Trojan.DownLoader7.20163

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '%WINDIR%\svchost.exe'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Creates and executes the following:

%TEMP%\svchost.exe
%WINDIR%\svchost.exe
%PROGRAM_FILES%\Company\PluginMini0511\Plugin-Setup.exe
%TEMP%\svchost.exe (downloaded from the Internet)

Executes the following:

<SYSTEM32>\netsh.exe firewall set opmode Disable

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\Company\PluginMini0511\interface2\Preview\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Preview\preview.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Preview\preview.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\partner\partner_setting.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\partner\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Preview\base.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Preview\PreViewMgr.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\setting\map\worldmap.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface2\sprBao\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\sprBao\Remote.dll
%PROGRAM_FILES%\Company\PluginMini0511\interface2\QuanDoanh\001a\window\QuanDoanh.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\QuanDoanh\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\QuanDoanh\script\window\QuanDoanh.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\partner\partner.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Hanhtrang_Ruong\repository.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Hanhtrang_Ruong\ThrowAway.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Hanhtrang_Ruong\zhanhunbag.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Hanhtrang_Ruong\OrderBag_Logic.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Hanhtrang_Ruong\PluginCfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Hanhtrang_Ruong\repository.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Hanhtrang_Ruong\zhanhunbag.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\partner\001a\window\partner.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\partner\001a\window\Selectnpc.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\partner\AutoPartner.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\interfacemanagercfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\NangDong\NangDong.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\NangDong\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\supermaplink\supermaplink.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\tool\AutoChiLing.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\tool\AutoQuanDoanh.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\supermaplink\maplink_ui.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\supermaplink\myui.dll
%PROGRAM_FILES%\Company\PluginMini0511\interface2\supermaplink\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\tool\AutoQuanDoanh.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\tool\Supercall.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\tool\TDLT.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\tool\Thuthapgo.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\tool\Input0.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\tool\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\tool\RungGai.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\supermaplink\maplink_ui.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\sprBao\SprBao_setting.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\sprBao\SuperBao.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\sprchinhtuyen\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\sprBao\Remote.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\sprBao\skillprogress.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\sprBao\SprBao_setting.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\sprchinhtuyen\QChinhTuyen.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\sprTrade\itembox.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\sprTrade\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\sprTrade\trade.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\sprThuongHoi\AutoThuongHoi.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\sprThuongHoi\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\sprTrade\extbagmodify.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autofight\script\window\skilltree.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autoFollow\autoFollow.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autoFollow\autoFollow.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autofight\script\window\autoMedicine.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autofight\script\window\auto_fight.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autofight\script\window\backtrack.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autoFollow\AutoTheo.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autoFollow\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autoFollow\selecttnpc.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_class\ItemCompare.dat
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autoFollow\key.dll
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autoFollow\key.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autoFollow\main.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autofight\script\window\autofight_setting.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\autothief\AutoThiefpanel.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\autothief\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autofight\001a\window\autofight.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\autoht\selecttnpcHT.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\autoht\toadotrain.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface2\autothief\AutoThief.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autofight\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autofight\script\misc\new.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autofight\script\window\autofight.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autofight\script\window\autofightdata.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autofight\script\logic\AutoFightData.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autofight\script\misc\autofight_setting.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_autofight\script\misc\auto_fight.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\dnd_system\member.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\dnd_system\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\fightsprite\autoMedicine.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Detector\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\dnd_system\AutoParty.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\dnd_system\AutoParty.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\fightsprite\fightsprite.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Hanhtrang_Ruong\itembox.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Hanhtrang_Ruong\OrderBag.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Hanhtrang_Ruong\OrderBag_Compare.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\fightsprite\peresplus_setting.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\fightsprite\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Hanhtrang_Ruong\itembox.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Detector\enemy.WAV
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_class\PluginCfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_class\ZhenYuan.dat
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_teamportrait\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_class\ItemDetail.dat
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_class\ItemEnhance.dat
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_class\ItemEquip.dat
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_teamportrait\teamportrait.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Compose\Compose.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Compose\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Detector\Detector.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_teamportrait\teamportrait.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_teamportrait\team_modify.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Compose\compose.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\tool\Thuthapthaoduoc.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\UI_UnLock\unlock.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\UI_UnLock\unlock.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\unrealII\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\UI_PLAYERPANEL\viewwealthvalue.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\UI_PLAYERPANEL\zhenyuan.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\UI_UnLock\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\unrealII\unreal.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\unreal_tester\script\window\cuonghoa.lua
%PROGRAM_FILES%\Company\PluginMini0511\Plugin-Setup.exe
%PROGRAM_FILES%\Company\PluginMini0511\setting\item\001\other\scriptitem.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface2\unrealII\unreal.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\unreal_tester\001a\window\cuonghoa_setting.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\unreal_tester\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\UI_PLAYERPANEL\viewwealthvalue.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\ui_autosay2\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\UI_MINICLOCK\miniclock.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\UI_MINICLOCK\miniclock.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\ui_autosay2\data\msg.wav
%PROGRAM_FILES%\Company\PluginMini0511\interface2\ui_autosay2\data\reply.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface2\ui_autosay2\data\reply2.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface2\UI_MINICLOCK\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\UI_PLAYERPANEL\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\UI_PLAYERPANEL\Scrip08.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\UI_PLAYERPANEL\Scrip09.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\UI_PLAYERPANEL\playerhonor_wealth.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\UI_PLAYERPANEL\playerpanel.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\UI_PLAYERPANEL\playerpanel.lua
%PROGRAM_FILES%\Company\PluginMini0511\Uninstall.exe
%PROGRAM_FILES%\Company\PluginMini0511\Uninstall.ini
%TEMP%\aut1.tmp
%PROGRAM_FILES%\Company\PluginMini0511\ui\001c\wndconfig.ini
%PROGRAM_FILES%\Company\PluginMini0511\ui\001c\_ui3\minimapnormal.ini
%PROGRAM_FILES%\Company\PluginMini0511\ui\002a\wndconfig.ini
%TEMP%\kubzxhz
<SYSTEM32>\config1.sys
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\svchost[1].a3x
%TEMP%\svchost.exe
%TEMP%\aut2.tmp
<SYSTEM32>\autoexec1.bat
%TEMP%\aut3.tmp
%PROGRAM_FILES%\Company\PluginMini0511\ui\001c\window\cover.ini
%PROGRAM_FILES%\Company\PluginMini0511\setting\misc\daytip.ini
%WINDIR%\svchost.exe
%PROGRAM_FILES%\Company\PluginMini0511\ui\001a\UI_POPBAR=552,518.txt
%PROGRAM_FILES%\Company\PluginMini0511\setting\item\001\other\version.cfg
%PROGRAM_FILES%\Company\PluginMini0511\setting\item\001\other\xuanjing_lv4.spr
%PROGRAM_FILES%\Company\PluginMini0511\setting\misc\agreement.txt
%PROGRAM_FILES%\Company\PluginMini0511\ui\001a\window\cover.ini
%PROGRAM_FILES%\Company\PluginMini0511\ui\001b\window\cover.ini
%PROGRAM_FILES%\Company\PluginMini0511\ui\001b\wndconfig.ini
%PROGRAM_FILES%\Company\PluginMini0511\ui\001b\_ui3\minimapnormal.ini
%PROGRAM_FILES%\Company\PluginMini0511\ui\001a\window\fightmode.ini
%PROGRAM_FILES%\Company\PluginMini0511\ui\001a\wndconfig.ini
%PROGRAM_FILES%\Company\PluginMini0511\ui\001a\_ui3\minimapnormal.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\collection.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\Confirm.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\GetIDNPC.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\BuffTC.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\checkplugin.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\Chuctet.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\gutmodel.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\mgr.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\NangDong.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\new4X.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\guttalk.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\healthy.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\helpsprite.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\books.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\001a\window\cover.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\001a\window\nopick_setting.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\001a\window\renascencepanel.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\tool\tool.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\tool\tool.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\tool\VuotRao.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\001a\window\shop.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\autobuffskill.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\AutoCastLeftSkill.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\autotreasure.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\001a\window\tools.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\001a\window\viewfightskill.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\ui_autosay2\autosay.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\ui_autosay2\AutoSay.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\ui_autosay2\autosay2.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\worldmap_sub.rar
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\xuanjing.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\ui_autosay2\AutoReply.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\ui_autosay2\AutoSay2.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\ui_autosay2\data\hanhua3.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface2\ui_autosay2\data\hanhua4.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface2\ui_autosay2\data\hanhua5.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface2\ui_autosay2\data\hanhua.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface2\ui_autosay2\data\hanhua1.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface2\ui_autosay2\data\hanhua2.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\viewfightskill.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\NSMM.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\playerpray.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\playname_ex.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\NhanThuongOnline.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\NoEXPl.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\noPick.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\produceVSV.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\shortcuts.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\TenTPHK.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\tools.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\ReloadCH.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\renascencepanel.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\shop.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\autoht\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\Hanhtrang_Ruong\itembox.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\Hanhtrang_Ruong\itembox.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Hanhtrang_Ruong\orderbag.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\fightsprite\peresplus_setting.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\fightsprite\playerstate.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\fightsprite\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\Hanhtrang_Ruong\orderbag_compare.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Hanhtrang_Ruong\repository.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Hanhtrang_Ruong\throwAway.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Hanhtrang_Ruong\zhanhunbag.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\Hanhtrang_Ruong\orderbag_logic.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Hanhtrang_Ruong\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\Hanhtrang_Ruong\repository.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\fightsprite\image\mana.spr
%PROGRAM_FILES%\Company\PluginMini0511\interface\dnd_system\member.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\dnd_system\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\dnd_system\system.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\Detector\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\dnd_system\AutoParty.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\dnd_system\AutoParty.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\dnd_system\system.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\fightsprite\image\life_green.spr
%PROGRAM_FILES%\Company\PluginMini0511\interface\fightsprite\image\life_red.spr
%PROGRAM_FILES%\Company\PluginMini0511\interface\fightsprite\image\life_yellow.spr
%PROGRAM_FILES%\Company\PluginMini0511\interface\fightsprite\autoMedicine.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\fightsprite\fightsprite.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\fightsprite\fightsprite.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\QuanDoanh\script\window\QuanDoanh.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\setting\map\worldmap.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface\sprBao\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\Preview\PreViewMgr.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\QuanDoanh\001a\window\QuanDoanh.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\QuanDoanh\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\sprBao\Remote.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\sprBao\SuperBao.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\sprchinhtuyen\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\sprchinhtuyen\QChinhTuyen.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\sprBao\skillprogress.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\sprBao\SprBao_setting.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\sprBao\SprBao_setting.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Preview\preview.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\NangDong\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\partner\AutoPartner.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\partner\partner.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\Hanhtrang_Ruong\zhanhunbag.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\interfacemanagercfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\NangDong\NangDong.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\partner\partner.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Preview\base.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Preview\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\Preview\preview.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\partner\partner_setting.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\partner\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\partner\selectnpc.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\autoht\toadotrain.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface\autothief\AutoThief.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\autothief\AutoThiefpanel.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\autoht\AutoReplyHT.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\autoht\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\autoht\selecttnpcHT.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\autothief\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autofight\script\misc\autofight_setting.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autofight\script\misc\auto_fight.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autofight\script\misc\new.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autofight\001a\window\autofight.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autofight\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autofight\script\logic\AutoFightData.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\autoht\autoht.lua
%TEMP%\$inst\temp_0.tmp
%PROGRAM_FILES%\Company\PluginMini0511\config.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\AutoAnswer\AutoAnswer.lua
%TEMP%\$inst\2.tmp
%TEMP%\$inst\4.tmp
%TEMP%\$inst\5.tmp
%PROGRAM_FILES%\Company\PluginMini0511\interface\AutoAnswer\Hoadang.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\AutoGetAward\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\autoht\autoFollowHT.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\autoht\autoht.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\AutoAnswer\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\AutoAnswer\tiku.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface\AutoGetAward\AutoGetAward.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_class\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_teamportrait\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_teamportrait\teamportrait.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autoFollow\selecttnpc.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_class\enhance.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_class\item.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_teamportrait\teamportrait.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Compose\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\Detector\Detector.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Detector\enemy.WAV
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_teamportrait\team_modify.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Compose\compose.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\Compose\Compose.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autoFollow\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autofight\script\window\autoMedicine.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autofight\script\window\auto_fight.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autofight\script\window\backtrack.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autofight\script\window\autofight.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autofight\script\window\autofightdata.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autofight\script\window\autofight_setting.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autofight\script\window\skilltree.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autoFollow\key.dll
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autoFollow\key.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autoFollow\main.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autoFollow\autoFollow.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autoFollow\autoFollow.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\btssl_autoFollow\AutoTheo.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\sprThuongHoi\AutoThuongHoi.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\ui_autosay2\data\hanhua1.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface\ui_autosay2\data\hanhua2.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface\ui_autosay2\data\hanhua3.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface\ui_autosay2\autosay2.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\ui_autosay2\AutoSay2.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\ui_autosay2\data\hanhua.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface\ui_autosay2\data\hanhua4.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface\ui_autosay2\data\reply2.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface\ui_autosay2\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\UI_MINICLOCK\miniclock.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\ui_autosay2\data\hanhua5.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface\ui_autosay2\data\msg.wav
%PROGRAM_FILES%\Company\PluginMini0511\interface\ui_autosay2\data\reply.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface\ui_autosay2\AutoSay.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\renascencepanel.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\shop.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\shortcuts.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\popbar.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\produceVSV.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\ReloadCH.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\TenTPHK.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\xuanjing.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\ui_autosay2\AutoReply.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\ui_autosay2\autosay.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\tools.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\viewfightskill.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\worldmap_sub.rar
%PROGRAM_FILES%\Company\PluginMini0511\interface2\AutoAnswer\AutoAnswer.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\AutoAnswer\Hoadang.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\AutoAnswer\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\unreal_tester\001a\window\cuonghoa_setting.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\unreal_tester\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\unreal_tester\script\window\cuonghoa.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\AutoAnswer\tiku.txt
%PROGRAM_FILES%\Company\PluginMini0511\interface2\autoht\autoht.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\autoht\autoht.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\autoht\AutoReplyHT.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\AutoGetAward\AutoGetAward.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\AutoGetAward\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\autoht\autoFollowHT.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\unrealII\unreal.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\UI_PLAYERPANEL\playerpanel.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\UI_PLAYERPANEL\playerpanel.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\UI_PLAYERPANEL\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\UI_MINICLOCK\miniclock.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\UI_MINICLOCK\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\UI_PLAYERPANEL\playerhonor_wealth.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\UI_PLAYERPANEL\viewwealthvalue.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\UI_UnLock\unlock.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\unrealII\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\unrealII\unreal.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\UI_PLAYERPANEL\viewwealthvalue.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\UI_UnLock\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\UI_UnLock\unlock.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\tool\TDLT.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\tool\Thuthapgo.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\tool\Thuthapthaoduoc.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\tool\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\tool\RungGai.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\tool\Supercall.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\tool\tool.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\001a\window\nopick_setting.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\001a\window\popbar.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\001a\window\renascencepanel.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\tool\tool.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\tool\VuotRao.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\001a\window\cover.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\tool\Input0.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\sprTrade\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\sprTrade\trade.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\supermaplink\maplink_ui.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\sprThuongHoi\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\sprTrade\extbagmodify.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\sprTrade\itembox.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\supermaplink\maplink_ui.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\tool\AutoChiLing.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\tool\AutoQuanDoanh.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\tool\AutoQuanDoanh.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\supermaplink\myui.dll
%PROGRAM_FILES%\Company\PluginMini0511\interface\supermaplink\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\supermaplink\supermaplink.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\helpsprite.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\mgr.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\NangDong.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\gutmodel.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\guttalk.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\healthy.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\new4X.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\NSMM.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\playerpray.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\playname_ex.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\NhanThuongOnline.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\NoEXPl.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\noPick.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\GetIDNPC.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\autobuffskill.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\AutoCastLeftSkill.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\001a\window\shop.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\001a\window\tools.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\001a\window\viewfightskill.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\autotreasure.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\Chuctet.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\collection.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\Confirm.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\books.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\BuffTC.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Tools\script\window\checkplugin.lua

Sets the 'hidden' attribute to the following files:

%PROGRAM_FILES%\Company\PluginMini0511\interface2\Hanhtrang_Ruong\ThrowAway.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\partner\001a\window\Selectnpc.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Detector\enemy.WAV
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Detector\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\setting\misc\agreement.txt
%WINDIR%\svchost.exe
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\playerpray.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Tools\script\window\renascencepanel.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface2\Detector\Detector.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Detector\plugincfg.ini
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_class\ItemCompare.dat
%PROGRAM_FILES%\Company\PluginMini0511\interface\Detector\Detector.lua
%PROGRAM_FILES%\Company\PluginMini0511\interface\Detector\enemy.WAV
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_class\ItemEquip.dat
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_class\ZhenYuan.dat
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_class\ItemDetail.dat
%PROGRAM_FILES%\Company\PluginMini0511\interface2\btssl_class\ItemEnhance.dat

Deletes the following files:

%TEMP%\aut2.tmp
%TEMP%\kubzxhz
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\svchost[1].a3x
%TEMP%\aut3.tmp
%TEMP%\aut1.tmp
%TEMP%\$inst\2.tmp
%TEMP%\$inst\temp_0.tmp
%TEMP%\$inst\5.tmp
%TEMP%\$inst\4.tmp

Network activity:

Connects to:

'an##me.info':80

TCP:

HTTP GET requests:

an##me.info/files/svchost.a3x

UDP:

DNS ASK an##me.info

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'GINA Logon'
ClassName: 'Shell_TrayWnd' WindowName: ''

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial