Trojan.MulDrop11.19123

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\photshoop.exe
%APPDATA%\microsoft\windows\start menu\programs\startup\photshop.url

Modifies file system

Creates the following files

%APPDATA%\photshop.exe
%TEMP%\4zbn4fe4.out
%TEMP%\4zbn4fe4.cmdline
%TEMP%\4zbn4fe4.0.vb
%APPDATA%\random\optional\winamp.exe
%TEMP%\resfbe7.tmp
%TEMP%\vbcfbe6.tmp
%TEMP%\cuer02te.out
%TEMP%\cuer02te.cmdline
%TEMP%\cuer02te.0.vb
%APPDATA%\random\optional\qip 2012.exe
%TEMP%\resf85d.tmp
%TEMP%\vbcf83d.tmp
%TEMP%\vbcff51.tmp
%TEMP%\a_c78pw6.out
%TEMP%\a_c78pw6.0.vb
%APPDATA%\random\optional\mozilla thunderbird.exe
%TEMP%\resf484.tmp
%TEMP%\vbcf474.tmp
%TEMP%\jj4dovzz.out
%TEMP%\jj4dovzz.cmdline
%TEMP%\jj4dovzz.0.vb
%APPDATA%\random\optional\mail.ru agent.exe
%TEMP%\resf119.tmp
%TEMP%\vbcf118.tmp
%TEMP%\vehmx6wi.out
%TEMP%\vehmx6wi.cmdline
%TEMP%\a_c78pw6.cmdline
%TEMP%\resff52.tmp
%APPDATA%\random\default\icq.exe
%TEMP%\-31jyoyc.0.vb
%TEMP%\vbc10f5.tmp
%TEMP%\g7ygmnpa.out
%TEMP%\g7ygmnpa.cmdline
%TEMP%\g7ygmnpa.0.vb
%APPDATA%\random\default\total commander 64 bit.exe
%TEMP%\resdba.tmp
%TEMP%\vbcdb9.tmp
%TEMP%\xi2jqkaz.out
%TEMP%\xi2jqkaz.cmdline
%TEMP%\xi2jqkaz.0.vb
%APPDATA%\random\default\telegram.exe
%TEMP%\resa5e.tmp
%TEMP%\vbca4e.tmp
%TEMP%\uyngotah.out
%TEMP%\uyngotah.cmdline
%TEMP%\uyngotah.0.vb
%APPDATA%\random\default\qip 2012.exe
%TEMP%\res6f3.tmp
%TEMP%\vbc6f2.tmp
%TEMP%\tjiqdhis.out
%TEMP%\tjiqdhis.cmdline
%TEMP%\tjiqdhis.0.vb
%APPDATA%\random\default\mail.ru agent.exe
%TEMP%\res359.tmp
%TEMP%\vbc358.tmp
%TEMP%\-31jyoyc.out
%TEMP%\-31jyoyc.cmdline
%TEMP%\vehmx6wi.0.vb
%TEMP%\res10f6.tmp
%APPDATA%\random\optional\launch internet explorer browser.exe
%TEMP%\vbcedbd.tmp
%TEMP%\wigcg0dv.cmdline
%TEMP%\wigcg0dv.0.vb
%APPDATA%\random\mail.ru agent.exe
%TEMP%\resd5a2.tmp
%TEMP%\vbcd592.tmp
%TEMP%\co_k4p_t.out
%TEMP%\co_k4p_t.cmdline
%TEMP%\co_k4p_t.0.vb
%APPDATA%\random\internet explorer.exe
%TEMP%\resd1ca.tmp
%TEMP%\vbcd1c9.tmp
%TEMP%\g1gbjxrs.out
%TEMP%\wigcg0dv.out
%TEMP%\g1gbjxrs.cmdline
%APPDATA%\random\icq.exe
%TEMP%\rescdc3.tmp
%TEMP%\vbccdb2.tmp
%TEMP%\dxlmbbzn.out
%TEMP%\dxlmbbzn.cmdline
%TEMP%\dxlmbbzn.0.vb
%APPDATA%\random\google chrome.exe
%TEMP%\resc95e.tmp
%TEMP%\vbcc95d.tmp
%TEMP%\30cg5q6m.out
%TEMP%\30cg5q6m.cmdline
%TEMP%\30cg5q6m.0.vb
%TEMP%\g1gbjxrs.0.vb
%TEMP%\vbcd94b.tmp
%TEMP%\resd94c.tmp
%APPDATA%\random\opera.exe
%TEMP%\1xebgvzl.out
%TEMP%\1xebgvzl.cmdline
%TEMP%\1xebgvzl.0.vb
%APPDATA%\random\optional\icq.exe
%TEMP%\resea63.tmp
%TEMP%\vbcea62.tmp
%TEMP%\2add_5n4.out
%TEMP%\2add_5n4.cmdline
%TEMP%\2add_5n4.0.vb
%APPDATA%\random\optional\google chrome.exe
%TEMP%\rese5b0.tmp
%TEMP%\vbce59f.tmp
%TEMP%\wdamhkqm.out
%TEMP%\wdamhkqm.cmdline
%TEMP%\wdamhkqm.0.vb
%APPDATA%\random\windows media player.exe
%TEMP%\rese1c8.tmp
%TEMP%\vbce1c7.tmp
%TEMP%\k08d8xgk.out
%TEMP%\k08d8xgk.cmdline
%TEMP%\k08d8xgk.0.vb
%APPDATA%\random\windows explorer.exe
%TEMP%\resdd24.tmp
%TEMP%\vbcdd23.tmp
%TEMP%\_qtbpstu.out
%TEMP%\_qtbpstu.cmdline
%TEMP%\_qtbpstu.0.vb
%TEMP%\resedbe.tmp
%APPDATA%\random\default\acrobat reader dc.exe

Deletes the following files

%TEMP%\resc95e.tmp
%TEMP%\4zbn4fe4.cmdline
%TEMP%\4zbn4fe4.out
%TEMP%\vbcff51.tmp
%TEMP%\resff52.tmp
%TEMP%\cuer02te.0.vb
%TEMP%\cuer02te.out
%TEMP%\cuer02te.cmdline
%TEMP%\vbcfbe6.tmp
%TEMP%\resfbe7.tmp
%TEMP%\a_c78pw6.out
%TEMP%\a_c78pw6.cmdline
%TEMP%\a_c78pw6.0.vb
%TEMP%\vbcf83d.tmp
%TEMP%\resf85d.tmp
%TEMP%\jj4dovzz.cmdline
%TEMP%\jj4dovzz.out
%TEMP%\jj4dovzz.0.vb
%TEMP%\vbcf474.tmp
%TEMP%\resf484.tmp
%TEMP%\vehmx6wi.0.vb
%TEMP%\vehmx6wi.out
%TEMP%\vbcf118.tmp
%TEMP%\vehmx6wi.cmdline
%TEMP%\4zbn4fe4.0.vb
%TEMP%\res359.tmp
%TEMP%\g7ygmnpa.cmdline
%TEMP%\vbc10f5.tmp
%TEMP%\res10f6.tmp
%TEMP%\xi2jqkaz.cmdline
%TEMP%\xi2jqkaz.out
%TEMP%\xi2jqkaz.0.vb
%TEMP%\vbcdb9.tmp
%TEMP%\resdba.tmp
%TEMP%\uyngotah.0.vb
%TEMP%\uyngotah.out
%TEMP%\vbca4e.tmp
%TEMP%\vbce59f.tmp
%TEMP%\resa5e.tmp
%TEMP%\tjiqdhis.out
%TEMP%\tjiqdhis.cmdline
%TEMP%\tjiqdhis.0.vb
%TEMP%\vbc6f2.tmp
%TEMP%\res6f3.tmp
%TEMP%\-31jyoyc.out
%TEMP%\-31jyoyc.0.vb
%TEMP%\-31jyoyc.cmdline
%TEMP%\vbc358.tmp
%TEMP%\resf119.tmp
%TEMP%\1xebgvzl.out
%TEMP%\1xebgvzl.cmdline
%TEMP%\resd94c.tmp
%TEMP%\co_k4p_t.0.vb
%TEMP%\co_k4p_t.cmdline
%TEMP%\co_k4p_t.out
%TEMP%\vbcd592.tmp
%TEMP%\resd5a2.tmp
%TEMP%\g1gbjxrs.out
%TEMP%\g1gbjxrs.0.vb
%TEMP%\g1gbjxrs.cmdline
%TEMP%\vbcd1c9.tmp
%TEMP%\resd1ca.tmp
%TEMP%\dxlmbbzn.cmdline
%TEMP%\dxlmbbzn.0.vb
%TEMP%\dxlmbbzn.out
%TEMP%\vbccdb2.tmp
%TEMP%\rescdc3.tmp
%TEMP%\30cg5q6m.cmdline
%TEMP%\30cg5q6m.0.vb
%TEMP%\30cg5q6m.out
%TEMP%\vbcc95d.tmp
%TEMP%\wigcg0dv.0.vb
%TEMP%\wigcg0dv.cmdline
%TEMP%\vbcd94b.tmp
%TEMP%\wigcg0dv.out
%TEMP%\1xebgvzl.0.vb
%TEMP%\resdd24.tmp
%TEMP%\vbcedbd.tmp
%TEMP%\resedbe.tmp
%TEMP%\2add_5n4.out
%TEMP%\2add_5n4.0.vb
%TEMP%\2add_5n4.cmdline
%TEMP%\vbcea62.tmp
%TEMP%\resea63.tmp
%TEMP%\wdamhkqm.cmdline
%TEMP%\wdamhkqm.out
%TEMP%\uyngotah.cmdline
%TEMP%\g7ygmnpa.0.vb
%TEMP%\rese5b0.tmp
%TEMP%\k08d8xgk.0.vb
%TEMP%\k08d8xgk.cmdline
%TEMP%\k08d8xgk.out
%TEMP%\vbce1c7.tmp
%TEMP%\rese1c8.tmp
%TEMP%\_qtbpstu.0.vb
%TEMP%\_qtbpstu.cmdline
%TEMP%\_qtbpstu.out
%TEMP%\vbcdd23.tmp
%TEMP%\wdamhkqm.0.vb
%TEMP%\g7ygmnpa.out

Moves the following files

from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk to %APPDATA%\random\google chrome.lnk
from C:\users\public\desktop\opera.lnk to %APPDATA%\random\default\opera.lnk
from C:\users\public\desktop\mozilla thunderbird.lnk to %APPDATA%\random\default\mozilla thunderbird.lnk
from C:\users\public\desktop\mozilla firefox.lnk to %APPDATA%\random\default\mozilla firefox.lnk
from C:\users\public\desktop\mirc.lnk to %APPDATA%\random\default\mirc.lnk
from C:\users\public\desktop\google chrome.lnk to %APPDATA%\random\default\google chrome.lnk
from C:\users\public\desktop\acrobat reader dc.lnk to %APPDATA%\random\default\acrobat reader dc.lnk
from %HOMEPATH%\desktop\total commander 64 bit.lnk to %APPDATA%\random\default\total commander 64 bit.lnk
from %HOMEPATH%\desktop\telegram.lnk to %APPDATA%\random\default\telegram.lnk
from %HOMEPATH%\desktop\qip 2012.lnk to %APPDATA%\random\default\qip 2012.lnk
from %HOMEPATH%\desktop\mail.ru agent.lnk to %APPDATA%\random\default\mail.ru agent.lnk
from %HOMEPATH%\desktop\icq.lnk to %APPDATA%\random\default\icq.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk to %APPDATA%\random\optional\window switcher.lnk
from C:\users\public\desktop\steam.lnk to %APPDATA%\random\default\steam.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\winamp.lnk to %APPDATA%\random\optional\winamp.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\qip 2012.lnk to %APPDATA%\random\optional\qip 2012.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\mozilla thunderbird.lnk to %APPDATA%\random\optional\mozilla thunderbird.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\mail.ru agent.lnk to %APPDATA%\random\optional\mail.ru agent.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk to %APPDATA%\random\optional\launch internet explorer browser.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\icq.lnk to %APPDATA%\random\optional\icq.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk to %APPDATA%\random\optional\google chrome.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk to %APPDATA%\random\windows media player.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk to %APPDATA%\random\windows explorer.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk to %APPDATA%\random\opera.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\mail.ru agent.lnk to %APPDATA%\random\mail.ru agent.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk to %APPDATA%\random\internet explorer.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\icq.lnk to %APPDATA%\random\icq.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk to %APPDATA%\random\optional\shows desktop.lnk
from C:\users\public\desktop\winamp.lnk to %APPDATA%\random\default\winamp.lnk

Substitutes the following files

%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
%HOMEPATH%\Desktop\Telegram.lnk
%HOMEPATH%\Desktop\QIP 2012.lnk
%HOMEPATH%\Desktop\Mail.Ru Agent.lnk
%HOMEPATH%\Desktop\ICQ.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Winamp.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\QIP 2012.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Mozilla Thunderbird.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Mail.Ru Agent.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\ICQ.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Opera.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mail.Ru Agent.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\ICQ.lnk
%HOMEPATH%\Desktop\Total Commander 64 bit.lnk
C:\Users\Public\Desktop\Acrobat Reader DC.lnk

Network activity

UDP

DNS ASK my###9.ddns.net
DNS ASK my###8.ddns.net

Miscellaneous

Creates and executes the following

'%APPDATA%\photshop.exe'
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4zbn4fe4.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFF52.tmp" "%TEMP%\vbcFF51.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-31jyoyc.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES359.tmp" "%TEMP%\vbc358.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tjiqdhis.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6F3.tmp" "%TEMP%\vbc6F2.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uyngotah.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA5E.tmp" "%TEMP%\vbcA4E.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xi2jqkaz.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDBA.tmp" "%TEMP%\vbcDB9.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\g7ygmnpa.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kkdkfnqu.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hxuepe-y.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES16C2.tmp" "%TEMP%\vbc16C1.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hr7lbjph.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1868.tmp" "%TEMP%\vbc1867.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3vwfe0ax.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES19EF.tmp" "%TEMP%\vbc19DE.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1xkqk4xx.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1EA2.tmp" "%TEMP%\vbc1EA1.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bqwtq4h0.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2057.tmp" "%TEMP%\vbc2056.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zrkcqlec.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES21CE.tmp" "%TEMP%\vbc21CD.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFBE7.tmp" "%TEMP%\vbcFBE6.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES10F6.tmp" "%TEMP%\vbc10F5.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cuer02te.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDD24.tmp" "%TEMP%\vbcDD23.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\30cg5q6m.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC95E.tmp" "%TEMP%\vbcC95D.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dxlmbbzn.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCDC3.tmp" "%TEMP%\vbcCDB2.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\g1gbjxrs.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD1CA.tmp" "%TEMP%\vbcD1C9.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\co_k4p_t.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD5A2.tmp" "%TEMP%\vbcD592.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wigcg0dv.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD94C.tmp" "%TEMP%\vbcD94B.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_qtbpstu.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\k08d8xgk.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\a_c78pw6.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE1C8.tmp" "%TEMP%\vbcE1C7.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wdamhkqm.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE5B0.tmp" "%TEMP%\vbcE59F.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2add_5n4.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEA63.tmp" "%TEMP%\vbcEA62.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1xebgvzl.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEDBE.tmp" "%TEMP%\vbcEDBD.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vehmx6wi.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF119.tmp" "%TEMP%\vbcF118.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jj4dovzz.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF484.tmp" "%TEMP%\vbcF474.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF85D.tmp" "%TEMP%\vbcF83D.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2345.tmp" "%TEMP%\vbc2344.tmp"' (with hidden window)

Executes the following

'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\30cg5q6m.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-31jyoyc.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES359.tmp" "%TEMP%\vbc358.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tjiqdhis.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6F3.tmp" "%TEMP%\vbc6F2.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uyngotah.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA5E.tmp" "%TEMP%\vbcA4E.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xi2jqkaz.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDBA.tmp" "%TEMP%\vbcDB9.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\g7ygmnpa.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES10F6.tmp" "%TEMP%\vbc10F5.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE1C8.tmp" "%TEMP%\vbcE1C7.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kkdkfnqu.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hr7lbjph.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1868.tmp" "%TEMP%\vbc1867.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3vwfe0ax.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES19EF.tmp" "%TEMP%\vbc19DE.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1xkqk4xx.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1EA2.tmp" "%TEMP%\vbc1EA1.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bqwtq4h0.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2057.tmp" "%TEMP%\vbc2056.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zrkcqlec.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES21CE.tmp" "%TEMP%\vbc21CD.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4zbn4fe4.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFF52.tmp" "%TEMP%\vbcFF51.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFBE7.tmp" "%TEMP%\vbcFBE6.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cuer02te.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF85D.tmp" "%TEMP%\vbcF83D.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dxlmbbzn.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCDC3.tmp" "%TEMP%\vbcCDB2.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\g1gbjxrs.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD1CA.tmp" "%TEMP%\vbcD1C9.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\co_k4p_t.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD5A2.tmp" "%TEMP%\vbcD592.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wigcg0dv.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD94C.tmp" "%TEMP%\vbcD94B.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_qtbpstu.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDD24.tmp" "%TEMP%\vbcDD23.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hxuepe-y.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES16C2.tmp" "%TEMP%\vbc16C1.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\k08d8xgk.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE5B0.tmp" "%TEMP%\vbcE59F.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2add_5n4.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEA63.tmp" "%TEMP%\vbcEA62.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1xebgvzl.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEDBE.tmp" "%TEMP%\vbcEDBD.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vehmx6wi.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF119.tmp" "%TEMP%\vbcF118.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jj4dovzz.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF484.tmp" "%TEMP%\vbcF474.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\a_c78pw6.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC95E.tmp" "%TEMP%\vbcC95D.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wdamhkqm.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2345.tmp" "%TEMP%\vbc2344.tmp"

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней