Technical Information
- [<HKLM>\SOFTWARE\Classes\fsp\shell\open\command] '' = '"%ProgramFiles(x86)%\Funshion Online\Funshion\Funshion.exe" "%1"'
- [<HKLM>\Software\Classes\Funshion Task\shell\open\Command] '' = '"%ProgramFiles(x86)%\Funshion Online\Funshion\Funshion.exe" "%1" /dummy'
- [<HKLM>\Software\Wow6432Node\MicroSoft\windows\CurrentVersion\Run] 'Funshion' = '%ProgramFiles(x86)%\Funshion Online\Funshion\Funshion.exe'
- [<HKLM>\Software\Classes\fsp\shell\open\command] '' = '"%ProgramFiles(x86)%\Funshion Online\Funshion\Funshion.exe" %1'
- '%WINDIR%\syswow64\taskkill.exe' /f /im "Funshion.exe"
- '%WINDIR%\syswow64\taskkill.exe' /f /im "FSPServer.exe"
- '%WINDIR%\syswow64\taskkill.exe' /f /im "FunshionService.exe"
- %TEMP%\nsce44d.tmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskmgnbarbk.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskmgnbaritem.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskmgnbarlscrollbtn.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskmgnbarlist.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskmgnbarrscrollbtn.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskmgntitlebkgnd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskmgntitleleft.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskmgntitleright.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\tasktabbkgnd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\tasktoolbarbkgnd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskmanagerclosebtn.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskmanagerclosetxtbtn.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\tasktoolbardelete.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\tasktoolbardownloaden.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\tasktoolbarrestore.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\tasktoolbarrestoreen.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\tasktoolbarstop.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\tasktoolbarstopen.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\thumbs.db
- %ProgramFiles(x86)%\funshion online\funshion\skin\tipbottomarrow.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\tiprightarrow.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\tiptoparrow.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskdown.ico
- %ProgramFiles(x86)%\funshion online\funshion\skin\tasktoolbardeleteen.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\tasktoolbardownload.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskliststatselicon.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\tasklistrightline.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskplaying.ico
- %ProgramFiles(x86)%\funshion online\funshion\skin\rpcstartdlgbk.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\scrollbardownarrow.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\scrollbardownarrowround.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\scrollbaruparrow.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\scrollbaruparrowround.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\scrollbarverbkgnd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\scrollbarverwidgetbkgnd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\scrollbarverwidgethead.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\scrollbarverwidgetmid.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\scrollbarverwidgettrail.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\scrolllinkbkgnd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\scrolllinkfrm.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\settingdlgicon.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\splidbarbkgnd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\splidbarmark.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\statusbarbkgnd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\statusbarleft.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\statusbarright.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\statusbarsplid.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskbarbtnmenu.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskbarbtnopenlcl.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskbarbtnshowplayer.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskbartipdownarrow.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskpause.ico
- %ProgramFiles(x86)%\funshion online\funshion\skin\playertipclosebtn.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskliststaticons.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playinfobkgnd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskstop.ico
- %ProgramFiles(x86)%\funshion online\funshion\uninstall.exe
- %PROGRAMDATA%\microsoft\windows\start menu\programs\funshion\uninstall funshion.lnk
- %TEMP%\xml2fspdata.exe
- %TEMP%\nsmf054.tmp\execdos.dll
- %TEMP%\nsmf054.tmp\md5dll.dll
- %TEMP%\nsmf054.tmp\nsisdl.dll
- %HOMEPATH%\funshion\install.ini
- %TEMP%\getmacaddress.dll
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\install.ini
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\funshion_clone.exe
- %HOMEPATH%\funshion\cache\cacheflash\blankfs.swf
- %HOMEPATH%\funshion\cache\cacheflash\donghua1_16.swf
- %HOMEPATH%\funshion\cache\cacheflash\donghua3_18.swf
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\selfdel.bat
- %ProgramFiles(x86)%\funshion online\funshion\funshion.ini
- %APPDATA%\microsoft\windows\cookies\user@funshion[1].txt
- %APPDATA%\microsoft\windows\cookies\user@funshion[2].txt
- %HOMEPATH%\funshion\fsdxdiag.txt
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\dnserrordiagoff_weboc[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\navcancl[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagetemplate[2]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]
- %HOMEPATH%\funshion\fstracert.txt
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\httperrorpagesscripts[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\background_gradient[2]
- %ProgramFiles(x86)%\funshion online\funshion\funshionhelp.url
- %ProgramFiles(x86)%\funshion online\funshion\skin\playerhidebtnrgn.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\rpcloading.gif
- %ProgramFiles(x86)%\funshion online\funshion\media\start funshion.lnk
- %WINDIR%\syswow64\funshion.ini
- %HOMEPATH%\funshion.ini
- %ProgramFiles(x86)%\funshion online\funshion\pncrt.dll
- %ProgramFiles(x86)%\funshion online\funshion\pndx5016.dll
- %ProgramFiles(x86)%\funshion online\funshion\pndx5032.dll
- %ProgramFiles(x86)%\funshion online\funshion\rmoc3260.dll
- %ProgramFiles(x86)%\funshion online\funshion\cook.dll
- %ProgramFiles(x86)%\funshion online\funshion\drvc.dll
- %WINDIR%\syswow64\coreaac.ax
- %TEMP%\funshion.ini
- %HOMEPATH%\funshion\cacheflash\donghua3_18.swf
- %HOMEPATH%\funshion\cacheflash\donghua1_16.swf
- %HOMEPATH%\funshion\cacheflash\blankfs.swf
- %HOMEPATH%\funshion\flash-1.swf
- %ProgramFiles(x86)%\funshion online\funshion\funshionimg.jpg
- %ProgramFiles(x86)%\funshion online\funshion\funshion-install.ico
- %ProgramFiles(x86)%\funshion online\funshion\funshiongame.ico
- C:\users\public\desktop\pop game corpora.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\funshion\pop game corpora.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\funshion\funshion use help.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\funshion\update history.lnk
- C:\users\public\desktop\funshion.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\funshion.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\funshion\funshion.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\funshion.lnk
- %ProgramFiles(x86)%\funshion online\funshion\media\install latest funshion.lnk
- %ProgramFiles(x86)%\funshion online\funshion\skin\taskupload.ico
- %ProgramFiles(x86)%\funshion online\funshion\skin\playerhidebtn.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playerbarsplid.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playerbarrightbk.bmp
- %ProgramFiles(x86)%\funshion online\funshion\funshionplugin2.dll
- %ProgramFiles(x86)%\funshion online\funshion\quality.dll
- %ProgramFiles(x86)%\funshion online\funshion\upnp.dll
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\funshioninstall.exe
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\installlangam.dll
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\evid4226-vc80-mt.exe
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\bmps\3.bmp
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\bmps\4.bmp
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\bmps\5.bmp
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\bmps\6.bmp
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\bmps\dialog.bmp
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\bmps\ch_fin.bmp
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\bmps\ch_rcmd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\bmps\en_fin.bmp
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\bmps\en_rcmd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\buffering.gif
- %ProgramFiles(x86)%\funshion online\funshion\skin\captionbkgnd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\captionclosebtn.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\captionmaxbtn.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\captionmenubtn.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\captionmenubtnen.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\captionminbtn.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\captionnormalbtn.bmp
- %ProgramFiles(x86)%\funshion online\funshion\langresenamerican.dll
- %ProgramFiles(x86)%\funshion online\funshion\funshionservice.exe
- %ProgramFiles(x86)%\funshion online\funshion\dbghelp.dll
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[1]
- %ProgramFiles(x86)%\funshion online\funshion\skin\captiontext.bmp
- %ProgramFiles(x86)%\funshion online\funshion\funshion.exe
- %TEMP%\funshioninstall_c56435.exe
- %TEMP%\funshionme.exe
- %TEMP%\nsce44e.tmp\inetc.dll
- %TEMP%\nsaeb33.tmp
- %TEMP%\legendlog.ini
- %TEMP%\nsmf054.tmp\system.dll
- %TEMP%\nsmf054.tmp\findprocdll.dll
- %TEMP%\nsmf054.tmp\killprocdll.dll
- %TEMP%\nsmf054.tmp\execcmd.dll
- %TEMP%\nsmf054.tmp\welcomepage.ini
- %TEMP%\nsmf054.tmp\instpath.ini
- %TEMP%\nsce44e.tmp\system.dll
- %TEMP%\welcomepage.ini
- %TEMP%\mode.ini
- %TEMP%\blank.bmp
- %TEMP%\welcome.bmp
- %TEMP%\licensecn.bmp
- %TEMP%\licenseen.bmp
- %TEMP%\installpathcn.bmp
- %TEMP%\installpathen.bmp
- %TEMP%\installfilescn.bmp
- %TEMP%\installfilesen.bmp
- %ProgramFiles(x86)%\funshion online\funshion\crashreport.exe
- %ProgramFiles(x86)%\funshion online\funshion\encrypt.dll
- %TEMP%\instpath.ini
- %ProgramFiles(x86)%\funshion online\funshion\getmacaddress.dll
- %ProgramFiles(x86)%\funshion online\funshion\updatehistory.url
- %ProgramFiles(x86)%\funshion online\funshion\skin\captiontexten.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\ietoolbarback.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playinfocurplay.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playinfoheaderbkgnd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playinfotitlebk.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playlistaddbtn.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playlistremove.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playsplidbarbefore.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playsplidbarbkgnd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playsplidbardownload.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playsplidbarhead.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playsplidbarthumb.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playsplidbartrail.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playerbarbkgnd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playerbarbtnfullview.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playerbarbtnmute.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playerbarbtnnext.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playerbarbtnnormal.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playerbarbtnpause.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playerbarbtnplay.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playerbarbtnplaylist.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playerbarbtnpre.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playerbarbtnsetting.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playerbarbtnstop.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playerbarbtnvolume.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playerbarleftbk.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\diskwarnning.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playinfobtnmenu.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\dragcorner.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playinfobtmbar.bmp
- %ProgramFiles(x86)%\funshion online\funshion\routersetting.dll
- %ProgramFiles(x86)%\funshion online\funshion\skin\ietoolbarbacken.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\ietoolbarbkgnd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\ietoolbarforward.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\ietoolbarforwarden.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\ietoolbarhomepage.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\ietoolbarhomepageen.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\ietoolbarrefresh.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\ietoolbarrefreshen.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\listheaderbkgnd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\listheadersplid.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\mainncframebtm.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\mainncframeleft.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\mainncframeright.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\mainncframetop.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\mainncleftbtmcorner.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\mainnclefttopcorner.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\mainncrightbtmcorner.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\mainncrighttopcorner.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\pauseadclosebtn.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playbarvolumebarbkgnd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playbarvolumebarbkgndright.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playbarvolumebarthumb.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playbufferinfowndbkgnd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playbufferinfowndleft.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playbufferinfowndright.bmp
- %ProgramFiles(x86)%\funshion online\funshion\skin\playinfobkgndsel.bmp
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bullet[1]
- %TEMP%\xml2fspdata.exe
- %HOMEPATH%\funshion\cacheflash\blankfs.swf
- %HOMEPATH%\funshion\cacheflash\donghua1_16.swf
- %HOMEPATH%\funshion\cacheflash\donghua3_18.swf
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\install.ini
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\bmps\3.bmp
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\bmps\4.bmp
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\bmps\5.bmp
- %TEMP%\installpathcn.bmp
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\bmps\6.bmp
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\bmps\ch_rcmd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\bmps\dialog.bmp
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\bmps\en_fin.bmp
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\bmps\en_rcmd.bmp
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\funshioninstall.exe
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\funshion_clone.exe
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\installlangam.dll
- %TEMP%\nsmf054.tmp\system.dll
- %TEMP%\nsmf054.tmp\welcomepage.ini
- %TEMP%\nsmf054.tmp\nsisdl.dll
- %TEMP%\nsmf054.tmp\md5dll.dll
- %TEMP%\nsmf054.tmp\killprocdll.dll
- %TEMP%\nsce44e.tmp\system.dll
- %TEMP%\funshion.ini
- %TEMP%\welcomepage.ini
- %TEMP%\instpath.ini
- %TEMP%\mode.ini
- %TEMP%\welcome.bmp
- %TEMP%\licensecn.bmp
- %APPDATA%\microsoft\windows\cookies\user@funshion[1].txt
- %ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\bmps\ch_fin.bmp
- %TEMP%\licenseen.bmp
- %TEMP%\blank.bmp
- %TEMP%\installfilescn.bmp
- %TEMP%\installfilesen.bmp
- %TEMP%\nsmf054.tmp\execcmd.dll
- %TEMP%\nsmf054.tmp\execdos.dll
- %TEMP%\nsmf054.tmp\findprocdll.dll
- %TEMP%\nsmf054.tmp\instpath.ini
- %TEMP%\nsce44e.tmp\inetc.dll
- %TEMP%\installpathen.bmp
- %APPDATA%\microsoft\windows\cookies\user@funshion[2].txt
- from %TEMP%\legendlog.ini to <LS_APPDATA>\temp
- %APPDATA%\microsoft\windows\cookies\user@funshion[1].txt
- %APPDATA%\microsoft\windows\cookies\user@funshion[2].txt
- DNS ASK ze###ion.com
- DNS ASK pa#####.funshion.com
- DNS ASK fs.##nshion.com
- DNS ASK ns.##nshion.com
- DNS ASK sq#.##nshion.com
- DNS ASK se#####-bs.funshion.com
- DNS ASK bt###eam.org
- DNS ASK ad.##nshion.com
- '<LOCALNET>.44.1':1900
- ClassName: 'funshion_player_tzdenjohn' WindowName: '?? 2.1.0.20Beta'
- ClassName: '' WindowName: ''
- ClassName: 'NDDEAgnt' WindowName: 'NetDDE Agent'
- ClassName: 'MPWClass' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- '%TEMP%\funshioninstall_c56435.exe' /S
- '%TEMP%\funshionme.exe'
- '%TEMP%\xml2fspdata.exe' "%HOMEPATH%\funshion\control\\"
- '%ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\funshioninstall.exe'
- '%ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\evid4226-vc80-mt.exe'
- '%ProgramFiles(x86)%\funshion online\funshion\funshion.exe'
- '%ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\funshion_clone.exe' 1 2 3
- '%ProgramFiles(x86)%\funshion online\funshion\funshionservice.exe' UISTARTFSPSERVER
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im "Funshion.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im "FSPServer.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im "FunshionService.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C rename "%HOMEPATH%\funshion\historyTorrent\*.torrent" *.fsp' (with hidden window)
- '%TEMP%\xml2fspdata.exe' "%HOMEPATH%\funshion\control\\"' (with hidden window)
- '%ProgramFiles(x86)%\funshion online\funshion\xpsp2patch\evid4226-vc80-mt.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles(x86)%\Funshion Online\Funshion\XPSP2Patch\selfdel.bat""' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im "Funshion.exe"
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im "FSPServer.exe"
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im "FunshionService.exe"
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\CoreAAC.ax"
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\quartz.dll"
- '%WINDIR%\syswow64\cmd.exe' /C rename "%HOMEPATH%\funshion\historyTorrent\*.torrent" *.fsp
- '%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles(x86)%\Funshion Online\Funshion\XPSP2Patch\selfdel.bat""
- '%WINDIR%\syswow64\dxdiag.exe' /whql:off /t %HOMEPATH%\funshion\fsdxdiag.txt
- '%WINDIR%\syswow64\tracert.exe' -d -h 16 -w 800 209.131.36.158