Library
My library

+ Add to library

Profile

Trojan.DownLoader32.38907

Added to the Dr.Web virus database: 2019-12-29

Virus description added:

Technical Information

Malicious functions
Injects code into
the following system processes:
  • %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
Terminates or attempts to terminate
the following system processes:
  • %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
Modifies file system
Creates the following files
  • %HOMEPATH%\rsv
  • %TEMP%\csc38169b5f7f6141069643663f22447f.tmp
  • %TEMP%\0tbslj1a.out
  • %TEMP%\0tbslj1a.cmdline
  • %TEMP%\0tbslj1a.0.cs
  • %TEMP%\uos2pqgi.dll
  • %TEMP%\res3f02.tmp
  • %TEMP%\csc2ce070129a09404b984e5d5e76e21617.tmp
  • %TEMP%\uos2pqgi.out
  • %TEMP%\uos2pqgi.cmdline
  • %TEMP%\uos2pqgi.0.cs
  • %TEMP%\zc1yfgb2.dll
  • %TEMP%\res3d1f.tmp
  • %TEMP%\csc45facb8e594452aaff955c3ee147a.tmp
  • %TEMP%\zc1yfgb2.out
  • %TEMP%\zc1yfgb2.cmdline
  • %TEMP%\zc1yfgb2.0.cs
  • %TEMP%\xnjjznh3.dll
  • %TEMP%\res37a3.tmp
  • %TEMP%\cscc410a4f540544119b9cb106095b1888b.tmp
  • %TEMP%\xnjjznh3.out
  • %TEMP%\xnjjznh3.cmdline
  • %TEMP%\xnjjznh3.0.cs
  • %TEMP%\edabhzef.dll
  • %TEMP%\res451a.tmp
  • %TEMP%\1esztvr3.0.cs
  • %TEMP%\lpi4x3dm.cmdline
  • %TEMP%\1esztvr3.cmdline
  • %TEMP%\lpi4x3dm.0.cs
  • %TEMP%\umwss1we.dll
  • %TEMP%\res5b39.tmp
  • %TEMP%\cscd8f6eff923b34260bccf3da1d2f54792.tmp
  • %TEMP%\umwss1we.out
  • %TEMP%\umwss1we.cmdline
  • %TEMP%\umwss1we.0.cs
  • %TEMP%\bt1n21si.dll
  • %TEMP%\res530f.tmp
  • %TEMP%\cscaa013688f846484e83bdf44822bef064.tmp
  • %TEMP%\bt1n21si.out
  • %TEMP%\bt1n21si.cmdline
  • %TEMP%\bt1n21si.0.cs
  • %TEMP%\cajbkwsz.dll
  • %TEMP%\res5012.tmp
  • %TEMP%\csc9d9411d8d5dc42dea16a112078b79a69.tmp
  • %TEMP%\cajbkwsz.out
  • %TEMP%\cajbkwsz.cmdline
  • %TEMP%\cajbkwsz.0.cs
  • %TEMP%\1esztvr3.dll
  • %TEMP%\res47b9.tmp
  • %TEMP%\csce373cd3ea3d44c7eafb0817e92d5cbcd.tmp
  • %TEMP%\1esztvr3.out
  • %TEMP%\res35de.tmp
  • %TEMP%\0tbslj1a.dll
  • %TEMP%\csc196eb628f4cb4e5cac45c2e95e64cb1b.tmp
  • %TEMP%\wlxjj3hx.dll
  • %TEMP%\csc7a7fc0dbad2f42c89def94d810a1b2f.tmp
  • %TEMP%\wlxjj3hx.out
  • %TEMP%\wlxjj3hx.cmdline
  • %TEMP%\wlxjj3hx.0.cs
  • %TEMP%\jyxdltq3.dll
  • %TEMP%\res208a.tmp
  • %TEMP%\csc2003496ea02446f6ad9aea864ef097b4.tmp
  • %TEMP%\jyxdltq3.out
  • %TEMP%\jyxdltq3.cmdline
  • %TEMP%\jyxdltq3.0.cs
  • %TEMP%\kavmxtu1.dll
  • %TEMP%\res1b0e.tmp
  • %TEMP%\csce253e118d30f4af3b8bd4125d39d27b7.tmp
  • %TEMP%\kavmxtu1.out
  • %TEMP%\kavmxtu1.cmdline
  • %TEMP%\kavmxtu1.0.cs
  • %TEMP%\uc1q4hze.dll
  • %TEMP%\res18dd.tmp
  • %TEMP%\csce25f508ef8743b790a8279231b16bdf.tmp
  • %TEMP%\uc1q4hze.out
  • %TEMP%\uc1q4hze.cmdline
  • %TEMP%\uc1q4hze.0.cs
  • %TEMP%\yko1xt25.dll
  • %TEMP%\res2220.tmp
  • %TEMP%\nbeeomzh.0.cs
  • %TEMP%\edabhzef.cmdline
  • %TEMP%\nbeeomzh.cmdline
  • %TEMP%\edabhzef.0.cs
  • %TEMP%\mnb10yie.dll
  • %TEMP%\res2fe6.tmp
  • %TEMP%\csca5009f9d3f824fd1b15561a5b3e6d5c.tmp
  • %TEMP%\mnb10yie.out
  • %TEMP%\mnb10yie.cmdline
  • %TEMP%\mnb10yie.0.cs
  • %TEMP%\fdro25f1.dll
  • %TEMP%\res2e40.tmp
  • %TEMP%\csc3aedde5aa7a04b50bb4f1f17f56fa1.tmp
  • %TEMP%\fdro25f1.out
  • %TEMP%\fdro25f1.cmdline
  • %TEMP%\fdro25f1.0.cs
  • %TEMP%\b1p4ia2x.dll
  • %TEMP%\res2970.tmp
  • %TEMP%\csc900a2c0be6514d7686fc6866e555eec5.tmp
  • %TEMP%\b1p4ia2x.out
  • %TEMP%\b1p4ia2x.cmdline
  • %TEMP%\b1p4ia2x.0.cs
  • %TEMP%\nbeeomzh.dll
  • %TEMP%\res27da.tmp
  • %TEMP%\csc28f58c717e1243148bc198e032a0467c.tmp
  • %TEMP%\nbeeomzh.out
  • %TEMP%\edabhzef.out
  • %TEMP%\p3bec5ef.0.cs
  • %TEMP%\cnrd1pfz.cmdline
  • %TEMP%\res5e36.tmp
  • %TEMP%\csc2da66df7f51e4ce8a5c624c669301277.tmp
  • %TEMP%\hpoafwzi.out
  • %TEMP%\hpoafwzi.cmdline
  • %TEMP%\hpoafwzi.0.cs
  • %TEMP%\alwjpgk1.dll
  • %TEMP%\res9e12.tmp
  • %TEMP%\csca264337eacd04e0eb082fcdce22da9e.tmp
  • %TEMP%\alwjpgk1.out
  • %TEMP%\alwjpgk1.cmdline
  • %TEMP%\alwjpgk1.0.cs
  • %TEMP%\4f3tqnkj.dll
  • %TEMP%\res9a4b.tmp
  • %TEMP%\cscd93510a9cbf043e1bf8e64c02960cea9.tmp
  • %TEMP%\4f3tqnkj.out
  • %TEMP%\4f3tqnkj.cmdline
  • %TEMP%\4f3tqnkj.0.cs
  • %TEMP%\23nzh1mk.dll
  • %TEMP%\res93e5.tmp
  • %TEMP%\cscdf016d02d8624025b87caa7b1d1c1a82.tmp
  • %TEMP%\23nzh1mk.out
  • %TEMP%\23nzh1mk.cmdline
  • %TEMP%\23nzh1mk.0.cs
  • %TEMP%\u2kwlvhk.dll
  • %TEMP%\resaa81.tmp
  • %TEMP%\m5yozyeb.0.cs
  • %TEMP%\csca76ba6c2a3c74a928857f7454ffe33.tmp
  • %TEMP%\m5yozyeb.cmdline
  • %TEMP%\cnrd1pfz.0.cs
  • %TEMP%\tji2mlym.dll
  • %TEMP%\resbc4c.tmp
  • %TEMP%\csc1f871bf063994f77a9cba5aec2d5a29.tmp
  • %TEMP%\tji2mlym.out
  • %TEMP%\tji2mlym.cmdline
  • %TEMP%\tji2mlym.0.cs
  • %TEMP%\jrsg41vh.dll
  • %TEMP%\resb53b.tmp
  • %TEMP%\cscc31ce5aaf3b343f2a8b7c05501ac314.tmp
  • %TEMP%\jrsg41vh.out
  • %TEMP%\jrsg41vh.cmdline
  • %TEMP%\jrsg41vh.0.cs
  • %TEMP%\ewub02yw.dll
  • %TEMP%\resb319.tmp
  • %TEMP%\cscd9fb8cbd6184acd97a0d8b86b7025ac.tmp
  • %TEMP%\ewub02yw.out
  • %TEMP%\ewub02yw.cmdline
  • %TEMP%\ewub02yw.0.cs
  • %TEMP%\m5yozyeb.dll
  • %TEMP%\resad10.tmp
  • %TEMP%\csc44c966d6110486ea4406b916aa96a9.tmp
  • %TEMP%\m5yozyeb.out
  • %TEMP%\res9137.tmp
  • %TEMP%\res1370.tmp
  • %TEMP%\csc29238aab701e4a1da5b97642bae72568.tmp
  • %TEMP%\0knd001y.dll
  • %TEMP%\csc4b41f0027857458482a2b4a4b662a58.tmp
  • %TEMP%\0knd001y.out
  • %TEMP%\0knd001y.cmdline
  • %TEMP%\0knd001y.0.cs
  • %TEMP%\pg2ztoax.dll
  • %TEMP%\res7204.tmp
  • %TEMP%\cscb3b7197834c94199abfb8cb11e723d9a.tmp
  • %TEMP%\pg2ztoax.out
  • %TEMP%\pg2ztoax.cmdline
  • %TEMP%\pg2ztoax.0.cs
  • %TEMP%\4d455c5z.dll
  • %TEMP%\res698b.tmp
  • %TEMP%\csc3b018dcfd3964c4287e3a07378f1cd9b.tmp
  • %TEMP%\4d455c5z.out
  • %TEMP%\4d455c5z.cmdline
  • %TEMP%\4d455c5z.0.cs
  • %TEMP%\4yhfzotd.dll
  • %TEMP%\res66dd.tmp
  • %TEMP%\csc64793446397a4ce096754d93a22e7244.tmp
  • %TEMP%\4yhfzotd.out
  • %TEMP%\4yhfzotd.cmdline
  • %TEMP%\4yhfzotd.0.cs
  • %TEMP%\lpi4x3dm.dll
  • %TEMP%\res74d1.tmp
  • %TEMP%\lpi4x3dm.out
  • %TEMP%\u2kwlvhk.cmdline
  • %TEMP%\p3bec5ef.cmdline
  • %TEMP%\u2kwlvhk.0.cs
  • %TEMP%\r5b5zyie.dll
  • %TEMP%\res8ac1.tmp
  • %TEMP%\csc402ad33208a40fabd71a3863f55d8c.tmp
  • %TEMP%\r5b5zyie.out
  • %TEMP%\r5b5zyie.cmdline
  • %TEMP%\r5b5zyie.0.cs
  • %TEMP%\wfh2pgx3.dll
  • %TEMP%\res8822.tmp
  • %TEMP%\csc2493a95034c64f42b8d54c6173109c2d.tmp
  • %TEMP%\wfh2pgx3.out
  • %TEMP%\wfh2pgx3.cmdline
  • %TEMP%\wfh2pgx3.0.cs
  • %TEMP%\xwtvvmi3.dll
  • %TEMP%\res7fe8.tmp
  • %TEMP%\cscdcf11859a5984ecca804e75dcde8bd6.tmp
  • %TEMP%\xwtvvmi3.out
  • %TEMP%\xwtvvmi3.cmdline
  • %TEMP%\xwtvvmi3.0.cs
  • %TEMP%\p3bec5ef.dll
  • %TEMP%\res7d2a.tmp
  • %TEMP%\csca91b22d3cef243f18c11ce79a16e24c.tmp
  • %TEMP%\p3bec5ef.out
  • %TEMP%\u2kwlvhk.out
  • %TEMP%\hpoafwzi.dll
  • %TEMP%\cscf763c83636024588984183ece03754d2.tmp
  • %TEMP%\sgk315vf.dll
  • %TEMP%\csc8a28fcceb312451aba5eaf19fa51c060.tmp
  • %TEMP%\dgochv5v.out
  • %TEMP%\dgochv5v.cmdline
  • %TEMP%\dgochv5v.0.cs
  • %TEMP%\jwyn3auq.dll
  • %TEMP%\res8390.tmp
  • %TEMP%\cscb3c84de1de6f4b2d98de3f1b59986d79.tmp
  • %TEMP%\jwyn3auq.out
  • %TEMP%\jwyn3auq.cmdline
  • %TEMP%\jwyn3auq.0.cs
  • %TEMP%\lnj4j1q3.dll
  • %TEMP%\res8008.tmp
  • %TEMP%\csc3c1257dc1b664422affd4131fa2ebe8.tmp
  • %TEMP%\lnj4j1q3.out
  • %TEMP%\lnj4j1q3.cmdline
  • %TEMP%\lnj4j1q3.0.cs
  • %TEMP%\xzezfibh.dll
  • %TEMP%\res73f7.tmp
  • %TEMP%\cscf8b2eefaa30342d88fc2149e467f320.tmp
  • %TEMP%\xzezfibh.out
  • %TEMP%\xzezfibh.cmdline
  • %TEMP%\xzezfibh.0.cs
  • %TEMP%\e021onaj.dll
  • %TEMP%\res8dcd.tmp
  • %TEMP%\xthbfaja.0.cs
  • %TEMP%\5enxntbo.cmdline
  • %TEMP%\xthbfaja.cmdline
  • %TEMP%\5enxntbo.0.cs
  • %TEMP%\lij5cn0z.dll
  • %TEMP%\resab4c.tmp
  • %TEMP%\csc7e4b76e87e454c3abe1654cd4a73b1e.tmp
  • %TEMP%\lij5cn0z.out
  • %TEMP%\lij5cn0z.cmdline
  • %TEMP%\lij5cn0z.0.cs
  • %TEMP%\2jznf52w.dll
  • %TEMP%\resa10f.tmp
  • %TEMP%\cscfd4fc781d1864a8792ed1cf8e9848849.tmp
  • %TEMP%\2jznf52w.out
  • %TEMP%\2jznf52w.cmdline
  • %TEMP%\2jznf52w.0.cs
  • %TEMP%\ayikzgt5.dll
  • %TEMP%\res9ccb.tmp
  • %TEMP%\cscf09e679f551b40b6b3c7bb8b31e5379.tmp
  • %TEMP%\ayikzgt5.out
  • %TEMP%\ayikzgt5.cmdline
  • %TEMP%\ayikzgt5.0.cs
  • %TEMP%\xthbfaja.dll
  • %TEMP%\res928e.tmp
  • %TEMP%\csc91f11761109454eb3ac1e4de9ce8c9.tmp
  • %TEMP%\xthbfaja.out
  • %TEMP%\res707e.tmp
  • %TEMP%\dgochv5v.dll
  • %TEMP%\csca70218948823451b8a773fb76b36a1.tmp
  • %TEMP%\aj3p3r2f.dll
  • %TEMP%\cscd08a6de32bad400ab81fea17fb56b9a2.tmp
  • %TEMP%\aj3p3r2f.out
  • %TEMP%\aj3p3r2f.cmdline
  • %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\run.dat
  • %TEMP%\aj3p3r2f.0.cs
  • %TEMP%\l0t0dzsj.dll
  • %TEMP%\res47aa.tmp
  • %TEMP%\csce17071a8485424083d9ae163e1b9b9.tmp
  • %TEMP%\l0t0dzsj.out
  • %TEMP%\l0t0dzsj.cmdline
  • %TEMP%\l0t0dzsj.0.cs
  • %TEMP%\uafpfj32.dll
  • %TEMP%\res3d0f.tmp
  • %TEMP%\csc494e36afbe3f4ea39aa2986924e4c.tmp
  • %TEMP%\uafpfj32.out
  • %TEMP%\uafpfj32.cmdline
  • %TEMP%\uafpfj32.0.cs
  • %TEMP%\uqoptlcj.dll
  • %TEMP%\res363c.tmp
  • %TEMP%\csc484b58fe571f4e2a815b456d9eeeb0d2.tmp
  • %TEMP%\uqoptlcj.out
  • %TEMP%\uqoptlcj.cmdline
  • %TEMP%\uqoptlcj.0.cs
  • %TEMP%\res4e1f.tmp
  • %TEMP%\knk3j5cl.0.cs
  • %TEMP%\e021onaj.cmdline
  • %TEMP%\knk3j5cl.cmdline
  • %TEMP%\e021onaj.0.cs
  • %TEMP%\bljb3q0g.dll
  • %TEMP%\res67e6.tmp
  • %TEMP%\csc7b75235fa2314828a4954458dd8564c9.tmp
  • %TEMP%\bljb3q0g.out
  • %TEMP%\bljb3q0g.cmdline
  • %TEMP%\bljb3q0g.0.cs
  • %TEMP%\gbc5ctcj.dll
  • %TEMP%\res645d.tmp
  • %TEMP%\csc78105d2c71ea48ff93d486b664324394.tmp
  • %TEMP%\gbc5ctcj.out
  • %TEMP%\gbc5ctcj.cmdline
  • %TEMP%\gbc5ctcj.0.cs
  • %TEMP%\y4rj4snc.dll
  • %TEMP%\res5b87.tmp
  • %TEMP%\cscab7a29e1f880444bb08eeda39e32d73.tmp
  • %TEMP%\y4rj4snc.out
  • %TEMP%\y4rj4snc.cmdline
  • %TEMP%\y4rj4snc.0.cs
  • %TEMP%\knk3j5cl.dll
  • %TEMP%\res582d.tmp
  • %TEMP%\csc842f4eeb4e9460ba9e49209c934fcd.tmp
  • %TEMP%\knk3j5cl.out
  • %TEMP%\e021onaj.out
  • %TEMP%\gxy1330m.0.cs
  • %TEMP%\yko1xt25.cmdline
  • %TEMP%\resaf51.tmp
  • %TEMP%\csc805d947929664f8eb36d99253b8b48.tmp
  • %TEMP%\sgk315vf.out
  • %TEMP%\sgk315vf.cmdline
  • %TEMP%\sgk315vf.0.cs
  • %TEMP%\ufbbeeq4.dll
  • %TEMP%\resfaf1.tmp
  • %TEMP%\cscd534e95e5ee44e7ea279fa4b884c345.tmp
  • %TEMP%\ufbbeeq4.out
  • %TEMP%\ufbbeeq4.cmdline
  • %TEMP%\ufbbeeq4.0.cs
  • %TEMP%\nsdmdc5h.dll
  • %TEMP%\resf823.tmp
  • %TEMP%\cscf055dc82dc194b25b2bf8ca18d5f999e.tmp
  • %TEMP%\nsdmdc5h.out
  • %TEMP%\nsdmdc5h.cmdline
  • %TEMP%\nsdmdc5h.0.cs
  • %TEMP%\dkpi4zzg.dll
  • %TEMP%\resefe9.tmp
  • %TEMP%\cscf2edd73e98414d67be7b1d669a2afb60.tmp
  • %TEMP%\dkpi4zzg.out
  • %TEMP%\dkpi4zzg.cmdline
  • %TEMP%\dkpi4zzg.0.cs
  • %TEMP%\qokze0kx.dll
  • %TEMP%\res128.tmp
  • %TEMP%\2oiyftqt.0.cs
  • %TEMP%\csc16dab5b9f7e4c5a83a96abbe7374880.tmp
  • %TEMP%\2oiyftqt.cmdline
  • %TEMP%\yko1xt25.0.cs
  • %TEMP%\t4kociyu.dll
  • %TEMP%\res10a3.tmp
  • %TEMP%\csca5f06b12dc944b1aa91ebab1ddc4a0ea.tmp
  • %TEMP%\t4kociyu.out
  • %TEMP%\t4kociyu.cmdline
  • %TEMP%\t4kociyu.0.cs
  • %TEMP%\5yjpogjq.dll
  • %TEMP%\resb17.tmp
  • %TEMP%\cscb7057e1367d642179f163501f84c43.tmp
  • %TEMP%\5yjpogjq.out
  • %TEMP%\5yjpogjq.cmdline
  • %TEMP%\5yjpogjq.0.cs
  • %TEMP%\axbbgge3.dll
  • %TEMP%\res905.tmp
  • %TEMP%\cscc61afd4b6aaf469694404ab073d9832d.tmp
  • %TEMP%\axbbgge3.out
  • %TEMP%\axbbgge3.cmdline
  • %TEMP%\axbbgge3.0.cs
  • %TEMP%\2oiyftqt.dll
  • %TEMP%\res33b.tmp
  • %TEMP%\cscfddfb50cea5b463d968cf0b5aebd653a.tmp
  • %TEMP%\2oiyftqt.out
  • %TEMP%\resee63.tmp
  • %TEMP%\yko1xt25.out
  • %TEMP%\csc4d85fff7c2b84a75b7e81f3eef8e7542.tmp
  • %TEMP%\yf3gpqck.dll
  • %TEMP%\csc4a289db4a8ce453887605bdae95dc21.tmp
  • %TEMP%\yf3gpqck.out
  • %TEMP%\yf3gpqck.cmdline
  • %TEMP%\yf3gpqck.0.cs
  • %TEMP%\5iatwonn.dll
  • %TEMP%\resc773.tmp
  • %TEMP%\csc3834a4082c244b568ed5f169569e02b.tmp
  • %TEMP%\5iatwonn.out
  • %TEMP%\5iatwonn.cmdline
  • %TEMP%\5iatwonn.0.cs
  • %TEMP%\ukmuv0sd.dll
  • %TEMP%\resbe20.tmp
  • %TEMP%\csc34f3408970b6417aa2dda029191cb85f.tmp
  • %TEMP%\ukmuv0sd.out
  • %TEMP%\ukmuv0sd.cmdline
  • %TEMP%\ukmuv0sd.0.cs
  • %TEMP%\2lwhw2u4.dll
  • %TEMP%\resba78.tmp
  • %TEMP%\cscab3ede1d5d5440f287c3be4bdfa0e35.tmp
  • %TEMP%\2lwhw2u4.out
  • %TEMP%\2lwhw2u4.cmdline
  • %TEMP%\2lwhw2u4.0.cs
  • %TEMP%\5enxntbo.dll
  • %TEMP%\rescb79.tmp
  • %TEMP%\5enxntbo.out
  • %TEMP%\qokze0kx.cmdline
  • %TEMP%\gxy1330m.cmdline
  • %TEMP%\qokze0kx.0.cs
  • %TEMP%\1dedzl3l.dll
  • %TEMP%\rese733.tmp
  • %TEMP%\csc71e5de2255e4d53a46b36632210ee46.tmp
  • %TEMP%\1dedzl3l.out
  • %TEMP%\1dedzl3l.cmdline
  • %TEMP%\1dedzl3l.0.cs
  • %TEMP%\c1o1ndph.dll
  • %TEMP%\rese38b.tmp
  • %TEMP%\csc635bd042ad5340e1a3ed39c122a04ccb.tmp
  • %TEMP%\c1o1ndph.out
  • %TEMP%\c1o1ndph.cmdline
  • %TEMP%\c1o1ndph.0.cs
  • %TEMP%\e5qt11zy.dll
  • %TEMP%\resda19.tmp
  • %TEMP%\csce7842091c41342d2a0f02c85d7fc56d2.tmp
  • %TEMP%\e5qt11zy.out
  • %TEMP%\e5qt11zy.cmdline
  • %TEMP%\e5qt11zy.0.cs
  • %TEMP%\gxy1330m.dll
  • %TEMP%\resd603.tmp
  • %TEMP%\cscadfe18a64edf4d6ca5ff6f1f9dcc5c77.tmp
  • %TEMP%\gxy1330m.out
  • %TEMP%\qokze0kx.out
  • %TEMP%\cnrd1pfz.out
Deletes the following files
  • %TEMP%\res363c.tmp
  • %TEMP%\0tbslj1a.dll
  • %TEMP%\0tbslj1a.0.cs
  • %TEMP%\csc38169b5f7f6141069643663f22447f.tmp
  • %TEMP%\res451a.tmp
  • %TEMP%\uos2pqgi.cmdline
  • %TEMP%\uos2pqgi.dll
  • %TEMP%\uos2pqgi.0.cs
  • %TEMP%\uos2pqgi.out
  • %TEMP%\csc2ce070129a09404b984e5d5e76e21617.tmp
  • %TEMP%\res3f02.tmp
  • %TEMP%\0tbslj1a.cmdline
  • %TEMP%\0tbslj1a.out
  • %TEMP%\zc1yfgb2.out
  • %TEMP%\zc1yfgb2.cmdline
  • %TEMP%\csc45facb8e594452aaff955c3ee147a.tmp
  • %TEMP%\res3d1f.tmp
  • %TEMP%\xnjjznh3.out
  • %TEMP%\xnjjznh3.0.cs
  • %TEMP%\xnjjznh3.cmdline
  • %TEMP%\xnjjznh3.dll
  • %TEMP%\cscc410a4f540544119b9cb106095b1888b.tmp
  • %TEMP%\res37a3.tmp
  • %TEMP%\zc1yfgb2.dll
  • %TEMP%\csc28f58c717e1243148bc198e032a0467c.tmp
  • %TEMP%\res47b9.tmp
  • %TEMP%\res5e36.tmp
  • %TEMP%\umwss1we.cmdline
  • %TEMP%\umwss1we.out
  • %TEMP%\umwss1we.0.cs
  • %TEMP%\umwss1we.dll
  • %TEMP%\cscd8f6eff923b34260bccf3da1d2f54792.tmp
  • %TEMP%\res5b39.tmp
  • %TEMP%\bt1n21si.dll
  • %TEMP%\bt1n21si.out
  • %TEMP%\bt1n21si.cmdline
  • %TEMP%\bt1n21si.0.cs
  • %TEMP%\cscaa013688f846484e83bdf44822bef064.tmp
  • %TEMP%\res530f.tmp
  • %TEMP%\cajbkwsz.0.cs
  • %TEMP%\cajbkwsz.dll
  • %TEMP%\cajbkwsz.out
  • %TEMP%\cajbkwsz.cmdline
  • %TEMP%\csc9d9411d8d5dc42dea16a112078b79a69.tmp
  • %TEMP%\res5012.tmp
  • %TEMP%\1esztvr3.0.cs
  • %TEMP%\1esztvr3.out
  • %TEMP%\1esztvr3.cmdline
  • %TEMP%\1esztvr3.dll
  • %TEMP%\edabhzef.dll
  • %TEMP%\zc1yfgb2.0.cs
  • %TEMP%\edabhzef.out
  • %TEMP%\edabhzef.0.cs
  • %TEMP%\edabhzef.cmdline
  • %TEMP%\kavmxtu1.out
  • %TEMP%\wlxjj3hx.cmdline
  • %TEMP%\wlxjj3hx.dll
  • %TEMP%\csc7a7fc0dbad2f42c89def94d810a1b2f.tmp
  • %TEMP%\res2220.tmp
  • %TEMP%\jyxdltq3.out
  • %TEMP%\jyxdltq3.0.cs
  • %TEMP%\jyxdltq3.cmdline
  • %TEMP%\jyxdltq3.dll
  • %TEMP%\csc2003496ea02446f6ad9aea864ef097b4.tmp
  • %TEMP%\res208a.tmp
  • %TEMP%\kavmxtu1.0.cs
  • %TEMP%\wlxjj3hx.0.cs
  • %TEMP%\kavmxtu1.dll
  • %TEMP%\kavmxtu1.cmdline
  • %TEMP%\csce253e118d30f4af3b8bd4125d39d27b7.tmp
  • %TEMP%\res1b0e.tmp
  • %TEMP%\uc1q4hze.dll
  • %TEMP%\uc1q4hze.out
  • %TEMP%\uc1q4hze.cmdline
  • %TEMP%\uc1q4hze.0.cs
  • %TEMP%\csce25f508ef8743b790a8279231b16bdf.tmp
  • %TEMP%\res18dd.tmp
  • %TEMP%\csca76ba6c2a3c74a928857f7454ffe33.tmp
  • %TEMP%\csce373cd3ea3d44c7eafb0817e92d5cbcd.tmp
  • %TEMP%\res27da.tmp
  • %TEMP%\nbeeomzh.cmdline
  • %TEMP%\wlxjj3hx.out
  • %TEMP%\csc196eb628f4cb4e5cac45c2e95e64cb1b.tmp
  • %TEMP%\res35de.tmp
  • %TEMP%\mnb10yie.dll
  • %TEMP%\mnb10yie.cmdline
  • %TEMP%\mnb10yie.out
  • %TEMP%\mnb10yie.0.cs
  • %TEMP%\csca5009f9d3f824fd1b15561a5b3e6d5c.tmp
  • %TEMP%\res2fe6.tmp
  • %TEMP%\fdro25f1.out
  • %TEMP%\fdro25f1.0.cs
  • %TEMP%\fdro25f1.cmdline
  • %TEMP%\fdro25f1.dll
  • %TEMP%\csc3aedde5aa7a04b50bb4f1f17f56fa1.tmp
  • %TEMP%\res2e40.tmp
  • %TEMP%\b1p4ia2x.cmdline
  • %TEMP%\b1p4ia2x.dll
  • %TEMP%\b1p4ia2x.0.cs
  • %TEMP%\b1p4ia2x.out
  • %TEMP%\csc900a2c0be6514d7686fc6866e555eec5.tmp
  • %TEMP%\res2970.tmp
  • %TEMP%\nbeeomzh.dll
  • %TEMP%\nbeeomzh.0.cs
  • %TEMP%\nbeeomzh.out
  • %TEMP%\lpi4x3dm.cmdline
  • %TEMP%\lpi4x3dm.dll
  • %TEMP%\lpi4x3dm.0.cs
  • %TEMP%\hpoafwzi.cmdline
  • %TEMP%\hpoafwzi.0.cs
  • %TEMP%\csc2da66df7f51e4ce8a5c624c669301277.tmp
  • %TEMP%\resaa81.tmp
  • %TEMP%\alwjpgk1.0.cs
  • %TEMP%\alwjpgk1.dll
  • %TEMP%\alwjpgk1.out
  • %TEMP%\alwjpgk1.cmdline
  • %TEMP%\csca264337eacd04e0eb082fcdce22da9e.tmp
  • %TEMP%\res9e12.tmp
  • %TEMP%\4f3tqnkj.out
  • %TEMP%\4f3tqnkj.cmdline
  • %TEMP%\4f3tqnkj.dll
  • %TEMP%\4f3tqnkj.0.cs
  • %TEMP%\cscd93510a9cbf043e1bf8e64c02960cea9.tmp
  • %TEMP%\res9a4b.tmp
  • %TEMP%\23nzh1mk.0.cs
  • %TEMP%\23nzh1mk.dll
  • %TEMP%\23nzh1mk.cmdline
  • %TEMP%\23nzh1mk.out
  • %TEMP%\cscdf016d02d8624025b87caa7b1d1c1a82.tmp
  • %TEMP%\res93e5.tmp
  • %TEMP%\u2kwlvhk.0.cs
  • %TEMP%\hpoafwzi.dll
  • %TEMP%\resad10.tmp
  • %TEMP%\yko1xt25.dll
  • %TEMP%\csc44c966d6110486ea4406b916aa96a9.tmp
  • %TEMP%\cnrd1pfz.cmdline
  • %TEMP%\tji2mlym.out
  • %TEMP%\tji2mlym.0.cs
  • %TEMP%\tji2mlym.dll
  • %TEMP%\tji2mlym.cmdline
  • %TEMP%\csc1f871bf063994f77a9cba5aec2d5a29.tmp
  • %TEMP%\resbc4c.tmp
  • %TEMP%\jrsg41vh.dll
  • %TEMP%\jrsg41vh.out
  • %TEMP%\jrsg41vh.0.cs
  • %TEMP%\jrsg41vh.cmdline
  • %TEMP%\cscc31ce5aaf3b343f2a8b7c05501ac314.tmp
  • %TEMP%\resb53b.tmp
  • %TEMP%\ewub02yw.out
  • %TEMP%\ewub02yw.dll
  • %TEMP%\ewub02yw.0.cs
  • %TEMP%\ewub02yw.cmdline
  • %TEMP%\cscd9fb8cbd6184acd97a0d8b86b7025ac.tmp
  • %TEMP%\resb319.tmp
  • %TEMP%\m5yozyeb.0.cs
  • %TEMP%\m5yozyeb.out
  • %TEMP%\m5yozyeb.cmdline
  • %TEMP%\m5yozyeb.dll
  • %TEMP%\u2kwlvhk.dll
  • %TEMP%\res7d2a.tmp
  • %TEMP%\u2kwlvhk.cmdline
  • %TEMP%\0knd001y.dll
  • %TEMP%\0knd001y.cmdline
  • %TEMP%\0knd001y.0.cs
  • %TEMP%\csc4b41f0027857458482a2b4a4b662a58.tmp
  • %TEMP%\res74d1.tmp
  • %TEMP%\pg2ztoax.out
  • %TEMP%\pg2ztoax.0.cs
  • %TEMP%\pg2ztoax.cmdline
  • %TEMP%\pg2ztoax.dll
  • %TEMP%\cscb3b7197834c94199abfb8cb11e723d9a.tmp
  • %TEMP%\res7204.tmp
  • %TEMP%\4d455c5z.dll
  • %TEMP%\4d455c5z.cmdline
  • %TEMP%\4d455c5z.out
  • %TEMP%\4d455c5z.0.cs
  • %TEMP%\csc3b018dcfd3964c4287e3a07378f1cd9b.tmp
  • %TEMP%\res698b.tmp
  • %TEMP%\4yhfzotd.dll
  • %TEMP%\4yhfzotd.cmdline
  • %TEMP%\4yhfzotd.out
  • %TEMP%\4yhfzotd.0.cs
  • %TEMP%\csc64793446397a4ce096754d93a22e7244.tmp
  • %TEMP%\res66dd.tmp
  • %TEMP%\lpi4x3dm.out
  • %TEMP%\0knd001y.out
  • %TEMP%\cnrd1pfz.0.cs
  • %TEMP%\csc29238aab701e4a1da5b97642bae72568.tmp
  • %TEMP%\csca91b22d3cef243f18c11ce79a16e24c.tmp
  • %TEMP%\res9137.tmp
  • %TEMP%\r5b5zyie.0.cs
  • %TEMP%\r5b5zyie.dll
  • %TEMP%\r5b5zyie.out
  • %TEMP%\r5b5zyie.cmdline
  • %TEMP%\csc402ad33208a40fabd71a3863f55d8c.tmp
  • %TEMP%\res8ac1.tmp
  • %TEMP%\wfh2pgx3.0.cs
  • %TEMP%\wfh2pgx3.out
  • %TEMP%\wfh2pgx3.cmdline
  • %TEMP%\wfh2pgx3.dll
  • %TEMP%\csc2493a95034c64f42b8d54c6173109c2d.tmp
  • %TEMP%\res8822.tmp
  • %TEMP%\xwtvvmi3.out
  • %TEMP%\xwtvvmi3.0.cs
  • %TEMP%\xwtvvmi3.cmdline
  • %TEMP%\xwtvvmi3.dll
  • %TEMP%\cscdcf11859a5984ecca804e75dcde8bd6.tmp
  • %TEMP%\res7fe8.tmp
  • %TEMP%\p3bec5ef.cmdline
  • %TEMP%\p3bec5ef.out
  • %TEMP%\p3bec5ef.0.cs
  • %TEMP%\p3bec5ef.dll
  • %TEMP%\u2kwlvhk.out
  • %TEMP%\hpoafwzi.out
  • %TEMP%\yko1xt25.0.cs
  • %TEMP%\res33b.tmp
  • %TEMP%\dgochv5v.cmdline
  • %TEMP%\dgochv5v.out
  • %TEMP%\dgochv5v.0.cs
  • %TEMP%\csc8a28fcceb312451aba5eaf19fa51c060.tmp
  • %TEMP%\res8dcd.tmp
  • %TEMP%\jwyn3auq.0.cs
  • %TEMP%\jwyn3auq.out
  • %TEMP%\jwyn3auq.cmdline
  • %TEMP%\jwyn3auq.dll
  • %TEMP%\cscb3c84de1de6f4b2d98de3f1b59986d79.tmp
  • %TEMP%\res928e.tmp
  • %TEMP%\dgochv5v.dll
  • %TEMP%\lnj4j1q3.dll
  • %TEMP%\lnj4j1q3.out
  • %TEMP%\lnj4j1q3.cmdline
  • %TEMP%\csc3c1257dc1b664422affd4131fa2ebe8.tmp
  • %TEMP%\res8008.tmp
  • %TEMP%\xzezfibh.out
  • %TEMP%\xzezfibh.dll
  • %TEMP%\xzezfibh.cmdline
  • %TEMP%\xzezfibh.0.cs
  • %TEMP%\cscf8b2eefaa30342d88fc2149e467f320.tmp
  • %TEMP%\res8390.tmp
  • %TEMP%\knk3j5cl.0.cs
  • %TEMP%\csc91f11761109454eb3ac1e4de9ce8c9.tmp
  • %TEMP%\csc16dab5b9f7e4c5a83a96abbe7374880.tmp
  • %TEMP%\resaf51.tmp
  • %TEMP%\lij5cn0z.dll
  • %TEMP%\lij5cn0z.0.cs
  • %TEMP%\lij5cn0z.out
  • %TEMP%\lij5cn0z.cmdline
  • %TEMP%\csc7e4b76e87e454c3abe1654cd4a73b1e.tmp
  • %TEMP%\resab4c.tmp
  • %TEMP%\2jznf52w.out
  • %TEMP%\2jznf52w.0.cs
  • %TEMP%\2jznf52w.cmdline
  • %TEMP%\2jznf52w.dll
  • %TEMP%\cscfd4fc781d1864a8792ed1cf8e9848849.tmp
  • %TEMP%\resa10f.tmp
  • %TEMP%\ayikzgt5.0.cs
  • %TEMP%\ayikzgt5.dll
  • %TEMP%\ayikzgt5.out
  • %TEMP%\ayikzgt5.cmdline
  • %TEMP%\cscf09e679f551b40b6b3c7bb8b31e5379.tmp
  • %TEMP%\res9ccb.tmp
  • %TEMP%\xthbfaja.cmdline
  • %TEMP%\xthbfaja.dll
  • %TEMP%\xthbfaja.0.cs
  • %TEMP%\res73f7.tmp
  • %TEMP%\lnj4j1q3.0.cs
  • %TEMP%\e021onaj.dll
  • %TEMP%\e021onaj.0.cs
  • %TEMP%\e021onaj.out
  • %TEMP%\res47aa.tmp
  • %TEMP%\aj3p3r2f.dll
  • %TEMP%\aj3p3r2f.0.cs
  • %TEMP%\aj3p3r2f.cmdline
  • %TEMP%\cscd08a6de32bad400ab81fea17fb56b9a2.tmp
  • %TEMP%\res4e1f.tmp
  • %TEMP%\l0t0dzsj.dll
  • %TEMP%\l0t0dzsj.out
  • %TEMP%\l0t0dzsj.cmdline
  • %TEMP%\l0t0dzsj.0.cs
  • %TEMP%\csce17071a8485424083d9ae163e1b9b9.tmp
  • %TEMP%\uafpfj32.cmdline
  • %TEMP%\res582d.tmp
  • %TEMP%\uafpfj32.dll
  • %TEMP%\uafpfj32.out
  • %TEMP%\uafpfj32.0.cs
  • %TEMP%\csc494e36afbe3f4ea39aa2986924e4c.tmp
  • %TEMP%\res3d0f.tmp
  • %TEMP%\uqoptlcj.dll
  • %TEMP%\uqoptlcj.0.cs
  • %TEMP%\uqoptlcj.cmdline
  • %TEMP%\uqoptlcj.out
  • %TEMP%\csc484b58fe571f4e2a815b456d9eeeb0d2.tmp
  • %TEMP%\5enxntbo.out
  • %TEMP%\xthbfaja.out
  • %TEMP%\csc842f4eeb4e9460ba9e49209c934fcd.tmp
  • %TEMP%\knk3j5cl.out
  • %TEMP%\aj3p3r2f.out
  • %TEMP%\e021onaj.cmdline
  • %TEMP%\csca70218948823451b8a773fb76b36a1.tmp
  • %TEMP%\res707e.tmp
  • %TEMP%\bljb3q0g.out
  • %TEMP%\bljb3q0g.0.cs
  • %TEMP%\bljb3q0g.dll
  • %TEMP%\bljb3q0g.cmdline
  • %TEMP%\csc7b75235fa2314828a4954458dd8564c9.tmp
  • %TEMP%\res67e6.tmp
  • %TEMP%\gbc5ctcj.0.cs
  • %TEMP%\gbc5ctcj.dll
  • %TEMP%\gbc5ctcj.cmdline
  • %TEMP%\gbc5ctcj.out
  • %TEMP%\csc78105d2c71ea48ff93d486b664324394.tmp
  • %TEMP%\res645d.tmp
  • %TEMP%\y4rj4snc.dll
  • %TEMP%\y4rj4snc.out
  • %TEMP%\y4rj4snc.cmdline
  • %TEMP%\y4rj4snc.0.cs
  • %TEMP%\cscab7a29e1f880444bb08eeda39e32d73.tmp
  • %TEMP%\res5b87.tmp
  • %TEMP%\knk3j5cl.dll
  • %TEMP%\knk3j5cl.cmdline
  • %TEMP%\5enxntbo.cmdline
  • %TEMP%\5enxntbo.dll
  • %TEMP%\5enxntbo.0.cs
  • %TEMP%\sgk315vf.cmdline
  • %TEMP%\sgk315vf.0.cs
  • %TEMP%\sgk315vf.out
  • %TEMP%\csc805d947929664f8eb36d99253b8b48.tmp
  • %TEMP%\res128.tmp
  • %TEMP%\ufbbeeq4.0.cs
  • %TEMP%\ufbbeeq4.cmdline
  • %TEMP%\ufbbeeq4.dll
  • %TEMP%\ufbbeeq4.out
  • %TEMP%\cscd534e95e5ee44e7ea279fa4b884c345.tmp
  • %TEMP%\resfaf1.tmp
  • %TEMP%\nsdmdc5h.cmdline
  • %TEMP%\nsdmdc5h.dll
  • %TEMP%\nsdmdc5h.0.cs
  • %TEMP%\nsdmdc5h.out
  • %TEMP%\cscf055dc82dc194b25b2bf8ca18d5f999e.tmp
  • %TEMP%\resf823.tmp
  • %TEMP%\dkpi4zzg.cmdline
  • %TEMP%\dkpi4zzg.0.cs
  • %TEMP%\dkpi4zzg.dll
  • %TEMP%\dkpi4zzg.out
  • %TEMP%\cscf2edd73e98414d67be7b1d669a2afb60.tmp
  • %TEMP%\resefe9.tmp
  • %TEMP%\sgk315vf.dll
  • %TEMP%\cscfddfb50cea5b463d968cf0b5aebd653a.tmp
  • %TEMP%\yko1xt25.cmdline
  • %TEMP%\2oiyftqt.dll
  • %TEMP%\cscf763c83636024588984183ece03754d2.tmp
  • %TEMP%\res1370.tmp
  • %TEMP%\t4kociyu.0.cs
  • %TEMP%\t4kociyu.cmdline
  • %TEMP%\t4kociyu.dll
  • %TEMP%\t4kociyu.out
  • %TEMP%\csca5f06b12dc944b1aa91ebab1ddc4a0ea.tmp
  • %TEMP%\res10a3.tmp
  • %TEMP%\5yjpogjq.cmdline
  • %TEMP%\5yjpogjq.dll
  • %TEMP%\5yjpogjq.0.cs
  • %TEMP%\5yjpogjq.out
  • %TEMP%\cscb7057e1367d642179f163501f84c43.tmp
  • %TEMP%\resb17.tmp
  • %TEMP%\axbbgge3.dll
  • %TEMP%\axbbgge3.out
  • %TEMP%\axbbgge3.cmdline
  • %TEMP%\axbbgge3.0.cs
  • %TEMP%\cscc61afd4b6aaf469694404ab073d9832d.tmp
  • %TEMP%\res905.tmp
  • %TEMP%\2oiyftqt.out
  • %TEMP%\2oiyftqt.cmdline
  • %TEMP%\2oiyftqt.0.cs
  • %TEMP%\qokze0kx.out
  • %TEMP%\cscadfe18a64edf4d6ca5ff6f1f9dcc5c77.tmp
  • %TEMP%\qokze0kx.cmdline
  • %TEMP%\resd603.tmp
  • %TEMP%\yf3gpqck.dll
  • %TEMP%\yf3gpqck.out
  • %TEMP%\yf3gpqck.cmdline
  • %TEMP%\csc4a289db4a8ce453887605bdae95dc21.tmp
  • %TEMP%\rescb79.tmp
  • %TEMP%\5iatwonn.dll
  • %TEMP%\5iatwonn.cmdline
  • %TEMP%\5iatwonn.out
  • %TEMP%\5iatwonn.0.cs
  • %TEMP%\csc3834a4082c244b568ed5f169569e02b.tmp
  • %TEMP%\resc773.tmp
  • %TEMP%\ukmuv0sd.0.cs
  • %TEMP%\ukmuv0sd.cmdline
  • %TEMP%\ukmuv0sd.out
  • %TEMP%\ukmuv0sd.dll
  • %TEMP%\csc34f3408970b6417aa2dda029191cb85f.tmp
  • %TEMP%\resbe20.tmp
  • %TEMP%\2lwhw2u4.0.cs
  • %TEMP%\2lwhw2u4.out
  • %TEMP%\2lwhw2u4.cmdline
  • %TEMP%\2lwhw2u4.dll
  • %TEMP%\cscab3ede1d5d5440f287c3be4bdfa0e35.tmp
  • %TEMP%\resba78.tmp
  • %TEMP%\yf3gpqck.0.cs
  • %TEMP%\yko1xt25.out
  • %TEMP%\qokze0kx.dll
  • %TEMP%\gxy1330m.out
  • %TEMP%\csc4d85fff7c2b84a75b7e81f3eef8e7542.tmp
  • %TEMP%\resee63.tmp
  • %TEMP%\1dedzl3l.out
  • %TEMP%\1dedzl3l.0.cs
  • %TEMP%\1dedzl3l.cmdline
  • %TEMP%\1dedzl3l.dll
  • %TEMP%\csc71e5de2255e4d53a46b36632210ee46.tmp
  • %TEMP%\rese733.tmp
  • %TEMP%\c1o1ndph.cmdline
  • %TEMP%\c1o1ndph.out
  • %TEMP%\c1o1ndph.dll
  • %TEMP%\c1o1ndph.0.cs
  • %TEMP%\csc635bd042ad5340e1a3ed39c122a04ccb.tmp
  • %TEMP%\rese38b.tmp
  • %TEMP%\e5qt11zy.out
  • %TEMP%\e5qt11zy.0.cs
  • %TEMP%\e5qt11zy.dll
  • %TEMP%\e5qt11zy.cmdline
  • %TEMP%\csce7842091c41342d2a0f02c85d7fc56d2.tmp
  • %TEMP%\resda19.tmp
  • %TEMP%\gxy1330m.cmdline
  • %TEMP%\gxy1330m.0.cs
  • %TEMP%\gxy1330m.dll
  • %TEMP%\qokze0kx.0.cs
  • %TEMP%\cnrd1pfz.out
Network activity
Connects to
  • 'localhost':41008
TCP
  • '41###.duckdns.org':41008
UDP
  • DNS ASK 41###.duckdns.org
Miscellaneous
Creates and executes the following
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\uqoptlcj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\hpoafwzi.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAA81.tmp" "%TEMP%\CSC2DA66DF7F51E4CE8A5C624C669301277.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\m5yozyeb.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAD10.tmp" "%TEMP%\CSC44C966D6110486EA4406B916AA96A9.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ewub02yw.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB319.tmp" "%TEMP%\CSCD9FB8CBD6184ACD97A0D8B86B7025AC.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\jrsg41vh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB53B.tmp" "%TEMP%\CSCC31CE5AAF3B343F2A8B7C05501AC314.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES74D1.tmp" "%TEMP%\CSC4B41F0027857458482A2B4A4B662A58.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\tji2mlym.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\cnrd1pfz.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBEFB.tmp" "%TEMP%\CSCF902A29B30AF4817B6DC203FA1AE6FAF.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ug11b1iy.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC5ED.tmp" "%TEMP%\CSC70B3D53740694F0794B4411176973278.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ed43hjua.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC8AB.tmp" "%TEMP%\CSC44CF75AABFD345E29521CADB6C489AE.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\1pu34mvh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD02A.tmp" "%TEMP%\CSCBEBB12FCC9284C4795A54BD63A7C9093.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\qtrqetgw.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9A4B.tmp" "%TEMP%\CSCD93510A9CBF043E1BF8E64C02960CEA9.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBC4C.tmp" "%TEMP%\CSC1F871BF063994F77A9CBA5AEC2D5A29.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9E12.tmp" "%TEMP%\CSCA264337EACD04E0EB082FCDCE22DA9E.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\alwjpgk1.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\4f3tqnkj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES93E5.tmp" "%TEMP%\CSCDF016D02D8624025B87CAA7B1D1C1A82.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\lpi4x3dm.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5E36.tmp" "%TEMP%\CSCA76BA6C2A3C74A928857F7454FFE33.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\4yhfzotd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES66DD.tmp" "%TEMP%\CSC64793446397A4CE096754D93A22E7244.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\4d455c5z.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES698B.tmp" "%TEMP%\CSC3B018DCFD3964C4287E3A07378F1CD9B.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\pg2ztoax.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7204.tmp" "%TEMP%\CSCB3B7197834C94199ABFB8CB11E723D9A.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD25B.tmp" "%TEMP%\CSC72E720641D7E458F8C52EB8DEB19F48.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\0knd001y.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES530F.tmp" "%TEMP%\CSCAA013688F846484E83BDF44822BEF064.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\p3bec5ef.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\xwtvvmi3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7FE8.tmp" "%TEMP%\CSCDCF11859A5984ECCA804E75DCDE8BD6.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\wfh2pgx3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8822.tmp" "%TEMP%\CSC2493A95034C64F42B8D54C6173109C2D.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\r5b5zyie.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8AC1.tmp" "%TEMP%\CSC402AD33208A40FABD71A3863F55D8C.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\u2kwlvhk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9137.tmp" "%TEMP%\CSC29238AAB701E4A1DA5B97642BAE72568.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\umwss1we.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\23nzh1mk.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7D2A.tmp" "%TEMP%\CSCA91B22D3CEF243F18C11CE79A16E24C.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5B39.tmp" "%TEMP%\CSCD8F6EFF923B34260BCCF3DA1D2F54792.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\xbblgw3t.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ddg2s33i.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\dwe5h3oj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES16DA.tmp" "%TEMP%\CSC26D5F82CD4E14B6699F4C2B1FB134655.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\fasbzhfn.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2D18.tmp" "%TEMP%\CSCB51127A61E014D7FA7572BB745EFB44C.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\3g3hld3l.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2F3A.tmp" "%TEMP%\CSCDE5761EC18449F28EC9C589DDD6439.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\wm3vfyg5.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3514.tmp" "%TEMP%\CSCDCE33CAE23B448B68C6AA9E6B63BB35D.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\jwa35mjg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\wwswdapr.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3745.tmp" "%TEMP%\CSC4D0389C197994CC2B73D20C6BC239C9.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3CA2.tmp" "%TEMP%\CSCF27AC3551ED04DA0933B39AADD5F1E7E.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\fojj3v5x.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3E66.tmp" "%TEMP%\CSC45E4699C82F74C33A35B57BFD5C2B9F8.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\mexz53ko.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4366.tmp" "%TEMP%\CSC918892FAD4AE49DEB842EACCFEE69BDF.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\0y53xfg2.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES451A.tmp" "%TEMP%\CSCD66AF1F2BA264C7A951E6B7E40A0ACCD.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\5xjlfgtm.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4AC5.tmp" "%TEMP%\CSC21F37448985B423BB3215EE4881FCBDC.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\yz03iu3m.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1499.tmp" "%TEMP%\CSC3BABB017345D4588BCD0E7A4940EABD.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF2C.tmp" "%TEMP%\CSC47D0F02F41FD42C1B2A683755865753.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD0A.tmp" "%TEMP%\CSCA5BA757F8BB6459AB07AD2C878B2D3B8.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES33B.tmp" "%TEMP%\CSCFDDFB50CEA5B463D968CF0B5AEBD653A.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE262.tmp" "%TEMP%\CSCF357626C454822BE5E6BFA1EA30EC.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\sxi2lpyj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE465.tmp" "%TEMP%\CSC3C628934E41D4B7EA73831AD7784F5F.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\h43lc1iz.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEA5E.tmp" "%TEMP%\CSCD7BFA236B62B41739A6AB9498404CE4.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\gkvgsj3a.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEC32.tmp" "%TEMP%\CSCC31AD281F3A845CE8F5FED88D38FE49.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\f5tdasch.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD90F.tmp" "%TEMP%\CSCFC332E2CB0A84621AFB6464F95E7E194.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDB70.tmp" "%TEMP%\CSC11F96ACB3447481092E074246990FD.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\khvhitdm.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF1AE.tmp" "%TEMP%\CSCC706C15CB33D4AF094B161A1BAC39C41.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFDAF.tmp" "%TEMP%\CSCB0F7FBAB8DFF44C59AB0611A3159BCD2.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\d2zzsrhq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFFD1.tmp" "%TEMP%\CSC8F6F3D6D6DBA4BF3AA2716399162CA49.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\mc0vuvxg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5CA.tmp" "%TEMP%\CSCA64FDEAB7C4143DB8468BC69E956B556.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\xzxwzexg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES75F.tmp" "%TEMP%\CSC7330AFB0C36F4DA3956D7919D3B54D4.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\wlfgedaf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\fbrtcxjq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF3FF.tmp" "%TEMP%\CSC6162FD4F7CC94A95A8BA2F6ABF1FCD.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\lbpgthrh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\bt1n21si.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5012.tmp" "%TEMP%\CSC9D9411D8D5DC42DEA16A112078B79A69.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\cajbkwsz.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9CCB.tmp" "%TEMP%\CSCF09E679F551B40B6B3C7BB8B31E5379.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2jznf52w.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA10F.tmp" "%TEMP%\CSCFD4FC781D1864A8792ED1CF8E9848849.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\lij5cn0z.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAB4C.tmp" "%TEMP%\CSC7E4B76E87E454C3ABE1654CD4A73B1E.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\5enxntbo.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAF51.tmp" "%TEMP%\CSC16DAB5B9F7E4C5A83A96ABBE7374880.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2lwhw2u4.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBA78.tmp" "%TEMP%\CSCAB3EDE1D5D5440F287C3BE4BDFA0E35.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE38B.tmp" "%TEMP%\CSC635BD042AD5340E1A3ED39C122A04CCB.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ukmuv0sd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\5iatwonn.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC773.tmp" "%TEMP%\CSC3834A4082C244B568ED5F169569E02B.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\yf3gpqck.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCB79.tmp" "%TEMP%\CSC4A289DB4A8CE453887605BDAE95DC21.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\gxy1330m.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD603.tmp" "%TEMP%\CSCADFE18A64EDF4D6CA5FF6F1F9DCC5C77.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\e5qt11zy.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDA19.tmp" "%TEMP%\CSCE7842091C41342D2A0F02C85D7FC56D2.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\xthbfaja.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8DCD.tmp" "%TEMP%\CSC8A28FCCEB312451ABA5EAF19FA51C060.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ayikzgt5.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\dgochv5v.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8390.tmp" "%TEMP%\CSCB3C84DE1DE6F4B2D98DE3F1B59986D79.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES363C.tmp" "%TEMP%\CSC484B58FE571F4E2A815B456D9EEEB0D2.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3D0F.tmp" "%TEMP%\CSC494E36AFBE3F4EA39AA2986924E4C.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\l0t0dzsj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES47AA.tmp" "%TEMP%\CSCE17071A8485424083D9AE163E1B9B9.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\aj3p3r2f.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4E1F.tmp" "%TEMP%\CSCD08A6DE32BAD400AB81FEA17FB56B9A2.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\knk3j5cl.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES582D.tmp" "%TEMP%\CSC842F4EEB4E9460BA9E49209C934FCD.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\y4rj4snc.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\c1o1ndph.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5B87.tmp" "%TEMP%\CSCAB7A29E1F880444BB08EEDA39E32D73.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBE20.tmp" "%TEMP%\CSC34F3408970B6417AA2DDA029191CB85F.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES645D.tmp" "%TEMP%\CSC78105D2C71EA48FF93D486B664324394.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES67E6.tmp" "%TEMP%\CSC7B75235FA2314828A4954458DD8564C9.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\e021onaj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES707E.tmp" "%TEMP%\CSCA70218948823451B8A773FB76B36A1.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\xzezfibh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES73F7.tmp" "%TEMP%\CSCF8B2EEFAA30342D88FC2149E467F320.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\lnj4j1q3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8008.tmp" "%TEMP%\CSC3C1257DC1B664422AFFD4131FA2EBE8.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\jwyn3auq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\gbc5ctcj.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\uafpfj32.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\bljb3q0g.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES928E.tmp" "%TEMP%\CSC91F11761109454EB3AC1E4DE9CE8C9.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\1dedzl3l.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\wlxjj3hx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\nbeeomzh.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES27DA.tmp" "%TEMP%\CSC28F58C717E1243148BC198E032A0467C.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\b1p4ia2x.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2970.tmp" "%TEMP%\CSC900A2C0BE6514D7686FC6866E555EEC5.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\fdro25f1.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2E40.tmp" "%TEMP%\CSC3AEDDE5AA7A04B50BB4F1F17F56FA1.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\mnb10yie.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2FE6.tmp" "%TEMP%\CSCA5009F9D3F824FD1B15561A5B3E6D5C.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES208A.tmp" "%TEMP%\CSC2003496EA02446F6AD9AEA864EF097B4.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE733.tmp" "%TEMP%\CSC71E5DE2255E4D53A46B36632210EE46.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2220.tmp" "%TEMP%\CSC7A7FC0DBAD2F42C89DEF94D810A1B2F.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\edabhzef.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\zc1yfgb2.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3D1F.tmp" "%TEMP%\CSC45FACB8E594452AAFF955C3EE147A.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\uos2pqgi.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3F02.tmp" "%TEMP%\CSC2CE070129A09404B984E5D5E76E21617.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\0tbslj1a.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES451A.tmp" "%TEMP%\CSC38169B5F7F6141069643663F22447F.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\1esztvr3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES47B9.tmp" "%TEMP%\CSCE373CD3EA3D44C7EAFB0817E92D5CBCD.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES35DE.tmp" "%TEMP%\CSC196EB628F4CB4E5CAC45C2E95E64CB1B.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\xnjjznh3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES37A3.tmp" "%TEMP%\CSCC410A4F540544119B9CB106095B1888B.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\x2hawp0f.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\gb22o1xf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\kavmxtu1.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEE63.tmp" "%TEMP%\CSC4D85FFF7C2B84A75B7E81F3EEF8E7542.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\dkpi4zzg.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEFE9.tmp" "%TEMP%\CSCF2EDD73E98414D67BE7B1D669A2AFB60.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\nsdmdc5h.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF823.tmp" "%TEMP%\CSCF055DC82DC194B25B2BF8CA18D5F999E.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ufbbeeq4.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFAF1.tmp" "%TEMP%\CSCD534E95E5EE44E7EA279FA4B884C345.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\sgk315vf.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES128.tmp" "%TEMP%\CSC805D947929664F8EB36D99253B8B48.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1B0E.tmp" "%TEMP%\CSCE253E118D30F4AF3B8BD4125D39D27B7.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\jyxdltq3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2oiyftqt.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES905.tmp" "%TEMP%\CSCC61AFD4B6AAF469694404AB073D9832D.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\5yjpogjq.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB17.tmp" "%TEMP%\CSCB7057E1367D642179F163501F84C43.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\t4kociyu.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES10A3.tmp" "%TEMP%\CSCA5F06B12DC944B1AA91EBAB1DDC4A0EA.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\yko1xt25.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1370.tmp" "%TEMP%\CSCF763C83636024588984183ECE03754D2.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\uc1q4hze.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES18DD.tmp" "%TEMP%\CSCE25F508EF8743B790A8279231B16BDF.TMP"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\qokze0kx.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\axbbgge3.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4C99.tmp" "%TEMP%\CSCC6DC5A6C16214192A3FCF51190E754C.TMP"' (with hidden window)
Executes the following
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\uqoptlcj.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\alwjpgk1.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9E12.tmp" "%TEMP%\CSCA264337EACD04E0EB082FCDCE22DA9E.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\hpoafwzi.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAA81.tmp" "%TEMP%\CSC2DA66DF7F51E4CE8A5C624C669301277.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\m5yozyeb.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAD10.tmp" "%TEMP%\CSC44C966D6110486EA4406B916AA96A9.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ewub02yw.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB319.tmp" "%TEMP%\CSCD9FB8CBD6184ACD97A0D8B86B7025AC.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\jrsg41vh.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\0knd001y.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB53B.tmp" "%TEMP%\CSCC31CE5AAF3B343F2A8B7C05501AC314.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBC4C.tmp" "%TEMP%\CSC1F871BF063994F77A9CBA5AEC2D5A29.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\cnrd1pfz.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBEFB.tmp" "%TEMP%\CSCF902A29B30AF4817B6DC203FA1AE6FAF.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ug11b1iy.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC5ED.tmp" "%TEMP%\CSC70B3D53740694F0794B4411176973278.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ed43hjua.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC8AB.tmp" "%TEMP%\CSC44CF75AABFD345E29521CADB6C489AE.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\1pu34mvh.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD02A.tmp" "%TEMP%\CSCBEBB12FCC9284C4795A54BD63A7C9093.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\4f3tqnkj.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9A4B.tmp" "%TEMP%\CSCD93510A9CBF043E1BF8E64C02960CEA9.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES93E5.tmp" "%TEMP%\CSCDF016D02D8624025B87CAA7B1D1C1A82.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\23nzh1mk.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9137.tmp" "%TEMP%\CSC29238AAB701E4A1DA5B97642BAE72568.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\umwss1we.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5B39.tmp" "%TEMP%\CSCD8F6EFF923B34260BCCF3DA1D2F54792.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\lpi4x3dm.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5E36.tmp" "%TEMP%\CSCA76BA6C2A3C74A928857F7454FFE33.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\4yhfzotd.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES66DD.tmp" "%TEMP%\CSC64793446397A4CE096754D93A22E7244.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\4d455c5z.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES698B.tmp" "%TEMP%\CSC3B018DCFD3964C4287E3A07378F1CD9B.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\pg2ztoax.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\qtrqetgw.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\tji2mlym.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7204.tmp" "%TEMP%\CSCB3B7197834C94199ABFB8CB11E723D9A.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\p3bec5ef.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7D2A.tmp" "%TEMP%\CSCA91B22D3CEF243F18C11CE79A16E24C.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\xwtvvmi3.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7FE8.tmp" "%TEMP%\CSCDCF11859A5984ECCA804E75DCDE8BD6.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\wfh2pgx3.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8822.tmp" "%TEMP%\CSC2493A95034C64F42B8D54C6173109C2D.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\r5b5zyie.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8AC1.tmp" "%TEMP%\CSC402AD33208A40FABD71A3863F55D8C.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\u2kwlvhk.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES530F.tmp" "%TEMP%\CSCAA013688F846484E83BDF44822BEF064.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES74D1.tmp" "%TEMP%\CSC4B41F0027857458482A2B4A4B662A58.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD25B.tmp" "%TEMP%\CSC72E720641D7E458F8C52EB8DEB19F48.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\xbblgw3t.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD90F.tmp" "%TEMP%\CSCFC332E2CB0A84621AFB6464F95E7E194.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\yz03iu3m.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1499.tmp" "%TEMP%\CSC3BABB017345D4588BCD0E7A4940EABD.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\dwe5h3oj.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES16DA.tmp" "%TEMP%\CSC26D5F82CD4E14B6699F4C2B1FB134655.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\fasbzhfn.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2D18.tmp" "%TEMP%\CSCB51127A61E014D7FA7572BB745EFB44C.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\3g3hld3l.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2F3A.tmp" "%TEMP%\CSCDE5761EC18449F28EC9C589DDD6439.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\wm3vfyg5.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3514.tmp" "%TEMP%\CSCDCE33CAE23B448B68C6AA9E6B63BB35D.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3745.tmp" "%TEMP%\CSC4D0389C197994CC2B73D20C6BC239C9.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\bt1n21si.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\x2hawp0f.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3CA2.tmp" "%TEMP%\CSCF27AC3551ED04DA0933B39AADD5F1E7E.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\fojj3v5x.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3E66.tmp" "%TEMP%\CSC45E4699C82F74C33A35B57BFD5C2B9F8.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\mexz53ko.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4366.tmp" "%TEMP%\CSC918892FAD4AE49DEB842EACCFEE69BDF.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\0y53xfg2.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES451A.tmp" "%TEMP%\CSCD66AF1F2BA264C7A951E6B7E40A0ACCD.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\5xjlfgtm.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4AC5.tmp" "%TEMP%\CSC21F37448985B423BB3215EE4881FCBDC.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF2C.tmp" "%TEMP%\CSC47D0F02F41FD42C1B2A683755865753.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF1AE.tmp" "%TEMP%\CSCC706C15CB33D4AF094B161A1BAC39C41.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\wwswdapr.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\f5tdasch.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\khvhitdm.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDB70.tmp" "%TEMP%\CSC11F96ACB3447481092E074246990FD.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ddg2s33i.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE262.tmp" "%TEMP%\CSCF357626C454822BE5E6BFA1EA30EC.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\sxi2lpyj.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE465.tmp" "%TEMP%\CSC3C628934E41D4B7EA73831AD7784F5F.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\h43lc1iz.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEA5E.tmp" "%TEMP%\CSCD7BFA236B62B41739A6AB9498404CE4.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\gkvgsj3a.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEC32.tmp" "%TEMP%\CSCC31AD281F3A845CE8F5FED88D38FE49.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\gb22o1xf.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\wlfgedaf.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\fbrtcxjq.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF3FF.tmp" "%TEMP%\CSC6162FD4F7CC94A95A8BA2F6ABF1FCD.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\lbpgthrh.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFDAF.tmp" "%TEMP%\CSCB0F7FBAB8DFF44C59AB0611A3159BCD2.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\d2zzsrhq.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFFD1.tmp" "%TEMP%\CSC8F6F3D6D6DBA4BF3AA2716399162CA49.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\mc0vuvxg.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5CA.tmp" "%TEMP%\CSCA64FDEAB7C4143DB8468BC69E956B556.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\xzxwzexg.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES75F.tmp" "%TEMP%\CSC7330AFB0C36F4DA3956D7919D3B54D4.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD0A.tmp" "%TEMP%\CSCA5BA757F8BB6459AB07AD2C878B2D3B8.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\jwa35mjg.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5012.tmp" "%TEMP%\CSC9D9411D8D5DC42DEA16A112078B79A69.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2FE6.tmp" "%TEMP%\CSCA5009F9D3F824FD1B15561A5B3E6D5C.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES928E.tmp" "%TEMP%\CSC91F11761109454EB3AC1E4DE9CE8C9.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ayikzgt5.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9CCB.tmp" "%TEMP%\CSCF09E679F551B40B6B3C7BB8B31E5379.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2jznf52w.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA10F.tmp" "%TEMP%\CSCFD4FC781D1864A8792ED1CF8E9848849.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\lij5cn0z.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAB4C.tmp" "%TEMP%\CSC7E4B76E87E454C3ABE1654CD4A73B1E.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\5enxntbo.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAF51.tmp" "%TEMP%\CSC16DAB5B9F7E4C5A83A96ABBE7374880.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5B87.tmp" "%TEMP%\CSCAB7A29E1F880444BB08EEDA39E32D73.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2lwhw2u4.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ukmuv0sd.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBE20.tmp" "%TEMP%\CSC34F3408970B6417AA2DDA029191CB85F.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\5iatwonn.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC773.tmp" "%TEMP%\CSC3834A4082C244B568ED5F169569E02B.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\yf3gpqck.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCB79.tmp" "%TEMP%\CSC4A289DB4A8CE453887605BDAE95DC21.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\gxy1330m.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD603.tmp" "%TEMP%\CSCADFE18A64EDF4D6CA5FF6F1F9DCC5C77.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\e5qt11zy.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8DCD.tmp" "%TEMP%\CSC8A28FCCEB312451ABA5EAF19FA51C060.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\xthbfaja.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\dgochv5v.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8390.tmp" "%TEMP%\CSCB3C84DE1DE6F4B2D98DE3F1B59986D79.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\jwyn3auq.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\uafpfj32.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3D0F.tmp" "%TEMP%\CSC494E36AFBE3F4EA39AA2986924E4C.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe'
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\l0t0dzsj.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES47AA.tmp" "%TEMP%\CSCE17071A8485424083D9AE163E1B9B9.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\aj3p3r2f.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4E1F.tmp" "%TEMP%\CSCD08A6DE32BAD400AB81FEA17FB56B9A2.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\knk3j5cl.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES582D.tmp" "%TEMP%\CSC842F4EEB4E9460BA9E49209C934FCD.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDA19.tmp" "%TEMP%\CSCE7842091C41342D2A0F02C85D7FC56D2.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBA78.tmp" "%TEMP%\CSCAB3EDE1D5D5440F287C3BE4BDFA0E35.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\y4rj4snc.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES645D.tmp" "%TEMP%\CSC78105D2C71EA48FF93D486B664324394.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\bljb3q0g.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES67E6.tmp" "%TEMP%\CSC7B75235FA2314828A4954458DD8564C9.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\e021onaj.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES707E.tmp" "%TEMP%\CSCA70218948823451B8A773FB76B36A1.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\xzezfibh.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES73F7.tmp" "%TEMP%\CSCF8B2EEFAA30342D88FC2149E467F320.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\lnj4j1q3.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8008.tmp" "%TEMP%\CSC3C1257DC1B664422AFFD4131FA2EBE8.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES363C.tmp" "%TEMP%\CSC484B58FE571F4E2A815B456D9EEEB0D2.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\gbc5ctcj.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\c1o1ndph.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE38B.tmp" "%TEMP%\CSC635BD042AD5340E1A3ED39C122A04CCB.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\1dedzl3l.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES208A.tmp" "%TEMP%\CSC2003496EA02446F6AD9AEA864EF097B4.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\wlxjj3hx.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2220.tmp" "%TEMP%\CSC7A7FC0DBAD2F42C89DEF94D810A1B2F.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\nbeeomzh.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES27DA.tmp" "%TEMP%\CSC28F58C717E1243148BC198E032A0467C.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\b1p4ia2x.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2970.tmp" "%TEMP%\CSC900A2C0BE6514D7686FC6866E555EEC5.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\fdro25f1.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2E40.tmp" "%TEMP%\CSC3AEDDE5AA7A04B50BB4F1F17F56FA1.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\mnb10yie.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\edabhzef.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\cajbkwsz.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES35DE.tmp" "%TEMP%\CSC196EB628F4CB4E5CAC45C2E95E64CB1B.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\xnjjznh3.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES37A3.tmp" "%TEMP%\CSCC410A4F540544119B9CB106095B1888B.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\zc1yfgb2.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3D1F.tmp" "%TEMP%\CSC45FACB8E594452AAFF955C3EE147A.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\uos2pqgi.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3F02.tmp" "%TEMP%\CSC2CE070129A09404B984E5D5E76E21617.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\0tbslj1a.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES451A.tmp" "%TEMP%\CSC38169B5F7F6141069643663F22447F.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\1esztvr3.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\jyxdltq3.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2oiyftqt.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1B0E.tmp" "%TEMP%\CSCE253E118D30F4AF3B8BD4125D39D27B7.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES128.tmp" "%TEMP%\CSC805D947929664F8EB36D99253B8B48.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE733.tmp" "%TEMP%\CSC71E5DE2255E4D53A46B36632210EE46.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\qokze0kx.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEE63.tmp" "%TEMP%\CSC4D85FFF7C2B84A75B7E81F3EEF8E7542.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\dkpi4zzg.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEFE9.tmp" "%TEMP%\CSCF2EDD73E98414D67BE7B1D669A2AFB60.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\nsdmdc5h.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF823.tmp" "%TEMP%\CSCF055DC82DC194B25B2BF8CA18D5F999E.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ufbbeeq4.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFAF1.tmp" "%TEMP%\CSCD534E95E5EE44E7EA279FA4B884C345.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\sgk315vf.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES47B9.tmp" "%TEMP%\CSCE373CD3EA3D44C7EAFB0817E92D5CBCD.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES18DD.tmp" "%TEMP%\CSCE25F508EF8743B790A8279231B16BDF.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES33B.tmp" "%TEMP%\CSCFDDFB50CEA5B463D968CF0B5AEBD653A.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\axbbgge3.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES905.tmp" "%TEMP%\CSCC61AFD4B6AAF469694404AB073D9832D.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\5yjpogjq.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB17.tmp" "%TEMP%\CSCB7057E1367D642179F163501F84C43.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\t4kociyu.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES10A3.tmp" "%TEMP%\CSCA5F06B12DC944B1AA91EBAB1DDC4A0EA.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\yko1xt25.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1370.tmp" "%TEMP%\CSCF763C83636024588984183ECE03754D2.TMP"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\uc1q4hze.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\kavmxtu1.cmdline"
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4C99.tmp" "%TEMP%\CSCC6DC5A6C16214192A3FCF51190E754C.TMP"

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android