Gen.Variant.Midie.6956_ba128a31de

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

mscaps.exe:2748
wtmps.exe:2700
%original file name%.exe:1932
@AE1.tmp.exe:1116
NOTEPAD.EXE:3596
NOTEPAD.EXE:3744
NOTEPAD.EXE:3676
NOTEPAD.EXE:3568
NOTEPAD.EXE:2284
NOTEPAD.EXE:3524
NOTEPAD.EXE:3536
NOTEPAD.EXE:2240
NOTEPAD.EXE:3732
NOTEPAD.EXE:3704
netsh.exe:2472
netsh.exe:636
launch.exe:2640
WdExt.exe:2332
WINMINE.EXE:3636
WINMINE.EXE:3664
WINMINE.EXE:3608
WINMINE.EXE:3772

The Trojan injects its code into the following process(es):

360Inst_62.exe:644
Explorer.EXE:532

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process mscaps.exe:2748 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\11.tmp (406 bytes)
%System%\wtime32.dll (29045 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\11.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wtmps.exe (0 bytes)

The process wtmps.exe:2700 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\mscaps.exe (27349 bytes)

The process %original file name%.exe:1932 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsc4.tmp\System.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp (18098 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\360Inst_62.exe (23936 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsc4.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc4.tmp (0 bytes)

The process @AE1.tmp.exe:1116 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\000CBA8B_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CB933_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC597_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC1EE_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Messenger\Extension\WdExt.exe (242745 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC7AA_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC180_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC22C_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBF9C_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC4AD_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC113_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Temp\mydll.dll (12549 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CB79D_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CB897_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC624_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CB878_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBC12_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CB82A_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC4EB_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBD79_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBB66_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC5C6_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC2B9_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CB8F5_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC0B5_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC48E_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC019_Rar\@AE1.tmp.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBCEC_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC317_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBBD3_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBC31_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC430_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC057_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC662_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CB9C0_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBF8C_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC75C_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBC6F_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CB7DC_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBABA_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC4CC_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC038_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC7CA_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC336_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC568_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBBF2_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC151_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC45F_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CB9EF_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBFFA_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC827_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC50B_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC0D4_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBB95_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CB9DF_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC077_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC374_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC0E4_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC420_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC3D2_Rar\@AE1.tmp.exe (13122 bytes)
%WinDir%\system.ini (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CB77E_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC0A6_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC643_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC6EF_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC24B_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CB859_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC29A_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC6C0_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC2D8_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBA1E_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC70E_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC067_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBD4A_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC142_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC26B_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBA2D_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CB7FB_Rar\@AE1.tmp.exe (13122 bytes)
C:\%original file name%.exe (2792 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CB73F_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC7E9_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC682_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBF2F_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBAF8_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC559_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC605_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC1CE_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC808_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp5.tmp (455744 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CB9FE_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBB37_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC1A0_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp8.tmp (907 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC123_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CB8D6_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBA5C_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC355_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Temp\adm1.bat (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC46E_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBC9E_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBBB4_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Se7.tmp (1792 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC3B3_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC1BF_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC0C5_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC20D_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Sp6.tmp (1304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC76C_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC73D_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CB8B6_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBD0C_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC44F_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBCBE_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC029_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC6A1_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CB914_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Temp\adm0.bat (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CBF7D_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC49D_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC2F7_Rar\@AE1.tmp.exe (13122 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Se7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Sp6.tmp (0 bytes)
C:\cbf7d (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp5.tmp (0 bytes)
%Documents and Settings%\%current user%\Application Data\Temp\mydll.dll (0 bytes)

The process 360Inst_62.exe:644 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp.dir (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp.dir\safe_icon.bmp (824 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp.dir\safe_logo.jpg (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\360net.dll (111 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp.dir\safe_title.JPG (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp (2467 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp.dir\setup.ini (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp.dir\IELog.jpg (8 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp.dir (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp.dir\safe_icon.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp.dir\safe_logo.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp.dir\safe_title.JPG (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp.dir\setup.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp.dir\IELog.jpg (0 bytes)

The process launch.exe:2640 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Temp\adm0.bat (112 bytes)

The process WdExt.exe:2332 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\000CCD48_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD576_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE37F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE499_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD14F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDB13_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCCAC_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCEDE_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD72B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE17C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE5F0_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE62F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD854_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDE40_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDA38_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD2C6_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD2A7_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD15F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE41C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpF.tmp (36444 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE7A6_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDA0A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDDB3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Temp\mydll.dll (12549 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpE.tmp (21164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD4D9_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE65E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDF0B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCD29_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD73B_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD6ED_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE16C_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCC8C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE4A8_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCE52_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDE01_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE370_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE15D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDCD8_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE600_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD084_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Repairs\sha.dll (7589 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD5E3_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCEFD_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE787_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD585_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpB.tmp (26548 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE360_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpD.tmp (18508 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDB52_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD324_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE5C2_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD6CD_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE729_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD5F3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCD58_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD4BA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD5C4_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD362_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE322_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDB90_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD71C_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE796_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDCC9_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDB32_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD3C0_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCF6B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD41E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD864_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE8CF_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE777_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE479_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE12E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDBA0_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE64E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE1BA_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDDC3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCF0D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD9CB_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Defender\launch.exe (18077 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE8FE_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD98D_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE8DE_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDC7B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE719_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD305_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD249_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE70A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCD77_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE331_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCF4C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCF2C_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD873_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDC6B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD893_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD6BE_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE312_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD74A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Identities\"%CurrentUserName%"\arc.dll (96316 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE890_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE13D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpC.tmp (28924 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE2D4_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD6DD_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE18B_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDB04_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD3DF_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD1EB_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp10.tmp (55476 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD278_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE2F3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wtmps.exe (31581 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCF3C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE8B0_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDCB9_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDC3C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE2E3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD0F1_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD45C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDB81_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Shared\Modules\fil.dll (10805 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD046_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD9FA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD0C3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDE4F_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE489_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD883_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD1DC_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD6AE_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDD07_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDD17_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD3A1_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD612_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCD38_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCF9A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Common\Shared\dis.dll (10077 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD18E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDC8A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD5D3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE1DA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDB42_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDCF8_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD007_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD2E5_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDDF2_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE758_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCDD5_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE90D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDB71_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE19B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE4B8_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE44B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD825_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCCEA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD47C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD065_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD844_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE8EE_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD5B4_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD44D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD566_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE7B6_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCFB9_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDE20_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCC9C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD120_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD8A2_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE5D1_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE43B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE46A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD49B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE610_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE42B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDE30_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDDD2_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE341_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDB61_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDCE8_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD0A3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE351_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE748_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE14D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD8C1_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE45A_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD20B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE8BF_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Application Data\Temp\adm1.bat (156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDA58_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCE03_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCCFA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\Addins\att.dll (18829 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD75A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE4C8_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD5A5_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE881_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD382_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD343_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD835_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD9BB_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDDE2_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCE13_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE63F_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE739_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD6FC_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE8A0_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD816_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD595_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Caches\Files\usd.dll (7933 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE1CA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE1AB_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE91D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE2C4_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDA29_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCE32_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD3EF_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD9DB_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCFD8_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE5E1_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE767_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCD19_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpA.tmp (48916 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDA19_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD602_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCCBB_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDC5B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD026_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD8B2_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDA48_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDE11_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CE61F_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CCF1D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDB23_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CDA67_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CD70C_Rar\WdExt.exe (13122 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tmpC.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpF.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpA.tmp (0 bytes)
%Documents and Settings%\%current user%\Application Data\Temp\mydll.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp10.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpE.tmp (0 bytes)

Registry activity

The process mscaps.exe:2748 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{ef2b00e3-19da-4e78-b118-6b6451b719f2}]
"Locale" = "*"
"StubPath" = "%System%\mscaps.exe /s /n /i:U shell32.dll"
"Version" = "1,125,2406,1"
"ComponentID" = "DirectShow"

The process %original file name%.exe:1932 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB C8 AA F4 12 CA 95 E8 36 32 DA B0 28 55 37 9D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process @AE1.tmp.exe:1116 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\Temp]
"adm0.bat" = "adm0"
"adm1.bat" = "adm1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\adm914]
"a4_0" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\adm914]
"a1_0" = "3432392762"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools" = "1"

[HKCU\Software\adm914\695404737]
"43014726" = "0500687474703A2F2F6D617474666F6C6C2E65752E696E74657269612E706C2F6C6F676F732E67696600687474703A2F2F7374312E646973742E73752E6C742F6C6F676F682E67696600687474703A2F2F6C70626D782E72752F6C6F676F732E67696600687474703A2F2F626A65726D2E6D6173732E68632E72752F6C6F676F682E67696600687474703A2F2F534F536954455F41564552495F534F5369544545452E6861686168"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\adm914\695404737]
"14338242" = "0"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\adm914\695404737]
"7169121" = "36"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"

[HKCU\Software\adm914\695404737]
"35845605" = "169"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 F8 7C 41 A0 B7 D2 25 A1 57 96 0C C7 27 24 0F"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKCU\Software\adm914\695404737]
"28676484" = "35"

[HKCU\Software\adm914]
"a3_0" = "17001001"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\adm914\695404737]
"50183847" = "AB5E0738695C8F8323226F12B1D03D7D79E71A90760ACADED2B04A211637CD4145F6749BEE9023AA532184F995577060D6510DE74D26646EFEDFC32366D2CC8E7771C37E919020908A4DB60C10921A99946050DEA9E148F0FFAB69F3A9524762D4085A5E517FCB0C38FF00DB7E5CB8BFF62F51C41C88B0B67DC3FC07CB089EF3"

[HKCU\Software\adm914]
"a2_0" = "5517"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\adm914\695404737]
"21507363" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"@AE1.tmp.exe" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\@AE1.tmp.exe:*:Enabled:ipsec"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

Task Manager is disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process NOTEPAD.EXE:3596 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4E 2C 75 B5 55 DB 14 7F F9 66 83 9E C6 0D 7A 8E"

The process NOTEPAD.EXE:3744 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 3A 43 EB 5A 68 F1 3F 69 6D E7 A1 28 99 CA C6"

The process NOTEPAD.EXE:3676 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD 4C F5 BF 53 E2 2E 89 2B 97 32 89 38 4A 75 33"

The process NOTEPAD.EXE:3568 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5C B1 0D 26 80 9A 15 AD A4 E5 9E 23 90 83 C3 0A"

The process NOTEPAD.EXE:2284 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "00 81 14 33 75 6C B5 42 FB CA 23 A6 5D C7 8E A3"

The process NOTEPAD.EXE:3524 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "43 9F 77 0F 2D CF E9 A3 CF 49 91 F0 46 14 19 18"

The process NOTEPAD.EXE:3536 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F2 0D 4E 24 68 C0 36 99 93 80 5E 4E C5 72 D5 60"

The process NOTEPAD.EXE:2240 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "56 2A 29 CA 73 7B E8 5D 1E C6 30 DC 39 A2 C7 6E"

The process NOTEPAD.EXE:3732 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "31 C7 AB 2A 3B 32 2B D4 A4 00 3E 42 2D 49 BE 45"

The process NOTEPAD.EXE:3704 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D8 08 44 87 A7 CB 26 8D 8C 23 4D CB D7 3E F1 72"

The process 360Inst_62.exe:644 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 8C 71 66 57 57 3A 03 26 33 1D DD D2 DF F8 8C"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"360Install" = ""

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Temp]
"360Inst_62.exe" = "%Documents and Settings%\%current user%\Local Settings\Temp\360Inst_62.exe:*:Enabled:360安全中心"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process netsh.exe:2472 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CF 81 80 38 59 A1 8B AA 53 6F 49 48 65 F8 18 FB"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

The process netsh.exe:636 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1B 65 79 74 D5 AF 7E 6F AB 74 89 A0 6F FF BA 88"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

The process launch.exe:2640 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 2C 53 6A 49 F5 F0 52 BB B5 FE 88 6F 80 3C B3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender Extension" = "%Documents and Settings%\%current user%\Application Data\Microsoft\Defender\launch.exe"

The process WdExt.exe:2332 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 BD 40 FB 03 75 E4 3C 2F 53 96 A8 AB 79 82 02"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process WINMINE.EXE:3636 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "06 D1 4D B5 B9 32 7C D0 C5 95 79 7F C4 14 D4 3C"

The process WINMINE.EXE:3664 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 51 56 33 4F 18 AC BE A2 01 70 7A 6E 10 C8 E1"

The process WINMINE.EXE:3608 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "69 A7 70 10 45 9E 9B 28 CC 8D 43 EE 4F 8C DA E8"

The process WINMINE.EXE:3772 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "32 83 2F 45 76 60 E3 6D 17 71 F7 10 48 22 41 C2"

Dropped PE files

MD5	File path
f1c9f4a1f92588aeb82be5d2d4c2c730	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Microsoft\Caches\Files\usd.dll
1fcc5b3ed6bc76d70cfa49d051e0dff6	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Microsoft\Common\Shared\dis.dll
8d1aceca7708f6e86ec8320ee15535ed	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Microsoft\Defender\launch.exe
b658d0ed0b76421f38e9e1cd3398d411	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Microsoft\Messenger\Extension\WdExt.exe
6a9461f260ebb2556b8ae1d0ba93858a	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Microsoft\Repairs\sha.dll
d0c9ada173da923efabb53d5a9b28d54	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Microsoft\Shared\Modules\fil.dll
fffa05401511ad2a89283c52d0c86472	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Microsoft\Windows\Addins\att.dll
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CD816_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CD835_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CD844_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CD854_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CD864_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CD873_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CD883_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CD893_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CD8A2_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CD8B2_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CD8C1_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CD98D_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CD9BB_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CD9CB_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CD9DB_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CD9FA_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDA0A_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDA19_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDA29_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDA38_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDA48_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDA58_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDA67_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDB04_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDB13_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDB23_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDB32_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDB42_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDB52_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDB61_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDB71_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDB81_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDB90_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDBA0_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDC3C_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDC5B_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDC6B_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDC7B_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDC8A_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDCB9_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDCC9_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDCD8_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDCE8_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDCF8_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDD07_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDD17_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDDB3_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDDC3_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDDD2_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDDE2_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDDF2_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDE01_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDE11_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDE20_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDE30_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDE40_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDE4F_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CDF0B_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE12E_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE13D_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE14D_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE15D_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE16C_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE17C_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE18B_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE19B_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE1AB_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE1BA_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE1CA_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE1DA_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE2C4_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE2D4_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE2E3_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE2F3_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE312_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE322_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE331_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE341_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE351_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE360_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE370_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE37F_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE41C_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE42B_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE43B_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE44B_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE45A_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE46A_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE479_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE489_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE499_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE4A8_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE4B8_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE4C8_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE5C2_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE5D1_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE5E1_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE5F0_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE600_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE610_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE61F_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE62F_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE63F_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE64E_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE65E_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE70A_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE719_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE729_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE739_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE748_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE758_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE767_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE777_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE787_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE796_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE7A6_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE7B6_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE881_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE890_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE8A0_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE8B0_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE8BF_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE8CF_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE8DE_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE8EE_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE8FE_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE90D_Rar\WdExt.exe
10273889600c3d79fa0fcd250e9db43d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000CE91D_Rar\WdExt.exe
f7fa8c04295ef519db2b8c20321a7752	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\360Inst_62.exe
15c5c02f54b27d2184cb5f81cacd5d61	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\360net.dll
78d3c8705f8baf7d34e6a6737d1cfa18	c:\WINDOWS\system32\mscaps.exe
978888892a1ed13e94d2fcb832a2a6b5	c:\WINDOWS\system32\wtime32.dll
f2a51c32746cfcd2baa1473a965e34a8	c:\%original file name%.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   mscaps.exe:2748
   wtmps.exe:2700
   %original file name%.exe:1932
   @AE1.tmp.exe:1116
   NOTEPAD.EXE:3596
   NOTEPAD.EXE:3744
   NOTEPAD.EXE:3676
   NOTEPAD.EXE:3568
   NOTEPAD.EXE:2284
   NOTEPAD.EXE:3524
   NOTEPAD.EXE:3536
   NOTEPAD.EXE:2240
   NOTEPAD.EXE:3732
   NOTEPAD.EXE:3704
   netsh.exe:2472
   netsh.exe:636
   launch.exe:2640
   WdExt.exe:2332
   WINMINE.EXE:3636
   WINMINE.EXE:3664
   WINMINE.EXE:3608
   WINMINE.EXE:3772
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temp\11.tmp (406 bytes)
   %System%\wtime32.dll (29045 bytes)
   %System%\mscaps.exe (27349 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc4.tmp\System.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp (18098 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\360Inst_62.exe (23936 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBA8B_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CB933_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC597_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC1EE_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Messenger\Extension\WdExt.exe (242745 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC7AA_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC180_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC22C_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBF9C_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC4AD_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC113_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Application Data\Temp\mydll.dll (12549 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CB79D_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CB897_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC624_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CB878_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBC12_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CB82A_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC4EB_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBD79_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBB66_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC5C6_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC2B9_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CB8F5_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC0B5_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC48E_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC019_Rar\@AE1.tmp.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBCEC_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC317_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBBD3_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBC31_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC430_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC057_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC662_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CB9C0_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBF8C_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC75C_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBC6F_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CB7DC_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBABA_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC4CC_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC038_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC7CA_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC336_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC568_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBBF2_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC151_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC45F_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CB9EF_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBFFA_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC827_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC50B_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC0D4_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBB95_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CB9DF_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC077_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC374_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC0E4_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC420_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC3D2_Rar\@AE1.tmp.exe (13122 bytes)
   %WinDir%\system.ini (70 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CB77E_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC0A6_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC643_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC6EF_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC24B_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CB859_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC29A_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC6C0_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC2D8_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBA1E_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC70E_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC067_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBD4A_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC142_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC26B_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBA2D_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CB7FB_Rar\@AE1.tmp.exe (13122 bytes)
   C:\%original file name%.exe (2792 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CB73F_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC7E9_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC682_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBF2F_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBAF8_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC559_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC605_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC1CE_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC808_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmp5.tmp (455744 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CB9FE_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBB37_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC1A0_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmp8.tmp (907 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC123_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CB8D6_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBA5C_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC355_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Application Data\Temp\adm1.bat (196 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC46E_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBC9E_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBBB4_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Se7.tmp (1792 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC3B3_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC1BF_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC0C5_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC20D_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Sp6.tmp (1304 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC76C_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC73D_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CB8B6_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBD0C_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC44F_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBCBE_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC029_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC6A1_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CB914_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Application Data\Temp\adm0.bat (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CBF7D_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC49D_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CC2F7_Rar\@AE1.tmp.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp.dir (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp.dir\safe_icon.bmp (824 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp.dir\safe_logo.jpg (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\360net.dll (111 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp.dir\safe_title.JPG (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp.dir\setup.ini (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\!@t284.tmp.dir\IELog.jpg (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCD48_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD576_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE37F_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE499_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD14F_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDB13_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCCAC_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCEDE_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD72B_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE17C_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE5F0_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE62F_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD854_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDE40_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDA38_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD2C6_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD2A7_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD15F_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE41C_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmpF.tmp (36444 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE7A6_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDA0A_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDDB3_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmpE.tmp (21164 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD4D9_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE65E_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDF0B_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCD29_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD73B_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD6ED_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE16C_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCC8C_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE4A8_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCE52_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDE01_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE370_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE15D_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDCD8_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE600_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD084_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Repairs\sha.dll (7589 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD5E3_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCEFD_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE787_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD585_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmpB.tmp (26548 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE360_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmpD.tmp (18508 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDB52_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD324_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE5C2_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD6CD_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE729_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD5F3_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCD58_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD4BA_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD5C4_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD362_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE322_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDB90_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD71C_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE796_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDCC9_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDB32_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD3C0_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCF6B_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD41E_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD864_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE8CF_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE777_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE479_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE12E_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDBA0_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE64E_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE1BA_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDDC3_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCF0D_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD9CB_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Defender\launch.exe (18077 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE8FE_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD98D_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE8DE_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDC7B_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE719_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD305_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD249_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE70A_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCD77_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE331_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCF4C_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCF2C_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD873_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDC6B_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD893_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD6BE_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE312_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD74A_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Identities\"%CurrentUserName%"\arc.dll (96316 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE890_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE13D_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmpC.tmp (28924 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE2D4_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD6DD_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE18B_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDB04_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD3DF_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD1EB_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmp10.tmp (55476 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD278_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE2F3_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\wtmps.exe (31581 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCF3C_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE8B0_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDCB9_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDC3C_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE2E3_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD0F1_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD45C_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDB81_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Shared\Modules\fil.dll (10805 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD046_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD9FA_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD0C3_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDE4F_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE489_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD883_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD1DC_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD6AE_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDD07_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDD17_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD3A1_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD612_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCD38_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCF9A_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Common\Shared\dis.dll (10077 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD18E_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDC8A_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD5D3_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE1DA_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDB42_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDCF8_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD007_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD2E5_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDDF2_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE758_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCDD5_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE90D_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDB71_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE19B_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE4B8_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE44B_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD825_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCCEA_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD47C_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD065_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD844_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE8EE_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD5B4_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD44D_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD566_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE7B6_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCFB9_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDE20_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCC9C_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD120_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD8A2_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE5D1_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE43B_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE46A_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD49B_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE610_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE42B_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDE30_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDDD2_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE341_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDB61_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDCE8_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD0A3_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE351_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE748_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE14D_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD8C1_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE45A_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD20B_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE8BF_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDA58_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCE03_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCCFA_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Windows\Addins\att.dll (18829 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD75A_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE4C8_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD5A5_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE881_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD382_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD343_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD835_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD9BB_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDDE2_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCE13_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE63F_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE739_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD6FC_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE8A0_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD816_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD595_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Caches\Files\usd.dll (7933 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE1CA_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE1AB_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE91D_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE2C4_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDA29_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCE32_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD3EF_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD9DB_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCFD8_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE5E1_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE767_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCD19_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmpA.tmp (48916 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDA19_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD602_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCCBB_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDC5B_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD026_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD8B2_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDA48_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDE11_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CE61F_Rar\WdExt.exe (26244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CCF1D_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDB23_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CDA67_Rar\WdExt.exe (13122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000CD70C_Rar\WdExt.exe (13122 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "360Install" = ""
   
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Windows Defender Extension" = "%Documents and Settings%\%current user%\Application Data\Microsoft\Defender\launch.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: 360.cn
Product Name: 360Inst.exe
Product Version: 2.2.0.1004
Legal Copyright: Copyright (C) 360.cn Inc.All Rights Reserve
Legal Trademarks: 360????
Original Filename:
Internal Name:
File Version: 2.2.0.1004
File Description: 360??????????
Comments:
Language: English

Company Name: 360.cnProduct Name: 360Inst.exeProduct Version: 2.2.0.1004Legal Copyright: Copyright (C) 360.cn Inc.All Rights ReserveLegal Trademarks: 360????Original Filename: Internal Name: File Version: 2.2.0.1004File Description: 360??????????Comments: Language: English

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	2108	2560	3.76997	6dbb11cce72cc16b887018dd4c34d252
.rdata	8192	1478	1536	3.36814	838666d924e8b6e9dfc84f930bd16733
.data	12288	172032	512	0.377955	7d6dcdf3bcb22dca4957ddb77c1c8cbf
.rsrc	184320	17024	17408	4.06525	af359578aa0a098ebcfcabe66586539a

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://softm-b.update.360safe.com/360safe/safe_home.cab?value=27832
hxxp://pinst.360.cn/360safe/safe_home.cab?value=27832	106.120.168.93
windowsupdate.microsoft.com	65.55.50.189
tr.p.360.cn	106.120.169.158
st.p.360.cn	218.30.118.91

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /360safe/safe_home.cab?value=27832 HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)

Host: pinst.360.cn

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.8

Date: Sun, 29 May 2016 03:42:32 GMT

Content-Type: application/octet-stream

Content-Length: 24698

Last-Modified: Fri, 01 Apr 2016 08:17:31 GMT

Connection: close

Accept-Ranges: bytes

MSCF....z`......,...........................b"........\DY. .IELog.jpg.8...b"....\DY. .safe_icon.bmp..!...%....\DY. .safe_logo.jpg."....F....\DY. .safe_title.JPG......\.....HmR .setup.ini.i.Z8._.rCK...T.K.088. .....lp.....A..lp'.'...B.,....w....%..@.}.......{...'...U.U.....S..L.,..$.!..........v..x .bj..@. ......$[Kgg{~..;'fc3.....j..nl........q.76..;...- vB..5....3!J-..V.{..."...V.TT7..6.3...&.t.w....;......9...Q.2....a.J.[.gk!JQ.....29...&.bfe2e.f%.fcf.................3...s......n.......U.%.....Q.V.........h............`r..s6vg.s....8....b........&P.g!J.?T..WP.......-...N..`......a.fQ.;A].M.0t..,..I..0i...!.M1.........e..(a3.f.3~QNQ.v.7.$.#!...&......)!...*.......E...q.r...H.`...b|....b.b....\\.....99...........?.......PGu(....P..:C.,... 5.r-.......9...;B\.f..P[.[..C......w.f.g,......\..!....?........`...v0nv.......a...f...@EFFFAFEAA....`....c........{................G...Sb.?......},"\\.'......O.M#..: .P...........M .&........."2.*..........X...... .p...Q..Q...>.. S.=D..CU1.tx.......W4.j....E..G.8..M.)N.R..$A...............v.....!2.....1%;>..jr.........>.L..H..".<.@.C.)..`..Z......i_.0y......%..'.t..8....X*..b..'.v.klaZ...Q..`.....o......A.=.'...fb{|k...A..A..:.H.*......o.1.s|..$.......e3.Ie...FPH3A....(.....1[v5d......q.M..0H.%......S.12#..g4p2F..H"}..Th........B...8..5k....W.y..3...&7j..../...2"...,."O.PV@A.{A,f..N9L..._...&.`^2....t..F-.......[.f.3..(.c.PL.Y1.`..}..F.T..............o..<.....qH;..n.......%$.r....e.D..YNG...)..|.....v1.&..&6.......'...2|v..0.8.....f..b.i...R.U..IG<1.A.6...&

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

360Inst_62.exe_644:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

SRPQSSh

SRPQSSh

1.2.3

1.2.3

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

DES part of OpenSSL 0.9.7c 30 Sep 2003

DES part of OpenSSL 0.9.7c 30 Sep 2003

libdes part of OpenSSL 0.9.7c 30 Sep 2003

libdes part of OpenSSL 0.9.7c 30 Sep 2003

MD5 part of OpenSSL 0.9.7c 30 Sep 2003

MD5 part of OpenSSL 0.9.7c 30 Sep 2003

MD4 part of OpenSSL 0.9.7c 30 Sep 2003

MD4 part of OpenSSL 0.9.7c 30 Sep 2003

SHLWAPI.dll

SHLWAPI.dll

VERSION.dll

VERSION.dll

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

RegCloseKey

RegCloseKey

RegDeleteKeyW

RegDeleteKeyW

RegOpenKeyExW

RegOpenKeyExW

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteW

ShellExecuteW

ShellExecuteExW

ShellExecuteExW

SHELL32.dll

SHELL32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

COMCTL32.dll

COMCTL32.dll

MSIMG32.dll

MSIMG32.dll

MSVCP60.dll

MSVCP60.dll

WS2_32.dll

WS2_32.dll

SETUPAPI.dll

SETUPAPI.dll

HttpQueryInfoW

HttpQueryInfoW

InternetOpenUrlW

InternetOpenUrlW

InternetCanonicalizeUrlA

InternetCanonicalizeUrlA

InternetCrackUrlA

InternetCrackUrlA

WININET.dll

WININET.dll

MSVCRT.dll

MSVCRT.dll

_wcmdln

_wcmdln

PSAPI.DLL

PSAPI.DLL

iphlpapi.dll

iphlpapi.dll

Secur32.dll

Secur32.dll

WinHttpGetIEProxyConfigForCurrentUser

WinHttpGetIEProxyConfigForCurrentUser

WINHTTP.dll

WINHTTP.dll

GetProcessHeap

GetProcessHeap

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExW

SetWindowsHookExW

.?AV?$CDialogImpl@VCCancelMsgBox@@VCWindow@ATL@@@ATL@@

.?AV?$CDialogImpl@VCCancelMsgBox@@VCWindow@ATL@@@ATL@@

.?AVCCancelMsgBox@@

.?AVCCancelMsgBox@@

.?AVCHttpDownload@@

.?AVCHttpDownload@@

HttpGetLastError

HttpGetLastError

HttpGetReceivedLength

HttpGetReceivedLength

HttpGetContentLength

HttpGetContentLength

HttpGetConnectState

HttpGetConnectState

HttpGetState

HttpGetState

HttpResetAll

HttpResetAll

HttpWait

HttpWait

HttpCancel

HttpCancel

HttpDownload

HttpDownload

HttpInitDownPara

HttpInitDownPara

HttpDeleteDownloadObj

HttpDeleteDownloadObj

HttpCreateDownloadObj

HttpCreateDownloadObj

ag.p.360.cn

ag.p.360.cn

tr.p.360.cn

tr.p.360.cn

221.194.134.221

221.194.134.221

220.181.126.81

220.181.126.81

error %d

error %d

124.238.243.54

124.238.243.54

,

,

[%s] %s

[%s] %s

%u/%u-%u/%u-%u/%u-%u/%u-%d%%>,

%u/%u-%u/%u-%u/%u-%u/%u-%d%%>,

function shExpMatch(host, domain) {var c = domain.charAt(0); if(c == "\*") {var str = host.charAt(0) domain; var exp1 = new RegExp(str); return host.match(exp1);} else {var exp2 = new RegExp(domain); return host.match(exp2);} }

function shExpMatch(host, domain) {var c = domain.charAt(0); if(c == "\*") {var str = host.charAt(0) domain; var exp1 = new RegExp(str); return host.match(exp1);} else {var exp2 = new RegExp(domain); return host.match(exp2);} }

function dnsDomainLevels(host) {var idx = host.indexOf(".");if(idx == -1) return 0; var substr = host.substring(idx 1); return 1 dnsDomainLevels(substr);}

function dnsDomainLevels(host) {var idx = host.indexOf(".");if(idx == -1) return 0; var substr = host.substring(idx 1); return 1 dnsDomainLevels(substr);}

function myIpAddress() { return "127.0.0.1"; }

function myIpAddress() { return "127.0.0.1"; }

function dnsResolve(host) { return "127.0.0.1"; }

function dnsResolve(host) { return "127.0.0.1"; }

function localHostOrDomainIs(host, hostdom) {if(hostdom.match(host)) return true; else return false; }

function localHostOrDomainIs(host, hostdom) {if(hostdom.match(host)) return true; else return false; }

function dnsDomainIs(host, domain) {if(host.match(domain)) return true; else return false; }

function dnsDomainIs(host, domain) {if(host.match(domain)) return true; else return false; }

function isPlainHostName(host) {if(host.match(".")) return false; else return true; }

function isPlainHostName(host) {if(host.match(".")) return false; else return true; }

%sX

%sX

360Pd2I64X

360Pd2I64X

360Pd%s

360Pd%s

%s-%s

%s-%s

HTTP/1.0 200 OK

HTTP/1.0 200 OK

%s%s%s

%s%s%s

GET /index.html HTTP/1.0

GET /index.html HTTP/1.0

127.0.0.1

127.0.0.1

TCP Port

TCP Port

st.p.360.cn

st.p.360.cn

stun01.sipphone.com

stun01.sipphone.com

%s%s-%s

%s%s-%s

Referer: %s

Referer: %s

Content-Length: %d

Content-Length: %d

Content-Type: multipart/form-data; boundary=%s

Content-Type: multipart/form-data; boundary=%s

Host: %s

Host: %s

User-Agent: Mozilla/4.0(compatible;MSIE 5.00;Windows 98)

User-Agent: Mozilla/4.0(compatible;MSIE 5.00;Windows 98)

User-Agent: %s

User-Agent: %s

%s %s HTTP/1.1

%s %s HTTP/1.1

ku6.com

ku6.com

fastweb

fastweb

Content-Disposition: form-data; name="%s"

Content-Disposition: form-data; name="%s"

(3-!0,1'8"5.*2$

(3-!0,1'8"5.*2$

Corrupted file or wrong key

Corrupted file or wrong key

M-SEARCH * HTTP/1.1

M-SEARCH * HTTP/1.1

HOST: 239.255.255.250:1900

HOST: 239.255.255.250:1900

controlURL

controlURL

hXXp://

hXXp://

URLBase

URLBase

HTTP/1.1

HTTP/1.1

s:encodingStyle="hXXp://schemas.xmlsoap.org/soap/encoding/">

s:encodingStyle="hXXp://schemas.xmlsoap.org/soap/encoding/">

xmlns:s="hXXp://schemas.xmlsoap.org/soap/envelope/"

xmlns:s="hXXp://schemas.xmlsoap.org/soap/envelope/"

AddPortMapping

AddPortMapping

NewPortMappingDescription

NewPortMappingDescription

NewInternalPort

NewInternalPort

NewExternalPort

NewExternalPort

DeletePortMapping

DeletePortMapping

External NAT port in use

External NAT port in use

External NAT port in use: Too many retries

External NAT port in use: Too many retries

Error getting StaticPortMappingCollection

Error getting StaticPortMappingCollection

Port mapping not owned by this class

Port mapping not owned by this class

RemoveNatPortMapping

RemoveNatPortMapping

%s:%d-ID(%s)-NAT(%d)-VER(%d)-STAT(%d)-FULL(%d%%)-DNVOL(%u)-UPVOL(%u),

%s:%d-ID(%s)-NAT(%d)-VER(%d)-STAT(%d)-FULL(%d%%)-DNVOL(%u)-UPVOL(%u),

Cid[%u] %s

Cid[%u] %s

HOST%d(%s)-PRI(%d)-ZONE(%d)-VOL(%u)-CNT(%d),

HOST%d(%s)-PRI(%d)-ZONE(%d)-VOL(%u)-CNT(%d),

%s:%d-HOST(%s)-VOL(%u)-OK(%d)-ERR(%d),

%s:%d-HOST(%s)-VOL(%u)-OK(%d)-ERR(%d),

HTTP/

HTTP/

%s %s

%s %s

0|2008-10-08|15:04:02|QHErrObj.cpp|1||MEM|1|

0|2008-10-08|15:04:02|QHErrObj.cpp|1||MEM|1|

version="1.0.0.0"

version="1.0.0.0"

360Inst.exe

360Inst.exe

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

@ /URL:

@ /URL:

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HttpDownLib

HttpDownLib

%s360net.dll

%s360net.dll

%s\%s

%s\%s

%s\*.*

%s\*.*

Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.

Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.

?value=%d

?value=%d

kernel32.dll

kernel32.dll

%d.%d.%d.%d

%d.%d.%d.%d

%s.exe

%s.exe

@PDown://b7=1|b2=%d|p2=%s|p3=%d|p4=%d|%s|h1=%s|h3=%d|b9=%d

@PDown://b7=1|b2=%d|p2=%s|p3=%d|p4=%d|%s|h1=%s|h3=%d|b9=%d

PDown://b7=1|b2=%d|p3=%d|p4=%d|%s|h1=%s|h3=%d|b9=%d

PDown://b7=1|b2=%d|p3=%d|p4=%d|%s|h1=%s|h3=%d|b9=%d

mod=Installer&ver=%s&t_pidpro=%s_%s

mod=Installer&ver=%s&t_pidpro=%s_%s

%s /S /D=%s

%s /S /D=%s

%s /D=%s

%s /D=%s

1.2.0.1004

1.2.0.1004

hXXp://pdown.stat.360safe.com/dimana.htm

hXXp://pdown.stat.360safe.com/dimana.htm

@ddrawex.dll

@ddrawex.dll

ddraw.dll

ddraw.dll

d3d9.dll

d3d9.dll

d3d8thk.dll

d3d8thk.dll

d3d8.dll

d3d8.dll

@,%s,

@,%s,

MainWindowSize

MainWindowSize

Description%d

Description%d

Urls

Urls

HTTPTimeup

HTTPTimeup

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_CURRENT_USER

HKEY_PERFORMANCE_DATA

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_USERS

pdown://p2=%s|b5=%s|b6=%s|p4=%d;%s;%s;%u;

pdown://p2=%s|b5=%s|b6=%s|p4=%d;%s;%s;%u;

%sNUList.ini

%sNUList.ini

HNetCfg.FwAuthorizedApplication

HNetCfg.FwAuthorizedApplication

HNetCfg.FwMgr

HNetCfg.FwMgr

[Login] ---------- end ----------

[Login] ---------- end ----------

[Login] ---------- start ----------

[Login] ---------- start ----------

----------[CreateP2SPTask] ID:%d, pdonw:%s, file:%s----------

----------[CreateP2SPTask] ID:%d, pdonw:%s, file:%s----------

----------[StartTask] ID:%d----------

----------[StartTask] ID:%d----------

----------[StopTask] ID:%d----------

----------[StopTask] ID:%d----------

----------[GetFinishMessage] ID:%d----------

----------[GetFinishMessage] ID:%d----------

[DiskScheduler] type:%d, taskid:%d, cost:%dms, msg:%d.

[DiskScheduler] type:%d, taskid:%d, cost:%dms, msg:%d.

[DiskFile] set file valid data failed file:%s %d

[DiskFile] set file valid data failed file:%s %d

[CDiskFile::RenameFile] MoveFile fail, error code is %d

[CDiskFile::RenameFile] MoveFile fail, error code is %d

[CDiskFile::RenameFile] file(%s) already exist

[CDiskFile::RenameFile] file(%s) already exist

%s.%u

%s.%u

[__check_piece_hash] id:%d, piece:%d

[__check_piece_hash] id:%d, piece:%d

[CDiskFile::__write_disk] WriteFile fail, error code is %d

[CDiskFile::__write_disk] WriteFile fail, error code is %d

[CDiskFile::__write_disk] SetFilePointer fail, error code is %d

[CDiskFile::__write_disk] SetFilePointer fail, error code is %d

[CDiskFile::__read_disk] ReadFile fail, error code is %d

[CDiskFile::__read_disk] ReadFile fail, error code is %d

[CDiskFile::__read_disk] SetFilePointer fail, error code is %d

[CDiskFile::__read_disk] SetFilePointer fail, error code is %d

[CDiskFile::__open_file] create file(%s) fail! error code is %d

[CDiskFile::__open_file] create file(%s) fail! error code is %d

Kernel32.dll

Kernel32.dll

n[Use Tcp Proxy]:Tcp %s, %d

n[Use Tcp Proxy]:Tcp %s, %d

[change tracker ip]: udp: %s ,tcpproxy:%s %d

[change tracker ip]: udp: %s ,tcpproxy:%s %d

Drop result %s:%d

Drop result %s:%d

Receive result %s:%d %I64u flag %d

Receive result %s:%d %I64u flag %d

Registering %s:%d %I64u

Registering %s:%d %I64u

tracker Udp dns resolve: %s:%d

tracker Udp dns resolve: %s:%d

[Use Udp Server]

[Use Udp Server]

login server , public ip %s:%d private ip %s:%d peerid: %s

login server , public ip %s:%d private ip %s:%d peerid: %s

ReDirect Server ,Relogin

ReDirect Server ,Relogin

PeerId Exist, ReLogin

PeerId Exist, ReLogin

share: taskid %d hash %s result %d

share: taskid %d hash %s result %d

GetPeer: taskid %d hash %s result %d

GetPeer: taskid %d hash %s result %d

[TaskScheduler] type:%d, taskid:%d, cost:%dms, msg:%d.

[TaskScheduler] type:%d, taskid:%d, cost:%dms, msg:%d.

360P2SP.dll

360P2SP.dll

\LiveUpdateLog\P2SP.log

\LiveUpdateLog\P2SP.log

PolicyControl%d

PolicyControl%d

[CTaskMgr] DNS proxy: %s

[CTaskMgr] DNS proxy: %s

\livep.dat

\livep.dat

[CTaskMgr::__update_config] update livep.dat

[CTaskMgr::__update_config] update livep.dat

[CTaskMgr::__check_load] traffic control stop! load:%d disk:%d , taskmgr:%d

[CTaskMgr::__check_load] traffic control stop! load:%d disk:%d , taskmgr:%d

[CTaskMgr::__check_load] traffic control start! load:%d disk:%d , taskmgr:%d

[CTaskMgr::__check_load] traffic control start! load:%d disk:%d , taskmgr:%d

[CTaskMgr::__CreateTask] Init task fail. Id:%d, Pdown:%s, File:%s

[CTaskMgr::__CreateTask] Init task fail. Id:%d, Pdown:%s, File:%s

[CTaskMgr::__sendmsg_knl] type:%d, taskid:%d, cost:%dms, msg:%d.

[CTaskMgr::__sendmsg_knl] type:%d, taskid:%d, cost:%dms, msg:%d.

[CTaskMgr::__sendmsg_knl] send fail! current load: %d

[CTaskMgr::__sendmsg_knl] send fail! current load: %d

sd-d-d d:d:d:=[%s]-->%s

sd-d-d d:d:d:=[%s]-->%s

>hXXp://pstat.p.360.cn/uplog.php

>hXXp://pstat.p.360.cn/uplog.php

pstat.p.360.cn

pstat.p.360.cn

%s\LiveUpdateLog\track-dddddd.d.log

%s\LiveUpdateLog\track-dddddd.d.log

FindProxyForURL

FindProxyForURL

[P2SP_FindProxyForURL]

[P2SP_FindProxyForURL]

. Result: %s.

. Result: %s.

. URL: %s, Host: %s.

. URL: %s, Host: %s.

[CProxyMgr::GetProxyAddrW] P2SP_FindProxyForURL fail

[CProxyMgr::GetProxyAddrW] P2SP_FindProxyForURL fail

%s_%d

%s_%d

[NotifyWinPop] %d , %s ,%s ,%s

[NotifyWinPop] %d , %s ,%s ,%s

%s;%d;%s;%s

%s;%d;%s;%s

customhttp

customhttp

%s;%d;%s;%s;%d

%s;%d;%s;%s;%d

HTTP Proxy Authorization

HTTP Proxy Authorization

http=

http=

hXXp://wpad.%s/wpad.dat

hXXp://wpad.%s/wpad.dat

hXXp://%s/wpad.dat

hXXp://%s/wpad.dat

HTTPMINPIECE

HTTPMINPIECE

MAXHTTPCONN

MAXHTTPCONN

MAXCONNMSG

MAXCONNMSG

HTTPTIMEOUT

HTTPTIMEOUT

%u.%u.%u.%u

%u.%u.%u.%u

KICKHTTP

KICKHTTP

MSGQUEUE

MSGQUEUE

HTTPDATA

HTTPDATA

HTTPHDR

HTTPHDR

HTTPCONN

HTTPCONN

[UdpListing] Port :%d

[UdpListing] Port :%d

[UdpListing] Err: %d

[UdpListing] Err: %d

[TcpListing] Nattype =%d , Port = %d

[TcpListing] Nattype =%d , Port = %d

[TcpListing] Err: %d

[TcpListing] Err: %d

[UPnp] is Open :NatType:%d, port: %d

[UPnp] is Open :NatType:%d, port: %d

StunRecv:Type %d Count:%d

StunRecv:Type %d Count:%d

mStunt Dns resolve: %s:%d

mStunt Dns resolve: %s:%d

Net Type StunTypePortRestrictedNat

Net Type StunTypePortRestrictedNat

Nat Test again,Relogin %d

Nat Test again,Relogin %d

Begin Login

Begin Login

tudp %6s

tudp %6s

tudp %6s flag:%d seq: ack: len M

tudp %6s flag:%d seq: ack: len M

passive

passive

tudp send action:%6s

tudp send action:%6s

tudp send action:%s

tudp send action:%s

tudp action:%6s ini ack:%d ack:%d

tudp action:%6s ini ack:%d ack:%d

tracker rsp not login

tracker rsp not login

Disconnect from %s:%d , reason %d , api_reason %d

Disconnect from %s:%d , reason %d , api_reason %d

[=]connect to %s:%d

[=]connect to %s:%d

[=]Requesting Meta %s:%d

[=]Requesting Meta %s:%d

[=]Send request index %d begin %d lenth %d

[=]Send request index %d begin %d lenth %d

[=]connected from %s:%d

[=]connected from %s:%d

[=]Handshake with %s:%d %d

[=]Handshake with %s:%d %d

[=]recv bitfield s:%d, %d bytes

[=]recv bitfield s:%d, %d bytes

[=]recv meta req s:%d, %s

[=]recv meta req s:%d, %s

[=]recv Meta File from %s :%d , %d

[=]recv Meta File from %s :%d , %d

[=]recv have %s :%d , %d

[=]recv have %s :%d , %d

[=]recv piece request %s :%d , index %d begin %d length %d

[=]recv piece request %s :%d , index %d begin %d length %d

[=]recv piece data %s :%d , index %d begin %d length %d

[=]recv piece data %s :%d , index %d begin %d length %d

[=]recv cancel %s :%d , index %d begin %d length %d

[=]recv cancel %s :%d , index %d begin %d length %d

[=]recv interest %s :%d

[=]recv interest %s :%d

[=]recv unchoke %s :%d

[=]recv unchoke %s :%d

[=]Disconnect s:%d, status %d , Reason %d , api %d

[=]Disconnect s:%d, status %d , Reason %d , api %d

>

>

>

>

TaskID = %u FileName=%s ErrorCode= %d

TaskID = %u FileName=%s ErrorCode= %d

TaskID = %u ErrorCode = %d

TaskID = %u ErrorCode = %d

TaskID = %u ErrorCode = %d PDownURL = %s

TaskID = %u ErrorCode = %d PDownURL = %s

TaskID = %u URL = %s File=%s

TaskID = %u URL = %s File=%s

TaskID = %u Start

TaskID = %u Start

TaskID = %u File = %s

TaskID = %u File = %s

TaskID = %u FileName = %s

TaskID = %u FileName = %s

TaskID = %u Pause

TaskID = %u Pause

TaskID = %u StopSeed

TaskID = %u StopSeed

TaskID = %u Stop

TaskID = %u Stop

,IP|%u,ER|%u

,IP|%u,ER|%u

TaskID|%u,ErrorCode|%d,LineNo|%d,DnCount|%d,HttpNum|%d,DnFailCount|%d,FStatus|%d,IsTorrent|%d,Peers|%d,Seeds|%d,P2SS|%I64d,P2PS|%I64d,PDMode|%d,Dup|%I64d,P2SDUP|%I64d,P2PDUP|%I64d,P2PTS|%I64d,P2PUS|%I64d,P2PTDS|%I64d,P2PUDS|%I64d,Proxy|%d,DNSTime|%u,ConTime|%u,HeadTime|%u,DataTime|%u,61Err|%d,60Err|%d,54Err|%d,53Err|%d,DNS|%u,416Code|%u,502Code|%u,503Code|%u,ElsNum|%u,Nat|%d,HttpMgrFail|%d

TaskID|%u,ErrorCode|%d,LineNo|%d,DnCount|%d,HttpNum|%d,DnFailCount|%d,FStatus|%d,IsTorrent|%d,Peers|%d,Seeds|%d,P2SS|%I64d,P2PS|%I64d,PDMode|%d,Dup|%I64d,P2SDUP|%I64d,P2PDUP|%I64d,P2PTS|%I64d,P2PUS|%I64d,P2PTDS|%I64d,P2PUDS|%I64d,Proxy|%d,DNSTime|%u,ConTime|%u,HeadTime|%u,DataTime|%u,61Err|%d,60Err|%d,54Err|%d,53Err|%d,DNS|%u,416Code|%u,502Code|%u,503Code|%u,ElsNum|%u,Nat|%d,HttpMgrFail|%d

Cid = %u TaskID = %u PieceMgr InitCid Ok

Cid = %u TaskID = %u PieceMgr InitCid Ok

Cid = %u TaskID = %u PieceMgr InitCid fail

Cid = %u TaskID = %u PieceMgr InitCid fail

Cid = %u TaskID = %u GetHttpStatInfo fail

Cid = %u TaskID = %u GetHttpStatInfo fail

Cid = %u TaskID = %u HttpConnnect fail

Cid = %u TaskID = %u HttpConnnect fail

Cid = %u TaskID = %u m_nFinishStatus not working Delete

Cid = %u TaskID = %u m_nFinishStatus not working Delete

Cid = %u TaskID = %u SetFileLen %I64d

Cid = %u TaskID = %u SetFileLen %I64d

Cid = %u TaskID = %u Httpcode = %u Delete

Cid = %u TaskID = %u Httpcode = %u Delete

Cid = %u TaskID = %u IsContinueDownload fail Delete

Cid = %u TaskID = %u IsContinueDownload fail Delete

Cid = %u TaskID = %u WriteRange fail ErrorCode = %u, Delete

Cid = %u TaskID = %u WriteRange fail ErrorCode = %u, Delete

Cid = %u TaskID = %u

Cid = %u TaskID = %u

Cid = %u TaskID = %u OnNotifyHttpData fail Delete

Cid = %u TaskID = %u OnNotifyHttpData fail Delete

Cid = %u TaskID = %u IsContinueDownload fail Delete

Cid = %u TaskID = %u IsContinueDownload fail Delete

Cid = %u TaskID = %u Delete Reason = %u HttpCode = %d

Cid = %u TaskID = %u Delete Reason = %u HttpCode = %d

TaskID = %u Cid = %u

TaskID = %u Cid = %u

TaskID = %u Cid = %u ErrorCode = %d

TaskID = %u Cid = %u ErrorCode = %d

Cid = %u TaskID = %u Delete Reason = %u

Cid = %u TaskID = %u Delete Reason = %u

Cid = %u TaskID = %u OnNotifyHttpRelease Delete

Cid = %u TaskID = %u OnNotifyHttpRelease Delete

%u-%s

%u-%s

TaskID = %u ErrorCode = %u

TaskID = %u ErrorCode = %u

TaskID = %u Index = %u ErrorCode = %d

TaskID = %u Index = %u ErrorCode = %d

[P2SPLOG] Taskid:%d, Filelen:%I64d(Byte), Time:%d(ms), Avgrate:%d(KBps), P2S:%I64d(%d%%), P2P:%I64d(%d%%) Dup %I64u, P2S Dup %I64u, P2P Dup %I64u, MaxConNum:%d

[P2SPLOG] Taskid:%d, Filelen:%I64d(Byte), Time:%d(ms), Avgrate:%d(KBps), P2S:%I64d(%d%%), P2P:%I64d(%d%%) Dup %I64u, P2S Dup %I64u, P2P Dup %I64u, MaxConNum:%d

Cid = %u TaskID = %u WriteSlice fail, Delete

Cid = %u TaskID = %u WriteSlice fail, Delete

Cid = %u TaskID = %u Delete

Cid = %u TaskID = %u Delete

Cid = %u TaskID = %u Read FilePos Error Offset= %I64d FileLen = %I64d

Cid = %u TaskID = %u Read FilePos Error Offset= %I64d FileLen = %I64d

Cid = %u TaskID = %u DataReq Index Error Index = %d MaxIndex = %d

Cid = %u TaskID = %u DataReq Index Error Index = %d MaxIndex = %d

TaskID = %u Load TorrentData fail ErrorCode = %d

TaskID = %u Load TorrentData fail ErrorCode = %d

ERR(%u)-Cid(%u)

ERR(%u)-Cid(%u)

Cid = %u TaskID = %u AsyncStartHttp fail ErrorCode = %d

Cid = %u TaskID = %u AsyncStartHttp fail ErrorCode = %d

Cid = %u TaskID = %u AllocRange fail

Cid = %u TaskID = %u AllocRange fail

TaskID = %u SetFileLen %I64d

TaskID = %u SetFileLen %I64d

TaskID = %u Delay = %d

TaskID = %u Delay = %d

Cid = %u TaskID = %u SendRequest fail ErrorCode = %d

Cid = %u TaskID = %u SendRequest fail ErrorCode = %d

Cid = %u TaskID = %u AllocSlice fail

Cid = %u TaskID = %u AllocSlice fail

TaskID = %u Downlaod fail ErrorCode = %d

TaskID = %u Downlaod fail ErrorCode = %d

TaskID = %u httpMrg Downlaod fail ErrorCode = %d

TaskID = %u httpMrg Downlaod fail ErrorCode = %d

TaskID = %u Downlaod fail ErrorCode = %d

TaskID = %u Downlaod fail ErrorCode = %d

Cid = %u TaskID = %u Torrent Http Start

Cid = %u TaskID = %u Torrent Http Start

TaskID = %u AsyncConnect fail

TaskID = %u AsyncConnect fail

TaskID = %u http init fail

TaskID = %u http init fail

TaskID = %u SetProxy fail

TaskID = %u SetProxy fail

%s:%d-PType(%u)-AType(%u)

%s:%d-PType(%u)-AType(%u)

sd.p.360.cn

sd.p.360.cn

hXXp://sd.p.360.cn/%s.trt

hXXp://sd.p.360.cn/%s.trt

Cid = %u TaskID = %u Torrent Delete

Cid = %u TaskID = %u Torrent Delete

TaskID = %u Download Torret fail

TaskID = %u Download Torret fail

TaskID = %u Cid = %u Dataoffset is bigger than filelen

TaskID = %u Cid = %u Dataoffset is bigger than filelen

TaskID = %u Cid = %u TorrentBuffer is NULL

TaskID = %u Cid = %u TorrentBuffer is NULL

TaskID = %u Cid = %u NOT INIT

TaskID = %u Cid = %u NOT INIT

TaskID = %u Cid = %u Proxy Auth fail

TaskID = %u Cid = %u Proxy Auth fail

TaskID = %u Cid = %u Auth type unknown

TaskID = %u Cid = %u Auth type unknown

Cid = %u TaskID = %u Error = %u

Cid = %u TaskID = %u Error = %u

Cid = %u TaskID = %u OnNotifyTorrentRelease

Cid = %u TaskID = %u OnNotifyTorrentRelease

TaskID = %u Rename start

TaskID = %u Rename start

TaskID = %u CheckFile Start

TaskID = %u CheckFile Start

TaskID = %u change Auth type = %d

TaskID = %u change Auth type = %d

ID(%u)-TYPE(http)-IP(%s)-PORT(%d)

ID(%u)-TYPE(http)-IP(%s)-PORT(%d)

ID(%u)-Host(%s)-IP(%s)-INFO(%s/%s)-TYPE(http)-REASON(%s)-ERRCODE(%u)-ERRPARA(%u)-REDIRECT(%d)-PROXY(%u)-AUTH(%u)-Begin(%I64d)-End(%I64d)-Vol(%I64d)-Rate(%u)-ConnMs(%d)-GetMs(%d)

ID(%u)-Host(%s)-IP(%s)-INFO(%s/%s)-TYPE(http)-REASON(%s)-ERRCODE(%u)-ERRPARA(%u)-REDIRECT(%d)-PROXY(%u)-AUTH(%u)-Begin(%I64d)-End(%I64d)-Vol(%I64d)-Rate(%u)-ConnMs(%d)-GetMs(%d)

%s-Timeout(%d)-Quota(%d)

%s-Timeout(%d)-Quota(%d)

HttpDup

HttpDup

HttpData

HttpData

CID[=] %s(%s) disconnected, reason %d, api %d, state %d, downloaded %I64d, %d ms

CID[=] %s(%s) disconnected, reason %d, api %d, state %d, downloaded %I64d, %d ms

CID[=] %s(%s) closed, error code %d, api %d, state %d, downloaded %I64d, %d ms

CID[=] %s(%s) closed, error code %d, api %d, state %d, downloaded %I64d, %d ms

CID[=] %s(%s) connect ok,cost %d ms

CID[=] %s(%s) connect ok,cost %d ms

CID[=] %s(%s) connect failed, %d

CID[=] %s(%s) connect failed, %d

CID[=] %s(%s) Receive Header Completed , %d bytes , status code:%d , Content-Length : %I64d

CID[=] %s(%s) Receive Header Completed , %d bytes , status code:%d , Content-Length : %I64d

CID[=] %s(%s) Connecting to %s:%d pending %d ms

CID[=] %s(%s) Connecting to %s:%d pending %d ms

CID[=] %s(%s) Connecting to %s:%d failed, error code:%d %d ms

CID[=] %s(%s) Connecting to %s:%d failed, error code:%d %d ms

DNS Result :%s

DNS Result :%s

DNS Error %d

DNS Error %d

CID[=] Connecting to %s:%d

CID[=] Connecting to %s:%d

CID[=] %s(%s) Connecting to %s:%d

CID[=] %s(%s) Connecting to %s:%d

============addportmap success

============addportmap success

HTTP://

HTTP://

TaskID = %u exception raised in method CFileMgr::Read, read from file fail(call ReadFile), error code is %d

TaskID = %u exception raised in method CFileMgr::Read, read from file fail(call ReadFile), error code is %d

TaskID = %u exception raised in method CFileMgr::GetSize, file size is too huge

TaskID = %u exception raised in method CFileMgr::GetSize, file size is too huge

TaskID = %u exception raised in method CFileMgr::GetSize, get file size fail(call GetFileSize), error code is %d

TaskID = %u exception raised in method CFileMgr::GetSize, get file size fail(call GetFileSize), error code is %d

TaskID = %u exception raised in method CFileMgr::LoadMemFile, open file fail, error code is %d

TaskID = %u exception raised in method CFileMgr::LoadMemFile, open file fail, error code is %d

TaskID = %u exception raised in method CFileMgr::LoadMemFile, parameter nNumber must greater than zero

TaskID = %u exception raised in method CFileMgr::LoadMemFile, parameter nNumber must greater than zero

TaskID = %u exception raised in method CFileMgr::LoadMemFile, parameter pBuffer can not be NULL

TaskID = %u exception raised in method CFileMgr::LoadMemFile, parameter pBuffer can not be NULL

TaskID = %u exception raised in method CFileMgr::SetMemFile, read from file fail(call WriteFile), error code is %d

TaskID = %u exception raised in method CFileMgr::SetMemFile, read from file fail(call WriteFile), error code is %d

TaskID = %u exception raised in method CFileMgr::SetMemFile, open file fail, error code is %d

TaskID = %u exception raised in method CFileMgr::SetMemFile, open file fail, error code is %d

TaskID = %u exception raised in method CFileMgr::SetMemFile, error code is %d

TaskID = %u exception raised in method CFileMgr::SetMemFile, error code is %d

TaskID = %u exception raised in method CFileMgr::SetMemFile, parameter nNumber must greater than zero

TaskID = %u exception raised in method CFileMgr::SetMemFile, parameter nNumber must greater than zero

TaskID = %u ,exception raised in method CFileMgr::SetMemFile, parameter pBuffer can not be NULL

TaskID = %u ,exception raised in method CFileMgr::SetMemFile, parameter pBuffer can not be NULL

TaskID = %u exception raised in method CFileMgr::GetMemSize, open file fail, error code is %d

TaskID = %u exception raised in method CFileMgr::GetMemSize, open file fail, error code is %d

TaskID = %u exception raised in method CFileMgr::LoadTorrentFile, parameter nNumber must greater than zero

TaskID = %u exception raised in method CFileMgr::LoadTorrentFile, parameter nNumber must greater than zero

TaskID = %u exception raised in method CFileMgr::LoadTorrentFile, parameter pBuffer can not be NULL

TaskID = %u exception raised in method CFileMgr::LoadTorrentFile, parameter pBuffer can not be NULL

TaskID = %u exception raised in method CFileMgr::SetMemFile, parameter pBuffer can not be NULL

TaskID = %u exception raised in method CFileMgr::SetMemFile, parameter pBuffer can not be NULL

TaskID = %u exception raised in method CFileMgr::GetTorrentSize, file size is too huge

TaskID = %u exception raised in method CFileMgr::GetTorrentSize, file size is too huge

TaskID = %u exception raised in method CFileMgr::GetTorrentSize, get file size fail(call GetFileSize), error code is %d

TaskID = %u exception raised in method CFileMgr::GetTorrentSize, get file size fail(call GetFileSize), error code is %d

TaskID = %u exception raised in method CFileMgr::GetTorrentSize, open file fail, error code is %d

TaskID = %u exception raised in method CFileMgr::GetTorrentSize, open file fail, error code is %d

IsFileExisting Error = %d

IsFileExisting Error = %d

[AllocRange] cid(%d) fail, errcode:0XX. length:%I64d, restore:%I64d, download:%I64d, errlen:%I64d, Pduplen:%I64d, Sduplen:%I64d

[AllocRange] cid(%d) fail, errcode:0XX. length:%I64d, restore:%I64d, download:%I64d, errlen:%I64d, Pduplen:%I64d, Sduplen:%I64d

[AllocRange] cid(%d) ok, from %I64d to %I64d. (%I64d) length:%I64d, restore:%I64d, download:%I64d, errlen:%I64d, Pduplen:%I64d, Sduplen:%I64d

[AllocRange] cid(%d) ok, from %I64d to %I64d. (%I64d) length:%I64d, restore:%I64d, download:%I64d, errlen:%I64d, Pduplen:%I64d, Sduplen:%I64d

[WriteRange] cid(%d) fail. from %I64d to %I64d, errcode:X. length:%I64d, restore:%I64d, download:%I64d, errlen:%I64d, Pduplen:%I64d, Sduplen:%I64d

[WriteRange] cid(%d) fail. from %I64d to %I64d, errcode:X. length:%I64d, restore:%I64d, download:%I64d, errlen:%I64d, Pduplen:%I64d, Sduplen:%I64d

[AllocSlice] cid(%d) fail, errcode:0XX. length:%I64d, restore:%I64d, download:%I64d, errlen:%I64d, Pduplen:%I64d, Sduplen:%I64d

[AllocSlice] cid(%d) fail, errcode:0XX. length:%I64d, restore:%I64d, download:%I64d, errlen:%I64d, Pduplen:%I64d, Sduplen:%I64d

[AllocSlice] cid(%d) ok, index(%d) from %d to %d. length:%I64d, restore:%I64d, download:%I64d, errlen:%I64d, Pduplen:%I64d, Sduplen:%I64d

[AllocSlice] cid(%d) ok, index(%d) from %d to %d. length:%I64d, restore:%I64d, download:%I64d, errlen:%I64d, Pduplen:%I64d, Sduplen:%I64d

[WriteSlice] cid(%d) fail. index(%d) from %d to %d, errcode:X. length:%I64d, restore:%I64d, download:%I64d, errlen:%I64d, Pduplen:%I64d, Sduplen:%I64d

[WriteSlice] cid(%d) fail. index(%d) from %d to %d, errcode:X. length:%I64d, restore:%I64d, download:%I64d, errlen:%I64d, Pduplen:%I64d, Sduplen:%I64d

[__LoadTorrent] invalid torrent file! errcode:x

[__LoadTorrent] invalid torrent file! errcode:x

ID(%u)-TYPE(p2p)-REASON(%s)-ERRCODE(%u)-Vol(%I64d)-Rate(%u)-ConnMs(%d)-BitMs(%d)

ID(%u)-TYPE(p2p)-REASON(%s)-ERRCODE(%u)-Vol(%I64d)-Rate(%u)-ConnMs(%d)-BitMs(%d)

ID(%u)-TYPE(p2p)-IP(%s)-PORT(%d)-NAT(%d)

ID(%u)-TYPE(p2p)-IP(%s)-PORT(%d)-NAT(%d)

TaskID = %u

TaskID = %u

TaskID = %u result = %d

TaskID = %u result = %d

RES(%d)-CNT(%d)

RES(%d)-CNT(%d)

ID(%u)-TYPE(http)-IP(0)-PORT(0)

ID(%u)-TYPE(http)-IP(0)-PORT(0)

Ip = %s

Ip = %s

Cid = %u TaskID = %u Rate = %u MaxRate = %u ,

Cid = %u TaskID = %u Rate = %u MaxRate = %u ,

Cid = %u TaskID = %u ConnectNum = %d

Cid = %u TaskID = %u ConnectNum = %d

Cid = %u TaskID = %u Ip = %s

Cid = %u TaskID = %u Ip = %s

TaskID = %u proxy=%d,Errcode = %u

TaskID = %u proxy=%d,Errcode = %u

TaskID = %u proxy=%d,Errcode = %u

TaskID = %u proxy=%d,Errcode = %u

TaskID = %u Errcode = %u

TaskID = %u Errcode = %u

TaskID = %u ErrorCode = %d,

TaskID = %u ErrorCode = %d,

TaskID = %u ErrorCode = %d ,

TaskID = %u ErrorCode = %d ,

Cid = %u TaskID = %u AsyncStartDownload from =%I64d to = %I64d HttpNum = %d

Cid = %u TaskID = %u AsyncStartDownload from =%I64d to = %I64d HttpNum = %d

TaskID = %u ErrorCode =%d,

TaskID = %u ErrorCode =%d,

Cid = %u TaskID = %u StopHttp

Cid = %u TaskID = %u StopHttp

Cid = %u TaskID = %u Http connect ok

Cid = %u TaskID = %u Http connect ok

OLDIP(%s)-OLDURL(%s)-NEWURL(%s)

OLDIP(%s)-OLDURL(%s)-NEWURL(%s)

Cid = %u TaskID = %u Recv Http Head Msg ,httpcode= %u

Cid = %u TaskID = %u Recv Http Head Msg ,httpcode= %u

Cid = %u TaskID = %u OnNotifyHttpData can not http

Cid = %u TaskID = %u OnNotifyHttpData can not http

TaskID = %u Cid = %u Proxy Fail Errcode = %u Ip = %s

TaskID = %u Cid = %u Proxy Fail Errcode = %u Ip = %s

TaskID = %u Cid = %u HttpErrcode = %u ip = %s

TaskID = %u Cid = %u HttpErrcode = %u ip = %s

TaskID = %u Cid = %u HttpCode = %u Ip = %s,

TaskID = %u Cid = %u HttpCode = %u Ip = %s,

TaskID = %u Cid = %u Fail Errcode = %u Ip = %s

TaskID = %u Cid = %u Fail Errcode = %u Ip = %s

TaskID = %u,Cid = %u change Auth type = %d

TaskID = %u,Cid = %u change Auth type = %d

Cid = %u TaskID = %u by DeleteHttp

Cid = %u TaskID = %u by DeleteHttp

Cid = %u TaskID = %u By DeleteConnect

Cid = %u TaskID = %u By DeleteConnect

Cid = %u TaskID = %u By DeleteAllHttp

Cid = %u TaskID = %u By DeleteAllHttp

Cid = %u TaskID = %u By DeleteAllConnect

Cid = %u TaskID = %u By DeleteAllConnect

ID(%u)-Host(%s)-IP(%s)-TYPE(http)-REASON(PRECONN)-ERRCODE(%u)-ERRPARA(%u)

ID(%u)-Host(%s)-IP(%s)-TYPE(http)-REASON(PRECONN)-ERRCODE(%u)-ERRPARA(%u)

%s->%s:%d-PType(%u)-AType(%u)

%s->%s:%d-PType(%u)-AType(%u)

Ip = %s Url

Ip = %s Url

Ip = %s url= %s

Ip = %s url= %s

Cid = %u TaskID = %u proxy fail

Cid = %u TaskID = %u proxy fail

Cid = %u TaskID = %u ProcHttpUnKnowncode ,HttpCode = %u

Cid = %u TaskID = %u ProcHttpUnKnowncode ,HttpCode = %u

Cid[%u] AuthType[%d:%d] ProxyHost[%s:%d]

Cid[%u] AuthType[%d:%d] ProxyHost[%s:%d]

Cid[%u] AuthType[%d] ProxyHost[%s:%d]

Cid[%u] AuthType[%d] ProxyHost[%s:%d]

TaskID = %u Cid = %u Httpcode = %d Ip = %s

TaskID = %u Cid = %u Httpcode = %d Ip = %s

TaskID = %u Cid = %u Httpcode = %d Ip = %s,

TaskID = %u Cid = %u Httpcode = %d Ip = %s,

TaskID = %u Cid = %u Httpcode = %d Url= %s

TaskID = %u Cid = %u Httpcode = %d Url= %s

TaskID = %u Cid = %u Httpcode = %d Ip = %s ,

TaskID = %u Cid = %u Httpcode = %d Ip = %s ,

TaskID = %u Cid = %u Httpcode = %d Ip = %s

TaskID = %u Cid = %u Httpcode = %d Ip = %s

[P2SPHOST::__addurl] %s

[P2SPHOST::__addurl] %s

[P2SPHOST::AddIplist] %s - %s

[P2SPHOST::AddIplist] %s - %s

[P2SPHOST::AddIplist] reparse host:%s

[P2SPHOST::AddIplist] reparse host:%s

[P2SPHOST::BlockUrl] URL: %s

[P2SPHOST::BlockUrl] URL: %s

[P2SPHOST::BlockUrl] invalid URL: %s

[P2SPHOST::BlockUrl] invalid URL: %s

[P2SPHOST::BlockIp] invalid IP: %s

[P2SPHOST::BlockIp] invalid IP: %s

[P2SPHOST::BlockIp] IP: %s

[P2SPHOST::BlockIp] IP: %s

[P2SPHOST::BlockIp] mask error(%d-%d). IP: %s

[P2SPHOST::BlockIp] mask error(%d-%d). IP: %s

[P2SPHOST::BlockIp] too much error(%d-%d). IP: %s

[P2SPHOST::BlockIp] too much error(%d-%d). IP: %s

[P2SPHOST::PickIp] IP: %s, traffic: %d, file: %s

[P2SPHOST::PickIp] IP: %s, traffic: %d, file: %s

[P2SPHOST::UpdateCidTraffic] ip(%s) not mapped!

[P2SPHOST::UpdateCidTraffic] ip(%s) not mapped!

D:\root.d\dev\360\C \360PubSrc\360Base\QHMD5.cpp

D:\root.d\dev\360\C \360PubSrc\360Base\QHMD5.cpp

netmsg.dll

netmsg.dll

mqutil.dll

mqutil.dll

wininet.dll

wininet.dll

__crt

__crt