Trojan.Siggen29.38610

Technical Information

Malicious functions

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="迅雷影音" dir=in action=allow program="%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894\Bin\XMP.exe" enable=yes
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="XLLiveUD" dir=in action=allow program="%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894\Bin\XLLiveUD.exe" enable=yes
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="XLBugReport" dir=in action=allow program="%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894\Bin\XLBugReport.exe" enable=yes
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="迅雷下载服务" dir=in action=allow program="%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894\TP\DownloadSDKServer.exe" enable=yes
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="APlayer" dir=in action=allow program="C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\APlayer.exe" enable=yes
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="XLLiveUD" dir=in action=allow program="C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\XLLiveUD.exe" enable=yes
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="aapt" dir=in action=allow program="C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\aapt.exe" enable=yes
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="adb" dir=in action=allow program="C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\adb.exe" enable=yes
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="DPInstX64" dir=in action=allow program="C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\DPInstX64.exe" enable=yes
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="InstallDriver" dir=in action=allow program="C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\InstallDriver.exe" enable=yes
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="PreInstall" dir=in action=allow program="C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\PreInstall.exe" enable=yes
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="DPInst" dir=in action=allow program="C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\DPInst.exe" enable=yes
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="XLLiveUD" dir=in action=allow program="%TEMP%\xlliveud\xmp_5.2.18.5894\XLLiveUD.exe" enable=yes

Modifies file system

Creates the following files

%TEMP%\nsa8ded.tmp\system.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\p2ptarget.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\p2pstat.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\p2pio.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\p2pframework.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\p2pcommonobjects.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\p2pbase.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\statxml.xml
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\proxyverifier.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\mp.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\mini_unzip_dll.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\minizip.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\microsoft.vc90.crt.manifest
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\libexpat.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\http.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\msvcr90.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\cacert.pem
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\tcpimpl.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\xar\downloaddispatcher.xta
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\zlib1.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\xudt.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\xltaskupgrade.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\xlreimport.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\xlluaruntime.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\xlliveudownload.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\xlfsio.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\xlbugreport.exe
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\xlbughandler.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\xdt.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\xbt.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\x509cert.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\upnp.exe
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\uactool.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\ftp.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\msvcp90.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\downloadsdkserver.exe
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\downloadsdkproxy.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\downloadsdk.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\mediainfo.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\res\xmp.ico
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\xmpiestat.js
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\xmpiemenu.htm
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\xlcrypto.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\xlaccount.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\maintray.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\mediadoctor.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\onlineindex_config.lua
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\tipaddin.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\xmpwin7taskbartrait.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\xmpliveupdatehelper.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\uachelper.dll
%TEMP%\nsa8ded.tmp\24.tmp
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\xmedialibrary64.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\app\ipcaplayer.xar
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\thunderfw.exe
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\swf\friendplayer.swf
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\dapctrl64.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\webxmp\xmp.exe
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\dl_uac_tool.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\dl_peer_id.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\dht.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\assistanttools.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\xlstat4.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\xlnpdapctrl.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\xlliveud.exe
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\useragent.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\sqlite3.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\shlext_x64.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\shlext.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\liveupdate_stat4.xml
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\liveudinstaller.exe
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\dapctrl.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\menuplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\xlbughandler.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\app\miniboxhelper.dll
C:\users\public\thunder network\kkvideo\temp\core\program\kkviconhandler64.dll
C:\users\public\thunder network\kkvideo\temp\core\program\kkviconhandler.dll
C:\users\public\thunder network\kkvideo\temp\core\program\kkv.exe
C:\users\public\thunder network\kkvideo\temp\core\program\datax.dll
C:\users\public\thunder network\kkvideo\temp\uninstall.exe
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\tray\maintray.xar
C:\users\public\thunder network\kkvideo\temp\core\program\xmp.exe
C:\users\public\thunder network\kkvideo\temp\core\program\kkvideo.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\xmpcloudplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\xmpassistplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\xldownloadplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\win7traitplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\welcomeplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\webbrowserplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\xmpstatplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\app\minibox.ini
C:\users\public\thunder network\kkvideo\temp\resource\iconres\default.skin
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\xlbughandler.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\liveupdate_stat4.xml
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\liveudinstaller.exe
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\datax.dll
C:\users\public\thunder network\kkvideo\temp\core\program\dapctrl.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\aplayerui.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\aplayer.dll
C:\users\public\thunder network\xmp5\programdata\skin\snh48_top7\title.png
C:\users\public\thunder network\xmp5\programdata\skin\snh48_top7\skinchange.lua
C:\users\public\thunder network\xmp5\programdata\skin\snh48_top7\rightsideview.bkg.png
%TEMP%\nsa8ded.tmp\12.tmp
C:\users\public\thunder network\xmp5\programdata\skin\snh48_top7\main.png
C:\users\public\thunder network\xmp5\programdata\skin\snh48_top7\lefttree.bkg.jpg
C:\users\public\thunder network\kkvideo\temp\xar\kkvideo\push.xar
C:\users\public\thunder network\kkvideo\temp\xar\kkvideo\main.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\webbrowserhelperplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\xmpexternal.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\webaplayerplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\vrplayerplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\vipreachplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\liveupdate\xmpliveupdate.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\favoriteplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\dlnaplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\configplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\config.ini
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\browserhistoryplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\bottomtipsplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\browser\webbrowserhelper.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\friendvipplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\browser\webaplayerplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\browser\gameplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\browser\friendvipplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\browser\config.ini
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\browser\browser.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\app\pusherfix.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\app\minibox.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\xmedialibrary.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\leftsideviewplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\playlistplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\friendplayerplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\userplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\topviewsearchplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\tipaddin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\subtitleplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\skinmanagerplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\searchbarplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\rightsideviewplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\rightsideviewhandleplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\recreationplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\programtreeplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\playrecordsynplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\playpaneltipplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\playpanelplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\playlistsubviewplugin.xar
C:\users\public\thunder network\xmp5\v5.2.18.5894\xar\plugins\movietipsplugin.xar
C:\users\public\thunder network\kkvideo\temp\xar\kkvideo\basecontrol.xar
%TEMP%\nsa8ded.tmp\26.tmp
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\xmpcoreversion.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsvc.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpservicehelper.exe
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpservice.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xlueops.exe
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xlueopc.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xlueipc.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetupproxy.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsvc64.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xlgraphic.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xlluaruntime.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xlfsio.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\zlib1.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xlbugreport.exe
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xlbughandler.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xlue.dll
%TEMP%\etilqs_71x6qcy134ciqn0
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\setupreal.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetup3.cab
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetup2.cab
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetup1.cab
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetup0.cab
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetup.ini
%TEMP%\xmpsetuplite-sijhaqws57\crashinfo.ini
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\vus4chrome\images\logo48.png
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\vus4chrome\npvusplugin.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\vus4chrome\manifest.json
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\vus4chrome\content_script.js
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\uninstall.exe
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\cooperationinstaller.exe
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpwin7taskbartrait.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmppushersetup.exe
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetupagent.exe
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\mini_unzip_dll.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xlgraphicplus.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\minizip.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\libpng13.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\libexpat.dll
%TEMP%\nsa8ded.tmp\38.tmp
%TEMP%\etilqs_vszrmwiteqrbdza
%TEMP%\etilqs_uqq8qv12ihefa9o
%TEMP%\etilqs_qv6bss9xmc7tvxl
%TEMP%\nsa8ded.tmp\50.tmp
%TEMP%\nsa8ded.tmp\22.tmp
%TEMP%\nsa8ded.tmp\execcmd.dll
%TEMP%\nsa8ded.tmp\21.tmp
%TEMP%\etilqs_algd0g2gffskwdr
%TEMP%\nsa8ded.tmp\zipdll.dll
%TEMP%\nsa8ded.tmp\inetc.dll
%TEMP%\nsa8ded.tmp\nsrandom.dll
%TEMP%\nsa8ded.tmp\base64.dll
%TEMP%\nsa8ded.tmp\nsisdl.dll
%TEMP%\nsa8ded.tmp\2.jpg
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetup4.cab
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\setupxar.xar
%TEMP%\etilqs_tihv7xf0aprh32n
%TEMP%\nsa8ded.tmp\xmpsetuplite-sijhaqws57.exe
%TEMP%\etilqs_qa0r5mvlzhwwgdq
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\microsoft.vc90.crt.manifest
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\microsoft.vc90.atl.manifest
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\msvcr90.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\msvcp90.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\msvcr71.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\msvcp71.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\atl90.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\atl71.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\dl_peer_id.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\setupui.cab
%ALLUSERSPROFILE%\thunder network\downloadlib\pub_store.dat
%TEMP%\nsa8ded.tmp\27.tmp
%TEMP%\etilqs_wgtwbfynysz43bb
%TEMP%\etilqs_kzejgulziqukyzv
%TEMP%\etilqs_xcl9xsh0whsgmns
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\mp4.ico
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\videourlsniffer.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\3gp.ico
C:\users\public\thunder network\aplayerrelease\temp\aplayer.dll
C:\users\public\thunder network\aplayerrelease\codecs\lavfilters\lavsplitter.dll.manifest
C:\users\public\thunder network\aplayerrelease\codecs\lavfilters\lavvideo.dll.manifest
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\onlineindex.lua
C:\users\public\thunder network\aplayerrelease\codecs\lavfilters\lavaudio.dll.manifest
C:\users\public\thunder network\aplayerrelease\codecs\microsoft.vc80.crt.manifest
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\xmp.exe
C:\users\public\thunder network\aplayerrelease\temp\aplayerui.dll
C:\users\public\thunder network\aplayerrelease\codecs\vsfilter.dll
C:\users\public\thunder network\aplayerrelease\codecs\audioswitcher.dll
C:\users\public\thunder network\aplayerrelease\codecs\flvsplitter.dll
C:\users\public\thunder network\aplayerrelease\codecs\flvmultisrc.dll
C:\users\public\thunder network\aplayerrelease\codecs\coreaac.ax
C:\users\public\thunder network\aplayerrelease\codecs\coreavc.ax
C:\users\public\thunder network\aplayerrelease\codecs\evrcp.dll
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetup5.cab
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\xmp.exe
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\aplayer.exe
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\streami.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\datax.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\webbrowserhelper.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\browserpage.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\userlogin.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\xmpupdatecodecs.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\xmputility.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\xmpplayer.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\xmpaddins.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\xmpassociate.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\xmpadvance.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\systemplugin.dll
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\browserexternal.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\uninst.exe
C:\users\public\thunder network\aplayerrelease\codecs\agif.dll
C:\users\public\thunder network\aplayerrelease\codecs\ijl15.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\wmv.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\wma.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\wav.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\dvd.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\lose_score.wav
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\logo.swf
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\ifo.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\idx.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\flv.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\flac.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\desktoplink.default.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\mov.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\cda.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\avi.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\audio.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\ass.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\amr.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\add_score.wav
%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetup6.cab
C:\users\public\thunder network\xmp5\v5.2.18.5894\program\xaddinupdate.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\mp3.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\pmp.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\mkv.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\vob.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\video.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\usf.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\type.wav
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\swf.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\sup.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\sub.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\ssf.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\ssa.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\srt.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\smi.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\rm.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\ra.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\psb.ico
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\res\mpg.ico
C:\users\public\thunder network\kkvideo\temp\core\program\xlbughandler.dll

Deletes the following files

C:\users\public\thunder network\xmp5\v5.2.18.5894\webxmp\xmp.exe
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\microsoft.vc90.crt.manifest
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\msvcp90.dll
%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\tp\msvcr90.dll
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\q1e129qo\onlineindex_config[1].lua
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dzhkzdlo\onlineindex[1].lua
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\604pwz7f\xmpsetuplite-sijhaqws57[1].exe
C:\users\public\thunder network\aplayer\temp\aplayer.dll
C:\users\public\thunder network\aplayer\temp\aplayerui.dll

Moves the following files

from C:\users\public\thunder network\aplayerrelease\codecs\agif.dll to C:\users\public\thunder network\aplayer\codecs\agif.dll
from C:\users\public\thunder network\aplayerrelease\codecs\audioswitcher.dll to C:\users\public\thunder network\aplayer\codecs\audioswitcher.dll
from C:\users\public\thunder network\aplayerrelease\codecs\coreaac.ax to C:\users\public\thunder network\aplayer\codecs\coreaac.ax
from C:\users\public\thunder network\aplayerrelease\codecs\coreavc.ax to C:\users\public\thunder network\aplayer\codecs\coreavc.ax
from C:\users\public\thunder network\aplayerrelease\codecs\evrcp.dll to C:\users\public\thunder network\aplayer\codecs\evrcp.dll
from C:\users\public\thunder network\aplayerrelease\codecs\flvmultisrc.dll to C:\users\public\thunder network\aplayer\codecs\flvmultisrc.dll
from C:\users\public\thunder network\aplayerrelease\codecs\flvsplitter.dll to C:\users\public\thunder network\aplayer\codecs\flvsplitter.dll
from C:\users\public\thunder network\aplayerrelease\codecs\ijl15.dll to C:\users\public\thunder network\aplayer\codecs\ijl15.dll
from C:\users\public\thunder network\aplayerrelease\codecs\lavfilters\lavaudio.dll.manifest to C:\users\public\thunder network\aplayer\codecs\lavfilters\lavaudio.dll.manifest
from C:\users\public\thunder network\aplayerrelease\codecs\lavfilters\lavsplitter.dll.manifest to C:\users\public\thunder network\aplayer\codecs\lavfilters\lavsplitter.dll.manifest
from C:\users\public\thunder network\aplayerrelease\codecs\lavfilters\lavvideo.dll.manifest to C:\users\public\thunder network\aplayer\codecs\lavfilters\lavvideo.dll.manifest
from C:\users\public\thunder network\aplayerrelease\codecs\microsoft.vc80.crt.manifest to C:\users\public\thunder network\aplayer\codecs\microsoft.vc80.crt.manifest
from C:\users\public\thunder network\aplayerrelease\codecs\vsfilter.dll to C:\users\public\thunder network\aplayer\codecs\vsfilter.dll
from C:\users\public\thunder network\aplayerrelease\temp\aplayer.dll to C:\users\public\thunder network\aplayer\temp\aplayer.dll
from C:\users\public\thunder network\aplayerrelease\temp\aplayerui.dll to C:\users\public\thunder network\aplayer\temp\aplayerui.dll

Substitutes the following files

C:\users\public\thunder network\xmp5\v5.2.18.5894\webxmp\xmp.exe

Network activity

Connects to

'in#.###ol.sina.com.cn':80
'co##.#.xunlei.com':80
's.##mg.com':443
'bo##ing.com':443
'bo##ing.com':80
'tw##ter.com':80
'ro###.ebay.com':443
'ro###.ebay.com':80
'sd#####es.operacdn.com':443
'bl#####st.rkn.gov.ru':443
'bl#####st.rkn.gov.ru':80
'fa###ook.com':80
're###.opera.com':80
'ev##orld.cn':443
'si#####ck2.opera.com':443
'oc##.#ectigo.com':80
'12#.#5.104.68':80
'en.###ipedia.org':443
'en.###ipedia.org':80
'se####.yahoo.com':443
'am##on.com':443
'du###uckgo.com':443
'am##on.com':80
'bing.com':80
'se####.yahoo.com':80
'google.com':80
'au######te.geo.opera.com':443
'au######te.geo.opera.com':80
'xm#.##wn.sandai.net':80
'ww#.#inaimg.cn':80
't.#n':80
'si#####ck2.opera.com':80
'r.#####.store.qq.com':80

TCP

HTTP GET requests

http://t.#n/RymEDnY
http://re###.opera.com/speeddials/partner/product
http://re###.opera.com/speeddials/partner/youtube
http://re###.opera.com/speeddials/partner/wikipedia_org_us
http://ro###.ebay.com/rover/1/711-53200-19255-0/1?ic###########################################################################################################################
http://www.ya##o.com/?il#####
http://www.tw##ter.com/?pa################
http://www.op##a.com/follow?ut###############################################################################################
http://re###.opera.com/speeddials/partner/twitter_us
http://re###.opera.com/speeddials/partner/booking_com_us
http://www.bo##ing.com/index.html?ai##########################################################################################
http://co##.#.xunlei.com/setup/xmp5/onlineindex.lua
http://t.#n/RUpewwF
http://ww#.#inaimg.cn/large/7185bdf1jw1exvsuv9ug0g20dw07tqv7.gif
http://oc##.#ectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEQDq1EQbUYlS%2FoK%2FQOtKqabm
http://t.#n/RUGO3K6
http://ww#.#inaimg.cn/large/7185bdf1gw1exgmtsy4hng20go0b34p4.gif
http://co##.#.xunlei.com/setup/xmp5/onlineindex_config.lua
http://t.#n/RU6cqnE
http://ww#.#inaimg.cn/large/7185bdf1gw1exp23tngaog20rv0gve81.gif
http://re###.opera.com/speeddials/partner/yahoo
http://re###.opera.com/speeddials/partner/ebay_us
http://re###.opera.com/speeddials/partner/amazon_us
http://t.#n/RywPElm
http://ww#.#inaimg.cn/large/7185bdf1gw1evmsu7ac1kg20go0901lf.gif
http://t.#n/RUpgTIj
http://ww#.#inaimg.cn/large/7185bdf1jw1exvsnp8lgdg20dw0aidkd.gif
http://t.#n/RUjdRC7
http://ww#.#inaimg.cn/large/7185bdf1gw1exzvzx1knxg20go0apqjz.gif
http://au######te.geo.opera.com/geolocation/
http://xm#.##wn.sandai.net/kankan/XMPSetupLite-SIjhaqws57.exe
http://ww#.#inaimg.cn/large/7185bdf1gw1ewyl50mtpeg20go0a5u10.gif
http://www.google.com/favicon.ico
http://www.bing.com/s/a/bing_p.ico
http://www.am##on.com/favicon.ico
http://en.###ipedia.org/favicon.ico
http://si#####ck2.opera.com/?ho###################################################
http://12#.#5.104.68/amVwY2JjdmUuZXhl/40.html
http://re###.opera.com/speeddials/partner/facebook
http://www.fa###ook.com/campaign/landing.php?ca#########################
http://bl#####st.rkn.gov.ru/
http://se####.yahoo.com/favicon.ico
http://re###.opera.com/favicon.ico
http://r.#####.store.qq.com/psb?/V#########################################################################

Other

'au######te.geo.opera.com':443
'du###uckgo.com':443
'am##on.com':443
'se####.yahoo.com':443
'en.###ipedia.org':443
'si#####ck2.opera.com':443
'ev##orld.cn':443
'bl#####st.rkn.gov.ru':443
'sd#####es.operacdn.com':443
'ro###.ebay.com':443
'ya##o.com':443
'bo##ing.com':443
'op##a.com':443
'eb##.com':443
'pa###.ebay.com':443

UDP

DNS ASK in#.###ol.sina.com.cn
DNS ASK zo##.###.kankan.xunlei.com
DNS ASK eb##.com
DNS ASK oc##.#ectigo.com
DNS ASK co##.#.xunlei.com
DNS ASK se###.#tat.v.xunlei.com
DNS ASK us##.##at.v.xunlei.com
DNS ASK s.##mg.com
DNS ASK op##a.com
DNS ASK bo##ing.com
DNS ASK tw##ter.com
DNS ASK ya##o.com
DNS ASK ro###.ebay.com
DNS ASK sd#####es.operacdn.com
DNS ASK bl#####st.rkn.gov.ru
DNS ASK fa###ook.com
DNS ASK re###.opera.com
DNS ASK ev##orld.cn
DNS ASK si#####ck2.opera.com
DNS ASK en.###ipedia.org
DNS ASK bi##.#ikimedia.org
DNS ASK du###uckgo.com
DNS ASK bing.com
DNS ASK am##on.com
DNS ASK se####.yahoo.com
DNS ASK google.com
DNS ASK au######te.geo.opera.com
DNS ASK xm#.##wn.sandai.net
DNS ASK ww#.#inaimg.cn
DNS ASK t.#n
DNS ASK pa###.ebay.com
DNS ASK r.#####.store.qq.com

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''
ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'
ClassName: 'XmpSetup{01572D6A-8C9A-484b-8B31-F2890BF1FB21}' WindowName: 'XmpSetup'
ClassName: 'D3974EEE-00FD-42E8-AD41-F90645CE1EA0_XMPADDIN_TIPWND_WORKER' WindowName: ''
ClassName: '0267614A-8022-4652-9DAC-50F88A4E84B3_XMPADDIN_BUBBLE' WindowName: ''
ClassName: 'XMP_CMD_HELPER{31317078-A84A-425a-A01C-6071F056D50F}' WindowName: ''
ClassName: 'XMP_CMD_HELPER{31317078-A84A-425a-A01C-6071F056D50F}_5.0' WindowName: ''
ClassName: 'XMP_GAMEBOX_HELPER{D1FF43B6-F59B-497e-9032-95D6414A32AA}' WindowName: ''
ClassName: 'XMP_CMD_HELPER{31317078-984A-425a-A01C-6071F056D50F}' WindowName: ''
ClassName: 'XMP_CMD_HELPER{31317078-984A-425a-A01C-6071F056D50F}_5.0' WindowName: ''
ClassName: 'XMP_CMD_HELPER{31317076-984A-425a-A01C-6071F056D50F}' WindowName: ''

Creates and executes the following

'%TEMP%\nsa8ded.tmp\xmpsetuplite-sijhaqws57.exe'
'%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetupagent.exe' /installdir "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894" /userdata "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894" /version "5.2.18.5894" /cmdfile "%TEMP%\XMP2DA8.tmp"
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "XLLiveUD" "%TEMP%\xlliveud\xmp_5.2.18.5894\XLLiveUD.exe"
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "DPInst" "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\DPInst.exe"
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "PreInstall" "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\PreInstall.exe"
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "InstallDriver" "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\InstallDriver.exe"
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "DPInstX64" "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\DPInstX64.exe"
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "adb" "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\adb.exe"
'%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmppushersetup.exe' /S /write /xmpsupport "XmpSetupLite"
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "aapt" "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\aapt.exe"
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "XLLiveUD" "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\XLLiveUD.exe"
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "APlayer" "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\APlayer.exe"
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "迅雷下载服务" "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894\TP\DownloadSDKServer.exe"
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "XLBugReport" "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894\Bin\XLBugReport.exe"
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "XLLiveUD" "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894\Bin\XLLiveUD.exe"
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "迅雷影音" "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894\Bin\XMP.exe"
'%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetupagent.exe' /installdir "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894" /userdata "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894" /version "5.2.18.5894" /cmdfile "%TEMP%\XMPC04.tmp"
'%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetupagent.exe' /installdir "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894" /userdata "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894" /version "5.2.18.5894" /cmdfile "%TEMP%\XMPFF08.tmp"
'%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetupagent.exe' /installdir "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894" /userdata "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894" /version "5.2.18.5894" /cmdfile "%TEMP%\XMPF3C1.tmp"
'%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetupagent.exe' /installdir "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894" /userdata "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894" /version "5.2.18.5894" /cmdfile "%TEMP%\XMPAA14.tmp"
'%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetupagent.exe' /installdir "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894" /userdata "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894" /version "5.2.18.5894" /cmdfile "%TEMP%\XMP36BE.tmp"
'%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetupagent.exe' /installdir "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894" /userdata "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894" /version "5.2.18.5894" /cmdfile "%TEMP%\XMP3ECA.tmp"

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C copy /b "%TEMP%\nsa8DED.tmp\SoHuVA_4.5.77.0-c204900003-nti-ng-tp-s.exe" + "%WINDIR%\Fonts\verdana.ttf" "%TEMP%\nsa8DED.tmp\SoHuVA_4.5.77.0-c204900003-nti-ng-tp-s.exe"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2192.20.32511579\608726919" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2192.11.254717030\273262588" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2192.13.1612306639\440562888" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2192.14.334664147\1319130452" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2192.17.206934881\389881366" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2192.18.1608303144\169376317" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2192.22.302520697\1063118988" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2192.21.1704329772\1079038028" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%WINDIR%\syswow64\cmd.exe' /C copy /b "%TEMP%\nsa8DED.tmp\ht_Y_ssxaz10_06255.exe" + "%WINDIR%\Fonts\verdana.ttf" "%TEMP%\nsa8DED.tmp\ht_Y_ssxaz10_06255.exe"
'%WINDIR%\syswow64\cmd.exe' /C copy /b "%TEMP%\nsa8DED.tmp\yx_zg.exe" + "%WINDIR%\Fonts\verdana.ttf" "%TEMP%\nsa8DED.tmp\yx_zg.exe"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2192.23.177235965\582603938" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894\Bin\ShlExt_x64.dll" /s
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="2192.4.175073398\1165214066" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=2068
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2192.12.77547245\1421571918" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'<SYSTEM32>\regsvr32.exe' "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894\Bin\ShlExt_x64.dll" /s
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2192.19.1526906259\710083067" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- http://12#.#5.104.68/amVwY2JjdmUuZXhl/40.html
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2192.8.544542049\521603587" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2192.7.1881301986\1777535458" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2192.5.1620478403\2064916167" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2192.4.175073398\1165214066" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2192.6.1253704013\1806461542" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="2192.0.720164506\12029230" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-d...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- http://12#.#5.104.68/amVwY2JjdmUuZXhl/40.html /crash-reporter-parent-id=2192
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "http://12#.#5.104.68/amVwY2JjdmUuZXhl/40.html"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2192.10.981143892\853320904" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%WINDIR%\syswow64\cmd.exe' /C copy /b "%TEMP%\nsa8DED.tmp\uni1248517c.exe" + "%WINDIR%\Fonts\verdana.ttf" "%TEMP%\nsa8DED.tmp\uni1248517c.exe"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2192.9.897231582\1105647982" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "PreInstall" "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\PreInstall.exe"' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="迅雷下载服务" dir=in action=allow program="%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894\TP\DownloadSDKServer.exe" enable=yes' (with hidden window)
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "DPInst" "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\DPInst.exe"' (with hidden window)
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "DPInstX64" "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\DPInstX64.exe"' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="迅雷影音" dir=in action=allow program="%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894\Bin\XMP.exe" enable=yes' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="XLLiveUD" dir=in action=allow program="%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894\Bin\XLLiveUD.exe" enable=yes' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="XLBugReport" dir=in action=allow program="%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894\Bin\XLBugReport.exe" enable=yes' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="InstallDriver" dir=in action=allow program="C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\InstallDriver.exe" enable=yes' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="DPInst" dir=in action=allow program="C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\DPInst.exe" enable=yes' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="aapt" dir=in action=allow program="C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\aapt.exe" enable=yes' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="adb" dir=in action=allow program="C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\adb.exe" enable=yes' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="DPInstX64" dir=in action=allow program="C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\DPInstX64.exe" enable=yes' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="XLLiveUD" dir=in action=allow program="%TEMP%\xlliveud\xmp_5.2.18.5894\XLLiveUD.exe" enable=yes' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="PreInstall" dir=in action=allow program="C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\PreInstall.exe" enable=yes' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="APlayer" dir=in action=allow program="C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\APlayer.exe" enable=yes' (with hidden window)
'%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetupagent.exe' /installdir "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894" /userdata "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894" /version "5.2.18.5894" /cmdfile "%TEMP%\XMP2DA8.tmp"' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="XLLiveUD" dir=in action=allow program="C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\XLLiveUD.exe" enable=yes' (with hidden window)
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "InstallDriver" "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\InstallDriver.exe"' (with hidden window)
'%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetupagent.exe' /installdir "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894" /userdata "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894" /version "5.2.18.5894" /cmdfile "%TEMP%\XMPAA14.tmp"' (with hidden window)
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "adb" "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\adb.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C copy /b "%TEMP%\nsa8DED.tmp\uni1248517c.exe" + "%WINDIR%\Fonts\verdana.ttf" "%TEMP%\nsa8DED.tmp\uni1248517c.exe"' (with hidden window)
'%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetupagent.exe' /installdir "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894" /userdata "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894" /version "5.2.18.5894" /cmdfile "%TEMP%\XMPC04.tmp"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C copy /b "%TEMP%\nsa8DED.tmp\ht_Y_ssxaz10_06255.exe" + "%WINDIR%\Fonts\verdana.ttf" "%TEMP%\nsa8DED.tmp\ht_Y_ssxaz10_06255.exe"' (with hidden window)
'%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetupagent.exe' /installdir "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894" /userdata "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894" /version "5.2.18.5894" /cmdfile "%TEMP%\XMPF3C1.tmp"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C copy /b "%TEMP%\nsa8DED.tmp\yx_zg.exe" + "%WINDIR%\Fonts\verdana.ttf" "%TEMP%\nsa8DED.tmp\yx_zg.exe"' (with hidden window)
'%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetupagent.exe' /installdir "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894" /userdata "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894" /version "5.2.18.5894" /cmdfile "%TEMP%\XMP36BE.tmp"' (with hidden window)
'%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetupagent.exe' /installdir "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894" /userdata "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894" /version "5.2.18.5894" /cmdfile "%TEMP%\XMPFF08.tmp"' (with hidden window)
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "迅雷影音" "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894\Bin\XMP.exe"' (with hidden window)
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "aapt" "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\aapt.exe"' (with hidden window)
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "XLBugReport" "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894\Bin\XLBugReport.exe"' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894\Bin\ShlExt_x64.dll" /s' (with hidden window)
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "迅雷下载服务" "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894\TP\DownloadSDKServer.exe"' (with hidden window)
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "APlayer" "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\APlayer.exe"' (with hidden window)
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "XLLiveUD" "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894\Program\XLLiveUD.exe"' (with hidden window)
'%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmppushersetup.exe' /S /write /xmpsupport "XmpSetupLite"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C copy /b "%TEMP%\nsa8DED.tmp\SoHuVA_4.5.77.0-c204900003-nti-ng-tp-s.exe" + "%WINDIR%\Fonts\verdana.ttf" "%TEMP%\nsa8DED.tmp\SoHuVA_4.5.77.0-c204900003-nti-ng-tp-s.exe"' (with hidden window)
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "XLLiveUD" "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894\Bin\XLLiveUD.exe"' (with hidden window)
'%ProgramFiles(x86)%\thunder network\xmp\v5.2.18.5894\bin\thunderfw.exe' "XLLiveUD" "%TEMP%\xlliveud\xmp_5.2.18.5894\XLLiveUD.exe"' (with hidden window)
'%TEMP%\xmpsetuplite-sijhaqws57\5.2.18.5894\xmpsetupagent.exe' /installdir "%ProgramFiles(x86)%\Thunder Network\XMP\V5.2.18.5894" /userdata "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894" /version "5.2.18.5894" /cmdfile "%TEMP%\XMP3ECA.tmp"' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней