Trojan.DownLoader2.23480

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{a75aed00-d7bf-11d1-9947-00c0Cf98bbc9}\] 'StubPath' = '<SYSTEM32>\lservice.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\] 'Windows Reg Services' = '<SYSTEM32>\ffservice.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'Windows Reg Services' = '<SYSTEM32>\ffservice.exe'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'Windows Reg Services' = '<SYSTEM32>\ffservice.exe'

Modifies file system

Creates the following files

%APPDATA%\temp.exe
%TEMP%\szwznayy.cmdline
%TEMP%\szwznayy.out
%TEMP%\vbc3c3b.tmp
%TEMP%\res3c4b.tmp
%TEMP%\szwznayy.dll
%TEMP%\y0rzczwg.0.vb
%TEMP%\y0rzczwg.cmdline
%TEMP%\y0rzczwg.out
%TEMP%\vbc419a.tmp
%TEMP%\vbc1f2d.tmp
%TEMP%\res41aa.tmp
%TEMP%\n-svpqfm.0.vb
%TEMP%\n-svpqfm.cmdline
%TEMP%\n-svpqfm.out
%TEMP%\vbc4860.tmp
%TEMP%\res4861.tmp
%TEMP%\n-svpqfm.dll
%TEMP%\v0j4-pzn.0.vb
%TEMP%\v0j4-pzn.cmdline
%TEMP%\v0j4-pzn.out
%TEMP%\b663v694.dll
%TEMP%\szwznayy.0.vb
%TEMP%\res366f.tmp
%TEMP%\vbc366e.tmp
%TEMP%\b663v694.out
%TEMP%\bt4kslai.dll
%TEMP%\gsuggcya.0.vb
%TEMP%\gsuggcya.cmdline
%TEMP%\gsuggcya.out
%TEMP%\vbc122d.tmp
%TEMP%\res122e.tmp
%TEMP%\gsuggcya.dll
%TEMP%\cfqawopg.0.vb
%TEMP%\cfqawopg.cmdline
%TEMP%\vbc5001.tmp
%TEMP%\y0rzczwg.dll
%TEMP%\cfqawopg.out
%TEMP%\cfqawopg.dll
%TEMP%\wihoufew.0.vb
%TEMP%\wihoufew.cmdline
%TEMP%\wihoufew.out
%TEMP%\vbc29fb.tmp
%TEMP%\res29fc.tmp
%TEMP%\wihoufew.dll
%TEMP%\b663v694.0.vb
%TEMP%\b663v694.cmdline
%TEMP%\res618.tmp
%TEMP%\res1f3e.tmp
%TEMP%\res5002.tmp
%TEMP%\v0j4-pzn.dll
%TEMP%\kiq3q8bo.0.vb
%TEMP%\vbc71c2.tmp
%TEMP%\res71d3.tmp
%TEMP%\bdzi34zy.dll
%TEMP%\87xyblsm.0.vb
%TEMP%\87xyblsm.cmdline
%TEMP%\87xyblsm.out
%TEMP%\vbc7a3e.tmp
%TEMP%\res7a4e.tmp
%TEMP%\87xyblsm.dll
%TEMP%\bnq6bole.0.vb
%TEMP%\bnq6bole.out
%TEMP%\vbc608.tmp
%TEMP%\vbc80f5.tmp
%TEMP%\res80f6.tmp
%TEMP%\bnq6bole.dll
%TEMP%\8omr9hyt.0.vb
%TEMP%\8omr9hyt.cmdline
%TEMP%\8omr9hyt.out
%TEMP%\vbc89af.tmp
%TEMP%\res89c0.tmp
%TEMP%\8omr9hyt.dll
%TEMP%\_r-vlzod.0.vb
%TEMP%\bdzi34zy.out
%TEMP%\szbb1ldf.0.vb
%TEMP%\bdzi34zy.cmdline
%TEMP%\4sn-5vl_.dll
%TEMP%\kiq3q8bo.cmdline
%TEMP%\kiq3q8bo.out
%TEMP%\vbc5699.tmp
%TEMP%\res56a9.tmp
%TEMP%\kiq3q8bo.dll
%TEMP%\4sn-5vl_.0.vb
%TEMP%\4sn-5vl_.cmdline
%TEMP%\4sn-5vl_.out
%TEMP%\vbc5d30.tmp
%TEMP%\res5d41.tmp
%TEMP%\_r-vlzod.cmdline
%TEMP%\lwfnopjy.dll
%TEMP%\szbb1ldf.cmdline
%TEMP%\szbb1ldf.out
%TEMP%\vbc6474.tmp
%TEMP%\res6475.tmp
%TEMP%\szbb1ldf.dll
%TEMP%\lwfnopjy.0.vb
%TEMP%\lwfnopjy.cmdline
%TEMP%\lwfnopjy.out
%TEMP%\vbc6acd.tmp
%TEMP%\res6add.tmp
%TEMP%\bdzi34zy.0.vb
%TEMP%\bnq6bole.cmdline
%TEMP%\bt4kslai.out
%TEMP%\yqgrf_nn.0.vb
%TEMP%\jsbrzlqv.0.vb
%TEMP%\jsbrzlqv.cmdline
%TEMP%\jsbrzlqv.out
%TEMP%\vbc514e.tmp
%TEMP%\res514f.tmp
%TEMP%\jsbrzlqv.dll
%TEMP%\yii8trdw.0.vb
%TEMP%\yii8trdw.cmdline
%TEMP%\yii8trdw.out
%TEMP%\x-pc0lh7.out
%TEMP%\vbc5fb6.tmp
%TEMP%\yii8trdw.dll
%TEMP%\khxt-aog.0.vb
%TEMP%\khxt-aog.cmdline
%TEMP%\khxt-aog.out
%TEMP%\vbc6ef8.tmp
%TEMP%\res6ef9.tmp
%TEMP%\khxt-aog.dll
%TEMP%\vochuhbl.0.vb
%TEMP%\vochuhbl.cmdline
%TEMP%\res4151.tmp
%TEMP%\c1psc5uc.dll
%TEMP%\vbc4150.tmp
%TEMP%\c1psc5uc.out
%TEMP%\c1psc5uc.cmdline
%WINDIR%\syswow64\lservice.exe
%WINDIR%\syswow64\ffservice.exe
%TEMP%\ckscmukf.0.vb
%TEMP%\ckscmukf.cmdline
%TEMP%\ckscmukf.out
%TEMP%\vbc1261.tmp
%TEMP%\res1271.tmp
%TEMP%\ckscmukf.dll
%TEMP%\x-pc0lh7.0.vb
%TEMP%\vochuhbl.out
%TEMP%\res5fc6.tmp
%TEMP%\x-pc0lh7.cmdline
%TEMP%\res2185.tmp
%TEMP%\x-pc0lh7.dll
%TEMP%\flrnsmpv.0.vb
%TEMP%\flrnsmpv.cmdline
%TEMP%\flrnsmpv.out
%TEMP%\vbc3182.tmp
%TEMP%\res3183.tmp
%TEMP%\flrnsmpv.dll
%TEMP%\c1psc5uc.0.vb
%WINDIR%\syswow64\wservice.exe
%TEMP%\vbc2174.tmp
%TEMP%\vbc803e.tmp
%TEMP%\res804e.tmp
%TEMP%\vochuhbl.dll
%TEMP%\qfadrlmp.out
%TEMP%\vbccf77.tmp
%TEMP%\rescf88.tmp
%TEMP%\qfadrlmp.dll
%TEMP%\wgldhney.0.vb
%TEMP%\wgldhney.cmdline
%TEMP%\wgldhney.out
%TEMP%\vbcdf94.tmp
%TEMP%\resdf95.tmp
%TEMP%\wgldhney.dll
%TEMP%\yqgrf_nn.cmdline
%TEMP%\bt4kslai.cmdline
%TEMP%\yqgrf_nn.out
%TEMP%\vbcebaa.tmp
%TEMP%\resebba.tmp
%TEMP%\yqgrf_nn.dll
%TEMP%\k_oyp5gt.0.vb
%TEMP%\k_oyp5gt.cmdline
%TEMP%\k_oyp5gt.out
%TEMP%\vbcf994.tmp
%TEMP%\resf9a5.tmp
%TEMP%\k_oyp5gt.dll
%TEMP%\qfadrlmp.cmdline
%TEMP%\nbsrgsyn.dll
%TEMP%\qfadrlmp.0.vb
%TEMP%\resa470.tmp
%TEMP%\5aa0rrlb.0.vb
%TEMP%\5aa0rrlb.cmdline
%TEMP%\5aa0rrlb.out
%TEMP%\vbc925e.tmp
%TEMP%\res926f.tmp
%TEMP%\5aa0rrlb.dll
%TEMP%\nbsrgsyn.0.vb
%TEMP%\nbsrgsyn.cmdline
%TEMP%\nbsrgsyn.out
%TEMP%\vbca460.tmp
%TEMP%\bt4kslai.0.vb
%TEMP%\resc007.tmp
%TEMP%\cge40lwh.0.vb
%TEMP%\cge40lwh.cmdline
%TEMP%\cge40lwh.out
%TEMP%\vbcb567.tmp
%TEMP%\resb568.tmp
%TEMP%\cge40lwh.dll
%TEMP%\sexk8et3.0.vb
%TEMP%\sexk8et3.cmdline
%TEMP%\sexk8et3.out
%TEMP%\vbcbff6.tmp
%TEMP%\sexk8et3.dll
%TEMP%\_r-vlzod.out

Sets the 'hidden' attribute to the following files

%WINDIR%\syswow64\wservice.exe
%WINDIR%\syswow64\lservice.exe
%WINDIR%\syswow64\ffservice.exe

Deletes the following files

%WINDIR%\syswow64\wservice.exe
%TEMP%\szwznayy.out
%TEMP%\szwznayy.cmdline
%TEMP%\szwznayy.dll
%TEMP%\res41aa.tmp
%TEMP%\vbc419a.tmp
%TEMP%\y0rzczwg.dll
%TEMP%\y0rzczwg.out
%TEMP%\y0rzczwg.cmdline
%TEMP%\cfqawopg.dll
%TEMP%\y0rzczwg.0.vb
%TEMP%\vbc4860.tmp
%TEMP%\n-svpqfm.0.vb
%TEMP%\n-svpqfm.dll
%TEMP%\n-svpqfm.out
%TEMP%\n-svpqfm.cmdline
%TEMP%\res5002.tmp
%TEMP%\vbc5001.tmp
%TEMP%\v0j4-pzn.dll
%TEMP%\v0j4-pzn.0.vb
%TEMP%\res3c4b.tmp
%TEMP%\res4861.tmp
%TEMP%\szwznayy.0.vb
%TEMP%\vbc3c3b.tmp
%TEMP%\b663v694.dll
%TEMP%\b663v694.cmdline
%TEMP%\vbc122d.tmp
%TEMP%\gsuggcya.0.vb
%TEMP%\gsuggcya.cmdline
%TEMP%\gsuggcya.dll
%TEMP%\gsuggcya.out
%TEMP%\res1f3e.tmp
%TEMP%\vbc1f2d.tmp
%TEMP%\cfqawopg.0.vb
%TEMP%\v0j4-pzn.out
%TEMP%\cfqawopg.out
%TEMP%\bt4kslai.0.vb
%TEMP%\cfqawopg.cmdline
%TEMP%\vbc29fb.tmp
%TEMP%\wihoufew.0.vb
%TEMP%\wihoufew.out
%TEMP%\wihoufew.dll
%TEMP%\wihoufew.cmdline
%TEMP%\res366f.tmp
%TEMP%\vbc366e.tmp
%TEMP%\b663v694.0.vb
%TEMP%\bt4kslai.dll
%TEMP%\b663v694.out
%TEMP%\res29fc.tmp
%TEMP%\res122e.tmp
%TEMP%\v0j4-pzn.cmdline
%TEMP%\kiq3q8bo.dll
%TEMP%\bdzi34zy.dll
%TEMP%\res7a4e.tmp
%TEMP%\vbc7a3e.tmp
%TEMP%\87xyblsm.cmdline
%TEMP%\87xyblsm.0.vb
%TEMP%\87xyblsm.out
%TEMP%\87xyblsm.dll
%TEMP%\res80f6.tmp
%TEMP%\vbc80f5.tmp
%TEMP%\vbc71c2.tmp
%TEMP%\bnq6bole.out
%TEMP%\bnq6bole.0.vb
%TEMP%\bnq6bole.dll
%TEMP%\res89c0.tmp
%TEMP%\vbc89af.tmp
%TEMP%\8omr9hyt.cmdline
%TEMP%\8omr9hyt.out
%TEMP%\8omr9hyt.dll
%TEMP%\8omr9hyt.0.vb
%TEMP%\_r-vlzod.cmdline
%TEMP%\bdzi34zy.0.vb
%TEMP%\bdzi34zy.out
%TEMP%\bdzi34zy.cmdline
%TEMP%\res71d3.tmp
%TEMP%\resb568.tmp
%TEMP%\kiq3q8bo.cmdline
%TEMP%\kiq3q8bo.out
%TEMP%\res5d41.tmp
%TEMP%\vbc5d30.tmp
%TEMP%\4sn-5vl_.out
%TEMP%\4sn-5vl_.dll
%TEMP%\4sn-5vl_.cmdline
%TEMP%\4sn-5vl_.0.vb
%TEMP%\res56a9.tmp
%TEMP%\kiq3q8bo.0.vb
%TEMP%\vbc5699.tmp
%TEMP%\res6475.tmp
%TEMP%\szbb1ldf.dll
%TEMP%\szbb1ldf.cmdline
%TEMP%\res6add.tmp
%TEMP%\vbc6acd.tmp
%TEMP%\lwfnopjy.0.vb
%TEMP%\lwfnopjy.out
%TEMP%\lwfnopjy.dll
%TEMP%\lwfnopjy.cmdline
%TEMP%\vbc6474.tmp
%TEMP%\szbb1ldf.0.vb
%TEMP%\szbb1ldf.out
%TEMP%\bt4kslai.out
%TEMP%\bt4kslai.cmdline
%TEMP%\vbc608.tmp
%TEMP%\jsbrzlqv.out
%TEMP%\jsbrzlqv.0.vb
%TEMP%\jsbrzlqv.dll
%TEMP%\jsbrzlqv.cmdline
%TEMP%\res5fc6.tmp
%TEMP%\vbc5fb6.tmp
%TEMP%\yii8trdw.cmdline
%TEMP%\yii8trdw.out
%TEMP%\yii8trdw.dll
%TEMP%\vochuhbl.0.vb
%TEMP%\yii8trdw.0.vb
%TEMP%\vbc6ef8.tmp
%TEMP%\khxt-aog.0.vb
%TEMP%\khxt-aog.out
%TEMP%\khxt-aog.cmdline
%TEMP%\khxt-aog.dll
%TEMP%\res804e.tmp
%TEMP%\vbc803e.tmp
%TEMP%\vochuhbl.cmdline
%TEMP%\c1psc5uc.cmdline
%TEMP%\c1psc5uc.dll
%TEMP%\vbc514e.tmp
%TEMP%\c1psc5uc.out
%TEMP%\c1psc5uc.0.vb
%TEMP%\res1271.tmp
%TEMP%\ckscmukf.0.vb
%TEMP%\ckscmukf.cmdline
%TEMP%\ckscmukf.out
%TEMP%\ckscmukf.dll
%WINDIR%\syswow64\lservice.exe
%WINDIR%\syswow64\ffservice.exe
%TEMP%\res2185.tmp
%TEMP%\vbc2174.tmp
%TEMP%\vochuhbl.dll
%TEMP%\x-pc0lh7.out
%TEMP%\res6ef9.tmp
%TEMP%\x-pc0lh7.cmdline
%TEMP%\res3183.tmp
%TEMP%\vbc3182.tmp
%TEMP%\flrnsmpv.dll
%TEMP%\flrnsmpv.out
%TEMP%\flrnsmpv.0.vb
%TEMP%\flrnsmpv.cmdline
%TEMP%\res4151.tmp
%TEMP%\vbc4150.tmp
%TEMP%\x-pc0lh7.dll
%TEMP%\vbc1261.tmp
%TEMP%\x-pc0lh7.0.vb
%TEMP%\res514f.tmp
%TEMP%\vochuhbl.out
%TEMP%\qfadrlmp.out
%TEMP%\qfadrlmp.dll
%TEMP%\resdf95.tmp
%TEMP%\vbcdf94.tmp
%TEMP%\wgldhney.0.vb
%TEMP%\wgldhney.dll
%TEMP%\wgldhney.out
%TEMP%\wgldhney.cmdline
%TEMP%\resebba.tmp
%TEMP%\qfadrlmp.0.vb
%TEMP%\res926f.tmp
%TEMP%\qfadrlmp.cmdline
%TEMP%\vbcebaa.tmp
%TEMP%\yqgrf_nn.cmdline
%TEMP%\resf9a5.tmp
%TEMP%\vbcf994.tmp
%TEMP%\k_oyp5gt.0.vb
%TEMP%\k_oyp5gt.cmdline
%TEMP%\k_oyp5gt.out
%TEMP%\k_oyp5gt.dll
%TEMP%\res618.tmp
%TEMP%\yqgrf_nn.out
%TEMP%\yqgrf_nn.0.vb
%TEMP%\yqgrf_nn.dll
%TEMP%\bnq6bole.cmdline
%TEMP%\_r-vlzod.out
%TEMP%\sexk8et3.out
%TEMP%\5aa0rrlb.dll
%TEMP%\5aa0rrlb.cmdline
%TEMP%\5aa0rrlb.out
%TEMP%\5aa0rrlb.0.vb
%TEMP%\resa470.tmp
%TEMP%\vbca460.tmp
%TEMP%\nbsrgsyn.cmdline
%TEMP%\nbsrgsyn.0.vb
%TEMP%\nbsrgsyn.out
%TEMP%\rescf88.tmp
%TEMP%\vbccf77.tmp
%TEMP%\nbsrgsyn.dll
%TEMP%\cge40lwh.out
%TEMP%\cge40lwh.cmdline
%TEMP%\cge40lwh.0.vb
%TEMP%\cge40lwh.dll
%TEMP%\resc007.tmp
%TEMP%\vbcbff6.tmp
%TEMP%\sexk8et3.cmdline
%TEMP%\sexk8et3.dll
%TEMP%\sexk8et3.0.vb
%TEMP%\vbc925e.tmp
%TEMP%\vbcb567.tmp
%TEMP%\_r-vlzod.0.vb

Substitutes the following files

%WINDIR%\syswow64\wservice.exe
%WINDIR%\syswow64\lservice.exe
%WINDIR%\syswow64\ffservice.exe

Network activity

UDP

DNS ASK iz#p.ir

Miscellaneous

Creates and executes the following

'%APPDATA%\temp.exe'
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lwfnopjy.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6475.tmp" "%TEMP%\vbc6474.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\szbb1ldf.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5D41.tmp" "%TEMP%\vbc5D30.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4sn-5vl_.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES56A9.tmp" "%TEMP%\vbc5699.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kiq3q8bo.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES29FC.tmp" "%TEMP%\vbc29FB.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5002.tmp" "%TEMP%\vbc5001.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4861.tmp" "%TEMP%\vbc4860.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\n-svpqfm.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES41AA.tmp" "%TEMP%\vbc419A.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\y0rzczwg.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3C4B.tmp" "%TEMP%\vbc3C3B.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\szwznayy.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES366F.tmp" "%TEMP%\vbc366E.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\v0j4-pzn.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\b663v694.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6ADD.tmp" "%TEMP%\vbc6ACD.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES94AC.tmp" "%TEMP%\vbc94AB.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB544.tmp" "%TEMP%\vbcB543.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7ua2vmoj.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAE6E.tmp" "%TEMP%\vbcAE6D.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9qtxszbr.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA70C.tmp" "%TEMP%\vbcA6FB.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yawcez-j.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9D28.tmp" "%TEMP%\vbc9D27.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES71D3.tmp" "%TEMP%\vbc71C2.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bdzi34zy.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_r-vlzod.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES89C0.tmp" "%TEMP%\vbc89AF.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8omr9hyt.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES80F6.tmp" "%TEMP%\vbc80F5.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bnq6bole.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7A4E.tmp" "%TEMP%\vbc7A3E.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\87xyblsm.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qh3nc-b_.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wihoufew.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1F3E.tmp" "%TEMP%\vbc1F2D.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cfqawopg.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6EF9.tmp" "%TEMP%\vbc6EF8.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\khxt-aog.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5FC6.tmp" "%TEMP%\vbc5FB6.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yii8trdw.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES514F.tmp" "%TEMP%\vbc514E.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jsbrzlqv.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES804E.tmp" "%TEMP%\vbc803E.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4151.tmp" "%TEMP%\vbc4150.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3183.tmp" "%TEMP%\vbc3182.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\flrnsmpv.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2185.tmp" "%TEMP%\vbc2174.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\x-pc0lh7.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1271.tmp" "%TEMP%\vbc1261.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ckscmukf.cmdline"' (with hidden window)
'%WINDIR%\syswow64\wservice.exe' -s' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\c1psc5uc.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5aa0rrlb.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vochuhbl.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES926F.tmp" "%TEMP%\vbc925E.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES122E.tmp" "%TEMP%\vbc122D.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDF95.tmp" "%TEMP%\vbcDF94.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gsuggcya.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES618.tmp" "%TEMP%\vbc608.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bt4kslai.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF9A5.tmp" "%TEMP%\vbcF994.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\k_oyp5gt.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEBBA.tmp" "%TEMP%\vbcEBAA.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yqgrf_nn.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wgldhney.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nbsrgsyn.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCF88.tmp" "%TEMP%\vbcCF77.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qfadrlmp.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC007.tmp" "%TEMP%\vbcBFF6.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sexk8et3.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB568.tmp" "%TEMP%\vbcB567.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cge40lwh.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA470.tmp" "%TEMP%\vbcA460.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\odg9wmgb.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBB11.tmp" "%TEMP%\vbcBB00.tmp"' (with hidden window)

Executes the following

'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ckscmukf.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6475.tmp" "%TEMP%\vbc6474.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\szbb1ldf.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5D41.tmp" "%TEMP%\vbc5D30.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4sn-5vl_.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES56A9.tmp" "%TEMP%\vbc5699.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kiq3q8bo.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5002.tmp" "%TEMP%\vbc5001.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4861.tmp" "%TEMP%\vbc4860.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6ADD.tmp" "%TEMP%\vbc6ACD.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\n-svpqfm.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES41AA.tmp" "%TEMP%\vbc419A.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\y0rzczwg.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3C4B.tmp" "%TEMP%\vbc3C3B.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\szwznayy.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES366F.tmp" "%TEMP%\vbc366E.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\v0j4-pzn.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yqgrf_nn.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bdzi34zy.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB544.tmp" "%TEMP%\vbcB543.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7ua2vmoj.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAE6E.tmp" "%TEMP%\vbcAE6D.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9qtxszbr.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA70C.tmp" "%TEMP%\vbcA6FB.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yawcez-j.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9D28.tmp" "%TEMP%\vbc9D27.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\b663v694.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lwfnopjy.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_r-vlzod.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES89C0.tmp" "%TEMP%\vbc89AF.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8omr9hyt.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES80F6.tmp" "%TEMP%\vbc80F5.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bnq6bole.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7A4E.tmp" "%TEMP%\vbc7A3E.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\87xyblsm.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES94AC.tmp" "%TEMP%\vbc94AB.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES71D3.tmp" "%TEMP%\vbc71C2.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES29FC.tmp" "%TEMP%\vbc29FB.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wihoufew.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1F3E.tmp" "%TEMP%\vbc1F2D.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jsbrzlqv.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES804E.tmp" "%TEMP%\vbc803E.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vochuhbl.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6EF9.tmp" "%TEMP%\vbc6EF8.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\khxt-aog.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5FC6.tmp" "%TEMP%\vbc5FB6.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yii8trdw.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\odg9wmgb.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES926F.tmp" "%TEMP%\vbc925E.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4151.tmp" "%TEMP%\vbc4150.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\c1psc5uc.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3183.tmp" "%TEMP%\vbc3182.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\flrnsmpv.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2185.tmp" "%TEMP%\vbc2174.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\x-pc0lh7.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1271.tmp" "%TEMP%\vbc1261.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES514F.tmp" "%TEMP%\vbc514E.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qh3nc-b_.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nbsrgsyn.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB568.tmp" "%TEMP%\vbcB567.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA470.tmp" "%TEMP%\vbcA460.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cfqawopg.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES122E.tmp" "%TEMP%\vbc122D.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gsuggcya.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES618.tmp" "%TEMP%\vbc608.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bt4kslai.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF9A5.tmp" "%TEMP%\vbcF994.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cge40lwh.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\k_oyp5gt.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5aa0rrlb.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDF95.tmp" "%TEMP%\vbcDF94.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wgldhney.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCF88.tmp" "%TEMP%\vbcCF77.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qfadrlmp.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC007.tmp" "%TEMP%\vbcBFF6.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sexk8et3.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEBBA.tmp" "%TEMP%\vbcEBAA.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBB11.tmp" "%TEMP%\vbcBB00.tmp"

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial