Technical Information
- [<HKLM>\System\CurrentControlSet\Services\QJnFefRP.dat] 'ImagePath' = '%WINDIR%\QJnFefRP.dat'
- %TEMP%\f9bc9.tmp
- %TEMP%\f9ce4.tmp
- %TEMP%\f9db0.tmp
- %WINDIR%\qjnfefrp.dat
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012019110220191103\index.dat
- %TEMP%\f9bc9.tmp
- %TEMP%\f9ce4.tmp
- %TEMP%\f9db0.tmp
- %WINDIR%\qjnfefrp.dat
- http://www.li####hengzyw.cn/1.txt
- http://52###uang.cn/data/attachment/common/6c/common_45_icon.png
- http://52###uang.cn/data/attachment/common/f7/common_44_icon.jpg
- http://52###uang.cn/data/attachment/common/17/common_43_icon.gif
- http://52###uang.cn/data/attachment/common/a1/common_42_icon.bmp
- http://52###uang.cn/uc_server/images/noavatar_small.gif
- http://52###uang.cn/uc_server/data/avatar/000/00/12/23_avatar_small.jpg
- http://52###uang.cn/uc_server/data/avatar/000/00/12/24_avatar_small.jpg
- http://52###uang.cn/uc_server/data/avatar/000/00/12/22_avatar_small.jpg
- http://52###uang.cn/data/cache/common_extra.js?Hb#
- http://52###uang.cn/uc_server/data/avatar/000/00/12/25_avatar_small.jpg
- http://ia.#1.la/go1?id###########################################################################################################################################################################...
- http://52###uang.cn/static/image/common/cls.gif
- http://52###uang.cn/uc_server/data/avatar/000/00/12/27_avatar_small.jpg
- http://52###uang.cn/template/ygbbs_v3/images//titlebg.png
- http://52###uang.cn/static/image/common/chart.png
- http://52###uang.cn/static/image/common/pt_item.png
- http://52###uang.cn/static/image/common/search.png
- http://52###uang.cn/static/image/common/site_qq.jpg
- http://52###uang.cn/data/attachment/common/32/common_66_icon.jpg
- http://52###uang.cn/data/attachment/common/fc/common_65_icon.jpg
- http://52###uang.cn/data/attachment/common/ea/common_64_icon.jpg
- http://52###uang.cn/data/attachment/common/03/common_63_icon.jpg
- http://52###uang.cn/uc_server/data/avatar/000/00/12/26_avatar_small.jpg
- http://52###uang.cn/static/image/common/online_admin.gif
- http://52###uang.cn/static/image/common/scrolltop.png
- http://52###uang.cn/uc_server/data/avatar/000/00/12/14_avatar_small.jpg
- http://www.2f#w.cn/favicon.ico
- http://52###uang.cn/source/plugin/popad_7ree/image/
- http://52###uang.cn/static/image/common/popupcredit_bg.gif
- http://52###uang.cn/plugin.php?id#############################################################################################################################
- http://52###uang.cn/uc_server/data/avatar/000/00/12/19_avatar_small.jpg
- http://52###uang.cn/static/image/common/loading.gif
- http://52###uang.cn/data/cache/ajax.js?Hb#
- http://52###uang.cn/home.php?mo##################################
- http://52###uang.cn/static/image/common/online_member.gif
- http://52###uang.cn/static/image/common/online_moderator.gif
- http://52###uang.cn/data/attachment/common/73/common_67_icon.jpg
- http://52###uang.cn/static/image/common/online_supermod.gif
- http://52###uang.cn/data/attachment/common/44/common_62_icon.png
- http://52###uang.cn/data/attachment/common/7f/common_61_icon.png
- http://52###uang.cn/data/attachment/common/07/common_60_icon.png
- http://52###uang.cn/data/attachment/common/09/common_59_icon.png
- http://52###uang.cn/data/attachment/common/72/common_57_icon.png
- http://52###uang.cn/data/attachment/common/9f/common_56_icon.png
- http://52###uang.cn/data/attachment/common/b5/common_55_icon.jpg
- http://52###uang.cn/data/attachment/common/a6/common_54_icon.png
- http://52###uang.cn/data/attachment/common/d8/common_53_icon.png
- http://52###uang.cn/data/attachment/common/9a/common_52_icon.png
- http://52###uang.cn/data/attachment/common/d9/common_46_icon.jpg
- http://52###uang.cn/data/attachment/common/67/common_47_icon.png
- http://52###uang.cn/data/attachment/common/28/common_51_icon.png
- http://52###uang.cn/data/attachment/common/cf/211841rjn4vwovwj74vvhz.gif
- http://52###uang.cn/template/ygbbs_v3/images//bg.jpg
- http://52###uang.cn/template/ygbbs_v3/images//logo.png
- http://js.##ers.51.la/20075089.js
- http://www.2f#w.cn/data/attachment/common/17/common_43_icon.png
- http://www.2f#w.cn/data/attachment/common/a1/common_42_icon.png
- http://www.2f#w.cn/data/attachment/common/34/common_41_icon.jpg
- http://www.2f#w.cn/data/attachment/common/d6/common_40_icon.png
- http://www.2f#w.cn/static/image/common/collapsed_no.gif
- http://www.2f#w.cn/static/image/common/logo.png
- http://52###uang.cn/data/cache/style_2_forum_index.css?Hb#
- http://52###uang.cn/template/ygbbs_v3/images//ygbbs_toptb.png
- http://www.2f#w.cn/data/cache/common.js?yC#
- http://www.2f#w.cn/data/cache/md5.js?yC#
- http://www.2f#w.cn/data/cache/forum.js?yC#
- http://www.2f#w.cn/data/cache/style_15_forum_index.css?yC#
- http://52###uang.cn/data/cache/logging.js?Hb#
- http://52###uang.cn/data/cache/forum.js?Hb#
- http://52###uang.cn/data/cache/common.js?Hb#
- http://52###uang.cn/data/cache/style_2_common.css?Hb#
- http://www.2f#w.cn/data/cache/style_15_common.css?yC#
- http://52###uang.cn/
- http://www.2f#w.cn/
- http://www.2f#w.cn/data/cache/logging.js?yC#
- http://52###uang.cn/uc_server/avatar.php?ui#################
- http://52###uang.cn/static/image/common/forum.gif
- http://www.2f#w.cn/data/attachment/common/f7/common_44_icon.jpg
- http://52###uang.cn/data/attachment/common/c0/common_50_icon.png
- http://52###uang.cn/data/attachment/common/f4/common_49_icon.png
- http://52###uang.cn/data/attachment/common/64/common_48_icon.jpg
- http://52###uang.cn/data/attachment/common/34/common_41_icon.jpg
- http://52###uang.cn/data/attachment/common/d6/common_40_icon.jpg
- http://52###uang.cn/data/attachment/common/c8/common_2_icon.png
- http://52###uang.cn/template/ygbbs_v3/images//collapsed_no.gif
- http://www.2f#w.cn/static/image/common/category_lbg.png
- http://www.2f#w.cn/static/image/common/online_member.gif
- http://www.2f#w.cn/static/image/common/online_moderator.gif
- http://52###uang.cn/data/attachment/common/14/common_69_icon.jpg
- http://52###uang.cn/static/image/common/collapsed_no.gif
- http://js.##ers.51.la/20419311.js
- http://52###uang.cn/source/plugin/toplist_7ree/template/images/list_7ree.gif
- http://52###uang.cn/task_b.png
- http://52###uang.cn/medal_b.png
- http://52###uang.cn/magic_b.png
- http://www.2f#w.cn/static/image/common/dot.gif
- http://www.2f#w.cn/static/image/common/online_supermod.gif
- http://www.2f#w.cn/static/image/common/online_admin.gif
- http://www.2f#w.cn/data/attachment/common/67/common_47_icon.png
- http://www.2f#w.cn/data/attachment/common/6c/common_45_icon.png
- http://52###uang.cn/template/ygbbs_v3/images//scbar.png
- http://52###uang.cn/favicon.ico
- DNS ASK li####hengzyw.cn
- DNS ASK 2f#w.cn
- DNS ASK 52###uang.cn
- DNS ASK ae##.alicdn.com
- DNS ASK s.##yun.com
- DNS ASK js.##ers.51.la
- DNS ASK s2.#x1x.com
- DNS ASK s4.#nzz.com
- DNS ASK ia.#1.la
- DNS ASK z3.#nzz.com
- DNS ASK c.##zz.com
- DNS ASK cn##.mmstat.com
- ClassName: '' WindowName: 'Microsoft Internet Explorer'
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''