Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Panda Cloud Systems Management' = '%ProgramFiles(x86)%\Panda Cloud Systems Management\Gui.exe'
- [<HKLM>\SOFTWARE\CLASSES\cag\shell\open\command] '' = '"%ProgramFiles(x86)%\Panda Cloud Systems Management\Gui.exe" %1'
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\CagService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\CagService] 'ImagePath' = '"%ProgramFiles(x86)%\Panda Cloud Systems Management\CagService.exe"'
- [<HKLM>\System\CurrentControlSet\Services\uvnc_service] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\uvnc_service] 'ImagePath' = '"%ProgramFiles(x86)%\Panda Cloud Systems Management\UltraVNC\winvnc.exe" -service'
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\taskkill.exe' /f /im winvnc.exe
Изменения в файловой системе
Создает следующие файлы
- %ProgramFiles(x86)%\panda cloud systems management\csicon.ico
- %WINDIR%\temp\cab9a13.tmp
- %WINDIR%\temp\tar840a.tmp
- %WINDIR%\temp\cab83f9.tmp
- %WINDIR%\temp\tar83d9.tmp
- %WINDIR%\temp\cab83d8.tmp
- %TEMP%\tebxldxg.dll
- %TEMP%\res7f54.tmp
- %TEMP%\csc7f53.tmp
- %TEMP%\tebxldxg.out
- %TEMP%\tebxldxg.cmdline
- %TEMP%\tebxldxg.0.cs
- <LS_APPDATA>\centrastage\gui.exe_url_qduk0ekofj2gspii32qw2p3odqm53q21\4.4.1803.1803\ktct2_gj.newcfg
- <LS_APPDATA>\centrastage\gui.exe_url_qduk0ekofj2gspii32qw2p3odqm53q21\4.4.1803.1803\kdb7slld.newcfg
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\h0ggiu8k.newcfg
- %PROGRAMDATA%\centrastage\brand\keys.xml
- %PROGRAMDATA%\centrastage\brand\agentrto.ico
- %PROGRAMDATA%\centrastage\brand\stopped.ico
- %PROGRAMDATA%\centrastage\brand\alertmodeoffline.ico
- %PROGRAMDATA%\centrastage\brand\alertmodeonline.ico
- %PROGRAMDATA%\centrastage\brand\ondemandmode.ico
- %PROGRAMDATA%\centrastage\brand\privacymode.ico
- %PROGRAMDATA%\centrastage\brand\offline.ico
- %PROGRAMDATA%\centrastage\brand\online.ico
- %WINDIR%\temp\tar9a14.tmp
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\9ryffd2p.newcfg
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\yoq5-v6e.newcfg
- %WINDIR%\temp\pqr-newn.0.cs
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\gcstmeeo.newcfg
- %PROGRAMDATA%\centrastage\auditsnapshot.xml
- %WINDIR%\temp\crfq87r9.dll
- %WINDIR%\temp\res73c7.tmp
- %WINDIR%\temp\csc73c6.tmp
- %WINDIR%\temp\crfq87r9.out
- %WINDIR%\temp\crfq87r9.cmdline
- %WINDIR%\temp\crfq87r9.0.cs
- %PROGRAMDATA%\centrastage\packages\b198fbe8-5b8f-bbf0-0375-9918aa3ef7f8.resume
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\kzgqt7b5.newcfg
- %PROGRAMDATA%\centrastage\monitoring\monitoralerts.xml
- %WINDIR%\temp\res50cd.tmp
- %WINDIR%\temp\yt4kx-vm.dll
- %WINDIR%\temp\csc50cc.tmp
- %WINDIR%\temp\yt4kx-vm.out
- %WINDIR%\temp\yt4kx-vm.cmdline
- %WINDIR%\temp\yt4kx-vm.0.cs
- %PROGRAMDATA%\centrastage\monitoring\monitordefs.xml
- %WINDIR%\temp\pqr-newn.dll
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\juzge5dq.newcfg
- %WINDIR%\temp\res4d53.tmp
- %WINDIR%\temp\csc4d52.tmp
- %WINDIR%\temp\pqr-newn.out
- %WINDIR%\temp\pqr-newn.cmdline
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\dts_zyii.newcfg
- %PROGRAMDATA%\centrastage\brand\desktopshortcut.ico
- %PROGRAMDATA%\centrastage\brand\primarylogo.png
- %PROGRAMDATA%\centrastage\packages\b198fbe8-5b8f-bbf0-0375-9918aa3ef7f8
- %ProgramFiles(x86)%\panda cloud systems management\ultravnc\ultravnc.ini
- %ProgramFiles(x86)%\panda cloud systems management\ultravnc\winvnc.exe
- %ProgramFiles(x86)%\panda cloud systems management\ultravnc\schook.dll
- %ProgramFiles(x86)%\panda cloud systems management\ultravnc\cad.exe
- %ProgramFiles(x86)%\panda cloud systems management\cagservice.exe.config
- %ProgramFiles(x86)%\panda cloud systems management\newtonsoft.json.dll
- %ProgramFiles(x86)%\panda cloud systems management\windowsagent.dll
- %ProgramFiles(x86)%\panda cloud systems management\weifenluo.winformsui.docking.dll
- %ProgramFiles(x86)%\panda cloud systems management\transitions.dll
- %ProgramFiles(x86)%\panda cloud systems management\scvncctrl.dll
- %ProgramFiles(x86)%\panda cloud systems management\mono.addins.setup.dll
- %ProgramFiles(x86)%\panda cloud systems management\mono.addins.dll
- %ProgramFiles(x86)%\panda cloud systems management\linqbridge.dll
- %ProgramFiles(x86)%\panda cloud systems management\interop.viewerx.dll
- %ProgramFiles(x86)%\panda cloud systems management\interop.mstsclib.dll
- %ProgramFiles(x86)%\panda cloud systems management\icsharpcode.sharpziplib.dll
- %ProgramFiles(x86)%\panda cloud systems management\gui.exe
- %ProgramFiles(x86)%\panda cloud systems management\core.xmlserializers.dll
- %ProgramFiles(x86)%\panda cloud systems management\core.dll
- %ProgramFiles(x86)%\panda cloud systems management\cagservice.exe
- %ProgramFiles(x86)%\panda cloud systems management\axinterop.viewerx.dll
- %ProgramFiles(x86)%\panda cloud systems management\axinterop.mstsclib.dll
- %ProgramFiles(x86)%\panda cloud systems management\defaultbrand.zip
- %ProgramFiles(x86)%\panda cloud systems management\es\gui.resources.dll
- %ProgramFiles(x86)%\panda cloud systems management\de\gui.resources.dll
- %ProgramFiles(x86)%\panda cloud systems management\fr\gui.resources.dll
- %ProgramFiles(x86)%\panda cloud systems management\it\gui.resources.dll
- %WINDIR%\temp\s17qas_3.dll
- %WINDIR%\temp\res665e.tmp
- %WINDIR%\temp\csc664d.tmp
- %ProgramFiles(x86)%\panda cloud systems management\uninst.exe
- %WINDIR%\temp\s17qas_3.out
- %WINDIR%\temp\s17qas_3.cmdline
- %WINDIR%\temp\s17qas_3.0.cs
- %PROGRAMDATA%\centrastage\addins\cagservice\addin-db-001\host-index.new
- %PROGRAMDATA%\centrastage\addins\cagservice\addin-db-001\addin-dir-data\c__program files (x86)_panda cloud systems management_ce16befb.data.new
- %PROGRAMDATA%\centrastage\addins\cagservice\addin-db-001\addin-data\1\__windowsagent,1.0.maddin.new
- %PROGRAMDATA%\centrastage\addins\cagservice\addin-db-001\addin-data\1\cag.core,1.0.maddin.new
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\gqdudi8y.newcfg
- %PROGRAMDATA%\centrastage\addins\cagservice\addin-db-001\hosts\cagservice.addins
- %ProgramFiles(x86)%\panda cloud systems management\log.txt
- %TEMP%\nst33e4.tmp\nsexec.dll
- %TEMP%\nst33e4.tmp\nsscm.dll
- %TEMP%\nst33e4.tmp\nsprocess.dll
- %TEMP%\nst33e4.tmp\simplefc.dll
- %PROGRAMDATA%\microsoft\windows\start menu\programs\panda cloud systems management\uninstall agent.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\panda cloud systems management\agent browser.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\panda cloud systems management\agent monitor.lnk
- %TEMP%\nst33e4.tmp\nsisxml.dll
- %ProgramFiles(x86)%\panda cloud systems management\sv\gui.resources.dll
- %ProgramFiles(x86)%\panda cloud systems management\pt\gui.resources.dll
- %PROGRAMDATA%\centrastage\monitoring\deviceuptimeperformancemonitorv2.xml
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\knhql4vd.newcfg
Удаляет следующие файлы
- %TEMP%\nst33e4.tmp\nsexec.dll
- %WINDIR%\temp\csc4d52.tmp
- %WINDIR%\temp\pqr-newn.dll
- %WINDIR%\temp\pqr-newn.cmdline
- %WINDIR%\temp\pqr-newn.0.cs
- %WINDIR%\temp\pqr-newn.out
- %WINDIR%\temp\res50cd.tmp
- %WINDIR%\temp\csc50cc.tmp
- %WINDIR%\temp\s17qas_3.0.cs
- %WINDIR%\temp\yt4kx-vm.out
- %WINDIR%\temp\yt4kx-vm.dll
- %WINDIR%\temp\yt4kx-vm.0.cs
- %PROGRAMDATA%\centrastage\packages\b198fbe8-5b8f-bbf0-0375-9918aa3ef7f8
- %WINDIR%\temp\res73c7.tmp
- %WINDIR%\temp\csc73c6.tmp
- %WINDIR%\temp\crfq87r9.0.cs
- %WINDIR%\temp\crfq87r9.out
- %WINDIR%\temp\tar9a14.tmp
- %WINDIR%\temp\res4d53.tmp
- %WINDIR%\temp\cab9a13.tmp
- %WINDIR%\temp\tar840a.tmp
- %WINDIR%\temp\cab83f9.tmp
- %TEMP%\nst33e4.tmp\nsprocess.dll
- %TEMP%\nst33e4.tmp\nsscm.dll
- %TEMP%\nst33e4.tmp\simplefc.dll
- %WINDIR%\temp\res665e.tmp
- %WINDIR%\temp\csc664d.tmp
- %WINDIR%\temp\s17qas_3.cmdline
- %WINDIR%\temp\s17qas_3.out
- %WINDIR%\temp\crfq87r9.dll
- %WINDIR%\temp\yt4kx-vm.cmdline
- %WINDIR%\temp\s17qas_3.dll
- %TEMP%\csc7f53.tmp
- %TEMP%\tebxldxg.cmdline
- %TEMP%\tebxldxg.dll
- %TEMP%\tebxldxg.out
- %TEMP%\tebxldxg.0.cs
- %WINDIR%\temp\cab83d8.tmp
- %WINDIR%\temp\tar83d9.tmp
- %TEMP%\nst33e4.tmp\nsisxml.dll
- %TEMP%\res7f54.tmp
- %WINDIR%\temp\crfq87r9.cmdline
Перемещает следующие файлы
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\gqdudi8y.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\user.config
- %PROGRAMDATA%\centrastage\addins\cagservice\addin-db-001\addin-data\1\cag.core,1.0.maddin.new в %PROGRAMDATA%\centrastage\addins\cagservice\addin-db-001\addin-data\1\cag.core,1.0.maddin
- %PROGRAMDATA%\centrastage\addins\cagservice\addin-db-001\addin-data\1\__windowsagent,1.0.maddin.new в %PROGRAMDATA%\centrastage\addins\cagservice\addin-db-001\addin-data\1\__windowsagent,1.0.maddin
- %PROGRAMDATA%\centrastage\addins\cagservice\addin-db-001\addin-dir-data\c__program files (x86)_panda cloud systems management_ce16befb.data.new в %PROGRAMDATA%\centrastage\addins\cagservice\addin-db-001\addin-dir-data\c__program files (x86)_panda cloud systems management_ce16befb.data
- %PROGRAMDATA%\centrastage\addins\cagservice\addin-db-001\host-index.new в %PROGRAMDATA%\centrastage\addins\cagservice\addin-db-001\host-index
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\h0ggiu8k.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\user.config
- <LS_APPDATA>\centrastage\gui.exe_url_qduk0ekofj2gspii32qw2p3odqm53q21\4.4.1803.1803\kdb7slld.newcfg в <LS_APPDATA>\centrastage\gui.exe_url_qduk0ekofj2gspii32qw2p3odqm53q21\4.4.1803.1803\user.config
- <LS_APPDATA>\centrastage\gui.exe_url_qduk0ekofj2gspii32qw2p3odqm53q21\4.4.1803.1803\ktct2_gj.newcfg в <LS_APPDATA>\centrastage\gui.exe_url_qduk0ekofj2gspii32qw2p3odqm53q21\4.4.1803.1803\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\9ryffd2p.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\yoq5-v6e.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\juzge5dq.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\kzgqt7b5.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\gcstmeeo.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\dts_zyii.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\knhql4vd.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_0uycjuatrm5vdq0zr2f3jqwhywajqoo0\4.4.1803.1803\user.config.bak
Подменяет следующие файлы
- %PROGRAMDATA%\centrastage\packages\b198fbe8-5b8f-bbf0-0375-9918aa3ef7f8
Сетевая активность
TCP
Запросы HTTP GET
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt
UDP
- DNS ASK 01#####.pandasecurity.com
- DNS ASK 25#.###.#55.255.in-addr.arpa
- DNS ASK sm######e.pandasecurity.com
- '255.255.255.255':13300
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- '%ProgramFiles(x86)%\panda cloud systems management\cagservice.exe'
- '%ProgramFiles(x86)%\panda cloud systems management\ultravnc\winvnc.exe' -service
- '%ProgramFiles(x86)%\panda cloud systems management\gui.exe'
- '%ProgramFiles(x86)%\panda cloud systems management\ultravnc\winvnc.exe' -service_run
- '%WINDIR%\syswow64\taskkill.exe' /f /im winvnc.exe' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\s17qas_3.cmdline"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES665E.tmp" "%WINDIR%\Temp\CSC664D.tmp"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tebxldxg.cmdline"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7F54.tmp" "%TEMP%\CSC7F53.tmp"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\pqr-newn.cmdline"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES4D53.tmp" "%WINDIR%\Temp\CSC4D52.tmp"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\yt4kx-vm.cmdline"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES50CD.tmp" "%WINDIR%\Temp\CSC50CC.tmp"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\crfq87r9.cmdline"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES73C7.tmp" "%WINDIR%\Temp\CSC73C6.tmp"' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Panda Cloud Systems Management\scvncctrl.dll"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\s17qas_3.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES665E.tmp" "%WINDIR%\Temp\CSC664D.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tebxldxg.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7F54.tmp" "%TEMP%\CSC7F53.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\pqr-newn.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES4D53.tmp" "%WINDIR%\Temp\CSC4D52.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\yt4kx-vm.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES50CD.tmp" "%WINDIR%\Temp\CSC50CC.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\crfq87r9.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES73C7.tmp" "%WINDIR%\Temp\CSC73C6.tmp"
