cmdline
  • %TEMP%\jznudiii.0.vb
  • %TEMP%\gqxj08kl.0.vb
  • %TEMP%\eo_vvvwl.cmdline
  • %TEMP%\gqxj08kl.cmdline
  • %TEMP%\88qozk-4.cmdline
  • %TEMP%\x-lvklco.out
  • %TEMP%\x-lvklco.0.vb
  • %TEMP%\x-lvklco.cmdline
  • %TEMP%\s8xufieg.0.vb
  • %TEMP%\s8xufieg.out
  • %TEMP%\s8xufieg.cmdline
  • %TEMP%\9li4pq-r.cmdline
  • %TEMP%\9li4pq-r.0.vb
  • %TEMP%\9li4pq-r.out
  • %TEMP%\av155unz.out
  • %TEMP%\av155unz.cmdline
  • %TEMP%\av155unz.0.vb
  • %TEMP%\om27wpef.cmdline
  • %TEMP%\om27wpef.0.vb
  • %TEMP%\om27wpef.out
  • %TEMP%\tn7hpvd3.cmdline
  • %TEMP%\tn7hpvd3.0.vb
  • %TEMP%\tn7hpvd3.out
  • %TEMP%\88qozk-4.0.vb
  • %TEMP%\88qozk-4.out
  • %TEMP%\eo_vvvwl.out
  • %TEMP%\eo_vvvwl.0.vb
  • %TEMP%\sa6sl_dx.cmdline
  • %TEMP%\4mjdvbp4.0.vb
  • %TEMP%\1rmfhoft.cmdline
  • %TEMP%\gwt8tjtp.out
  • %TEMP%\gwt8tjtp.cmdline
  • %TEMP%\9bqp-1yj.out
  • %TEMP%\9bqp-1yj.cmdline
  • %TEMP%\9bqp-1yj.0.vb
  • %TEMP%\rk8nmxxz.out
  • %TEMP%\rk8nmxxz.cmdline
  • %TEMP%\rk8nmxxz.0.vb
  • %TEMP%\cosiseox.0.vb
  • %TEMP%\cosiseox.cmdline
  • %TEMP%\cosiseox.out
  • %TEMP%\jzdfcfdl.cmdline
  • %TEMP%\jzdfcfdl.out
  • %TEMP%\jzdfcfdl.0.vb
  • %TEMP%\vfn1zklw.0.vb
  • %TEMP%\vfn1zklw.out
  • %TEMP%\1rmfhoft.0.vb
  • %TEMP%\w7j4z5uh.0.vb
  • %TEMP%\w7j4z5uh.cmdline
  • %TEMP%\gwt8tjtp.0.vb
  • %TEMP%\w7j4z5uh.out
  • %TEMP%\4mjdvbp4.out
  • %TEMP%\1rmfhoft.out
  • %TEMP%\yuv4qjx8.cmdline
  • %TEMP%\yuv4qjx8.out
  • %TEMP%\yuv4qjx8.0.vb
  • %TEMP%\mrxgsog-.0.vb
  • %TEMP%\mrxgsog-.out
  • %TEMP%\mrxgsog-.cmdline
  • %TEMP%\l02_jvr3.out
  • %TEMP%\yd3ltrka.0.vb
  • %TEMP%\l02_jvr3.0.vb
  • %TEMP%\l-wbh_fw.out
  • %TEMP%\d_um9n-v.out
  • %TEMP%\d_um9n-v.cmdline
  • %TEMP%\felkjeoe.out
  • %TEMP%\felkjeoe.0.vb
  • %TEMP%\felkjeoe.cmdline
  • %TEMP%\kwjo7vt3.0.vb
  • %TEMP%\kwjo7vt3.cmdline
  • %TEMP%\kwjo7vt3.out
  • %TEMP%\l02_jvr3.cmdline
  • %TEMP%\4mjdvbp4.cmdline
  • %TEMP%\d_um9n-v.0.vb
  • %TEMP%\yd3ltrka.cmdline
  • %TEMP%\uw7h3mge.cmdline
  • %TEMP%\uw7h3mge.out
  • %TEMP%\pqalhrlh.out
  • %TEMP%\vrqp5nyq.0.vb
  • %TEMP%\vrqp5nyq.out
  • %TEMP%\vrqp5nyq.cmdline
  • %TEMP%\eznyrp8t.0.vb
  • %TEMP%\eznyrp8t.out
  • %TEMP%\eznyrp8t.cmdline
  • %TEMP%\5c2n2ymb.out
  • %TEMP%\5c2n2ymb.0.vb
  • %TEMP%\5c2n2ymb.cmdline
  • %TEMP%\yfdszmsp.0.vb
  • %TEMP%\yfdszmsp.out
  • %TEMP%\yfdszmsp.cmdline
  • %TEMP%\-kwx2w5y.cmdline
  • %TEMP%\-kwx2w5y.0.vb
  • %TEMP%\-kwx2w5y.out
  • %TEMP%\vg7xpnfg.out
  • %TEMP%\-ozsjgz9.cmdline
  • %TEMP%\-ozsjgz9.0.vb
  • %TEMP%\pqalhrlh.0.vb
  • %TEMP%\jqsg8g_o.out
  • %TEMP%\vg7xpnfg.cmdline
  • %TEMP%\bgi96sdh.cmdline
  • %TEMP%\cdy-iran.0.vb
  • %TEMP%\cdy-iran.out
  • %TEMP%\cdy-iran.cmdline
  • %TEMP%\f5z5oaiy.cmdline
  • %TEMP%\f5z5oaiy.out
  • %TEMP%\f5z5oaiy.0.vb
  • %TEMP%\algclaod.cmdline
  • %TEMP%\algclaod.0.vb
  • %TEMP%\algclaod.out
  • %TEMP%\407cto6r.out
  • %TEMP%\407cto6r.cmdline
  • %TEMP%\407cto6r.0.vb
  • %TEMP%\7hxgozib.cmdline
  • %TEMP%\7hxgozib.out
  • %TEMP%\7hxgozib.0.vb
  • %TEMP%\00ivouno.out
  • %TEMP%\00ivouno.cmdline
  • %TEMP%\-ozsjgz9.out
  • %TEMP%\bgi96sdh.out
  • %TEMP%\00ivouno.0.vb
  • %TEMP%\bgi96sdh.0.vb
  • %TEMP%\vg7xpnfg.0.vb
  • %TEMP%\wgvavpis.0.vb
  • %TEMP%\_usr4gek.0.vb
  • %TEMP%\_usr4gek.cmdline
  • %TEMP%\_usr4gek.out
  • %TEMP%\4id1dtk2.0.vb
  • %TEMP%\4id1dtk2.cmdline
  • %TEMP%\4id1dtk2.out
  • %TEMP%\711hsohc.out
  • %TEMP%\711hsohc.0.vb
  • %TEMP%\711hsohc.cmdline
  • %TEMP%\6-8qlh7q.out
  • %TEMP%\6-8qlh7q.cmdline
  • %TEMP%\6-8qlh7q.0.vb
  • %TEMP%\ldrfhlic.out
  • %TEMP%\ldrfhlic.cmdline
  • %TEMP%\ldrfhlic.0.vb
  • %TEMP%\c73nfutz.cmdline
  • %TEMP%\c73nfutz.out
  • %TEMP%\3n0wx-mh.cmdline
  • %TEMP%\wyo8e7pb.out
  • %TEMP%\3n0wx-mh.0.vb
  • %TEMP%\3n0wx-mh.out
  • %TEMP%\felhyj2u.0.vb
  • %TEMP%\felhyj2u.out
  • %TEMP%\wgvavpis.cmdline
  • %TEMP%\wgvavpis.out
  • %TEMP%\1fhmrhzq.0.vb
  • %TEMP%\1fhmrhzq.cmdline
  • %TEMP%\1fhmrhzq.out
  • %TEMP%\ksuwg8s7.cmdline
  • %TEMP%\ksuwg8s7.out
  • %TEMP%\ksuwg8s7.0.vb
  • %TEMP%\ke_jw2l_.0.vb
  • %TEMP%\ke_jw2l_.out
  • %TEMP%\ke_jw2l_.cmdline
  • %TEMP%\k_3jf2zk.0.vb
  • %TEMP%\k_3jf2zk.out
  • %TEMP%\k_3jf2zk.cmdline
  • %TEMP%\ajns6heh.cmdline
  • %TEMP%\ajns6heh.out
  • %TEMP%\ajns6heh.0.vb
  • %TEMP%\wyo8e7pb.0.vb
  • %TEMP%\felhyj2u.cmdline
  • %TEMP%\wyo8e7pb.cmdline
  • %TEMP%\jqsg8g_o.0.vb
  • %TEMP%\jqsg8g_o.cmdline
  • %TEMP%\qg_5ic2p.0.vb
  • %TEMP%\-58cyadw.out
  • %TEMP%\-58cyadw.0.vb
  • %TEMP%\lpdri2vu.0.vb
  • %TEMP%\lpdri2vu.out
  • %TEMP%\lpdri2vu.cmdline
  • %TEMP%\ekgrs1uj.out
  • %TEMP%\ekgrs1uj.0.vb
  • %TEMP%\ekgrs1uj.cmdline
  • %TEMP%\78ybi_pi.out
  • %TEMP%\78ybi_pi.cmdline
  • %TEMP%\78ybi_pi.0.vb
  • %TEMP%\pgobg255.0.vb
  • %TEMP%\pgobg255.out
  • %TEMP%\pgobg255.cmdline
  • %TEMP%\lblvrf63.cmdline
  • %TEMP%\lblvrf63.0.vb
  • %TEMP%\lblvrf63.out
  • %TEMP%\ll42kzja.out
  • %TEMP%\dl5w-1_g.0.vb
  • %TEMP%\ll42kzja.cmdline
  • %TEMP%\dl5w-1_g.cmdline
  • %TEMP%\90dngrvz.0.vb
  • %TEMP%\bpkh9qag.out
  • %TEMP%\bpkh9qag.cmdline
  • %TEMP%\0i7-ddm4.0.vb
  • %TEMP%\0i7-ddm4.cmdline
  • %TEMP%\0i7-ddm4.out
  • %TEMP%\8yspj4oh.cmdline
  • %TEMP%\8yspj4oh.out
  • %TEMP%\8yspj4oh.0.vb
  • %TEMP%\_zwvu_rl.out
  • %TEMP%\_zwvu_rl.0.vb
  • %TEMP%\_zwvu_rl.cmdline
  • %TEMP%\o3anxtcl.out
  • %TEMP%\o3anxtcl.0.vb
  • %TEMP%\o3anxtcl.cmdline
  • %TEMP%\ief7rkdn.cmdline
  • %TEMP%\ief7rkdn.out
  • %TEMP%\ief7rkdn.0.vb
  • %TEMP%\90dngrvz.out
  • %TEMP%\90dngrvz.cmdline
  • %TEMP%\dl5w-1_g.out
  • %TEMP%\ll42kzja.0.vb
  • %TEMP%\-58cyadw.cmdline
  • %TEMP%\wnewuwef.cmdline
  • %TEMP%\5w2dsfr3.0.vb
  • %TEMP%\y4emxvhx.0.vb
  • %TEMP%\y4emxvhx.cmdline
  • %TEMP%\xabrlj1-.0.vb
  • %TEMP%\xabrlj1-.cmdline
  • %TEMP%\xabrlj1-.out
  • %TEMP%\hixpfvc1.0.vb
  • %TEMP%\hixpfvc1.out
  • %TEMP%\hixpfvc1.cmdline
  • %TEMP%\mpkrs3jt.cmdline
  • %TEMP%\mpkrs3jt.out
  • %TEMP%\mpkrs3jt.0.vb
  • %TEMP%\epz6qon9.cmdline
  • %TEMP%\epz6qon9.out
  • %TEMP%\epz6qon9.0.vb
  • %TEMP%\j3tgc2an.out
  • %TEMP%\j3tgc2an.0.vb
  • %TEMP%\j3tgc2an.cmdline
  • %TEMP%\5w2dsfr3.out
  • %TEMP%\iril_uyd.cmdline
  • %TEMP%\y4emxvhx.out
  • %TEMP%\5w2dsfr3.cmdline
  • %TEMP%\iril_uyd.out
  • %TEMP%\wnewuwef.out
  • %TEMP%\stehchkg.cmdline
  • %TEMP%\stehchkg.0.vb
  • %TEMP%\stehchkg.out
  • %TEMP%\ezllbfmb.out
  • %TEMP%\ezllbfmb.cmdline
  • %TEMP%\ezllbfmb.0.vb
  • %TEMP%\3rua_yq1.cmdline
  • %TEMP%\3rua_yq1.out
  • %TEMP%\c73nfutz.0.vb
  • %TEMP%\mgpiridx.cmdline
  • %TEMP%\3rua_yq1.0.vb
  • %TEMP%\qg_5ic2p.out
  • %TEMP%\xusfsfel.cmdline
  • %TEMP%\xusfsfel.out
  • %TEMP%\xusfsfel.0.vb
  • %TEMP%\9j6vwrer.out
  • %TEMP%\9j6vwrer.0.vb
  • %TEMP%\9j6vwrer.cmdline
  • %TEMP%\iril_uyd.0.vb
  • %TEMP%\wnewuwef.0.vb
  • %TEMP%\qg_5ic2p.cmdline
  • %TEMP%\ft3zkb6n.0.vb
  • %TEMP%\jomm_sk7.0.vb
  • %TEMP%\88ghq9bz.0.vb
  • %TEMP%\yunvlbau.0.vb
  • %TEMP%\yunvlbau.out
  • %TEMP%\gv9r8nit.0.vb
  • %TEMP%\gv9r8nit.out
  • %TEMP%\gv9r8nit.cmdline
  • %TEMP%\0ibxdzi-.0.vb
  • %TEMP%\0ibxdzi-.out
  • %TEMP%\0ibxdzi-.cmdline
  • %TEMP%\r9xbzz6c.out
  • %TEMP%\r9xbzz6c.0.vb
  • %TEMP%\r9xbzz6c.cmdline
  • %TEMP%\vwbidk_7.cmdline
  • %TEMP%\vwbidk_7.out
  • %TEMP%\vwbidk_7.0.vb
  • %TEMP%\frp8gje9.0.vb
  • %TEMP%\frp8gje9.cmdline
  • %TEMP%\frp8gje9.out
  • %TEMP%\jb5dbl75.cmdline
  • %TEMP%\zpk7qtx5.cmdline
  • %TEMP%\yunvlbau.cmdline
  • %TEMP%\jb5dbl75.0.vb
  • %TEMP%\z4855k1x.out
  • %TEMP%\z4855k1x.cmdline
  • %TEMP%\kob0fgao.out
  • %TEMP%\kmvimm2p.0.vb
  • %TEMP%\kmvimm2p.cmdline
  • %TEMP%\kmvimm2p.out
  • %TEMP%\nzmtz9mk.cmdline
  • %TEMP%\nzmtz9mk.0.vb
  • %TEMP%\nzmtz9mk.out
  • %TEMP%\o-ttuyqg.cmdline
  • %TEMP%\o-ttuyqg.0.vb
  • %TEMP%\o-ttuyqg.out
  • %TEMP%\8ntf7tgh.0.vb
  • %TEMP%\8ntf7tgh.cmdline
  • %TEMP%\8ntf7tgh.out
  • %TEMP%\ohkaagxr.0.vb
  • %TEMP%\ohkaagxr.out
  • %TEMP%\ohkaagxr.cmdline
  • %TEMP%\-j-dd1bt.out
  • %TEMP%\-j-dd1bt.0.vb
  • %TEMP%\-j-dd1bt.cmdline
  • %TEMP%\z4855k1x.0.vb
  • %TEMP%\kob0fgao.0.vb
  • %TEMP%\l4jlgvlx.cmdline
  • %TEMP%\dczruohn.0.vb
  • %TEMP%\mvcyhyvr.cmdline
  • %TEMP%\x2m15q6m.out
  • %TEMP%\x2m15q6m.cmdline
  • %TEMP%\x2m15q6m.0.vb
  • %TEMP%\xizatq8-.cmdline
  • %TEMP%\xizatq8-.out
  • %TEMP%\xizatq8-.0.vb
  • %TEMP%\pqalhrlh.cmdline
  • %TEMP%\wmqonjka.0.vb
  • %TEMP%\wmqonjka.cmdline
  • %TEMP%\q_malbnu.out
  • %TEMP%\q_malbnu.cmdline
  • %TEMP%\q_malbnu.0.vb
  • %TEMP%\pwwiswpz.out
  • %TEMP%\pwwiswpz.cmdline
  • %TEMP%\pwwiswpz.0.vb
  • %TEMP%\uw7h3mge.0.vb
  • %TEMP%\stckybpr.cmdline
  • %TEMP%\wmqonjka.out
  • %TEMP%\mvcyhyvr.0.vb
  • %TEMP%\l4jlgvlx.out
  • %TEMP%\mvcyhyvr.out
  • %TEMP%\stckybpr.out
  • %TEMP%\dczruohn.cmdline
  • %TEMP%\dczruohn.out
  • %TEMP%\lrsk0f83.cmdline
  • %TEMP%\lrsk0f83.0.vb
  • %TEMP%\lrsk0f83.out
  • %TEMP%\ps3q8nj6.0.vb
  • %TEMP%\ps3q8nj6.out
  • %TEMP%\ps3q8nj6.cmdline
  • %TEMP%\2pk_m_tk.0.vb
  • %TEMP%\2pk_m_tk.cmdline
  • %TEMP%\2pk_m_tk.out
  • %TEMP%\qbedgfvs.cmdline
  • %TEMP%\qbedgfvs.out
  • %TEMP%\qbedgfvs.0.vb
  • %TEMP%\x7prgie3.out
  • %TEMP%\x7prgie3.cmdline
  • %TEMP%\stckybpr.0.vb
  • %TEMP%\l4jlgvlx.0.vb
  • %TEMP%\x7prgie3.0.vb
  • %TEMP%\jb5dbl75.out
  • %TEMP%\kob0fgao.cmdline
  • %TEMP%\zpk7qtx5.out
  • %TEMP%\zpk7qtx5.0.vb
  • %TEMP%\ccg6qjgh.cmdline
  • %TEMP%\ccg6qjgh.0.vb
  • %TEMP%\u6eabrc1.out
  • %TEMP%\u6eabrc1.cmdline
  • %TEMP%\u6eabrc1.0.vb
  • %TEMP%\9hxc_5iw.out
  • %TEMP%\9hxc_5iw.cmdline
  • %TEMP%\9hxc_5iw.0.vb
  • %TEMP%\i5txtoxk.out
  • %TEMP%\i5txtoxk.cmdline
  • %TEMP%\i5txtoxk.0.vb
  • %TEMP%\hi2wsdyf.0.vb
  • %TEMP%\hi2wsdyf.out
  • %TEMP%\hi2wsdyf.cmdline
  • %TEMP%\nj8yelvi.out
  • %TEMP%\nj8yelvi.0.vb
  • %TEMP%\nj8yelvi.cmdline
  • %TEMP%\tjuwypnw.out
  • %TEMP%\tjuwypnw.0.vb
  • %TEMP%\ccg6qjgh.out
  • %TEMP%\tjuwypnw.cmdline
  • %TEMP%\y-xsm1ls.cmdline
  • %TEMP%\y-xsm1ls.out
  • %TEMP%\88ghq9bz.cmdline
  • %TEMP%\sihha2fj.cmdline
  • %TEMP%\sihha2fj.0.vb
  • %TEMP%\sihha2fj.out
  • %TEMP%\1sihlc_e.cmdline
  • %TEMP%\1sihlc_e.out
  • %TEMP%\1sihlc_e.0.vb
  • %TEMP%\mqxuyphq.out
  • %TEMP%\mqxuyphq.0.vb
  • %TEMP%\mqxuyphq.cmdline
  • %TEMP%\l2kgisg5.out
  • %TEMP%\l2kgisg5.cmdline
  • %TEMP%\l2kgisg5.0.vb
  • %TEMP%\lxjifzgt.cmdline
  • %TEMP%\lxjifzgt.0.vb
  • %TEMP%\lxjifzgt.out
  • %TEMP%\txm1vx4a.cmdline
  • %TEMP%\txm1vx4a.out
  • %TEMP%\88ghq9bz.out
  • %TEMP%\txm1vx4a.0.vb
  • %TEMP%\y-xsm1ls.0.vb
  • %TEMP%\a7pe8wya.cmdline
  • %TEMP%\uxpiasdq.out
  • %TEMP%\m2i-1jro.0.vb
  • %TEMP%\m2i-1jro.cmdline
  • %TEMP%\tkifbevn.0.vb
  • %TEMP%\tkifbevn.out
  • %TEMP%\tkifbevn.cmdline
  • %TEMP%\zs2azvms.cmdline
  • %TEMP%\zs2azvms.0.vb
  • %TEMP%\zs2azvms.out
  • %TEMP%\9oc8g5la.cmdline
  • %TEMP%\9oc8g5la.0.vb
  • %TEMP%\9oc8g5la.out
  • %TEMP%\hyvk5e9r.out
  • %TEMP%\hyvk5e9r.0.vb
  • %TEMP%\hyvk5e9r.cmdline
  • %TEMP%\lakgh0mf.out
  • %TEMP%\lakgh0mf.cmdline
  • %TEMP%\a7pe8wya.0.vb
  • %TEMP%\bpvqrtia.out
  • %TEMP%\lakgh0mf.0.vb
  • %TEMP%\m2i-1jro.out
  • %TEMP%\a7pe8wya.out
  • %TEMP%\bpvqrtia.0.vb
  • %TEMP%\bpvqrtia.cmdline
  • %TEMP%\f0t8mnz0.cmdline
  • %TEMP%\f0t8mnz0.out
  • %TEMP%\f0t8mnz0.0.vb
  • %TEMP%\vb0ogjre.out
  • %TEMP%\vb0ogjre.cmdline
  • %TEMP%\vb0ogjre.0.vb
  • %TEMP%\oyenfjil.0.vb
  • %TEMP%\jomm_sk7.out
  • %TEMP%\oyenfjil.out
  • %TEMP%\jomm_sk7.cmdline
  • %TEMP%\1tcm5pgj.0.vb
  • %TEMP%\1tcm5pgj.cmdline
  • %TEMP%\r3bcvprd.cmdline
  • %TEMP%\r3bcvprd.out
  • %TEMP%\r3bcvprd.0.vb
  • %TEMP%\iqymujfa.0.vb
  • %TEMP%\iqymujfa.cmdline
  • %TEMP%\iqymujfa.out
  • %TEMP%\uxpiasdq.0.vb
  • %TEMP%\uxpiasdq.cmdline
  • %TEMP%\1tcm5pgj.out
  • %TEMP%\mgpiridx.0.vb
Network activity
UDP
  • DNS ASK ou####k.myvnc.com
Miscellaneous
Creates and executes the following
  • '%TEMP%\svchost.bat'
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0v33sibj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\l2k3cpun.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ucv3q0du.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rrb059lb.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0m8uftth.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hvrz9mai.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\65rtc9-3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\exds2tvf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\d9cplva4.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ul_bip3g.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\iqkiygvq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5kgw_gwr.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yzoefkmk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\eecjdsab.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uau74djt.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7u_sr_ih.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fac1apnq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\idwaygu4.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cdcmlmcf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ss2w_aio.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fuylyjrc.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\n82ff1og.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qpzawkam.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\k3_-nn3_.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gaqy4mdv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mokyxxoy.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\n5lt_y29.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\l4dgytjn.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ol0cvzqd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qe_qu9jj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\heqpuvc9.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\l-wbh_fw.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gjt_fx8r.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\q-whn_ln.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vwfyhr20.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4qi5-spk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9dfpd_fc.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zzqgqqfv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ttqre0n5.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-8jszjhk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mhrndqg9.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yzznd-g_.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rrrksnty.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gmbfzfvh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ndhumc7d.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jvcipmte.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pr1tsdkk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vphaysdq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\aenod4_m.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7ubfmqhp.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3ykkqwfv.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gs6cxvnp.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kf1nrxk_.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ludhsmvg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\q-itzovx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kba1iqi6.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ntgm2thn.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sy9rzxok.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\indcyp2r.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7zogzdwj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\f5a9neru.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\x-lvklco.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ftztnvly.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\31ohrykn.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\i2_6trcl.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_f7y9nt3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dzveu7yk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\65xiakg6.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\r_epowcf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\plt57gix.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ftekd5cb.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\v3b5k5zs.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hyv0egyw.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\c4jokujp.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mgpiridx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\t1qpo8de.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wlifbfe-.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qekq92cu.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kntbcosu.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sbs6xvbn.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\seqtuirc.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mr5nvlgr.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mvbowkmh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4xmvcdee.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kigrm-id.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ft3zkb6n.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tp5n78ug.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uh56xxb9.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8xn4qkmu.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2r67uefr.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\enwqkbuj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rf3hms3t.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vfn1zklw.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9li4pq-r.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\av155unz.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\om27wpef.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tn7hpvd3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\88qozk-4.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gqxj08kl.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sa6sl_dx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gsgb-t9m.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cd_9gvgo.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bcsm1ejl.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zusafykf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jznudiii.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yd3ltrka.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4mjdvbp4.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\eo_vvvwl.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mrxgsog-.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\l02_jvr3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\d_um9n-v.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\felkjeoe.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kwjo7vt3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\w7j4z5uh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1rmfhoft.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gwt8tjtp.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9bqp-1yj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rk8nmxxz.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cosiseox.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jzdfcfdl.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\s8xufieg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yuv4qjx8.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nxyhy710.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uw7h3mge.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jb5dbl75.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jqsg8g_o.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bgi96sdh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cdy-iran.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\f5z5oaiy.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\algclaod.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\407cto6r.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7hxgozib.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\00ivouno.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-ozsjgz9.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pqalhrlh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vrqp5nyq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\eznyrp8t.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5c2n2ymb.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yfdszmsp.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-kwx2w5y.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vg7xpnfg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\felhyj2u.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wgvavpis.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1fhmrhzq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ksuwg8s7.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ke_jw2l_.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\k_3jf2zk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ajns6heh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wyo8e7pb.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3n0wx-mh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_usr4gek.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4id1dtk2.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\j3tgc2an.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\711hsohc.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\epz6qon9.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hixpfvc1.cmdline"' (with hidden window)
  • '%TEMP%\svchost.bat' ' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bpkh9qag.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0i7-ddm4.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8yspj4oh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_zwvu_rl.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\o3anxtcl.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ief7rkdn.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\90dngrvz.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dl5w-1_g.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-58cyadw.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lpdri2vu.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ekgrs1uj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\78ybi_pi.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pgobg255.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lblvrf63.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ll42kzja.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wnewuwef.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\stehchkg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ezllbfmb.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3rua_yq1.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qg_5ic2p.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xusfsfel.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9j6vwrer.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\iril_uyd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5w2dsfr3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\y4emxvhx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xabrlj1-.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mpkrs3jt.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6-8qlh7q.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ldrfhlic.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\c73nfutz.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kmvimm2p.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nzmtz9mk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\o-ttuyqg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8ntf7tgh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ohkaagxr.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-j-dd1bt.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\z4855k1x.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yunvlbau.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gv9r8nit.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0ibxdzi-.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\r9xbzz6c.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vwbidk_7.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\q_malbnu.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\frp8gje9.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\l4jlgvlx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dczruohn.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lrsk0f83.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ps3q8nj6.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2pk_m_tk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qbedgfvs.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\x7prgie3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\stckybpr.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mvcyhyvr.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\x2m15q6m.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xizatq8-.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wmqonjka.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zpk7qtx5.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kob0fgao.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lakgh0mf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hyvk5e9r.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9oc8g5la.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\88ghq9bz.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sihha2fj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1sihlc_e.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mqxuyphq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\l2kgisg5.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lxjifzgt.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\txm1vx4a.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tjuwypnw.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ccg6qjgh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\u6eabrc1.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9hxc_5iw.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\i5txtoxk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pwwiswpz.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nj8yelvi.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hi2wsdyf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uxpiasdq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\f0t8mnz0.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vb0ogjre.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\oyenfjil.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1tcm5pgj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\r3bcvprd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\iqymujfa.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bpvqrtia.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\a7pe8wya.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\m2i-1jro.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tkifbevn.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zs2azvms.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jomm_sk7.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\y-xsm1ls.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8cyhgln9.cmdline"' (with hidden window)
Executes the following
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bpkh9qag.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\l2k3cpun.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ucv3q0du.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rrb059lb.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0m8uftth.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hvrz9mai.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\65rtc9-3.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\exds2tvf.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\d9cplva4.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ul_bip3g.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\iqkiygvq.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5kgw_gwr.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yzoefkmk.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\eecjdsab.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uau74djt.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7u_sr_ih.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fac1apnq.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\idwaygu4.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cdcmlmcf.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ss2w_aio.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fuylyjrc.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\n82ff1og.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qpzawkam.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\k3_-nn3_.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gaqy4mdv.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mokyxxoy.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\n5lt_y29.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ol0cvzqd.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0v33sibj.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7zogzdwj.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\l4dgytjn.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\indcyp2r.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gjt_fx8r.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\q-whn_ln.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vwfyhr20.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4qi5-spk.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9dfpd_fc.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zzqgqqfv.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ttqre0n5.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-8jszjhk.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mhrndqg9.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yzznd-g_.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rrrksnty.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gmbfzfvh.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ndhumc7d.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jvcipmte.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pr1tsdkk.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vphaysdq.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\aenod4_m.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7ubfmqhp.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3ykkqwfv.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gs6cxvnp.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kf1nrxk_.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ludhsmvg.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\q-itzovx.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kba1iqi6.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ntgm2thn.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sy9rzxok.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\heqpuvc9.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qe_qu9jj.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rf3hms3t.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mgpiridx.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\s8xufieg.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2r67uefr.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ftztnvly.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\31ohrykn.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\i2_6trcl.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_f7y9nt3.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dzveu7yk.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\65xiakg6.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\r_epowcf.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\plt57gix.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ftekd5cb.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\v3b5k5zs.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hyv0egyw.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\c4jokujp.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\t1qpo8de.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nxyhy710.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wlifbfe-.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qekq92cu.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kntbcosu.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sbs6xvbn.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\seqtuirc.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mr5nvlgr.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mvbowkmh.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4xmvcdee.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kigrm-id.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ft3zkb6n.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tp5n78ug.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uh56xxb9.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8xn4qkmu.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\l-wbh_fw.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\enwqkbuj.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vfn1zklw.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9li4pq-r.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\av155unz.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\om27wpef.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tn7hpvd3.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\88qozk-4.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gqxj08kl.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sa6sl_dx.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gsgb-t9m.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cd_9gvgo.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bcsm1ejl.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zusafykf.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jznudiii.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\eo_vvvwl.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4mjdvbp4.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yuv4qjx8.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mrxgsog-.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\l02_jvr3.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\d_um9n-v.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\felkjeoe.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kwjo7vt3.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\w7j4z5uh.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1rmfhoft.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gwt8tjtp.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9bqp-1yj.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rk8nmxxz.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cosiseox.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jzdfcfdl.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\f5a9neru.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\x-lvklco.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yd3ltrka.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jomm_sk7.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cdy-iran.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\f5z5oaiy.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\algclaod.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\407cto6r.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7hxgozib.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\00ivouno.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-ozsjgz9.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pqalhrlh.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vrqp5nyq.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\eznyrp8t.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5c2n2ymb.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yfdszmsp.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-kwx2w5y.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vg7xpnfg.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\felhyj2u.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wgvavpis.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1fhmrhzq.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ksuwg8s7.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ke_jw2l_.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\k_3jf2zk.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ajns6heh.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wyo8e7pb.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3n0wx-mh.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_usr4gek.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4id1dtk2.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\711hsohc.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6-8qlh7q.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bgi96sdh.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ldrfhlic.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jqsg8g_o.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\epz6qon9.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0i7-ddm4.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8yspj4oh.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_zwvu_rl.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\o3anxtcl.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ief7rkdn.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\90dngrvz.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dl5w-1_g.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-58cyadw.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lpdri2vu.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ekgrs1uj.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\78ybi_pi.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pgobg255.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lblvrf63.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ll42kzja.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wnewuwef.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\stehchkg.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ezllbfmb.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3rua_yq1.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qg_5ic2p.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xusfsfel.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9j6vwrer.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\iril_uyd.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5w2dsfr3.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\y4emxvhx.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xabrlj1-.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hixpfvc1.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mpkrs3jt.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\j3tgc2an.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lakgh0mf.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pwwiswpz.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\88ghq9bz.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kmvimm2p.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nzmtz9mk.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\o-ttuyqg.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8ntf7tgh.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ohkaagxr.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-j-dd1bt.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\z4855k1x.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yunvlbau.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gv9r8nit.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0ibxdzi-.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\r9xbzz6c.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vwbidk_7.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\frp8gje9.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jb5dbl75.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\l4jlgvlx.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dczruohn.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lrsk0f83.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ps3q8nj6.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2pk_m_tk.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qbedgfvs.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\x7prgie3.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\stckybpr.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mvcyhyvr.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\x2m15q6m.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xizatq8-.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wmqonjka.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\q_malbnu.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kob0fgao.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uw7h3mge.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zpk7qtx5.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hyvk5e9r.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sihha2fj.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1sihlc_e.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mqxuyphq.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\l2kgisg5.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lxjifzgt.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\txm1vx4a.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tjuwypnw.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ccg6qjgh.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\u6eabrc1.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9hxc_5iw.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\i5txtoxk.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hi2wsdyf.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nj8yelvi.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\y-xsm1ls.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uxpiasdq.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\f0t8mnz0.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vb0ogjre.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\oyenfjil.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1tcm5pgj.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\r3bcvprd.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\iqymujfa.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bpvqrtia.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\a7pe8wya.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\m2i-1jro.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tkifbevn.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zs2azvms.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9oc8g5la.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\c73nfutz.cmdline"
  • '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8cyhgln9.cmdline"

Рекомендации по лечению

  1. В случае если операционная система способна загрузиться (в штатном режиме или режиме защиты от сбоев), скачайте лечащую утилиту Dr.Web CureIt! и выполните с ее помощью полную проверку вашего компьютера, а также используемых вами переносных носителей информации.
  2. Если загрузка операционной системы невозможна, измените настройки BIOS вашего компьютера, чтобы обеспечить возможность загрузки ПК с компакт-диска или USB-накопителя. Скачайте образ аварийного диска восстановления системы Dr.Web® LiveDisk или утилиту записи Dr.Web® LiveDisk на USB-накопитель, подготовьте соответствующий носитель. Загрузив компьютер с использованием данного носителя, выполните его полную проверку и лечение обнаруженных угроз.
Скачать Dr.Web

По серийному номеру

Выполните полную проверку системы с использованием Антивируса Dr.Web Light для macOS. Данный продукт можно загрузить с официального сайта Apple App Store.

На загруженной ОС выполните полную проверку всех дисковых разделов с использованием продукта Антивирус Dr.Web для Linux.

Скачать Dr.Web

По серийному номеру

  1. Если мобильное устройство функционирует в штатном режиме, загрузите и установите на него бесплатный антивирусный продукт Dr.Web для Android Light. Выполните полную проверку системы и используйте рекомендации по нейтрализации обнаруженных угроз.
  2. Если мобильное устройство заблокировано троянцем-вымогателем семейства Android.Locker (на экране отображается обвинение в нарушении закона, требование выплаты определенной денежной суммы или иное сообщение, мешающее нормальной работе с устройством), выполните следующие действия:
    • загрузите свой смартфон или планшет в безопасном режиме (в зависимости от версии операционной системы и особенностей конкретного мобильного устройства эта процедура может быть выполнена различными способами; обратитесь за уточнением к инструкции, поставляемой вместе с приобретенным аппаратом, или напрямую к его производителю);
    • после активации безопасного режима установите на зараженное устройство бесплатный антивирусный продукт Dr.Web для Android Light и произведите полную проверку системы, выполнив рекомендации по нейтрализации обнаруженных угроз;
    • выключите устройство и включите его в обычном режиме.

Подробнее о Dr.Web для Android

Демо бесплатно на 14 дней

Выдаётся при установке