Technical Information
- '%TEMP%\nsg2.tmp\90018_ailiao.exe'
- '%TEMP%\nsg2.tmp\KAVSETUPS_81_1008.exe'
- '%TEMP%\nsg2.tmp\kuping_s_51022.exe'
- '%TEMP%\nsg2.tmp\SoHuVA_4.2.0.0-c204900009-ng-s-run-x.exe'
- '%TEMP%\nsg2.tmp\ksbinstaller_s_87_1008.exe'
- '%TEMP%\nsg2.tmp\4zengjie_installer_cn.exe'
- '%TEMP%\nsg2.tmp\s2222.exe'
- '%TEMP%\nsg2.tmp\setup_qd318.exe'
- '%TEMP%\nsg2.tmp\nzos_201042.exe'
- '%TEMP%\nsg2.tmp\setup_3038.exe'
- '%TEMP%\nsg2.tmp\dianxin_silent[108].exe'
- '%TEMP%\nsg2.tmp\setup_open_3747.exe'
- '%TEMP%\nsg2.tmp\pczh_121.exe'
- '%TEMP%\nsg2.tmp\ravbd246.exe'
- '%TEMP%\nsg2.tmp\KAVSETUPS_81_1008.exe' (downloaded from the Internet)
- '%TEMP%\nsg2.tmp\SoHuVA_4.2.0.0-c204900009-ng-s-run-x.exe' (downloaded from the Internet)
- '%TEMP%\nsg2.tmp\ravbd246.exe' (downloaded from the Internet)
- '%TEMP%\nsg2.tmp\ksbinstaller_s_87_1008.exe' (downloaded from the Internet)
- '%TEMP%\nsg2.tmp\nzos_201042.exe' (downloaded from the Internet)
- '%TEMP%\nsg2.tmp\setup_open_3747.exe' (downloaded from the Internet)
- '%TEMP%\nsg2.tmp\pczh_121.exe' (downloaded from the Internet)
- '%TEMP%\nsg2.tmp\dianxin_silent[108].exe' (downloaded from the Internet)
- '%TEMP%\nsg2.tmp\setup_3038.exe' (downloaded from the Internet)
- '%TEMP%\nsg2.tmp\kuping_s_51022.exe' (downloaded from the Internet)
- '%TEMP%\nsg2.tmp\setup_qd318.exe' (downloaded from the Internet)
- '%TEMP%\nsg2.tmp\4zengjie_installer_cn.exe' (downloaded from the Internet)
- '%TEMP%\nsg2.tmp\90018_ailiao.exe' (downloaded from the Internet)
- '%TEMP%\nsg2.tmp\s2222.exe' (downloaded from the Internet)
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\download[1].php
- %TEMP%\nsg2.tmp\SoHuVA_4.2.0.0-c204900009-ng-s-run-x.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\download[1].php
- %TEMP%\nsg2.tmp\ksbinstaller_s_87_1008.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\dcs[1].do
- %TEMP%\nsg2.tmp\setup_qd318.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\setup_qd318[1].exe
- %TEMP%\nsg2.tmp\4zengjie_installer_cn.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\4zengjie_installer_cn[1].exe
- %TEMP%\nsg2.tmp\ravbd246.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ravbd246[1].exe
- %TEMP%\nsg2.tmp\nzos_201042.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\NiuZip_Setup_1.0_201042[1].exe
- %TEMP%\nsg2.tmp\ebwgwy_30071.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\70038[1]
- %TEMP%\nsg2.tmp\KAVSETUPS_81_1008.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\30071[1]
- %TEMP%\nsg2.tmp\savc_70038.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setup_3038[1].exe
- %TEMP%\nsg2.tmp\dianxin_silent[108].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\setup_open_3747[1].exe
- %TEMP%\nsg2.tmp\setup_3038.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\dianxin_silent[108][1].exe
- %HOMEPATH%\Start Menu\Programs\kbplay\Uninstall.lnk
- %TEMP%\nsg2.tmp\FindProcDLL.dll
- %TEMP%\nsg2.tmp\Inetc.dll
- %PROGRAM_FILES%\kbplay\uninst.exe
- %TEMP%\nsg2.tmp\90018_ailiao.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\90018_ailiao[1].exe
- %TEMP%\nsg2.tmp\s2222.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\s2222[1].exe
- %TEMP%\nsg2.tmp\kuping_s_51022.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\pczh_121[1].exe
- %TEMP%\nsg2.tmp\setup_open_3747.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\kuping_s_51022[1].exe
- %TEMP%\nsg2.tmp\pczh_121.exe
- %TEMP%\nsg2.tmp\ravbd246.exe
- %TEMP%\nsg2.tmp\s2222.exe
- %TEMP%\nsg2.tmp\nzos_201042.exe
- %TEMP%\nsg2.tmp\pczh_121.exe
- %TEMP%\nsg2.tmp\savc_70038.exe
- %TEMP%\nsg2.tmp\setup_qd318.exe
- %TEMP%\nsg2.tmp\SoHuVA_4.2.0.0-c204900009-ng-s-run-x.exe
- %TEMP%\nsg2.tmp\setup_3038.exe
- %TEMP%\nsg2.tmp\setup_open_3747.exe
- %TEMP%\nsg2.tmp\dianxin_silent[108].exe
- %TEMP%\nsg2.tmp\ebwgwy_30071.exe
- %TEMP%\nsg2.tmp\4zengjie_installer_cn.exe
- %TEMP%\nsg2.tmp\90018_ailiao.exe
- %TEMP%\nsg2.tmp\FindProcDLL.dll
- %TEMP%\nsg2.tmp\ksbinstaller_s_87_1008.exe
- %TEMP%\nsg2.tmp\kuping_s_51022.exe
- %TEMP%\nsg2.tmp\Inetc.dll
- %TEMP%\nsg2.tmp\KAVSETUPS_81_1008.exe
- 'd.#####.ijinshan.com':80
- 'p2#.#d.sohu.com':80
- 'mk.##xthon.cn':80
- 'dl.####n.ijinshan.com':80
- 'ni####.b0.upaiyun.com':80
- 'rs######ad.rising.com.cn':80
- '12#.#25.114.144':80
- 'do##.guangsu.cn':80
- 'do####ad.wuji.com':80
- 'do##.yinyue.fm':80
- 'xz.##anquan.com':80
- 'do##.##qingzhihui.com':80
- 'www.sj##.com':80
- 'do##.nisoka.com':80
- 'do####ad.wallba.com':80
- d.#####.ijinshan.com/liebao/download.php?ci#################
- dl.####n.ijinshan.com/duba/download.php?T=#################
- mk.##xthon.cn/max4/zxr/4zengjie_installer_cn.exe
- p2#.#d.sohu.com/dcs.do?f=##############################
- rs######ad.rising.com.cn/middle11/rsfree/ravbd246.exe
- ni####.b0.upaiyun.com/NiuZip_Setup_1.0_201042.exe
- 12#.#25.114.144/index/minidownload/70038
- 12#.#25.114.144/index/minidownload/30071
- do####ad.wuji.com/wuji/open/setup_open_3747.exe
- do##.##qingzhihui.com/pczh_121.exe
- xz.##anquan.com/download/dianxin_silent[108].exe
- do##.yinyue.fm/open/setup_3038.exe
- www.sj##.com/hezi/jm/s2222.exe
- do##.guangsu.cn/qdn/setup_qd318.exe
- do####ad.wallba.com/download.php/kuping_s_51022.exe
- do##.nisoka.com/happy/90018_ailiao.exe
- DNS ASK d.#####.ijinshan.com
- DNS ASK dl.####n.ijinshan.com
- DNS ASK mk.##xthon.cn
- DNS ASK p2#.#d.sohu.com
- DNS ASK rs######ad.rising.com.cn
- DNS ASK ni####.b0.upaiyun.com
- DNS ASK we####.baidu.com
- DNS ASK sh###.baidu.com
- DNS ASK do####ad.wuji.com
- DNS ASK do##.##qingzhihui.com
- DNS ASK xz.##anquan.com
- DNS ASK do##.yinyue.fm
- DNS ASK www.sj##.com
- DNS ASK do##.guangsu.cn
- DNS ASK do####ad.wallba.com
- DNS ASK do##.nisoka.com
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'