Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\sfdrv01] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\KupSvrLookup] 'Start' = '00000002'
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1183 -r Pass1183 -f 220.181.114.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns33.tmp ipseccmd -p Pass119 -r Pass119 -f 220.181.115.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass119 -r Pass119 -f 220.181.115.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns32.tmp ipseccmd -p Pass1183 -r Pass1183 -f 220.181.114.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1181 -r Pass1181 -f 220.181.112.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns31.tmp ipseccmd -p Pass1182 -r Pass1182 -f 220.181.113.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1182 -r Pass1182 -f 220.181.113.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns34.tmp ipseccmd -p Pass1110 -r Pass1110 -f 220.181.118.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1112 -r Pass1112 -f 220.181.23.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns37.tmp ipseccmd -p Pass1212 -r Pass1212 -f 220.181.24.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1212 -r Pass1212 -f 220.181.24.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns36.tmp ipseccmd -p Pass1112 -r Pass1112 -f 220.181.23.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1110 -r Pass1110 -f 220.181.118.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns35.tmp ipseccmd -p Pass1111 -r Pass1111 -f 220.181.135.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1111 -r Pass1111 -f 220.181.135.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns30.tmp ipseccmd -p Pass1181 -r Pass1181 -f 220.181.112.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1161 -r Pass1161 -f 220.181.101.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns2B.tmp ipseccmd -p Pass1162 -r Pass1162 -f 220.181.102.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1162 -r Pass1162 -f 220.181.102.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns2A.tmp ipseccmd -p Pass1161 -r Pass1161 -f 220.181.101.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1151 -r Pass1151 -f 125.39.89.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns29.tmp ipseccmd -p Pass116 -r Pass116 -f 220.181.100.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass116 -r Pass116 -f 220.181.100.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns2C.tmp ipseccmd -p Pass1163 -r Pass1163 -f 220.181.103.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass117 -r Pass117 -f 220.181.105.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns2F.tmp ipseccmd -p Pass118 -r Pass118 -f 220.181.111.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass118 -r Pass118 -f 220.181.111.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns2E.tmp ipseccmd -p Pass117 -r Pass117 -f 220.181.105.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1163 -r Pass1163 -f 220.181.103.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns2D.tmp ipseccmd -p Pass1171 -r Pass1171 -f 220.181.104.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1171 -r Pass1171 -f 220.181.104.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns38.tmp ipseccmd -p Pass1312 -r Pass1312 -f 220.181.25.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1118 -r Pass1118 -f 220.181.50.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns43.tmp ipseccmd -p Pass1119 -r Pass1119 -f 220.181.6.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1119 -r Pass1119 -f 220.181.6.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns42.tmp ipseccmd -p Pass1118 -r Pass1118 -f 220.181.50.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1116 -r Pass1116 -f 220.181.4.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns41.tmp ipseccmd -p Pass1117 -r Pass1117 -f 220.181.43.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1117 -r Pass1117 -f 220.181.43.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns44.tmp ipseccmd -p Pass1120 -r Pass1120 -f 220.181.69.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1122 -r Pass1122 -f 221.194.129.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\un0214144000245.exe
- %TEMP%\~nsu.tmp\Au_.exe _?=%PROGRAM_FILES%\FeixinMedia\
- %TEMP%\nss2.tmp\ns46.tmp ipseccmd -p Pass1122 -r Pass1122 -f 221.194.129.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1120 -r Pass1120 -f 220.181.69.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns45.tmp ipseccmd -p Pass1121 -r Pass1121 -f 220.181.92.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1121 -r Pass1121 -f 220.181.92.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns40.tmp ipseccmd -p Pass1116 -r Pass1116 -f 220.181.4.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1412 -r Pass1412 -f 220.181.27.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns3B.tmp ipseccmd -p Pass1512 -r Pass1512 -f 220.181.28.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1512 -r Pass1512 -f 220.181.28.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns3A.tmp ipseccmd -p Pass1412 -r Pass1412 -f 220.181.27.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1312 -r Pass1312 -f 220.181.25.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns39.tmp ipseccmd -p Pass1113 -r Pass1113 -f 220.181.26.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1113 -r Pass1113 -f 220.181.26.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns3C.tmp ipseccmd -p Pass1612 -r Pass1612 -f 220.181.29.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1114 -r Pass1114 -f 220.181.31.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns3F.tmp ipseccmd -p Pass1115 -r Pass1115 -f 220.181.38.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1115 -r Pass1115 -f 220.181.38.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns3E.tmp ipseccmd -p Pass1114 -r Pass1114 -f 220.181.31.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1612 -r Pass1612 -f 220.181.29.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns3D.tmp ipseccmd -p Pass1712 -r Pass1712 -f 220.181.30.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1712 -r Pass1712 -f 220.181.30.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns28.tmp ipseccmd -p Pass1151 -r Pass1151 -f 125.39.89.*+0 -n PASS -x
- %TEMP%\nsgF.tmp\ns11.tmp sc description KupSvrLookup "К№УГ IPv6 ЧЄ»»јјКхМṩЅшРР»ҐБЄНшдЇААёьРВТФј°Ф¤¶БјУЛЩ·юОсЎЈИз№ыНЈЦ№ёГ·юОсЈ¬ФтјЖЛг»ъЅ«І»ѕЯ±ёХвР©јјКхМṩµДјУЛЩ№¦ДЬЎЈ"
- %TEMP%\nsgF.tmp\ns12.tmp sc start KupSvrLookup
- %PROGRAM_FILES%\Common\kupdata.exe
- %TEMP%\nsgF.tmp\ns10.tmp sc create KupSvrLookup binpath= "%PROGRAM_FILES%\Common\kupdata.exe" type= share start= auto displayname= "ISATAP And Teredo To Cache Services"
- %TEMP%\nss2.tmp\nsD.tmp ipseccmd -p Block0 -r Block0 -f 118.145.*.*+0 -n BLOCK -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Block0 -r Block0 -f 118.145.*.*+0 -n BLOCK -x
- %PROGRAM_FILES%\FeixinMedia\mysetup.exe
- %TEMP%\nsgF.tmp\ns13.tmp sc create sfdrv01 binpath= <SYSTEM32>\starforce\sfdrv01.sys type= kernel start= system group= Base tag= yes
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass2 -r Pass2 -f 220.181.126.15+0 -n PASS -x
- %TEMP%\nss2.tmp\ns17.tmp ipseccmd -p Pass11 -r Pass11 -f 119.147.15.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass11 -r Pass11 -f 119.147.15.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns16.tmp ipseccmd -p Pass2 -r Pass2 -f 220.181.126.15+0 -n PASS -x
- %TEMP%\nsgF.tmp\ns14.tmp sc start sfdrv01
- %TEMP%\nss2.tmp\ns15.tmp ipseccmd -p Pass1 -r Pass1 -f 125.39.100.74+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1 -r Pass1 -f 125.39.100.74+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Block9 -r Block9 -f 221.194.*.*+0 -n BLOCK -x
- %TEMP%\nss2.tmp\ns7.tmp ipseccmd -p Block2 -r BlockNEW -f 119.188.*.*+0 -n BLOCK -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Block2 -r BlockNEW -f 119.188.*.*+0 -n BLOCK -x
- %TEMP%\nss2.tmp\ns8.tmp ipseccmd -p Block3 -r BlockTWO -f 122.70.*.*+0 -n BLOCK -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Block1 -r BlockTCP -f 119.147.*.*+0 -n BLOCK -x
- <Current directory>\mzone-5943.exe
- %TEMP%\nss2.tmp\ns5.tmp sc start PolicyAgent
- %TEMP%\nss2.tmp\ns6.tmp ipseccmd -p Block1 -r BlockTCP -f 119.147.*.*+0 -n BLOCK -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Block3 -r BlockTWO -f 122.70.*.*+0 -n BLOCK -x
- %TEMP%\nss2.tmp\nsB.tmp ipseccmd -p Block8 -r Block8 -f 220.181.*.*+0 -n BLOCK -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Block8 -r Block8 -f 220.181.*.*+0 -n BLOCK -x
- %TEMP%\nss2.tmp\nsC.tmp ipseccmd -p Block9 -r Block9 -f 221.194.*.*+0 -n BLOCK -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Block6 -r Block6 -f 125.39.*.*+0 -n BLOCK -x
- %TEMP%\nss2.tmp\ns9.tmp ipseccmd -p Block4 -r BlockTHREE -f 124.238.*.*+0 -n BLOCK -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Block4 -r BlockTHREE -f 124.238.*.*+0 -n BLOCK -x
- %TEMP%\nss2.tmp\nsA.tmp ipseccmd -p Block6 -r Block6 -f 125.39.*.*+0 -n BLOCK -x
- %TEMP%\nss2.tmp\ns18.tmp ipseccmd -p Pass12 -r Pass12 -f 119.147.182.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass112 -r Pass112 -f 125.39.39.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns23.tmp ipseccmd -p Pass113 -r Pass113 -f 125.39.78.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass113 -r Pass113 -f 125.39.78.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns22.tmp ipseccmd -p Pass112 -r Pass112 -f 125.39.39.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass110 -r Pass110 -f 125.39.127.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns21.tmp ipseccmd -p Pass111 -r Pass111 -f 125.39.185.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass111 -r Pass111 -f 125.39.185.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns24.tmp ipseccmd -p Pass114 -r Pass114 -f 125.39.85.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass115 -r Pass115 -f 125.39.87.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns27.tmp ipseccmd -p Pass1155 -r Pass1155 -f 125.39.88.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1155 -r Pass1155 -f 125.39.88.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns26.tmp ipseccmd -p Pass115 -r Pass115 -f 125.39.87.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass114 -r Pass114 -f 125.39.85.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns25.tmp ipseccmd -p Pass1144 -r Pass1144 -f 125.39.86.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass1144 -r Pass1144 -f 125.39.86.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns20.tmp ipseccmd -p Pass110 -r Pass110 -f 125.39.127.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass14 -r Pass14 -f 119.147.41.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns1B.tmp ipseccmd -p Pass15 -r Pass15 -f 119.147.64.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass15 -r Pass15 -f 119.147.64.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns1A.tmp ipseccmd -p Pass14 -r Pass14 -f 119.147.41.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass12 -r Pass12 -f 119.147.182.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns19.tmp ipseccmd -p Pass13 -r Pass13 -f 119.147.21.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass13 -r Pass13 -f 119.147.21.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns1C.tmp ipseccmd -p Pass16 -r Pass16 -f 119.147.74.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass18 -r Pass18 -f 122.70.142.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns1F.tmp ipseccmd -p Pass19 -r Pass19 -f 125.39.123.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass19 -r Pass19 -f 125.39.123.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns1E.tmp ipseccmd -p Pass18 -r Pass18 -f 122.70.142.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass16 -r Pass16 -f 119.147.74.*+0 -n PASS -x
- %TEMP%\nss2.tmp\ns1D.tmp ipseccmd -p Pass17 -r Pass17 -f 119.147.9.*+0 -n PASS -x
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass17 -r Pass17 -f 119.147.9.*+0 -n PASS -x
- <SYSTEM32>\sc.exe start KupSvrLookup
- <SYSTEM32>\sc.exe create sfdrv01 binpath= <SYSTEM32>\starforce\sfdrv01.sys type= kernel start= system group= Base tag= yes
- <SYSTEM32>\sc.exe start sfdrv01
- <SYSTEM32>\sc.exe start PolicyAgent
- <SYSTEM32>\sc.exe create KupSvrLookup binpath= "%PROGRAM_FILES%\Common\kupdata.exe" type= share start= auto displayname= "ISATAP And Teredo To Cache Services"
- <SYSTEM32>\sc.exe description KupSvrLookup "К№УГ IPv6 ЧЄ»»јјКхМṩЅшРР»ҐБЄНшдЇААёьРВТФј°Ф¤¶БјУЛЩ·юОсЎЈИз№ыНЈЦ№ёГ·юОсЈ¬ФтјЖЛг»ъЅ«І»ѕЯ±ёХвР©јјКхМṩµДјУЛЩ№¦ДЬЎЈ"
- %TEMP%\nss2.tmp\ns28.tmp
- %TEMP%\nss2.tmp\ns29.tmp
- %TEMP%\nss2.tmp\ns27.tmp
- %TEMP%\nss2.tmp\ns25.tmp
- %TEMP%\nss2.tmp\ns26.tmp
- %TEMP%\nss2.tmp\ns2A.tmp
- %TEMP%\nss2.tmp\ns2E.tmp
- %TEMP%\nss2.tmp\ns2F.tmp
- %TEMP%\nss2.tmp\ns2D.tmp
- %TEMP%\nss2.tmp\ns2B.tmp
- %TEMP%\nss2.tmp\ns2C.tmp
- %TEMP%\nss2.tmp\ns24.tmp
- %TEMP%\nss2.tmp\ns1C.tmp
- %TEMP%\nss2.tmp\ns1D.tmp
- %TEMP%\nss2.tmp\ns1B.tmp
- %TEMP%\nss2.tmp\ns19.tmp
- %TEMP%\nss2.tmp\ns1A.tmp
- %TEMP%\nss2.tmp\ns1E.tmp
- %TEMP%\nss2.tmp\ns22.tmp
- %TEMP%\nss2.tmp\ns23.tmp
- %TEMP%\nss2.tmp\ns21.tmp
- %TEMP%\nss2.tmp\ns1F.tmp
- %TEMP%\nss2.tmp\ns20.tmp
- %TEMP%\nss2.tmp\ns30.tmp
- %TEMP%\nss2.tmp\ns40.tmp
- %TEMP%\nss2.tmp\ns41.tmp
- %TEMP%\nss2.tmp\ns3F.tmp
- %TEMP%\nss2.tmp\ns3D.tmp
- %TEMP%\nss2.tmp\ns3E.tmp
- %TEMP%\nss2.tmp\ns42.tmp
- %TEMP%\nss2.tmp\ns46.tmp
- %TEMP%\~nsu.tmp\Au_.exe
- %TEMP%\nss2.tmp\ns45.tmp
- %TEMP%\nss2.tmp\ns43.tmp
- %TEMP%\nss2.tmp\ns44.tmp
- %TEMP%\nss2.tmp\ns3C.tmp
- %TEMP%\nss2.tmp\ns34.tmp
- %TEMP%\nss2.tmp\ns35.tmp
- %TEMP%\nss2.tmp\ns33.tmp
- %TEMP%\nss2.tmp\ns31.tmp
- %TEMP%\nss2.tmp\ns32.tmp
- %TEMP%\nss2.tmp\ns36.tmp
- %TEMP%\nss2.tmp\ns3A.tmp
- %TEMP%\nss2.tmp\ns3B.tmp
- %TEMP%\nss2.tmp\ns39.tmp
- %TEMP%\nss2.tmp\ns37.tmp
- %TEMP%\nss2.tmp\ns38.tmp
- %TEMP%\nss2.tmp\ns18.tmp
- %TEMP%\nss2.tmp\ns6.tmp
- %TEMP%\nss2.tmp\ns7.tmp
- %TEMP%\nss2.tmp\ns5.tmp
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe
- %TEMP%\nss2.tmp\nsExec.dll
- %TEMP%\nss2.tmp\ns8.tmp
- %TEMP%\nss2.tmp\nsC.tmp
- %TEMP%\nss2.tmp\nsD.tmp
- %TEMP%\nss2.tmp\nsB.tmp
- %TEMP%\nss2.tmp\ns9.tmp
- %TEMP%\nss2.tmp\nsA.tmp
- %TEMP%\nss2.tmp\nsisplugin.dll
- %TEMP%\nss2.tmp\System.dll
- %PROGRAM_FILES%\FeixinMedia\temp0214144000245.ini
- <Current directory>\mzone-5943.exe
- %PROGRAM_FILES%\FeixinMedia\menu.xml
- %PROGRAM_FILES%\FeixinMedia\s0001.xml
- %PROGRAM_FILES%\FeixinMedia\un0214144000245.exe
- %TEMP%\nsk4.tmp\modern-wizard.bmp
- %TEMP%\nsk4.tmp\InstallOptions.dll
- %TEMP%\nsk4.tmp\ioSpecial.ini
- %TEMP%\nss2.tmp\nsRandom.dll
- %TEMP%\nss2.tmp\Internet.dll
- %PROGRAM_FILES%\FeixinMedia\mysetup.exe
- <SYSTEM32>\starforce\sfdrv01.sys
- %TEMP%\nsgF.tmp\ns13.tmp
- %WINDIR%\yypro.pac
- %TEMP%\nsgF.tmp\ns12.tmp
- %PROGRAM_FILES%\Common\pro.txt
- C:\tthread.txt
- %TEMP%\nss2.tmp\ns16.tmp
- %TEMP%\nss2.tmp\ns17.tmp
- %TEMP%\nss2.tmp\ns15.tmp
- %TEMP%\nsgF.tmp\ns14.tmp
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\ol[1].asp
- %TEMP%\nsgF.tmp\ns11.tmp
- %PROGRAM_FILES%\Common\sfdrv01-nos.sys
- %PROGRAM_FILES%\Common\kupdata.exe
- %PROGRAM_FILES%\Common\msxml2.dll
- %PROGRAM_FILES%\Common\sqlite3.dll
- %PROGRAM_FILES%\Common\ypac.txt
- %PROGRAM_FILES%\Common\suject.db
- %TEMP%\nsgF.tmp\nsExec.dll
- %TEMP%\nsgF.tmp\ns10.tmp
- %TEMP%\nsgF.tmp\System.dll
- %PROGRAM_FILES%\Common\sfdrv01.sys
- %TEMP%\nsgF.tmp\AccessControl.dll
- %TEMP%\nss2.tmp\ns33.tmp
- %TEMP%\nss2.tmp\ns34.tmp
- %TEMP%\nss2.tmp\ns31.tmp
- %TEMP%\nss2.tmp\ns32.tmp
- %TEMP%\nss2.tmp\ns35.tmp
- %TEMP%\nss2.tmp\ns38.tmp
- %TEMP%\nss2.tmp\ns39.tmp
- %TEMP%\nss2.tmp\ns36.tmp
- %TEMP%\nss2.tmp\ns37.tmp
- %TEMP%\nss2.tmp\ns30.tmp
- %TEMP%\nss2.tmp\ns29.tmp
- %TEMP%\nss2.tmp\ns2A.tmp
- %TEMP%\nss2.tmp\ns27.tmp
- %TEMP%\nss2.tmp\ns28.tmp
- %TEMP%\nss2.tmp\ns2B.tmp
- %TEMP%\nss2.tmp\ns2E.tmp
- %TEMP%\nss2.tmp\ns2F.tmp
- %TEMP%\nss2.tmp\ns2C.tmp
- %TEMP%\nss2.tmp\ns2D.tmp
- %TEMP%\nss2.tmp\ns3A.tmp
- %PROGRAM_FILES%\FeixinMedia\ipseccmd.exe
- %TEMP%\nss2.tmp\Internet.dll
- %TEMP%\nss2.tmp\ns45.tmp
- %TEMP%\nss2.tmp\ns46.tmp
- %TEMP%\nss2.tmp\nsExec.dll
- %TEMP%\nss2.tmp\System.dll
- %PROGRAM_FILES%\FeixinMedia\un0214144000245.exe
- %TEMP%\nss2.tmp\nsisplugin.dll
- %TEMP%\nss2.tmp\nsRandom.dll
- %TEMP%\nss2.tmp\ns44.tmp
- %TEMP%\nss2.tmp\ns3D.tmp
- %TEMP%\nss2.tmp\ns3E.tmp
- %TEMP%\nss2.tmp\ns3B.tmp
- %TEMP%\nss2.tmp\ns3C.tmp
- %TEMP%\nss2.tmp\ns3F.tmp
- %TEMP%\nss2.tmp\ns42.tmp
- %TEMP%\nss2.tmp\ns43.tmp
- %TEMP%\nss2.tmp\ns40.tmp
- %TEMP%\nss2.tmp\ns41.tmp
- %TEMP%\nss2.tmp\ns26.tmp
- %TEMP%\nsgF.tmp\ns13.tmp
- %TEMP%\nsgF.tmp\ns14.tmp
- %TEMP%\nsgF.tmp\ns11.tmp
- %TEMP%\nsgF.tmp\ns12.tmp
- %PROGRAM_FILES%\Common\sfdrv01.sys
- %TEMP%\nsgF.tmp\nsExec.dll
- %TEMP%\nsgF.tmp\System.dll
- %PROGRAM_FILES%\Common\sfdrv01-nos.sys
- %TEMP%\nsgF.tmp\AccessControl.dll
- %TEMP%\nsgF.tmp\ns10.tmp
- %TEMP%\nss2.tmp\ns7.tmp
- %TEMP%\nss2.tmp\ns8.tmp
- %TEMP%\nss2.tmp\ns5.tmp
- %TEMP%\nss2.tmp\ns6.tmp
- %TEMP%\nss2.tmp\ns9.tmp
- %TEMP%\nss2.tmp\nsC.tmp
- %TEMP%\nss2.tmp\nsD.tmp
- %TEMP%\nss2.tmp\nsA.tmp
- %TEMP%\nss2.tmp\nsB.tmp
- %PROGRAM_FILES%\FeixinMedia\mysetup.exe
- %TEMP%\nss2.tmp\ns1F.tmp
- %TEMP%\nss2.tmp\ns20.tmp
- %TEMP%\nss2.tmp\ns1D.tmp
- %TEMP%\nss2.tmp\ns1E.tmp
- %TEMP%\nss2.tmp\ns21.tmp
- %TEMP%\nss2.tmp\ns24.tmp
- %TEMP%\nss2.tmp\ns25.tmp
- %TEMP%\nss2.tmp\ns22.tmp
- %TEMP%\nss2.tmp\ns23.tmp
- %TEMP%\nss2.tmp\ns1C.tmp
- %TEMP%\nss2.tmp\ns15.tmp
- %TEMP%\nss2.tmp\ns16.tmp
- %PROGRAM_FILES%\FeixinMedia\s0001.xml
- %PROGRAM_FILES%\FeixinMedia\menu.xml
- %TEMP%\nss2.tmp\ns17.tmp
- %TEMP%\nss2.tmp\ns1A.tmp
- %TEMP%\nss2.tmp\ns1B.tmp
- %TEMP%\nss2.tmp\ns18.tmp
- %TEMP%\nss2.tmp\ns19.tmp
- 'localhost':1037
- 'tj.#233.com':80
- tj.#233.com/ol.asp?t=###################################
- tj.#233.com/svr.asp?c=#######################################
- DNS ASK tj.#233.com
- ClassName: 'Shell_TrayWnd' WindowName: ''