Trojan.MulDrop11.44816

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'PCPRwgysHiDkyROmovTaTKJkn' = '%APPDATA%\dJuYdEiohKAP.exe'

Modifies file system

Creates the following files

%TEMP%\gmhkhas5.0.vb
%TEMP%\htm8-ny9.dll
%TEMP%\hihf6ymh.0.vb
%TEMP%\hihf6ymh.cmdline
%TEMP%\hihf6ymh.out
%TEMP%\vbc9865.tmp
%TEMP%\res9875.tmp
%TEMP%\hihf6ymh.dll
%TEMP%\mana6uyw.0.vb
%TEMP%\mana6uyw.cmdline
%TEMP%\mana6uyw.out
%TEMP%\vbca3ee.tmp
%TEMP%\resa3fe.tmp
%TEMP%\mana6uyw.dll
%TEMP%\9aczhqvm.0.vb
%TEMP%\9aczhqvm.cmdline
%TEMP%\9aczhqvm.out
%TEMP%\vbcac1b.tmp
%TEMP%\resac2c.tmp
%TEMP%\9aczhqvm.dll
%TEMP%\kzltmk64.0.vb
%TEMP%\kzltmk64.cmdline
%TEMP%\res91de.tmp
%TEMP%\kzltmk64.out
%TEMP%\vbc91cd.tmp
%TEMP%\htm8-ny9.cmdline
%TEMP%\res71e2.tmp
%TEMP%\l1ob7wls.dll
%TEMP%\ug-hsdgp.0.vb
%TEMP%\ug-hsdgp.cmdline
%TEMP%\ug-hsdgp.out
%TEMP%\vbc7b19.tmp
%TEMP%\res7b29.tmp
%TEMP%\ug-hsdgp.dll
%TEMP%\huswopi5.0.vb
%TEMP%\huswopi5.cmdline
%TEMP%\huswopi5.out
%TEMP%\vbc8346.tmp
%TEMP%\res8347.tmp
%TEMP%\huswopi5.dll
%TEMP%\0egopkxl.0.vb
%TEMP%\0egopkxl.cmdline
%TEMP%\0egopkxl.out
%TEMP%\vbc8b36.tmp
%TEMP%\res8b46.tmp
%TEMP%\0egopkxl.dll
%TEMP%\htm8-ny9.0.vb
%TEMP%\htm8-ny9.out
%TEMP%\resccf3.tmp
%TEMP%\resdef4.tmp
%TEMP%\kzltmk64.dll
%TEMP%\qznrb_oy.cmdline
%TEMP%\qznrb_oy.out
%TEMP%\vbcd147.tmp
%TEMP%\resd158.tmp
%TEMP%\qznrb_oy.dll
%TEMP%\nbuw0zia.0.vb
%TEMP%\nbuw0zia.cmdline
%TEMP%\nbuw0zia.out
%TEMP%\vbcd5db.tmp
%TEMP%\resd5ec.tmp
%TEMP%\nbuw0zia.dll
%TEMP%\jcn-ckq9.0.vb
%TEMP%\jcn-ckq9.cmdline
%TEMP%\jcn-ckq9.out
%TEMP%\vbcda11.tmp
%TEMP%\resda22.tmp
%TEMP%\jcn-ckq9.dll
%TEMP%\xjox6r5i.0.vb
%TEMP%\xjox6r5i.cmdline
%TEMP%\xjox6r5i.out
%TEMP%\vbcdee3.tmp
%TEMP%\qznrb_oy.0.vb
%TEMP%\vbc71d2.tmp
%TEMP%\cyewo2uk.dll
%TEMP%\vbccce2.tmp
%TEMP%\qyy5fsxc.0.vb
%TEMP%\qyy5fsxc.cmdline
%TEMP%\qyy5fsxc.out
%TEMP%\vbcbad1.tmp
%TEMP%\resbad2.tmp
%TEMP%\qyy5fsxc.dll
%TEMP%\2weglvby.0.vb
%TEMP%\2weglvby.cmdline
%TEMP%\2weglvby.out
%TEMP%\vbcc3f9.tmp
%TEMP%\resc409.tmp
%TEMP%\2weglvby.dll
%TEMP%\ndmftm-2.0.vb
%TEMP%\ndmftm-2.cmdline
%TEMP%\ndmftm-2.out
%TEMP%\vbcc89c.tmp
%TEMP%\resc89d.tmp
%TEMP%\ndmftm-2.dll
%TEMP%\cyewo2uk.0.vb
%TEMP%\cyewo2uk.cmdline
%TEMP%\cyewo2uk.out
%TEMP%\vbcb37e.tmp
%TEMP%\resb37f.tmp
%TEMP%\l1ob7wls.out
%TEMP%\v8y2kxge.0.vb
%TEMP%\cqfspkh-.cmdline
%TEMP%\cqfspkh-.out
%TEMP%\vbce64b.tmp
%TEMP%\rese64c.tmp
%TEMP%\cqfspkh-.dll
%TEMP%\wrhb-0q5.0.vb
%TEMP%\wrhb-0q5.cmdline
%TEMP%\wrhb-0q5.out
%TEMP%\vbcee0b.tmp
%TEMP%\resee1c.tmp
%TEMP%\wrhb-0q5.dll
%TEMP%\fzms_cmo.0.vb
%TEMP%\fzms_cmo.cmdline
%TEMP%\fzms_cmo.out
%TEMP%\vbcf5fa.tmp
%TEMP%\resf60b.tmp
%TEMP%\fzms_cmo.dll
%TEMP%\mwa0hpvh.0.vb
%TEMP%\mwa0hpvh.cmdline
%TEMP%\mwa0hpvh.out
%TEMP%\vbc9c1.tmp
%TEMP%\cqfspkh-.0.vb
%TEMP%\resa10.tmp
%TEMP%\6xu4bzji.dll
%TEMP%\vbcde1d.tmp
%TEMP%\gmhkhas5.cmdline
%TEMP%\gmhkhas5.out
%TEMP%\vbcc100.tmp
%TEMP%\resc120.tmp
%TEMP%\gmhkhas5.dll
%APPDATA%\djuydeiohkap.exe
%TEMP%\qqkzewlp.0.vb
%TEMP%\qqkzewlp.cmdline
%TEMP%\qqkzewlp.out
%TEMP%\vbccaa5.tmp
%TEMP%\rescab5.tmp
%TEMP%\qqkzewlp.dll
%TEMP%\azba7whr.0.vb
%TEMP%\azba7whr.cmdline
%TEMP%\azba7whr.out
%TEMP%\vbcd340.tmp
%TEMP%\resd350.tmp
%TEMP%\azba7whr.dll
%TEMP%\6xu4bzji.0.vb
%TEMP%\6xu4bzji.cmdline
%TEMP%\6xu4bzji.out
%TEMP%\resde2e.tmp
%TEMP%\scqqu1n3.0.vb
%TEMP%\l1ob7wls.0.vb
%TEMP%\v8y2kxge.cmdline
%TEMP%\vbc3fe4.tmp
%TEMP%\res3ff5.tmp
%TEMP%\scqqu1n3.dll
%TEMP%\tbrzvkhs.0.vb
%TEMP%\tbrzvkhs.cmdline
%TEMP%\tbrzvkhs.out
%TEMP%\vbc4c67.tmp
%TEMP%\res4c78.tmp
%TEMP%\tbrzvkhs.dll
%TEMP%\m1wq8h6n.0.vb
%TEMP%\m1wq8h6n.cmdline
%TEMP%\m1wq8h6n.out
%TEMP%\vbc588d.tmp
%TEMP%\res589d.tmp
%TEMP%\m1wq8h6n.dll
%TEMP%\uzv2dnmy.0.vb
%TEMP%\uzv2dnmy.cmdline
%TEMP%\uzv2dnmy.out
%TEMP%\vbc660a.tmp
%TEMP%\res661b.tmp
%TEMP%\uzv2dnmy.dll
%TEMP%\scqqu1n3.out
%TEMP%\l1ob7wls.cmdline
%TEMP%\scqqu1n3.cmdline
%TEMP%\obxddand.dll
%TEMP%\v8y2kxge.out
%TEMP%\vbc1395.tmp
%TEMP%\res1396.tmp
%TEMP%\v8y2kxge.dll
%TEMP%\eqxcemsp.0.vb
%TEMP%\eqxcemsp.cmdline
%TEMP%\eqxcemsp.out
%TEMP%\vbc1faa.tmp
%TEMP%\res1fcb.tmp
%TEMP%\eqxcemsp.dll
%TEMP%\whgbktxh.0.vb
%TEMP%\whgbktxh.cmdline
%TEMP%\whgbktxh.out
%TEMP%\vbc299d.tmp
%TEMP%\res29ae.tmp
%TEMP%\whgbktxh.dll
%TEMP%\obxddand.0.vb
%TEMP%\obxddand.cmdline
%TEMP%\obxddand.out
%TEMP%\vbc341d.tmp
%TEMP%\res342d.tmp
%TEMP%\mwa0hpvh.dll
%TEMP%\xjox6r5i.dll

Deletes the following files

%TEMP%\resc120.tmp
%TEMP%\vbc9865.tmp
%TEMP%\hihf6ymh.out
%TEMP%\hihf6ymh.cmdline
%TEMP%\hihf6ymh.0.vb
%TEMP%\hihf6ymh.dll
%TEMP%\resa3fe.tmp
%TEMP%\vbca3ee.tmp
%TEMP%\mana6uyw.dll
%TEMP%\htm8-ny9.cmdline
%TEMP%\res9875.tmp
%TEMP%\mana6uyw.cmdline
%TEMP%\resac2c.tmp
%TEMP%\vbcac1b.tmp
%TEMP%\9aczhqvm.dll
%TEMP%\9aczhqvm.0.vb
%TEMP%\9aczhqvm.out
%TEMP%\9aczhqvm.cmdline
%TEMP%\resb37f.tmp
%TEMP%\vbcb37e.tmp
%TEMP%\mana6uyw.0.vb
%TEMP%\mana6uyw.out
%TEMP%\htm8-ny9.out
%TEMP%\htm8-ny9.0.vb
%TEMP%\kzltmk64.cmdline
%TEMP%\vbc7b19.tmp
%TEMP%\ug-hsdgp.out
%TEMP%\ug-hsdgp.0.vb
%TEMP%\ug-hsdgp.dll
%TEMP%\ug-hsdgp.cmdline
%TEMP%\res8347.tmp
%TEMP%\vbc8346.tmp
%TEMP%\huswopi5.dll
%TEMP%\huswopi5.out
%TEMP%\huswopi5.0.vb
%TEMP%\huswopi5.cmdline
%TEMP%\res8b46.tmp
%TEMP%\vbc8b36.tmp
%TEMP%\0egopkxl.out
%TEMP%\0egopkxl.cmdline
%TEMP%\0egopkxl.dll
%TEMP%\0egopkxl.0.vb
%TEMP%\res91de.tmp
%TEMP%\vbc91cd.tmp
%TEMP%\kzltmk64.out
%TEMP%\l1ob7wls.dll
%TEMP%\htm8-ny9.dll
%TEMP%\vbc3fe4.tmp
%TEMP%\kzltmk64.dll
%TEMP%\vbcd147.tmp
%TEMP%\qznrb_oy.0.vb
%TEMP%\qznrb_oy.cmdline
%TEMP%\qznrb_oy.dll
%TEMP%\qznrb_oy.out
%TEMP%\resd5ec.tmp
%TEMP%\vbcd5db.tmp
%TEMP%\nbuw0zia.cmdline
%TEMP%\nbuw0zia.out
%TEMP%\nbuw0zia.dll
%TEMP%\nbuw0zia.0.vb
%TEMP%\resda22.tmp
%TEMP%\vbcda11.tmp
%TEMP%\jcn-ckq9.0.vb
%TEMP%\jcn-ckq9.out
%TEMP%\jcn-ckq9.cmdline
%TEMP%\jcn-ckq9.dll
%TEMP%\resdef4.tmp
%TEMP%\vbcdee3.tmp
%TEMP%\xjox6r5i.cmdline
%TEMP%\xjox6r5i.out
%TEMP%\resd158.tmp
%TEMP%\l1ob7wls.cmdline
%TEMP%\res7b29.tmp
%TEMP%\cyewo2uk.0.vb
%TEMP%\resbad2.tmp
%TEMP%\vbcbad1.tmp
%TEMP%\qyy5fsxc.0.vb
%TEMP%\qyy5fsxc.dll
%TEMP%\qyy5fsxc.cmdline
%TEMP%\qyy5fsxc.out
%TEMP%\resc409.tmp
%TEMP%\vbcc3f9.tmp
%TEMP%\2weglvby.out
%TEMP%\2weglvby.dll
%TEMP%\2weglvby.0.vb
%TEMP%\2weglvby.cmdline
%TEMP%\resc89d.tmp
%TEMP%\vbcc89c.tmp
%TEMP%\ndmftm-2.cmdline
%TEMP%\ndmftm-2.out
%TEMP%\ndmftm-2.dll
%TEMP%\ndmftm-2.0.vb
%TEMP%\resccf3.tmp
%TEMP%\vbccce2.tmp
%TEMP%\cyewo2uk.dll
%TEMP%\cyewo2uk.out
%TEMP%\kzltmk64.0.vb
%TEMP%\l1ob7wls.out
%TEMP%\l1ob7wls.0.vb
%TEMP%\vbc71d2.tmp
%TEMP%\cqfspkh-.out
%TEMP%\cqfspkh-.0.vb
%TEMP%\resee1c.tmp
%TEMP%\vbcee0b.tmp
%TEMP%\wrhb-0q5.out
%TEMP%\wrhb-0q5.cmdline
%TEMP%\wrhb-0q5.dll
%TEMP%\wrhb-0q5.0.vb
%TEMP%\resf60b.tmp
%TEMP%\vbcf5fa.tmp
%TEMP%\fzms_cmo.cmdline
%TEMP%\fzms_cmo.dll
%TEMP%\fzms_cmo.0.vb
%TEMP%\fzms_cmo.out
%TEMP%\resa10.tmp
%TEMP%\vbc9c1.tmp
%TEMP%\mwa0hpvh.dll
%TEMP%\mwa0hpvh.cmdline
%TEMP%\mwa0hpvh.out
%TEMP%\vbce64b.tmp
%TEMP%\6xu4bzji.0.vb
%TEMP%\cqfspkh-.cmdline
%TEMP%\xjox6r5i.dll
%TEMP%\mwa0hpvh.0.vb
%TEMP%\6xu4bzji.out
%TEMP%\gmhkhas5.out
%TEMP%\gmhkhas5.cmdline
%TEMP%\gmhkhas5.0.vb
%TEMP%\gmhkhas5.dll
%TEMP%\rescab5.tmp
%TEMP%\vbccaa5.tmp
%TEMP%\qqkzewlp.dll
%TEMP%\qqkzewlp.0.vb
%TEMP%\qqkzewlp.cmdline
%TEMP%\vbcc100.tmp
%TEMP%\qqkzewlp.out
%TEMP%\vbcd340.tmp
%TEMP%\azba7whr.out
%TEMP%\azba7whr.cmdline
%TEMP%\azba7whr.dll
%TEMP%\azba7whr.0.vb
%TEMP%\resde2e.tmp
%TEMP%\vbcde1d.tmp
%TEMP%\6xu4bzji.cmdline
%TEMP%\6xu4bzji.dll
%TEMP%\resd350.tmp
%TEMP%\rese64c.tmp
%TEMP%\cyewo2uk.cmdline
%TEMP%\res1396.tmp
%TEMP%\v8y2kxge.dll
%TEMP%\scqqu1n3.cmdline
%TEMP%\res4c78.tmp
%TEMP%\vbc4c67.tmp
%TEMP%\tbrzvkhs.dll
%TEMP%\tbrzvkhs.out
%TEMP%\tbrzvkhs.0.vb
%TEMP%\tbrzvkhs.cmdline
%TEMP%\res589d.tmp
%TEMP%\vbc588d.tmp
%TEMP%\m1wq8h6n.dll
%TEMP%\m1wq8h6n.0.vb
%TEMP%\m1wq8h6n.cmdline
%TEMP%\m1wq8h6n.out
%TEMP%\res661b.tmp
%TEMP%\vbc660a.tmp
%TEMP%\uzv2dnmy.0.vb
%TEMP%\uzv2dnmy.cmdline
%TEMP%\uzv2dnmy.out
%TEMP%\uzv2dnmy.dll
%TEMP%\res71e2.tmp
%TEMP%\vbc1395.tmp
%TEMP%\scqqu1n3.0.vb
%TEMP%\v8y2kxge.cmdline
%TEMP%\scqqu1n3.out
%TEMP%\cqfspkh-.dll
%TEMP%\v8y2kxge.out
%TEMP%\v8y2kxge.0.vb
%TEMP%\res1fcb.tmp
%TEMP%\vbc1faa.tmp
%TEMP%\eqxcemsp.0.vb
%TEMP%\eqxcemsp.dll
%TEMP%\eqxcemsp.cmdline
%TEMP%\eqxcemsp.out
%TEMP%\res29ae.tmp
%TEMP%\vbc299d.tmp
%TEMP%\whgbktxh.0.vb
%TEMP%\whgbktxh.cmdline
%TEMP%\whgbktxh.dll
%TEMP%\whgbktxh.out
%TEMP%\res342d.tmp
%TEMP%\vbc341d.tmp
%TEMP%\obxddand.out
%TEMP%\obxddand.dll
%TEMP%\obxddand.0.vb
%TEMP%\obxddand.cmdline
%TEMP%\res3ff5.tmp
%TEMP%\scqqu1n3.dll
%TEMP%\xjox6r5i.0.vb

Miscellaneous

Creates and executes the following

'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gmhkhas5.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qznrb_oy.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCCF3.tmp" "%TEMP%\vbcCCE2.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cyewo2uk.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC89D.tmp" "%TEMP%\vbcC89C.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ndmftm-2.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC409.tmp" "%TEMP%\vbcC3F9.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2weglvby.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES91DE.tmp" "%TEMP%\vbc91CD.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBAD2.tmp" "%TEMP%\vbcBAD1.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB37F.tmp" "%TEMP%\vbcB37E.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kzltmk64.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAC2C.tmp" "%TEMP%\vbcAC1B.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9aczhqvm.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA3FE.tmp" "%TEMP%\vbcA3EE.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mana6uyw.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9875.tmp" "%TEMP%\vbc9865.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qyy5fsxc.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hihf6ymh.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD158.tmp" "%TEMP%\vbcD147.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESED3C.tmp" "%TEMP%\vbcED2C.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES151.tmp" "%TEMP%\vbc140.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uww0tjtp.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFC8E.tmp" "%TEMP%\vbcFC7E.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fginaxah.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF77D.tmp" "%TEMP%\vbcF76D.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pscgou0c.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF22E.tmp" "%TEMP%\vbcF21D.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD5EC.tmp" "%TEMP%\vbcD5DB.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nbuw0zia.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yc_rn2ug.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE388.tmp" "%TEMP%\vbcE377.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\h92gzyv-.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDEF4.tmp" "%TEMP%\vbcDEE3.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xjox6r5i.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDA22.tmp" "%TEMP%\vbcDA11.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jcn-ckq9.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\se_iqtrk.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\htm8-ny9.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8B46.tmp" "%TEMP%\vbc8B36.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0egopkxl.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA10.tmp" "%TEMP%\vbc9C1.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mwa0hpvh.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF60B.tmp" "%TEMP%\vbcF5FA.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fzms_cmo.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEE1C.tmp" "%TEMP%\vbcEE0B.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wrhb-0q5.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1396.tmp" "%TEMP%\vbc1395.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE64C.tmp" "%TEMP%\vbcE64B.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDE2E.tmp" "%TEMP%\vbcDE1D.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6xu4bzji.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD350.tmp" "%TEMP%\vbcD340.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\azba7whr.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCAB5.tmp" "%TEMP%\vbcCAA5.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qqkzewlp.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC120.tmp" "%TEMP%\vbcC100.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cqfspkh-.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\eqxcemsp.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\v8y2kxge.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1FCB.tmp" "%TEMP%\vbc1FAA.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8347.tmp" "%TEMP%\vbc8346.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES589D.tmp" "%TEMP%\vbc588D.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\huswopi5.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7B29.tmp" "%TEMP%\vbc7B19.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ug-hsdgp.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES71E2.tmp" "%TEMP%\vbc71D2.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\l1ob7wls.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES661B.tmp" "%TEMP%\vbc660A.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uzv2dnmy.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\m1wq8h6n.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\whgbktxh.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4C78.tmp" "%TEMP%\vbc4C67.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tbrzvkhs.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3FF5.tmp" "%TEMP%\vbc3FE4.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\scqqu1n3.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES342D.tmp" "%TEMP%\vbc341D.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\obxddand.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES29AE.tmp" "%TEMP%\vbc299D.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\j9qd5zw5.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5C6.tmp" "%TEMP%\vbc5B5.tmp"' (with hidden window)

Executes the following

'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gmhkhas5.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qznrb_oy.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCCF3.tmp" "%TEMP%\vbcCCE2.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cyewo2uk.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC89D.tmp" "%TEMP%\vbcC89C.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ndmftm-2.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC409.tmp" "%TEMP%\vbcC3F9.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2weglvby.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES91DE.tmp" "%TEMP%\vbc91CD.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBAD2.tmp" "%TEMP%\vbcBAD1.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB37F.tmp" "%TEMP%\vbcB37E.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kzltmk64.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAC2C.tmp" "%TEMP%\vbcAC1B.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9aczhqvm.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA3FE.tmp" "%TEMP%\vbcA3EE.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mana6uyw.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9875.tmp" "%TEMP%\vbc9865.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qyy5fsxc.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hihf6ymh.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD158.tmp" "%TEMP%\vbcD147.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESED3C.tmp" "%TEMP%\vbcED2C.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES151.tmp" "%TEMP%\vbc140.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uww0tjtp.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFC8E.tmp" "%TEMP%\vbcFC7E.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fginaxah.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF77D.tmp" "%TEMP%\vbcF76D.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pscgou0c.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF22E.tmp" "%TEMP%\vbcF21D.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD5EC.tmp" "%TEMP%\vbcD5DB.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nbuw0zia.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yc_rn2ug.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE388.tmp" "%TEMP%\vbcE377.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\h92gzyv-.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDEF4.tmp" "%TEMP%\vbcDEE3.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xjox6r5i.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDA22.tmp" "%TEMP%\vbcDA11.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jcn-ckq9.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\se_iqtrk.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\htm8-ny9.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8B46.tmp" "%TEMP%\vbc8B36.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0egopkxl.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA10.tmp" "%TEMP%\vbc9C1.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mwa0hpvh.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF60B.tmp" "%TEMP%\vbcF5FA.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fzms_cmo.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEE1C.tmp" "%TEMP%\vbcEE0B.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wrhb-0q5.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1396.tmp" "%TEMP%\vbc1395.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE64C.tmp" "%TEMP%\vbcE64B.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDE2E.tmp" "%TEMP%\vbcDE1D.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6xu4bzji.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD350.tmp" "%TEMP%\vbcD340.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\azba7whr.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCAB5.tmp" "%TEMP%\vbcCAA5.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qqkzewlp.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC120.tmp" "%TEMP%\vbcC100.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cqfspkh-.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\eqxcemsp.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\v8y2kxge.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1FCB.tmp" "%TEMP%\vbc1FAA.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8347.tmp" "%TEMP%\vbc8346.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES589D.tmp" "%TEMP%\vbc588D.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\huswopi5.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7B29.tmp" "%TEMP%\vbc7B19.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ug-hsdgp.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES71E2.tmp" "%TEMP%\vbc71D2.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\l1ob7wls.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES661B.tmp" "%TEMP%\vbc660A.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uzv2dnmy.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\m1wq8h6n.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\whgbktxh.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4C78.tmp" "%TEMP%\vbc4C67.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tbrzvkhs.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3FF5.tmp" "%TEMP%\vbc3FE4.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\scqqu1n3.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES342D.tmp" "%TEMP%\vbc341D.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\obxddand.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES29AE.tmp" "%TEMP%\vbc299D.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\j9qd5zw5.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5C6.tmp" "%TEMP%\vbc5B5.tmp"

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней