Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

Win32.Application.ThunderN.A also known as BehavesLike.Win32.Suspicious.tc.

Malware Analysis of Win32.Application.ThunderN.A – APLAYERUPDATE_3.9.0.756.EXE

Created files:

%Temp%\APlayerUpdate_3.9.0.756\msvcr90.dll
%Temp%\APlayerUpdate_3.9.0.756\XmpSetupHelper.dll
%Temp%\APlayerUpdate_3.9.0.756.exe
%Temp%\FunCloudIns.dll
%Temp%\funshiontmp\AcceData.dll

Autostart registry keys:

HKLM\Software\Classes\Applications\anote.exe\NoStartPage: “”
HKLM\Software\Classes\Applications\uninstall.exe\NoStartPage: “”
HKLM\Software\Classes\Applications\XMP.exe\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile”
HKLM\Software\Classes\Applications\XMP.exe\Shell\open\: “?? ???? ??(&P)”
HKLM\Software\Classes\Applications\XMP.exe\Shell\: “open”
HKLM\Software\Classes\Applications\XMP.exe\DefaultIcon\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe”,0″
HKLM\Software\Classes\CLSID\{00000ADA-7E0D-47C1-986C-F017D09C4304}\InprocServer32\: “%Common Appdata%\Thunder Network\XMP5\Addins\VideoUrlSniffer.2.3.3.211.(461).dll”
HKLM\Software\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}\InprocServer32\: “%Program Files%\IQIYI Video\LStyle\QYPlugin.dll”
HKLM\Software\Classes\CLSID\{1A3BD145-3384-4F81-9F6C-10F045887FD3}\InprocServer32\: “%Common Appdata%\Thunder Network\XMP5\Addins\XMediaLibrary.461.dll”
HKLM\Software\Classes\CLSID\{2FB831EA-DA68-4A66-8E31-A2D976A6296C}\InprocServer32\: “%Program Files%\?iN?\X86\KZipShell.dll”
HKLM\Software\Classes\CLSID\{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}\InprocServer32\: “%Program Files%\IQIYI Video\LStyle\Accelerator\IEHelper.dll”
HKLM\Software\Classes\CLSID\{30C5E658-70B6-4570-A780-D362A5BE2049}\InprocServer32\: “%Common Appdata%\Video Legend\RBC\Addins\RBCShellExternal.dll”
HKLM\Software\Classes\CLSID\{3DCCD550-7586-40D2-A51D-D2F98EC06B3C}\InprocServer32\: “%Program Files%\?iN?\X86\KZipShell.dll”
HKLM\Software\Classes\CLSID\{4562B511-62E9-4533-B7B2-56A8BB10B482}\InprocServer32\: “%Common Appdata%\Thunder Network\KanKan\reghelper\xappex.1.1.1.85.(462).dll”
HKLM\Software\Classes\CLSID\{4DB0021B-1EC2-4C31-BD79-FEA2892EEB43}\InprocServer32\: “%Common Appdata%\Thunder Network\KKVideo\Addins\KKVIconHandler.dll”
HKLM\Software\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\InprocServer32\: “%Program Files%\IQIYI Video\LStyle\QYPlugin.dll”
HKLM\Software\Classes\CLSID\{695891DE-E87C-4942-9628-7217D3EFBD2D}\InprocServer32\: “%Program Files Common%\Thunder Network\KanKan\KKMediaCtrl.1.0.0.3.(462).dll”
HKLM\Software\Classes\CLSID\{6ADF19E3-77A3-4395-ADB4-9FD7D351EB3E}\InprocServer32\: “%Program Files%\?iN?\X86\KZipShell.dll”
HKLM\Software\Classes\CLSID\{6EE9CD3E-A386-4DAE-9737-A759DBF927AE}\InprocServer32\: “%Program Files Common%\Thunder Network\UserAgent\UserAgent2.0.2.18.dll”
HKLM\Software\Classes\CLSID\{7040AE7C-D539-4ABB-BEA1-B5E58A3D2655}\LocalServer32\: “C:\DOCUME~1\ALLUSE~1\APPLIC~1\THUNDE~1\XMP5\V5126~1.432\Program\XMP.exe”
HKLM\Software\Classes\CLSID\{8F556DA3-987D-47b0-AA88-EB8D52FE1B99}\InprocServer32\: “%Common Appdata%\Thunder Network\XMP5\Addins\ShlExt.5.1.13.3500.(460).dll”
HKLM\Software\Classes\CLSID\{9701758C-4373-482E-B13C-776C048EC890}\InprocServer32\: “%Program Files Common%\Thunder Network\KanKan\DapCtrl.2.5.7308.464.(462).dll”
HKLM\Software\Classes\CLSID\{A9332148-C691-4B9D-91FC-B9C461DBE9DD}\InprocServer32\: “%Common Appdata%\Thunder Network\APlayer\APlayer_3.9.0.756.dll”
HKLM\Software\Classes\CLSID\{AAA0C5B8-933F-4200-93AD-B143D7FFF9F2}\InprocServer32\: “%Program Files%\?iN?\X86\KZipShell.dll”
HKLM\Software\Classes\CLSID\{ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8}\InprocServer32\: “%Program Files Common%\Thunder Network\KanKan\DapCtrl.2.5.7308.464.(462).dll”
HKLM\Software\Classes\CLSID\{ACACC6EB-1FBA-4E13-A729-53AEB2DF54F9}\InprocServer32\: “%Program Files Common%\Thunder Network\KanKan\LiveDapCtrl.1.0.0.10.(462).dll”
HKLM\Software\Classes\CLSID\{B636EBDF-5B2F-4B73-8D0B-194C469CDECD}\InprocServer32\: “%Common Appdata%\Thunder Network\KKVideo\Addins\KKVIconHandler.dll”
HKLM\Software\Classes\CLSID\{BC5E4F38-63EF-4668-8499-F3DC78AF4EDC}\InprocServer32\: “%Program Files Common%\Thunder Network\KanKan\KKVPCtrl.1.0.1.3.(462).dll”
HKLM\Software\Classes\CLSID\{C9487131-EF4C-40D9-BA70-E85356CAF67E}\InprocServer32\: “%Program Files%\?iN?\X86\KZipShell.dll”
HKLM\Software\Classes\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\Shell\Open\Command\: “%Program Files%\IQIYI Video\LStyle\QyClient.exe web_startup_tray”
HKLM\Software\Classes\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\InProcServer32\: “shdocvw.dll”
HKLM\Software\Classes\CLSID\{DD5BF6D1-6663-47E0-9DFA-5C343CAF178E}\InprocServer32\: “%WinDir%\xinstaller.1.3.0.22.dll”
HKLM\Software\Classes\CLSID\{E1C2B026-FFFA-4437-9354-415B40BEEF87}\LocalServer32\: “”%Program Files Common%\Thunder Network\KanKan\ThunderServiceLite.exe””
HKLM\Software\Classes\CLSID\{E1C2B026-FFFA-4437-9354-415B40BEEF88}\LocalServer32\: “”%Program Files Common%\Thunder Network\KanKan\KankanLive.exe””
HKLM\Software\Classes\CLSID\{F19169FA-7EB8-45EB-8800-0D1F7C88F553}\InProcServer32\: “%Common Appdata%\Thunder Network\APlayer\APlayer_3.9.0.756.dll”
HKLM\Software\Classes\CLSID\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}\InprocServer32\: “%Program Files%\IQIYI Video\LStyle\Accelerator\IEHelper.dll”
HKLM\Software\Classes\360seURL\shell\open\command\: “”%Appdata%\360se6\Application\360se.exe” — “%1″”
HKLM\Software\Classes\bdhd\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 02 00 3F 3F 00 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 1F 00 00 3F 3F 3F 3F 3F 3F 3F 55 3F 3F 3F 3F 3F 3F 3F 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\KuaiZip.001\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.002\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.003\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.004\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.005\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.006\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.007\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.008\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.009\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.01\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.010\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.011\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.012\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.013\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.014\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.015\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.016\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.017\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.018\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.019\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.02\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.020\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.021\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.022\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.023\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.024\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.025\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.026\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.027\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.028\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.029\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.03\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.030\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.031\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.032\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.033\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.034\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.035\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.036\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.037\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.038\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.039\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.04\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.040\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.041\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.042\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.043\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.044\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.045\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.046\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.047\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.048\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.049\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.05\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.050\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.051\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.052\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.053\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.054\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.055\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.056\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.057\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.058\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.059\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.06\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.060\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.061\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.062\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.063\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.064\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.065\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.066\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.067\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.068\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.069\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.07\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.070\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.071\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.072\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.073\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.074\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.075\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.076\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.077\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.078\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.079\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.08\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.080\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.081\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.082\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.083\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.084\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.085\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.086\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.087\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.088\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.089\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.09\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.090\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.091\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.092\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.093\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.094\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.095\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.096\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.097\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.098\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.099\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.7z\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.arj\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.bz2\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.cab\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.gz\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.gzip\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.jar\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.kz\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.lzh\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.mou\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.rar\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.rpm\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.tar\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.tbz\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.tgz\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.wim\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.z\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZip.zip\shell\open\command\: “%Program Files%\?iN?\X86\KuaiZip.exe “%1″”
HKLM\Software\Classes\KuaiZipMount.ape\shell\open\command\: “%Program Files%\?iN?\X86\KZMount.exe -NewDriver “%1″”
HKLM\Software\Classes\KuaiZipMount.bin\shell\open\command\: “%Program Files%\?iN?\X86\KZMount.exe -NewDriver “%1″”
HKLM\Software\Classes\KuaiZipMount.ccd\shell\open\command\: “%Program Files%\?iN?\X86\KZMount.exe -NewDriver “%1″”
HKLM\Software\Classes\KuaiZipMount.cue\shell\open\command\: “%Program Files%\?iN?\X86\KZMount.exe -NewDriver “%1″”
HKLM\Software\Classes\KuaiZipMount.flac\shell\open\command\: “%Program Files%\?iN?\X86\KZMount.exe -NewDriver “%1″”
HKLM\Software\Classes\KuaiZipMount.iso\shell\open\command\: “%Program Files%\?iN?\X86\KZMount.exe -NewDriver “%1″”
HKLM\Software\Classes\KuaiZipMount.isz\shell\open\command\: “%Program Files%\?iN?\X86\KZMount.exe -NewDriver “%1″”
HKLM\Software\Classes\KuaiZipMount.mdf\shell\open\command\: “%Program Files%\?iN?\X86\KZMount.exe -NewDriver “%1″”
HKLM\Software\Classes\KuaiZipMount.mds\shell\open\command\: “%Program Files%\?iN?\X86\KZMount.exe -NewDriver “%1″”
HKLM\Software\Classes\KuaiZipMount.nrg\shell\open\command\: “%Program Files%\?iN?\X86\KZMount.exe -NewDriver “%1″”
HKLM\Software\Classes\KuaiZipMount.vcd\shell\open\command\: “%Program Files%\?iN?\X86\KZMount.exe -NewDriver “%1″”
HKLM\Software\Classes\KuaiZipMount.wv\shell\open\command\: “%Program Files%\?iN?\X86\KZMount.exe -NewDriver “%1″”
HKLM\Software\Classes\magnet2\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 02 00 3F 3F 00 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 1F 00 00 3F 3F 3F 3F 3F 3F 3F 55 3F 3F 3F 3F 3F 3F 3F 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\play\Shell\Open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” “%1″ /sstartfrom CloudPlayProtocol /sopenfrom CloudPlayProtocol”
HKLM\Software\Classes\play.ed2k\Shell\Open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” “%1″ /sstartfrom CloudPlayProtocol /sopenfrom CloudPlayProtocol”
HKLM\Software\Classes\play.ftp\Shell\Open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” “%1″ /sstartfrom CloudPlayProtocol /sopenfrom CloudPlayProtocol”
HKLM\Software\Classes\play.ftp.torrent\Shell\Open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” “%1″ /sstartfrom CloudPlayProtocol /sopenfrom CloudPlayProtocol”
HKLM\Software\Classes\play.http\Shell\Open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” “%1″ /sstartfrom CloudPlayProtocol /sopenfrom CloudPlayProtocol”
HKLM\Software\Classes\play.http.torrent\Shell\Open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” “%1″ /sstartfrom CloudPlayProtocol /sopenfrom CloudPlayProtocol”
HKLM\Software\Classes\play.magnet\Shell\Open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” “%1″ /sstartfrom CloudPlayProtocol /sopenfrom CloudPlayProtocol”
HKLM\Software\Classes\play.mms\Shell\Open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” “%1″ /sstartfrom CloudPlayProtocol /sopenfrom CloudPlayProtocol”
HKLM\Software\Classes\play.rtsp\Shell\Open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” “%1″ /sstartfrom CloudPlayProtocol /sopenfrom CloudPlayProtocol”
HKLM\Software\Classes\play.thunder\Shell\Open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” “%1″ /sstartfrom CloudPlayProtocol /sopenfrom CloudPlayProtocol”
HKLM\Software\Classes\play.thunder.torrent\Shell\Open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” “%1″ /sstartfrom CloudPlayProtocol /sopenfrom CloudPlayProtocol”
HKLM\Software\Classes\pps\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 02 00 3F 3F 00 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 1F 00 00 3F 3F 3F 3F 3F 3F 3F 55 3F 3F 3F 3F 3F 3F 3F 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\ppsrun\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 02 00 3F 3F 00 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 1F 00 00 3F 3F 3F 3F 3F 3F 3F 55 3F 3F 3F 3F 3F 3F 3F 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\ppstream\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 02 00 3F 3F 00 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 1F 00 00 3F 3F 3F 3F 3F 3F 3F 55 3F 3F 3F 3F 3F 3F 3F 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\pps_pfv\shell\open\command\: “”%Program Files%\IQIYI Video\LStyle\QyClient.exe” -runfrom openfile “%1″”
HKLM\Software\Classes\pps_qsv\shell\open\command\: “”%Program Files%\IQIYI Video\LStyle\QyClient.exe” -runfrom openfile “%1″”
HKLM\Software\Classes\qips\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 02 00 3F 3F 00 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 1F 00 00 3F 3F 3F 3F 3F 3F 3F 55 3F 3F 3F 3F 3F 3F 3F 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\qisu\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 02 00 3F 3F 00 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 1F 00 00 3F 3F 3F 3F 3F 3F 3F 55 3F 3F 3F 3F 3F 3F 3F 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\qygameclient\shell\open\command\: “”%Program Files%\IQIYI Video\Common\QyGameClient\QyGameClient.exe” -qygameclient “%1″”
HKLM\Software\Classes\xlkkvdfile\Shell\open\command\: “”%Common Appdata%\Thunder Network\KKVideo\Core\Program\KKV.exe” /iopenstyle 1 /ishow 1 /sshowopenfrom desktop /soperator dclickicon”
HKLM\Software\Classes\xmp.3g2\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.3gp\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.3gp2\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.3gpp\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.aac\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.ac3\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.amr\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.amv\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.ape\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.asf\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.ass\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.av\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.avi\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.bik\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.cda\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.csf\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.dat\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.divx\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.dts\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.dvd\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.evo\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.f4v\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.flac\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.flv\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.hlv\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.idx\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.ifo\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.m1a\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.m1v\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.m2a\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.m2p\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.m2ts\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.m2v\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.m4a\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.m4b\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.m4p\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.m4v\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.mid\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.midi\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.mka\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.mkv\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.mod\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.mov\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.mp2\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.mp2v\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.mp3\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.mp4\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.mpa\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.mpc\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.mpe\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.mpeg\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.mpeg1\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.mpeg2\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.mpeg4\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.mpg\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.mpv2\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.mts\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.oga\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.ogg\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.ogm\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.ogv\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.ogx\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.pmp\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.psb\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.pss\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.pva\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.qt\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.ra\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.ram\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.rm\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.rmvb\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.rp\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.rpm\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.rt\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.scm\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.smi\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.smil\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.srt\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.ssa\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.sub\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.swf\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.torrent\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.tp\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.tpr\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.ts\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.tta\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.usf\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.vob\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.vp6\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.wm\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.wma\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.wmp\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.wmv\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.wv\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.xlmv\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.xv\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Classes\xmp.xvx\Shell\open\command\: “”%Program Files%\Thunder Network\XMP\V5.1.26.4324\Bin\XMP.exe” /play “%1″ /sopenfrom WndExplr /sstartfrom LocalFile ”
HKLM\Software\Clients\StartMenuInternet\360se.exe\shell\open\command\: “”%Appdata%\360se6\Application\360se.exe””
HKLM\Software\Clients\StartMenuInternet\360se6\shell\open\command\: “”%Appdata%\360se6\Application\360se.exe””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\IQIYI Video\DisplayName: “???PPS??”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\IQIYI Video\UninstallString: “%Program Files%\IQIYI Video\LStyle\QyUninst.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\KuaiZip\UninstallString: “%Program Files%\?iN?\X86\Uninst.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\KuaiZip\DisplayName: “?iN?”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PPStream\UninstallString: “%Program Files%\IQIYI Video\LStyle\QyUninst.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\win7dock_is1\DisplayName: “win7dock 2.0”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\win7dock_is1\UninstallString: “”%Program Files%\win7dock\UninsFiles\unins000.exe””
HKLM\Software\QiYi\QiSu\DisplayName: “?????4.0”
HKLM\System\CurrentControlSet\Services\Bonjour Service\ImagePath: “%Program Files%\IQIYI Video\LStyle\mDNSResponder.exe”
HKLM\System\CurrentControlSet\Services\Bonjour Service\DisplayName: “Bonjour Service”
HKLM\System\CurrentControlSet\Services\KuaiZipDrive\ImagePath: “\??\%SysDir%\drivers\KuaiZipDrive.sys”
HKLM\System\CurrentControlSet\Services\KuaiZipDrive\DisplayName: “KuaiZipDrive”
HKLM\System\CurrentControlSet\Services\KuaizipUpdateChecker\ImagePath: “%SystemRoot%\System32\svchost.exe -k kuaizipupdatesvc”
HKLM\System\CurrentControlSet\Services\KuaizipUpdateChecker\DisplayName: “KuaizipUpdateChecker”
HKLM\System\CurrentControlSet\Services\QiyiService\ImagePath: “%Program Files%\IQIYI Video\LStyle\QiyiService.exe”
HKLM\System\CurrentControlSet\Services\QiyiService\DisplayName: “IQIYI Video Platform Service”
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}\DisplayName: “????,????”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\win7dockrun: “”%Program Files%\win7dock\win7dockdesk.exe” apprun”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\HCDNClient: “”%Program Files%\IQIYI Video\LStyle\QyKernel.exe” -shell_start”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\KKP: “”%Program Files%\Video Legend\KKP\Program\KKP.exe” ”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{60337D83-BE6E-44ED-9C16-C1399592C953}\DisplayName: “anote (v1.37) ”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{60337D83-BE6E-44ED-9C16-C1399592C953}\UninstallString: “”%Program Files%\anote\uninstall.exe” _?=%Program Files%\anote”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnityWebPlayer\UninstallString: “%Local Appdata%\Unity\WebPlayer\Uninstall.exe /CurrentUser”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnityWebPlayer\DisplayName: “Unity Web Player”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\360se6\DisplayName: “360?????7”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\360se6\UninstallString: “”%Appdata%\360se6\Application\7.1.1.518\Installer\setup.exe” –uninstall”
HKCU\Software\360\360se6\Update\ClientState\{02E720BD-2B50-4404-947C-65DBE64F6970}\UninstallString: “%Appdata%\360se6\Application\7.1.1.518\Installer\setup.exe”
HKLM\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32\: “”%Appdata%\360se6\Application\360se.exe””
HKLM\Software\Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\LocalServer32\: “”%Program Files%\Google\Chrome\Application\48.0.2564.109\delegate_execute.exe””
HKLM\Software\Classes\CLSID\{82d353df-90bd-4382-8bc2-3f6192b76e34}\InprocServer32\: “%SysDir%\wmvdecod.dll”
HKLM\Software\Classes\CLSID\{d23b90d0-144f-46bd-841d-59e4eb19dc59}\InprocServer32\: “%SysDir%\wmvencod.dll”
HKLM\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath: “”%Program Files%\Google\Chrome\Application\48.0.2564.109\Installer\chrmstp.exe” –configure-user-settings –verbose-logging –system-level –multi-install –chrome”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\UninstallString: “”%Program Files%\Google\Chrome\Application\48.0.2564.109\Installer\setup.exe” –uninstall –multi-install –chrome –system-level”

Detected by UnHackMe:

APLAYERUPDATE_3.9.0.756.EXE
Default location: %TEMP%\APLAYERUPDATE_3.9.0.756.EXE

Dropper hash(md5): 1ea753571cc7d29f8c88e4a0cb325faf

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.