Technical Information
- [<HKCU>\Software\classes\ed2k\Shell\Open\command] '' = '"%TEMP%\7ZipSfx.000\Program\ThunderNewTask.exe" "%1"'
- [<HKCU>\Software\classes\magnet\Shell\Open\command] '' = '"%TEMP%\7ZipSfx.000\Program\Thunder.exe" "%1"'
- [<HKCU>\Software\classes\xlapp\Shell\Open\command] '' = '"%TEMP%\7ZipSfx.000\Program\Thunder.exe" "%1"'
- [<HKCU>\Software\classes\thunder\Shell\Open\command] '' = '"%TEMP%\7ZipSfx.000\Program\ThunderNewTask.exe" "%1"'
- [<HKCU>\Software\classes\xlb\Shell\Open\command] '' = '"%TEMP%\7ZipSfx.000\Program\Thunder.exe" "%1"'
- [<HKCU>\Software\classes\Xunlei.TDFile.6\Shell\Open\command] '' = '"%TEMP%\7ZipSfx.000\Program\Thunder.exe" "%1"'
- [<HKCU>\Software\classes\Xunlei.LSTFile.6\Shell\Open\command] '' = '"%TEMP%\7ZipSfx.000\Program\Thunder.exe" "%1"'
- [<HKCU>\Software\classes\Xunlei.Bittorrent.6\Shell\Open\command] '' = '"%TEMP%\7ZipSfx.000\Program\Thunder.exe" "%1"'
- [<HKCU>\Software\classes\Xunlei.ThunderSkin.6\Shell\Open\command] '' = '"%TEMP%\7ZipSfx.000\Program\Thunder.exe" "%1"'
- %TEMP%\7zipsfx.000\program\sdk\xar\downloaddispatcher.xta
- %TEMP%\7zipsfx.000\program\sqlite3.dll
- %TEMP%\7zipsfx.000\program\sdk\xudt.dll
- %TEMP%\7zipsfx.000\program\sdk\xsdn.dll
- %TEMP%\7zipsfx.000\program\sdk\xlreimport.dll
- %TEMP%\7zipsfx.000\program\sdk\xlnr.dll
- %TEMP%\7zipsfx.000\program\sdk\xlbughandler.dll
- %TEMP%\7zipsfx.000\program\sdk\xdt.dll
- %TEMP%\7zipsfx.000\program\sdk\upnp.exe
- %TEMP%\7zipsfx.000\program\xlfsio.dll
- %TEMP%\7zipsfx.000\program\sdk\tcpimpl.dll
- %TEMP%\7zipsfx.000\program\sdk\p2ptarget.dll
- %TEMP%\7zipsfx.000\program\sdk\p2pstat.dll
- %TEMP%\7zipsfx.000\program\sdk\p2pio.dll
- %TEMP%\7zipsfx.000\program\sdk\p2pframework.dll
- %TEMP%\7zipsfx.000\program\sdk\p2pcommonobjects.dll
- %TEMP%\7zipsfx.000\program\sdk\xbt.dll
- %TEMP%\7zipsfx.000\thunder\xar\thundercore.xar
- %TEMP%\7zipsfx.000\program\xlgraphic.dll
- C:\users\public\thunder network\downloadsdk\profiles\pc.thunder9\globalsetting.ini
- %TEMP%\7zipsfx.000\program\sdk\gslb.data
- %TEMP%\7zipsfx.000\profiles\bindingconfig.ini
- C:\users\public\thunder network\downloadsdk\profiles\pub_store.dat
- %TEMP%\xunlei\conce11.tmp
- %APPDATA%\microsoft\windows\libraries\~library-ms.tmp
- %TEMP%\7zipsfx.000\profiles\community\community.ini
- %TEMP%\7zipsfx.000\program\sdk\p2pbase.dll
- %TEMP%\7zipsfx.000\program\thunder.exe
- %TEMP%\7zipsfx.000\profiles\taskdb.dat-journal
- %PROGRAMDATA%\thunder network\downloadlib\pub_store.dat
- %TEMP%\7zipsfx.000\program\zlib1.dll
- %TEMP%\7zipsfx.000\program\xlusers.dll
- %TEMP%\7zipsfx.000\program\xlue.dll
- %TEMP%\7zipsfx.000\program\xlstat4.dll
- %TEMP%\7zipsfx.000\program\xlluaruntime.dll
- %TEMP%\7zipsfx.000\profiles\taskdb.dat
- %TEMP%\7zipsfx.000\program\xlgraphicplus.dll
- %TEMP%\7zipsfx.000\program\sdk\http.dll
- %TEMP%\7zipsfx.000\program\sdk\ftp.dll
- %TEMP%\7zipsfx.000\program\sdk\downloadsdkserver.exe
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\layout\confighelper.lua
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\layout\tabheadersizechangeani.xml
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\layout\tabheadercontainer.xml.lua
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\layout\tabheadercontainer.xml
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\layout\tabheader.xml.lua
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\layout\tabheader.xml
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\layout\onload.lua
- %TEMP%\7zipsfx.000\program\sdk\settings.json
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\layout\uitab.lua
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\layout\blank1.lua
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\basecommunity\package.cfg
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\basecommunity\layout\nametable.cfg
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\basecommunity\layout\community.xml.lua
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\basecommunity\layout\community.xml
- %TEMP%\7zipsfx.000\thunder\xar\basiccontrols.xar
- %TEMP%\7zipsfx.000\program\tray.ico
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\layout\nametable.cfg
- %TEMP%\etilqs_xkdz33vhlzno55s
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\layout\uitabpage.xml
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\layout\xlbrowserappmainwnd.xml
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\layout\uitabpage.xml.lua
- %TEMP%\7zipsfx.000\program\sdk\downloadsdkproxy.dll
- %TEMP%\7zipsfx.000\program\sdk\downloadsdk.dll
- %TEMP%\7zipsfx.000\program\sdk\dht.dll
- %TEMP%\7zipsfx.000\program\sdk\assistanttools.dll
- %TEMP%\7zipsfx.000\program\libpng13.dll
- %TEMP%\7zipsfx.000\program\libexpat.dll
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\layout\xlbrowserapphelper.lua
- %TEMP%\7zipsfx.000\program\downloadkernel.dll
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\layout\tabheadersizechangeani.xml.lua
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\configpanel.xar
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\res\default\xlbrowserapp.xml
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\res\default\resource.cfg
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\res\default\closetabbtn.png
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\package.cfg
- %TEMP%\7zipsfx.000\thunder\xar\thunderapp\browsersupport\layout\xlbrowserappmainwnd.xml.lua
- %TEMP%\7zipsfx.000\program\basecommunity.dll
- %TEMP%\7zipsfx.000\data\stat.dat
- %APPDATA%\microsoft\windows\libraries\.library-ms~rf13cead.tmp
- from %APPDATA%\microsoft\windows\libraries\~library-ms.tmp to %APPDATA%\microsoft\windows\libraries\.library-ms
- from %TEMP%\xunlei\conce11.tmp to %TEMP%\7zipsfx.000\data\latest_stat.xml
- from %APPDATA%\microsoft\windows\libraries\.library-ms to %APPDATA%\microsoft\windows\libraries\.library-ms~rf13cead.tmp
- %APPDATA%\microsoft\windows\libraries\~library-ms.tmp
- %APPDATA%\microsoft\windows\libraries\.library-ms
- http://xm#####.rcv.sandai.net/?ap######
- http://st######l9-ssl.xunlei.com/json/modules.json
- http://ms##.##ient.xunlei.com/client8.login.html?xm###
- http://pl####.xl7.xunlei.com/7.9/normal/xl9browser_kernel_urls.xml?ke############
- http://pl####.xl7.xunlei.com/7.9/nav/GlobalRemoteConfig0.0.0.xml
- http://dc###.#cloud.sandai.net/api/xsdn
- http://hu######ta.sandai.net:80/ via hu#####ata.sandai.net
- http://dl###.###ent.v6.chub.sandai.net/query
- http://hu####.sandai.net:80/ via hu####.sandai.net
- DNS ASK jo###.#eg2t.sandai.net
- DNS ASK pc####.#6.shub.sandai.net
- DNS ASK de#######.v6.shub.sandai.net
- DNS ASK g3.####pn.sandai.net
- DNS ASK xl######der9.rcv.sandai.net
- DNS ASK hu####.sandai.net
- DNS ASK dh#.#elitis.com
- DNS ASK ro####.utorrent.com
- DNS ASK ro####.bittorrent.com
- DNS ASK dh#.###nsmissionbt.com
- DNS ASK hu###.sandai.net
- DNS ASK dl###.###ent.v6.chub.sandai.net
- DNS ASK hu#####ata.sandai.net
- DNS ASK hu###.##.phub.sandai.net
- DNS ASK pl####.xl7.xunlei.com
- DNS ASK gs##.##loud.sandai.net
- DNS ASK hu####.#6.phub.sandai.net
- DNS ASK po####.#lient.xunlei.com
- DNS ASK pc.####.xnet.sandai.net
- DNS ASK hu####.wap.sandai.net
- DNS ASK hu####c.sandai.net
- DNS ASK dc###.#cloud.sandai.net
- DNS ASK st######l9-ssl.xunlei.com
- DNS ASK ms##.##ient.xunlei.com
- DNS ASK xm#####.rcv.sandai.net
- 'hu####c.sandai.net':4000
- '92.#5.10.0':6889
- '22#.#05.125.10':46241
- '62.##0.204.73':55011
- '95.##6.42.221':28028
- '95.##.134.62':20775
- 'hu###.sandai.net':8000
- '17#.#08.139.245':34884
- '20#.#6.100.138':6881
- '31.##.177.230':25024
- '79.##6.203.58':1043
- 'dh#.###nsmissionbt.com':6881
- 'ro####.bittorrent.com':6881
- '45.##.195.142':34068
- 'hu####c.sandai.net':8000
- 'hu####.wap.sandai.net':8000
- '23#.#55.255.250':1900
- 'dh#.#elitis.com':8991
- '<LOCALNET>.59.1':1900
- '19#.#24.63.5':51413
- '81.##4.69.24':6881
- 'ro####.utorrent.com':6881
- '71.##8.238.54':62915
- 'hu####c.sandai.net':3076
- ClassName: 'XLShellCommandWindow' WindowName: 'XLShellCommandWindow'
- ClassName: 'ConsoleWindowClass' WindowName: ''
- '%TEMP%\7zipsfx.000\program\thunder.exe'
- '%TEMP%\7zipsfx.000\program\sdk\downloadsdkserver.exe' BDAF7A63-568C-43ab-9406-D145CF03B08C:1552
- '<SYSTEM32>\cmd.exe' /c attrib +h "%TEMP%\7ZipSfx.000"' (with hidden window)
- '%TEMP%\7zipsfx.000\program\sdk\downloadsdkserver.exe' BDAF7A63-568C-43ab-9406-D145CF03B08C:1552' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c attrib +h "%TEMP%\7ZipSfx.000"
- '<SYSTEM32>\attrib.exe' +h "%TEMP%\7ZipSfx.000"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%TEMP%\7zipsfx.000\program\sdk\d...