Trojan.MulDrop32.10629

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CCleaner Monitoring' = '%APPDATA%\CCleaner Monitoring.exe'

Creates or modifies the following files

<SYSTEM32>\tasks\ccleaner monitoring

Modifies file system

Creates the following files

%APPDATA%\ccleaner monitoring.exe
%TEMP%\res6401.tmp
%TEMP%\vbc6400.tmp
%TEMP%\vbc63e0.tmp
%TEMP%\cqpb4enp.out
%TEMP%\cqpb4enp.cmdline
%TEMP%\cqpb4enp.0.vb
%APPDATA%\random\default\telegram.exe
%TEMP%\res5e85.tmp
%TEMP%\vbc5e84.tmp
%TEMP%\vbc5e55.tmp
%TEMP%\q0z53fm3.0.vb
%APPDATA%\random\default\acrobat reader dc.exe
%TEMP%\msz02df2.0.vb
%APPDATA%\random\default\google chrome.exe
%TEMP%\res5996.tmp
%TEMP%\vbc5995.tmp
%TEMP%\vbc5965.tmp
%TEMP%\y5qjdh2z.out
%TEMP%\y5qjdh2z.cmdline
%TEMP%\y5qjdh2z.0.vb
%APPDATA%\random\optional\launch internet explorer browser.exe
%TEMP%\res52f1.tmp
%TEMP%\msz02df2.out
%TEMP%\vbc3e77.tmp
%TEMP%\q0z53fm3.cmdline
%TEMP%\vbc76a6.tmp
%TEMP%\vbc7676.tmp
%TEMP%\focdnnn1.out
%TEMP%\focdnnn1.cmdline
%TEMP%\focdnnn1.0.vb
%APPDATA%\random\default\opera.exe
%TEMP%\res7244.tmp
%TEMP%\vbc7243.tmp
%TEMP%\vbc7213.tmp
%TEMP%\oymqlfmp.out
%TEMP%\oymqlfmp.cmdline
%TEMP%\oymqlfmp.0.vb
%APPDATA%\random\default\mozilla thunderbird.exe
%TEMP%\res6dd1.tmp
%TEMP%\vbc6dd0.tmp
%TEMP%\vbc6da0.tmp
%TEMP%\gzfufm2k.out
%TEMP%\gzfufm2k.cmdline
%TEMP%\gzfufm2k.0.vb
%APPDATA%\random\default\firefox.exe
%TEMP%\res6910.tmp
%TEMP%\vbc690f.tmp
%TEMP%\vbc68df.tmp
%TEMP%\vbc52f0.tmp
%TEMP%\msz02df2.cmdline
%TEMP%\vbc52c1.tmp
%TEMP%\dmdfawfd.out
%TEMP%\dmdfawfd.cmdline
%TEMP%\vbc3340.tmp
%TEMP%\flix4r5b.0.vb
%APPDATA%\random\internet explorer.exe
%TEMP%\res38cd.tmp
%TEMP%\vbc38cc.tmp
%TEMP%\vbc387d.tmp
%TEMP%\eugcqudb.out
%TEMP%\eugcqudb.cmdline
%TEMP%\eugcqudb.0.vb
%APPDATA%\random\google chrome.exe
%TEMP%\res3341.tmp
%TEMP%\vbc3311.tmp
%TEMP%\flix4r5b.out
%TEMP%\nk4va23j.out
%TEMP%\nk4va23j.cmdline
%TEMP%\nk4va23j.0.vb
%APPDATA%\random\firefox.exe
%TEMP%\res2cdb.tmp
%TEMP%\vbc2ccb.tmp
%TEMP%\vbc2ba1.tmp
%TEMP%\jla5xjsq.out
%TEMP%\jla5xjsq.cmdline
%TEMP%\jla5xjsq.0.vb
%TEMP%\res76a7.tmp
%TEMP%\q0z53fm3.out
%TEMP%\vbc3e28.tmp
%APPDATA%\random\opera.exe
%TEMP%\flix4r5b.cmdline
%TEMP%\dmdfawfd.0.vb
%APPDATA%\random\optional\google chrome.exe
%TEMP%\res4ead.tmp
%TEMP%\vbc4eac.tmp
%TEMP%\vbc4e4e.tmp
%TEMP%\zdkclbeh.out
%TEMP%\zdkclbeh.cmdline
%TEMP%\zdkclbeh.0.vb
%APPDATA%\random\windows media player.exe
%TEMP%\res4a1b.tmp
%TEMP%\vbc4a1a.tmp
%TEMP%\vbc49cb.tmp
%TEMP%\sm31z1d5.out
%TEMP%\sm31z1d5.cmdline
%TEMP%\sm31z1d5.0.vb
%APPDATA%\random\windows explorer.exe
%TEMP%\res4451.tmp
%TEMP%\vbc4450.tmp
%TEMP%\vbc4430.tmp
%TEMP%\nxdlzcwp.out
%TEMP%\nxdlzcwp.cmdline
%TEMP%\nxdlzcwp.0.vb
%TEMP%\res3e87.tmp
%APPDATA%\random\default\steam.exe

Deletes the following files

%TEMP%\res2cdb.tmp
%TEMP%\cqpb4enp.out
%TEMP%\cqpb4enp.0.vb
%TEMP%\vbc6400.tmp
%TEMP%\res6401.tmp
%TEMP%\msz02df2.out
%TEMP%\msz02df2.0.vb
%TEMP%\msz02df2.cmdline
%TEMP%\vbc5e84.tmp
%TEMP%\res5e85.tmp
%TEMP%\y5qjdh2z.0.vb
%TEMP%\y5qjdh2z.cmdline
%TEMP%\y5qjdh2z.out
%TEMP%\vbc5995.tmp
%TEMP%\res5996.tmp
%TEMP%\dmdfawfd.out
%TEMP%\cqpb4enp.cmdline
%TEMP%\vbc690f.tmp
%TEMP%\focdnnn1.cmdline
%TEMP%\q0z53fm3.out
%TEMP%\focdnnn1.0.vb
%TEMP%\vbc76a6.tmp
%TEMP%\res76a7.tmp
%TEMP%\oymqlfmp.0.vb
%TEMP%\oymqlfmp.out
%TEMP%\oymqlfmp.cmdline
%TEMP%\vbc7243.tmp
%TEMP%\res7244.tmp
%TEMP%\gzfufm2k.cmdline
%TEMP%\gzfufm2k.out
%TEMP%\gzfufm2k.0.vb
%TEMP%\vbc6dd0.tmp
%TEMP%\res6dd1.tmp
%TEMP%\q0z53fm3.cmdline
%TEMP%\q0z53fm3.0.vb
%TEMP%\dmdfawfd.cmdline
%TEMP%\res6910.tmp
%TEMP%\dmdfawfd.0.vb
%TEMP%\flix4r5b.out
%TEMP%\res3e87.tmp
%TEMP%\eugcqudb.cmdline
%TEMP%\eugcqudb.out
%TEMP%\eugcqudb.0.vb
%TEMP%\vbc38cc.tmp
%TEMP%\res38cd.tmp
%TEMP%\nk4va23j.out
%TEMP%\nk4va23j.0.vb
%TEMP%\nk4va23j.cmdline
%TEMP%\vbc3340.tmp
%TEMP%\res3341.tmp
%TEMP%\jla5xjsq.0.vb
%TEMP%\jla5xjsq.out
%TEMP%\jla5xjsq.cmdline
%TEMP%\vbc2ccb.tmp
%TEMP%\vbc3e77.tmp
%TEMP%\flix4r5b.0.vb
%TEMP%\res52f1.tmp
%TEMP%\flix4r5b.cmdline
%TEMP%\zdkclbeh.0.vb
%TEMP%\zdkclbeh.out
%TEMP%\zdkclbeh.cmdline
%TEMP%\vbc4eac.tmp
%TEMP%\res4ead.tmp
%TEMP%\sm31z1d5.out
%TEMP%\sm31z1d5.0.vb
%TEMP%\sm31z1d5.cmdline
%TEMP%\vbc4a1a.tmp
%TEMP%\res4a1b.tmp
%TEMP%\nxdlzcwp.out
%TEMP%\nxdlzcwp.cmdline
%TEMP%\nxdlzcwp.0.vb
%TEMP%\vbc4450.tmp
%TEMP%\res4451.tmp
%TEMP%\vbc52f0.tmp
%TEMP%\focdnnn1.out

Moves the following files

from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk to %APPDATA%\random\firefox.lnk
from C:\users\public\desktop\mozilla thunderbird.lnk to %APPDATA%\random\default\mozilla thunderbird.lnk
from C:\users\public\desktop\firefox.lnk to %APPDATA%\random\default\firefox.lnk
from C:\users\public\desktop\acrobat reader dc.lnk to %APPDATA%\random\default\acrobat reader dc.lnk
from %HOMEPATH%\desktop\telegram.lnk to %APPDATA%\random\default\telegram.lnk
from %HOMEPATH%\desktop\google chrome.lnk to %APPDATA%\random\default\google chrome.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk to %APPDATA%\random\optional\window switcher.lnk
from C:\users\public\desktop\opera.lnk to %APPDATA%\random\default\opera.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk to %APPDATA%\random\optional\shows desktop.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk to %APPDATA%\random\optional\google chrome.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk to %APPDATA%\random\windows media player.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk to %APPDATA%\random\windows explorer.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk to %APPDATA%\random\opera.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk to %APPDATA%\random\internet explorer.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk to %APPDATA%\random\google chrome.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk to %APPDATA%\random\optional\launch internet explorer browser.lnk
from C:\users\public\desktop\steam.lnk to %APPDATA%\random\default\steam.lnk

Substitutes the following files

%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Opera.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
%HOMEPATH%\Desktop\Google Chrome.lnk
%HOMEPATH%\Desktop\Telegram.lnk
C:\Users\Public\Desktop\Acrobat Reader DC.lnk
C:\Users\Public\Desktop\Firefox.lnk
C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
C:\Users\Public\Desktop\Opera.lnk
C:\Users\Public\Desktop\Steam.lnk

Network activity

UDP

DNS ASK ke#.##ogsyte.com

Miscellaneous

Creates and executes the following

'%APPDATA%\ccleaner monitoring.exe'

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn "CCleaner Monitoring" /tr "%APPDATA%\CCleaner Monitoring.exe"
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\gzfufm2k.cmdline"
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6910.tmp" "%TEMP%\vbc690F.tmp"
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\q0z53fm3.cmdline"
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\cqpb4enp.cmdline"
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4A1B.tmp" "%TEMP%\vbc4A1A.tmp"
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5E85.tmp" "%TEMP%\vbc5E84.tmp"
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\y5qjdh2z.cmdline"
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5996.tmp" "%TEMP%\vbc5995.tmp"
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\oymqlfmp.cmdline"
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES52F1.tmp" "%TEMP%\vbc52F0.tmp"
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\dmdfawfd.cmdline"
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4EAD.tmp" "%TEMP%\vbc4EAC.tmp"
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\zdkclbeh.cmdline"
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6DD1.tmp" "%TEMP%\vbc6DD0.tmp"
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\nxdlzcwp.cmdline"
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\msz02df2.cmdline"
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\focdnnn1.cmdline"
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\eugcqudb.cmdline"
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3E87.tmp" "%TEMP%\vbc3E77.tmp"
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\flix4r5b.cmdline"
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES38CD.tmp" "%TEMP%\vbc38CC.tmp"
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7244.tmp" "%TEMP%\vbc7243.tmp"
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\nk4va23j.cmdline"
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3341.tmp" "%TEMP%\vbc3340.tmp"
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\jla5xjsq.cmdline"
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4451.tmp" "%TEMP%\vbc4450.tmp"
'<SYSTEM32>\taskeng.exe' {133FEB2C-FB00-4BA5-B4E9-DAA436809589} S-1-5-21-3691498038-2086406363-2140527554-1000:oqmgonanb\user:Interactive:[1]
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\sm31z1d5.cmdline"
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6401.tmp" "%TEMP%\vbc6400.tmp"
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES76A7.tmp" "%TEMP%\vbc76A6.tmp"
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2CDB.tmp" "%TEMP%\vbc2CCB.tmp"
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6910.tmp" "%TEMP%\vbc690F.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4A1B.tmp" "%TEMP%\vbc4A1A.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\gzfufm2k.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2CDB.tmp" "%TEMP%\vbc2CCB.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\nxdlzcwp.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4EAD.tmp" "%TEMP%\vbc4EAC.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\jla5xjsq.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7244.tmp" "%TEMP%\vbc7243.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\sm31z1d5.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\focdnnn1.cmdline"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn "CCleaner Monitoring" /tr "%APPDATA%\CCleaner Monitoring.exe"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\nk4va23j.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\oymqlfmp.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\q0z53fm3.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES38CD.tmp" "%TEMP%\vbc38CC.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6401.tmp" "%TEMP%\vbc6400.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\zdkclbeh.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3341.tmp" "%TEMP%\vbc3340.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES52F1.tmp" "%TEMP%\vbc52F0.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3E87.tmp" "%TEMP%\vbc3E77.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\y5qjdh2z.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5996.tmp" "%TEMP%\vbc5995.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\flix4r5b.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\msz02df2.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\eugcqudb.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5E85.tmp" "%TEMP%\vbc5E84.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4451.tmp" "%TEMP%\vbc4450.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\cqpb4enp.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES76A7.tmp" "%TEMP%\vbc76A6.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6DD1.tmp" "%TEMP%\vbc6DD0.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\dmdfawfd.cmdline"' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial