Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\7ZipSfx.000\xlmodule\download\minithunderplatform.exe' = '%TEMP...
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\7ZipSfx.000\xlmodule\download\minithunderplatform.exe" "minithunderplatform" enable
- %TEMP%\7ZipSfx.000\Data\ksoftmgrun.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60047772.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60047773.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60047775.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60047838.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60047839.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60047841.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60047992.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60048007.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60048019.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60048026.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60048050.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\61000010.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\61000011.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\61000036.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\61000056.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\61000059.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\61000070.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\61000071.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\61000072.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\61000073.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\61000074.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60047766.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\61000075.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60047717.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60047696.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60043068.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60043150.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60043465.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60043559.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60044053.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60044246.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60044347.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60044350.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60045166.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60045292.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60046094.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60046095.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60046533.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60046865.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60047253.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60047258.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60047447.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60047501.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60047597.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60047638.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60047692.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60047708.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\61000078.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\61000081.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\61000095.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001905.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001906.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001911.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001914.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001920.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001921.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001923.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001924.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001925.dat
- %TEMP%\7ZipSfx.000\Data\ksofticondownloader.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001933.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001936.dat
- %TEMP%\7ZipSfx.000\Data\softuninst.ini
- %TEMP%\7ZipSfx.000\xlmodule\download\zlib1.dll
- %TEMP%\7ZipSfx.000\Data\ksoftmgr.ini
- %TEMP%\7ZipSfx.000\Data\ksoftmgrlces.ini
- %TEMP%\7ZipSfx.000\softmgrcache\kuesize.dat
- %TEMP%\7ZipSfx.000\Data\localsoftcache.dat
- %ALLUSERSPROFILE%\Application Data\Thunder Network\DownloadLib\pub_store.dat
- %TEMP%\7ZipSfx.000\Data\localsofts.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001898.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001903.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001897.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001884.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001878.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\61000099.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70000175.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70000534.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70000981.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001063.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001065.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001103.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001234.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001788.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60040548.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001802.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001793.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001837.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001840.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001845.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001855.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001865.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001867.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001869.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001874.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001875.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\61000096.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001804.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\70001935.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60040422.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60035762.dat
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\hg.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000002.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000011.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000022.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000024.dat
- %TEMP%\7ZipSfx.000\security\kxescan\kfcdetect.dll.log
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000030.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000041.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000043.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000044.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000047.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000048.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000057.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000072.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000098.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000101.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000105.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000158.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000179.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000209.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000234.dat
- %TEMP%\7ZipSfx.000\Data\whitelist.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000321.dat
- %TEMP%\7ZipSfx.000\zlib1.dll
- %TEMP%\7ZipSfx.000\xlmodule\download\xlzlib1.dll
- %TEMP%\7ZipSfx.000\Data\ksoft_category.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\kuefreq.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\kuehead.dat
- %TEMP%\7ZipSfx.000\microsoft.vc80.crt.manifest
- %TEMP%\7ZipSfx.000\microsoft.vc80.mfc.manifest
- %TEMP%\7ZipSfx.000\xlmodule\download\id.dat
- %TEMP%\7ZipSfx.000\kskinmgr.dll
- %TEMP%\7ZipSfx.000\ksoftmgr.exe
- %TEMP%\7ZipSfx.000\ksoftmgrengine.dll
- %TEMP%\7ZipSfx.000\ksoftmgrproxy.exe
- %TEMP%\7ZipSfx.000\ktoolupd.dll
- %TEMP%\7ZipSfx.000\msvcp80.dll
- %TEMP%\7ZipSfx.000\msvcr80.dll
- %TEMP%\7ZipSfx.000\security\kxescan\kfcdetect.dll
- %TEMP%\7ZipSfx.000\xlmodule\download\atl71.dll
- %TEMP%\7ZipSfx.000\xlmodule\download\dl_peer_id.dll
- %TEMP%\7ZipSfx.000\xlmodule\download\download_engine.dll
- %TEMP%\7ZipSfx.000\xlmodule\download\minithunderplatform.exe
- %TEMP%\7ZipSfx.000\xlmodule\download\minizip.dll
- %TEMP%\7ZipSfx.000\xlmodule\download\msvcp71.dll
- %TEMP%\7ZipSfx.000\xlmodule\download\msvcr71.dll
- %TEMP%\7ZipSfx.000\xlmodule\xldl.dll
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000365.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000400.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000401.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60001823.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60002870.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60002916.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60002917.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60005314.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60005482.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60005485.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60005631.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60015668.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60040407.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60025942.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60036974.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60037692.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60037746.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60038097.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60038242.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60039362.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60039381.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60039584.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60039769.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60001738.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60001814.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60001630.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60001578.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60001519.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000407.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000421.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000612.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000619.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000769.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000794.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000844.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000963.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60001027.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60040408.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60001103.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60001094.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60001205.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60001281.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60001314.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60001373.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60001374.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60001429.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60001448.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60001471.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60001479.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60000404.dat
- %TEMP%\7ZipSfx.000\Data\kuefreq\60001169.dat
- %ALLUSERSPROFILE%\Application Data\Thunder Network\Mini_downloadlib\ODAwMDAyNTY=\Version_3_2_1_36\Profiles\error.dat
- '12#.#07.105.156':8080
- 'kn###.#loud.duba.net':8080
- 'localhost':1043
- '12#.#93.207.34':80
- '22#.#28.204.34':80
- 'so####r.duba.net':80
- http://so####r.duba.net/softmgr_v2/allsoft/general/xp/32.html
- http://12#.#93.207.34/uquery?21####
- http://22#.#28.204.34/uquery?22####
- DNS ASK kn###.#loud.duba.net
- DNS ASK so####r.duba.net
- DNS ASK rq.#####ize.cloud.duba.net
- DNS ASK hu#####.hz.sandai.net
- DNS ASK hu####.hz.sandai.net
- DNS ASK hu###.hz.sandai.net
- DNS ASK pm##.#z.sandai.net
- DNS ASK im#####r.hz.sandai.net
- DNS ASK sc###.##ub.hz.sandai.net
- DNS ASK re###.##ub.hz.sandai.net
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- '<Full path to file>' -sfxwaitall:0 "ksoftmgr.exe"
- '%TEMP%\7ZipSfx.000\ksoftmgr.exe'
- '%TEMP%\7ZipSfx.000\xlmodule\download\minithunderplatform.exe' -StartTP