Adware.Generic.1738283_554535b050

by malwarelabrobot on February 7th, 2017 in Malware Descriptions.

Susp_Dropper (Kaspersky), Adware.Generic.1738283 (AdAware), Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Trojan, Adware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 554535b0504d5506b5692d1cc063d92c
SHA1: a00ef736f178b259c793ec52638ca078ff710850
SHA256: 26a91f9c0fe300344cb149b97e4ee76ba5b604ae41fc592bdeeea109151483e0
SSDeep: 393216:mj2veRbbhugri9ACO07Fd3a/P7WyH2oOlJfd:T4Nu4rC1Fdq37pH2oC
Size: 14410048 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2017-01-22 15:35:56
Analyzed on: Windows7 SP1 32-bit


Summary:

Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Payload

No specific payload has been found.

Process activity

The Adware creates the following process(es):

FunshionService.exe:1296
%original file name%.exe:3676
AptShadow.exe:3148
Funshion.exe:1100
rundll32.exe:1928
rundll32.exe:100
rundll32.exe:3024
rundll32.exe:4048
regsvr32.exe:1024
regsvr32.exe:2600
regsvr32.exe:4056
regsvr32.exe:1524
regsvr32.exe:3964
regsvr32.exe:3172

The Adware injects its code into the following process(es):

rundll32.exe:3388

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process FunshionService.exe:1296 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\Funshion\Funshion.ini (4326 bytes)
%Program Files%\Funshion Online\3.0.6.62\FunshionService.log (390 bytes)
%Program Files%\Funshion Online\3.0.6.62\funshion.ini (35 bytes)

The process %original file name%.exe:3676 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lang\Funshion.en_US.bak (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\爷们儿.jpg (31 bytes)
C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\004_扑克王.fsv (481 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\socket\smtp.lua (8 bytes)
C:\Users\Public\Desktop\Funshion.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\Uninstall.exe (837 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\WDU138VJ.txt (517 bytes)
%Program Files%\Funshion Online\3.0.6.62\atrc.dll (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\003_暴力街区.fsv (535 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\奇葩一家亲.jpg (39 bytes)
%Program Files%\Funshion Online\3.0.6.62\pncrt.dll (1425 bytes)
C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\综艺娱乐\001_超级先生.fsv (563 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\TPGLK7MO.txt (508 bytes)
%Program Files%\Funshion Online\3.0.6.62\avutil-52.dll (1425 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\icon\RMVB.ico (58 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Funshion\Hot Game.lnk (1 bytes)
%Program Files%\Funshion Online\3.0.6.62\lang\Funshion.en_US (19 bytes)
%Program Files%\Funshion Online\3.0.6.62\fpvddec.ax (6841 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tools\tools.7z (247 bytes)
C:\ProgramData\Funshion\MediaLibrary\中国梦之声 第二季.jpg (37 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lang\Funshion.en_US (19 bytes)
%Program Files%\Funshion Online\3.0.6.62\FunshionWeb.exe (7385 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lang\Funshion.zh_CN (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\SeedIcon.ico (31 bytes)
%Program Files%\Funshion Online\3.0.6.62\lang\FunshionUpgrade.zh_CN (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunKoala64.dll (1281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\atrc.dll (96 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\windows.lua (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunKoala64.dll (210 bytes)
%Program Files%\Funshion Online\3.0.6.62\lua\socket\tp.lua (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunNail.dll (960 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunShadow.dll (525 bytes)
%Program Files%\Funshion Online\3.0.6.62\SimpleIE.dll (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunNail.dll (7345 bytes)
C:\Users\"%CurrentUserName%"\Funshion\Funshion.ini (5362 bytes)
%Program Files%\Funshion Online\3.0.6.62\lua\socket\url.lua (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\socket.lua (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\002_为奴十二年.fsv (685 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\B05KHRNM.txt (529 bytes)
C:\ProgramData\Funshion\MediaLibrary\为奴十二年.jpg (39 bytes)
C:\ProgramData\Funshion\MediaLibrary\谈判冤家.jpg (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\猫和老鼠.jpg (24 bytes)
%Program Files%\Funshion Online\3.0.6.62\lua\socket.lua (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\最新电影\001_海神密码.fsv (537 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\L45CSEFH.txt (523 bytes)
C:\Users\"%CurrentUserName%"\Funshion\Shortcut\FunShortcut.ini (789 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\uninst.exe (1281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\mime.lua (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\超级先生.jpg (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FsMediaBar.dll (164 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\动漫卡通\001_猫和老鼠.fsv (527 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\Default1.jpg (14 bytes)
C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\009_探索.fsv (472 bytes)
%Program Files%\Funshion Online\3.0.6.62\lua\mime.lua (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\004_扑克王.fsv (481 bytes)
%Program Files%\Funshion Online\3.0.6.62\Funshion.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\001_幻影车神：魔盗激情.fsv (715 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunWorks64.dll (4185 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster (4 bytes)
%Program Files%\Funshion Online\3.0.6.62\FsMediaBar64.dll (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5ENFIZ2I.txt (81 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IMFD3ND3.txt (78 bytes)
%Program Files%\Funshion Online\3.0.6.62\CoreAAC.ax (4185 bytes)
%Program Files%\Funshion Online\3.0.6.62\CoreAVC.ax (1425 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\SimpleIE.dll (146 bytes)
%Program Files%\Funshion Online\3.0.6.62\lang\Funshion.en_US.bak (5 bytes)
%Program Files%\Funshion Online\3.0.6.62\swscale-2.dll (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\ssdodge.daw (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lang\Funshion.zh_CN.bak (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\海神密码.jpg (37 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\gma.dll (3073 bytes)
%Program Files%\Funshion Online\3.0.6.62\windows.lua (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\010_中国梦之声 第二季.fsv (647 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\暴力街区.jpg (37 bytes)
%Program Files%\Funshion Online\3.0.6.62\funshionplugin2.dll (22430 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\drvc.dll (272 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\avutil-52.dll (322 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FunshionWeb.exe (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunWorks64.dll (622 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\AptRegIns.dll (1281 bytes)
%Program Files%\Funshion Online\3.0.6.62\icon\MP4.ico (57 bytes)
C:\ProgramData\Funshion\MediaLibrary\扑克王.jpg (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\TVR1C6E8.txt (78 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lang (4 bytes)
%Program Files%\Funshion Online\3.0.6.62\FsShlExt.dll (3361 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\icon\show.ico (143 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunWorks.dll (492 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\2N1SZ07V.txt (355 bytes)
C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\010_中国梦之声 第二季.fsv (647 bytes)
C:\ProgramData\Funshion\MediaLibrary\探索.jpg (24 bytes)
%Program Files%\Funshion Online\3.0.6.62\lua\socket\http.lua (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\AptRegIns.dll (242 bytes)
%Program Files%\Funshion Online\3.0.6.62\gma.dll (6146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\FunExt.dll (495 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\winusb.dll (22 bytes)
C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\动漫卡通\001_猫和老鼠.fsv (527 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FsShlExt64.dll (463 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\谈判冤家.jpg (34 bytes)
C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\经典电影\001_终结者.fsv (492 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\icon\FunshionGame2.ico (26 bytes)
C:\Users\"%CurrentUserName%"\Funshion\funshiontools\npFunshion.dll (2105 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\ssdodge.daw (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Funshion.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FunshionTools\funoictl.dll (271 bytes)
%Program Files%\Funshion Online\3.0.6.62\FsMediaBar.dll (673 bytes)
%Program Files%\Funshion Online\3.0.6.62\cjson.dll (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunSeed.dll (295 bytes)
C:\ProgramData\Funshion\MediaLibrary\分手大师.jpg (30 bytes)
C:\ProgramData\Funshion\MediaLibrary\爷们儿.jpg (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunDodge.dll (2105 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FunshionUpgrade.exe (1 bytes)
%Program Files%\Funshion Online\3.0.6.62\icon\Funshop4.ico (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\skin\default.skin (3 bytes)
%Program Files%\Funshion Online\3.0.6.62\FunshionUpgrade.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\Funshion\funshiontools\LoadIE.log (138 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\风行热播\001_分手大师.fsv (519 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\gma.dll (495 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\为奴十二年.jpg (39 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua51.dll (17 bytes)
%Program Files%\Funshion Online\3.0.6.62\cook.dll (601 bytes)
C:\ProgramData\Funshion\MediaLibrary\终结者.jpg (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\AptRelay.exe (673 bytes)
%Program Files%\Funshion Online\3.0.6.62\CrashReport.exe (4545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HS2VXI8I.txt (526 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\icon\Funshop4.ico (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\CoreAAC.ax (612 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\E1MBW261.txt (529 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\I2S4DNUW.txt (78 bytes)
%Program Files%\Funshion Online\3.0.6.62\lang\Funshion.zh_CN.bak (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunSeed64.dll (329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\W5U42C1J.txt (361 bytes)
%Program Files%\Funshion Online\3.0.6.62\drvc.dll (1425 bytes)
C:\ProgramData\Funshion\MediaLibrary\Default0.jpg (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Funshion.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\funshion.ini (1005 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\Funshion.exe (3 bytes)
C:\ProgramData\Funshion\MediaLibrary\猫和老鼠.jpg (24 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\swscale-2.dll (427 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv (4 bytes)
%Program Files%\Funshion Online\3.0.6.62\avcodec-55.dll (22350 bytes)
C:\ProgramData\Funshion\MediaLibrary\Default1.jpg (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\Inst.dll (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FsMediaBar64.dll (196 bytes)
C:\ProgramData\Funshion\MediaLibrary\倒霉熊.jpg (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\mime\core.dll (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\cook.dll (72 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\SeedIcon.ico (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\funshionplugin2.dll (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunWorks.dll (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\AptShadow.exe (487 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunDodge.dll (332 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\探索.jpg (24 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\socket\core.dll (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\socket\tp.lua (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FunshionTools\npFunshion.dll (385 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\uninst.exe (246 bytes)
C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\007_爷们儿.fsv (486 bytes)
%Program Files%\Funshion Online\3.0.6.62\icon\show.ico (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\socket\http.lua (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\skin\upgradedefault.skin (11 bytes)
C:\Users\Public\Desktop\VR游戏.lnk (1 bytes)
%Program Files%\Funshion Online\3.0.6.62\icon\RMVB.ico (58 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\分手大师.jpg (30 bytes)
C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\005_马向阳下乡记.fsv (527 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\CoreAVC.ax (278 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunSeed.dll (1425 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunShadow.dll (3361 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\海外剧场\001_玻璃鞋.fsv (459 bytes)
%Program Files%\Funshion Online\3.0.6.62\socket\core.dll (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\内地剧场\001_奇葩一家亲.fsv (484 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion (8 bytes)
C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\006_谈判冤家.fsv (468 bytes)
C:\ProgramData\Funshion\MediaLibrary\超级先生.jpg (25 bytes)
%Program Files%\Funshion Online\3.0.6.62\lang\FunshionUpgrade.en_US (1 bytes)
%Program Files%\Funshion Online\3.0.6.62\FsShlExt64.dll (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lang\FunshionUpgrade.zh_CN (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\005_马向阳下乡记.fsv (527 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\C1PSQ8S6.txt (379 bytes)
C:\Users\"%CurrentUserName%"\Funshion\funshiontools\funoictl.dll (2850 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\终结者.jpg (18 bytes)
C:\ProgramData\Funshion\MediaLibrary\玻璃鞋.jpg (11 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Funshion\Unistall.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Funshion\Versions History.lnk (369 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\CrashReport.exe (710 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FunshionService.exe (4 bytes)
C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\002_为奴十二年.fsv (685 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\avcodec-55.dll (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\0OB51DHV.txt (349 bytes)
%Program Files%\Funshion Online\3.0.6.62\skin\default.skin (25426 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Libraries\~行高清影视.tmp (560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FsShlExt.dll (588 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\PZXT9XB5.txt (511 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua5.1.dll (174 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tools\gma.dll (994 bytes)
C:\ProgramData\Funshion\MediaLibrary\暴力街区.jpg (37 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\泡沫之夏.jpg (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FunshionTools (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FunshionTools\funoictl64.dll (274 bytes)
%Program Files%\Funshion Online\3.0.6.62\mime\core.dll (19 bytes)
C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\海外剧场\001_玻璃鞋.fsv (459 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\7GLZOPMG.txt (81 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\008_倒霉熊.fsv (410 bytes)
C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\003_暴力街区.fsv (535 bytes)
%Program Files%\Funshion Online\3.0.6.62\icon\FunshionGame2.ico (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\fundata.7z (713 bytes)
C:\ProgramData\Funshion\MediaLibrary\海神密码.jpg (37 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\Inst.dll (448 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\幻影车神：魔盗激情.jpg (39 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\MQ8J51N9.txt (227 bytes)
C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\最新电影\001_海神密码.fsv (537 bytes)
%Program Files%\Funshion Online\3.0.6.62\lua\ltn12.lua (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\icon\MP4.ico (57 bytes)
%Program Files%\Funshion Online\3.0.6.62\FunshionService.exe (31556 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\socket\url.lua (10 bytes)
%Program Files%\Funshion Online\3.0.6.62\lua\socket\smtp.lua (8 bytes)
C:\ProgramData\Funshion\MediaLibrary\泡沫之夏.jpg (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\pncrt.dll (284 bytes)
C:\Windows\System32\funshion.ini (3093 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62 (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tools\CrashReport.exe (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\Default0.jpg (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\007_爷们儿.fsv (486 bytes)
C:\Users\"%CurrentUserName%"\FunShion.ini (76 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\socket\ftp.lua (9 bytes)
%Program Files%\Funshion Online\3.0.6.62\lang\Funshion.zh_CN (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\港台剧场\001_泡沫之夏.fsv (515 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\扑克王.jpg (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\001_幻影车神：魔盗激情.fsv (715 bytes)
C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\风行热播\001_分手大师.fsv (519 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FsLibrary.exe (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\中国梦之声 第二季.jpg (37 bytes)
%Program Files%\Funshion Online\3.0.6.62\FsLibrary.exe (12336 bytes)
%Program Files%\Funshion Online\3.0.6.62\Uninstall.exe (6712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\SetupFiles.7z (11 bytes)
C:\ProgramData\Funshion\MediaLibrary\幻影车神：魔盗激情.jpg (39 bytes)
C:\Users\"%CurrentUserName%"\Funshion\funshiontools\funoictl64.dll (2850 bytes)
%Program Files%\Funshion Online\3.0.6.62\skin\upgradedefault.skin (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\马向阳下乡记.jpg (25 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Funshion\Funshion.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\Funshion\funshiontools\FunshionService.exe (31071 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\AptNail.dll (504 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\009_探索.fsv (472 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\AptNail.dll (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\倒霉熊.jpg (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lang\FunshionUpgrade.en_US (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\综艺娱乐\001_超级先生.fsv (563 bytes)
%Program Files%\Funshion Online\3.0.6.62\lua51.dll (17 bytes)
%Program Files%\Funshion Online\3.0.6.62\Funshion.exe (23695 bytes)
C:\ProgramData\Funshion\MediaLibrary\奇葩一家亲.jpg (39 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Funshion.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OR79SQ18.txt (511 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Funshion.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunSeed64.dll (2105 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\玻璃鞋.jpg (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\gma.dll (495 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\经典电影\001_终结者.fsv (492 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\006_谈判冤家.fsv (468 bytes)
C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\008_倒霉熊.fsv (410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\fpvddec.ax (883 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunKoala.dll (673 bytes)
C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\港台剧场\001_泡沫之夏.fsv (515 bytes)
%Program Files%\Funshion Online\3.0.6.62\lua5.1.dll (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\ltn12.lua (8 bytes)
C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\内地剧场\001_奇葩一家亲.fsv (484 bytes)
%Program Files%\Funshion Online\3.0.6.62\lua\socket\ftp.lua (9 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Funshion\Funshion HD Media.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\funshiontmp\setup.ini (210 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\cjson.dll (25 bytes)
C:\ProgramData\Funshion\MediaLibrary\马向阳下乡记.jpg (25 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Funshion\Help.lnk (347 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunKoala.dll (165 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\AptRelay.exe (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\261TYHKH.txt (81 bytes)

The Adware deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lang\Funshion.en_US.bak (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\爷们儿.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\socket\smtp.lua (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lang (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\Uninstall.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\Default1.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\奇葩一家亲.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\TPGLK7MO.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\icon\RMVB.ico (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lang\Funshion.en_US (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lang\Funshion.zh_CN (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\经典电影 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\atrc.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\windows.lua (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\007_爷们儿.fsv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunNail.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunShadow.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\socket.lua (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\002_为奴十二年.fsv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\B05KHRNM.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\猫和老鼠.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\最新电影\001_海神密码.fsv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\mime.lua (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\超级先生.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FsMediaBar.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\动漫卡通\001_猫和老鼠.fsv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Libraries\风行高清影视.library-ms~RF141f33.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\004_扑克王.fsv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\icon\FunshionGame2.ico (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\C1PSQ8S6.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IMFD3ND3.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\内地剧场 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\SimpleIE.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\ssdodge.daw (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lang\Funshion.zh_CN.bak (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\海神密码.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\010_中国梦之声 第二季.fsv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\暴力街区.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OA7NFLKQ.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\drvc.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\avutil-52.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FunshionWeb.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunWorks64.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\socket (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\港台剧场 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\TVR1C6E8.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\PZXT9XB5.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\003_暴力街区.fsv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\icon\show.ico (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunWorks.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\2N1SZ07V.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\AptRegIns.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\winusb.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FsShlExt64.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\谈判冤家.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FunshionTools\funoictl.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunSeed.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FunshionUpgrade.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\skin\default.skin (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\最新电影 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\风行热播\001_分手大师.fsv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunKoala64.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\MQ8J51N9.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua51.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Libraries\风行高清影视.library-ms~RF141e59.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HS2VXI8I.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\icon\Funshop4.ico (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\CoreAAC.ax (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\I2S4DNUW.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunSeed64.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\0OB51DHV.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\L45CSEFH.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\funshion.ini (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\Funshion.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\swscale-2.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FsMediaBar64.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\mime\core.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\cook.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\SeedIcon.ico (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\funshionplugin2.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\skin (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunDodge.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\探索.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\socket\core.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\socket\tp.lua (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\socket (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FunshionTools\npFunshion.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\uninst.exe (0 bytes)
C:\Users\"%CurrentUserName%"\Funshion\funshiontools\funoictl.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\socket\http.lua (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\skin\upgradedefault.skin (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\分手大师.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\CoreAVC.ax (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\海外剧场\001_玻璃鞋.fsv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\内地剧场\001_奇葩一家亲.fsv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OR79SQ18.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\gma.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lang\FunshionUpgrade.zh_CN (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\005_马向阳下乡记.fsv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\终结者.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\为奴十二年.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\CrashReport.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\海外剧场 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FunshionService.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\avcodec-55.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FsShlExt.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua5.1.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\泡沫之夏.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FunshionTools (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FunshionTools\funoictl64.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\7GLZOPMG.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\008_倒霉熊.fsv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\Inst.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\幻影车神：魔盗激情.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\mime (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\icon\MP4.ico (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\socket\url.lua (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\icon (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\pncrt.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\gma.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\Default0.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\WDU138VJ.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\港台剧场\001_泡沫之夏.fsv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\扑克王.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\001_幻影车神：魔盗激情.fsv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FsLibrary.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\中国梦之声 第二季.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\动漫卡通 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\SetupFiles.7z (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\风行热播 (0 bytes)
C:\Users\"%CurrentUserName%"\Funshion\funshiontools\funoictl64.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\马向阳下乡记.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\AptNail.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\009_探索.fsv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\倒霉熊.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lang\FunshionUpgrade.en_US (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\综艺娱乐\001_超级先生.fsv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\玻璃鞋.jpg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\经典电影\001_终结者.fsv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\综艺娱乐 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\006_谈判冤家.fsv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\fpvddec.ax (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\ltn12.lua (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\socket\ftp.lua (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\cjson.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunKoala.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\AptRelay.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5ENFIZ2I.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\261TYHKH.txt (0 bytes)

The process AptShadow.exe:3148 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\touch.daw (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\senvclear.zip (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\ssenvclear.daw (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\FunTemp\Turkey.dll (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\senvclear.daw (784 bytes)

The Adware deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\senvclear.zip (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\senvclear.daw (0 bytes)

The process Funshion.exe:1100 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\Funshion\Config\template.xml (5 bytes)
C:\Users\"%CurrentUserName%"\Funshion\jdmarket\baiying1220.zip.dl (753304 bytes)
%Program Files%\Funshion Online\3.0.6.62\FunshionWeb.exe (1 bytes)
%Program Files%\Funshion Online\3.0.6.62\lua5.1.dll (176 bytes)
C:\Users\"%CurrentUserName%"\Funshion\Config\webinterface.xml (2 bytes)
C:\Users\"%CurrentUserName%"\Funshion\Cache\flashNew\1351296.swf.dl (561110 bytes)
C:\Users\"%CurrentUserName%"\FunShion.ini (76 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Funshion\Cache\neirong.funshion.com\client\nirvana\config.xml.dl (2894 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\92BIY313.txt (70 bytes)
C:\Users\"%CurrentUserName%"\Funshion\Funshion.ini (2150 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Funshion\Cache\ps.funshion.com\v5\search\hotword?cl=pcclient&ve=3.0.6.62&uc=162 (599 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IR3P5N8O.txt (673 bytes)
C:\Users\"%CurrentUserName%"\Funshion\jdmarket\baiying1220\default.skin (114695 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\9KFBJOP4.txt (523 bytes)
C:\Users\"%CurrentUserName%"\Funshion\ini\httpfile.ini.dl (7010 bytes)
C:\Users\"%CurrentUserName%"\Funshion\Cache\flashNew\1372668.swf.dl (331175 bytes)
C:\Users\"%CurrentUserName%"\Funshion\update\adConfig.xml.bak (1 bytes)
C:\Users\"%CurrentUserName%"\Funshion\jdmarket\baiying1220\manifest.json (475 bytes)
C:\Users\"%CurrentUserName%"\Funshion\update\adMaterialsTable1.xml.dl (510 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Y474JNLF.txt (208 bytes)
C:\Users\"%CurrentUserName%"\Funshion\jdmarket\market.ini (31 bytes)
C:\Users\"%CurrentUserName%"\Funshion\ini\temp_config.ini.dl (854 bytes)
C:\Users\"%CurrentUserName%"\Funshion\update\adConfig.xml.dl (500 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Funshion\Cache\po.funshion.com\v7\config\channel?cl=pcclient&ve=3.0.6.62&uc=162.dl (888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\0Z6STD2S.txt (823 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OA7NFLKQ.txt (346 bytes)

The Adware deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Y474JNLF.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\92BIY313.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IR3P5N8O.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\E1MBW261.txt (0 bytes)
C:\Users\"%CurrentUserName%"\Funshion\jdmarket\baiying1220.zip (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\9KFBJOP4.txt (0 bytes)

The process rundll32.exe:1928 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunShadow.dll (528 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunWorks.dll (495 bytes)

The process rundll32.exe:100 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\pulllog.db (155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\pulllog.db-journal (5062 bytes)

The Adware deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\pulllog.db-journal (0 bytes)

The process rundll32.exe:3024 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\kejet_v3[1].js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\21[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\stat[1].gif (43 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\CHLYAVDY.txt (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\funshionPlayerViewV3[1].swf (19801 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\yian_v1[1].js (510 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\core[1].js (763 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\DOMStore\WMZUWJRG\vas.funshion[1].xml (150 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\curvycorners-min[1].js (16066 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\91AA3705_AFA2_C4D5_7E5F_437CB2316D08[1].swf (4253 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\crossdomain[1].xml (116 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\h[1].js (12274 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\v8[1].js (42551 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QDS08KDR.txt (94 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (672 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\UU67513I.txt (1065 bytes)
%Program Files%\Funshion Online\3.0.6.62\SimpleIE.dll (147 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\stat[1].js (1081 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\install[1].htm (1926 bytes)

The Adware deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ZL1FLWKJ.txt (0 bytes)

The process rundll32.exe:4048 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\errorPageStrings[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\httpErrorPagesScripts[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\ErrorPageTemplate[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\navcancl[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\track[1].htm (649 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\info_48[1] (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\background_gradient[1] (453 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\httpErrorPagesScripts[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\bullet[1] (447 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\background_gradient[1] (453 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\navcancl[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\errorPageStrings[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\bullet[1] (447 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\ErrorPageTemplate[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (1344 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\info_48[1] (4 bytes)

The Adware deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\errorPageStrings[1] (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\httpErrorPagesScripts[1] (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\background_gradient[1] (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\bullet[1] (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\navcancl[1] (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\ErrorPageTemplate[1] (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\info_48[1] (0 bytes)

The process rundll32.exe:3388 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\4KJ7X6JP.txt (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IGCYX4S9.txt (835 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\FunTemp\Turkey.dll (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\funspeed\FunAcce_new.daw (308 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ZL1FLWKJ.txt (841 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\funspeed\Turkey_new.daw (1 bytes)

The Adware deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\4KJ7X6JP.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\0Z6STD2S.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IGCYX4S9.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\funspeed (0 bytes)

The process regsvr32.exe:2600 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\Funshion\funshiontools\funoictl64.dll (278 bytes)

The process regsvr32.exe:4056 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Program Files%\Funshion Online\3.0.6.62\FsShlExt.dll (589 bytes)

The process regsvr32.exe:3964 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Program Files%\Funshion Online\3.0.6.62\FsMediaBar.dll (167 bytes)

Registry activity

The process %original file name%.exe:3676 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\services\SharedAccess\Defaults\FirewallPolicy\FirewallRules]
"funshionupgradeudp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshionupgrade.exe|Name=funshionupgradeudp|"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband]
"Favorites" = "00 7C 01 00 00 14 00 1F 80 C8 27 34 1F 10 5C 10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\System\CurrentControlSet\services\SharedAccess\Defaults\FirewallPolicy\FirewallRules]
"funshionudp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshion.exe|Name=funshionudp|"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Funshion]
"Publisher" = "北京风行在线技术有限公司"

[HKLM\SOFTWARE\Microsoft\Tracing\554535b0504d5506b5692d1cc063d92c_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2]
"FavoritesResolve" = "A3 02 00 00 4C 00 00 00 01 14 02 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80A7D4B9-D2B8-48DE-B835-0407CEBEDEC0}]
"AppPath" = "%Program Files%\Funshion Online\3.0.6.62"
"Policy" = "3"

[HKLM\SOFTWARE\Microsoft\Tracing\554535b0504d5506b5692d1cc063d92c_RASMANCS]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2]
"Favorites" = "00 5A 01 00 00 14 00 1F 80 C8 27 34 1F 10 5C 10"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"funshionupgradetcp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshionupgrade.exe|Name=funshionupgradetcp|"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2]
"FavoritesChanges" = "1"

[HKCR\FunshionFsv\DefaultIcon]
"(Default)" = "%Program Files%\Funshion Online\3.0.6.62\Funshion.exe"

[HKCR\fsp\shell\open]
"(Default)" = "open"

[HKLM\SOFTWARE\Microsoft\Tracing\554535b0504d5506b5692d1cc063d92c_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SYSTEM\CurrentControlSet001\Services\SharedAccess\defaults\FirewallPolicy\firewallrules]
"funshionservicetcp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshionservice.exe|Name=funshionservicetcp|"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"funshionudp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshion.exe|Name=funshionudp|"

[HKLM\SYSTEM\CurrentControlSet001\Services\SharedAccess\defaults\FirewallPolicy\firewallrules]
"funshionupgradeudp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshionupgrade.exe|Name=funshionupgradeudp|"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Funshion]
"DisplayVersion" = "3.0.6.62"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"funshionservicetcp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshionservice.exe|Name=funshionservicetcp|"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Funshion]
"NoModify" = "1"

[HKCR\.fsp]
"(Default)" = "Funshion Task"

[HKLM\System\CurrentControlSet\services\SharedAccess\Defaults\FirewallPolicy\FirewallRules]
"funshionserviceudp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshionservice.exe|Name=funshionserviceudp|"
"funshionservicetcp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshionservice.exe|Name=funshionservicetcp|"

[HKLM\SOFTWARE\Funshion\Funshion]
"Install Path" = "%Program Files%\Funshion Online\3.0.6.62"

[HKLM\SOFTWARE\Funshion_Copy]
"ComInfoCopy" = "DF0E2962FD93,7404,d10d650e2503a2da1df335a99d3e0fe5,first,,3.0.6.62,1,000000000000000,2.13.1.2"

[HKCR\.fsv]
"(Default)" = "FunshionFsv"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband]
"FavoritesVersion" = "2"

[HKLM\SYSTEM\CurrentControlSet001\Services\SharedAccess\defaults\FirewallPolicy\firewallrules]
"funshionupgradetcp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshionupgrade.exe|Name=funshionupgradetcp|"

[HKLM\SOFTWARE\Microsoft\Tracing\554535b0504d5506b5692d1cc063d92c_RASAPI32]
"MaxFileSize" = "1048576"

[HKCR\fsp\shell]
"(Default)" = "open"

[HKLM\SOFTWARE\Funshion\Funshion]
"Version" = "3.0.6.62"

[HKCR\Funshion Task]
"(Default)" = "Funshion file"

[HKLM\SOFTWARE\Microsoft\Tracing\554535b0504d5506b5692d1cc063d92c_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SYSTEM\CurrentControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\firewallrules]
"funshionserviceudp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshionservice.exe|Name=funshionserviceudp|"

[HKLM\SYSTEM\CurrentControlSet001\Services\SharedAccess\defaults\FirewallPolicy\firewallrules]
"funshionudp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshion.exe|Name=funshionudp|"

[HKLM\SOFTWARE\MozillaPlugins\@funshion.com/npFunshion]
"Path" = "C:\Users\"%CurrentUserName%"\funshion\funshiontools\npFunshion.dll"

[HKCR\FunshionFsv]
"(Default)" = "FSV 文件"

[HKLM\System\CurrentControlSet\services\SharedAccess\Defaults\FirewallPolicy\FirewallRules]
"funshionupgradetcp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshionupgrade.exe|Name=funshionupgradetcp|"

[HKLM\SYSTEM\CurrentControlSet001\Services\SharedAccess\defaults\FirewallPolicy\firewallrules]
"funshiontcp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshion.exe|Name=funshiontcp|"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"funshionserviceudp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshionservice.exe|Name=funshionserviceudp|"

[HKCR\Funshion Task\shell\open\Command]
"(Default)" = "%Program Files%\Funshion Online\3.0.6.62\Funshion.exe %1 /dummy"

[HKCR\fsp\shell\open\command]
"(Default)" = "%Program Files%\Funshion Online\3.0.6.62\Funshion.exe %1 /dummy"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Funshion]
"DisplayName" = "Funshion"

[HKCR\fsp]
"URL Protocol" = "Type: REG_SZ, Length: 0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Funshion]
"NoRepair" = "1"

[HKCR\Funshion Task\DefaultIcon]
"(Default)" = "%Program Files%\Funshion Online\3.0.6.62\Funshion.exe,1"

[HKLM\SYSTEM\CurrentControlSet001\Services\SharedAccess\defaults\FirewallPolicy\firewallrules]
"funshionserviceudp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshionservice.exe|Name=funshionserviceudp|"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKCR\fsp]
"(Default)" = "Funshion file"

[HKLM\SOFTWARE\Microsoft\Tracing\554535b0504d5506b5692d1cc063d92c_RASMANCS]
"FileTracingMask" = "4294901760"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"funshiontcp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshion.exe|Name=funshiontcp|"
"funshionupgradeudp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshionupgrade.exe|Name=funshionupgradeudp|"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Funshion]
"URLInfoAbout" = "http://www.Funshion.com/"

[HKLM\SYSTEM\CurrentControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\firewallrules]
"funshionupgradeudp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshionupgrade.exe|Name=funshionupgradeudp|"

[HKCR\.fc!]
"(Default)" = "Funshion Task"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\554535b0504d5506b5692d1cc063d92c_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKCR\Funshion\DefaultIcon]
"(Default)" = "%Program Files%\Funshion Online\3.0.6.62\Funshion.exe,1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Funshion]
"DisplayIcon" = "%Program Files%\Funshion Online\3.0.6.62\Funshion.exe"

[HKLM\SOFTWARE\CoreCodec\CoreAVC Pro 2.x]
"serial" = "3TDVPV-XCNFDT-VAZVCD-17JVPC-16DCLL"

[HKLM\System\CurrentControlSet\services\SharedAccess\Defaults\FirewallPolicy\FirewallRules]
"funshiontcp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshion.exe|Name=funshiontcp|"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband]
"FavoritesChanges" = "9"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Funshion]
"UninstallString" = "%Program Files%\Funshion Online\3.0.6.62\Uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2]
"FavoritesVersion" = "2"

[HKCR\FunshionFsv\shell\open\command]
"(Default)" = "%Program Files%\Funshion Online\3.0.6.62\Funshion.exe %1"

[HKLM\SYSTEM\CurrentControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\firewallrules]
"funshionservicetcp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshionservice.exe|Name=funshionservicetcp|"

[HKLM\SOFTWARE\Microsoft\Tracing\554535b0504d5506b5692d1cc063d92c_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband]
"FavoritesResolve" = "CC 02 00 00 4C 00 00 00 01 14 02 00 00 00 00 00"

[HKLM\SOFTWARE\CoreCodec\CoreAVC Pro 2.x]
"User" = "ryomikai33@gundam.eu"

[HKLM\SOFTWARE\Microsoft\Tracing\554535b0504d5506b5692d1cc063d92c_RASMANCS]
"EnableConsoleTracing" = "0"

[HKCR\fsp\DefaultIcon]
"(Default)" = "%Program Files%\Funshion Online\3.0.6.62\Funshion.exe,1"

[HKLM\SOFTWARE\Microsoft\Tracing\554535b0504d5506b5692d1cc063d92c_RASMANCS]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fsp]
"Application" = "%Program Files%\Funshion Online\3.0.6.62\Funshion.exe %1"

[HKLM\SOFTWARE\Microsoft\Tracing\554535b0504d5506b5692d1cc063d92c_RASAPI32]
"EnableFileTracing" = "0"

[HKCR\FunshionFsv\shell]
"(Default)" = "open"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80A7D4B9-D2B8-48DE-B835-0407CEBEDEC0}]
"AppName" = "Funshion.exe"

[HKLM\SOFTWARE\Microsoft\Tracing\554535b0504d5506b5692d1cc063d92c_RASAPI32]
"FileTracingMask" = "4294901760"

[HKLM\SYSTEM\CurrentControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\firewallrules]
"funshionudp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshion.exe|Name=funshionudp|"
"funshionupgradetcp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshionupgrade.exe|Name=funshionupgradetcp|"
"funshiontcp" = "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=%Program Files%\Funshion Online\3.0.6.62\funshion.exe|Name=funshiontcp|"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware deletes the following registry key(s):

[HKCR\.fsp]

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4]
"Application"

The Adware disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FunshionUpgrade"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Funshion"

The process AptShadow.exe:3148 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\AptShadow_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\AptShadow_RASAPI32]
"MaxFileSize" = "1048576"
"FileTracingMask" = "4294901760"

[HKCU\Software\SystemSres]
"mac" = "204153594EFF"
"Guid" = "1751A54E-5FB6-48fb-8351-82D78B93E7AE"

[HKLM\SOFTWARE\Microsoft\Tracing\AptShadow_RASMANCS]
"FileTracingMask" = "4294901760"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\AptShadow_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\AptShadow_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\AptShadow_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\AptShadow_RASMANCS]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3F 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\AptShadow_RASAPI32]
"EnableFileTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

The process Funshion.exe:1100 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\Funshion_RASAPI32]
"FileDirectory" = "%windir%\tracing"
"EnableConsoleTracing" = "0"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\Funshion_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\Funshion_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\Funshion_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"ConsoleTracingMask" = "4294901760"

"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 44 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\Funshion_RASAPI32]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\Funshion_RASMANCS]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\Funshion_RASAPI32]
"EnableFileTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Adware adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Funshion" = "%Program Files%\Funshion Online\3.0.6.62\Funshion.exe startbywindows tray"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process rundll32.exe:1928 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

"UNCAsIntranet" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

The process rundll32.exe:100 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 40 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

"UNCAsIntranet" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

The process rundll32.exe:3024 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1247528503"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
"VerCache" = "BD 40 B2 94 38 25 D2 01 7F 0E CA 94 38 25 D2 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 42 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Internet Explorer\DOMStorage\funshion.com]
"(Default)" = "63"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "rundll32.exe"

[HKCU\Software\Microsoft\Internet Explorer\DOMStorage\Total]
"(Default)" = "91336"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Internet Explorer\LowRegistry]
"AddToFavoritesInitialSelection"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Internet Explorer\LowRegistry]
"AddToFeedsInitialSelection"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process rundll32.exe:4048 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 43 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad]
"WpadLastNetwork" = "{E549E976-C5F2-4E77-819D-55BC9B7C25BC}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 0C 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process rundll32.exe:3388 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 45 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

"UNCAsIntranet" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

The process regsvr32.exe:1024 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}]
"FilterData" = "02 00 00 00 00 00 60 00 02 00 00 00 00 00 00 00"

[HKCU\Software\Classes\http]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCU\Software\Classes\https]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}]
"FriendlyName" = "AVI/WAV File Source"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}]
"CLSID" = "{CF49D4E0-1115-11CE-B03A-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}]
"FilterData" = "02 00 00 00 01 00 80 00 01 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}]
"FilterData" = "02 00 00 00 00 00 60 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}]
"CLSID" = "{1B544C20-FD0B-11CE-8C63-00AA0044B51E}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}]
"FriendlyName" = "Video Renderer"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}]
"FilterData" = "02 00 00 00 00 00 60 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}]
"FilterData" = "02 00 00 00 02 00 60 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}]
"CLSID" = "{51B4ABF3-748F-4E3B-A276-C828330E926A}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}]
"FilterData" = "02 00 00 00 64 00 60 00 0A 00 00 00 00 00 00 00"

[HKCR\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\MJPEG Compressor]
"FriendlyName" = "MJPEG Compressor"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}]
"CLSID" = "{D51BD5A1-7548-11CF-A520-0080C77EF58A}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}]
"FriendlyName" = "File Source (Async.)"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}]
"CLSID" = "{33FACFE0-A9BE-11D0-A520-00A0D10129C0}"
"FriendlyName" = "SAMI (CC) Parser"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}]
"CLSID" = "{FEB50740-7BEF-11CE-9BD9-0000E202599C}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}]
"FriendlyName" = "Video Port Manager"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}]
"FilterData" = "02 00 00 00 00 00 20 00 01 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}]
"FriendlyName" = "Line 21 Decoder 2"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770}]
"FriendlyName" = "File Source (URL)"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
"CLSID" = "{D51BD5A3-7548-11CF-A520-0080C77EF58A}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}]
"FriendlyName" = "MJPEG Decompressor"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770}]
"CLSID" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}]
"CLSID" = "{E4206432-01A1-4BEE-B3E1-3702C8EDC574}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{48025243-2D39-11CE-875D-00608CB78066}]
"FriendlyName" = "Internal Script Command Renderer"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}]
"CLSID" = "{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}]
"FriendlyName" = "Video Renderer"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}]
"FriendlyName" = "AVI Decompressor"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}]
"FriendlyName" = "Wave Parser"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{48025243-2D39-11CE-875D-00608CB78066}]
"CLSID" = "{48025243-2D39-11CE-875D-00608CB78066}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}]
"FriendlyName" = "MIDI Parser"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}]
"CLSID" = "{D51BD5A5-7548-11CF-A520-0080C77EF58A}"

[HKCR\gopher]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}]
"FriendlyName" = "MPEG-I Stream Splitter"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}]
"FriendlyName" = "AVI Splitter"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}]
"FriendlyName" = "VGA 16 Color Ditherer"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770}]
"FilterData" = "02 00 00 00 00 00 40 00 01 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}]
"CLSID" = "{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}]
"CLSID" = "{A888DF60-1E90-11CF-AC98-00AA004C0FA9}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}]
"FriendlyName" = "Video Mixing Renderer 9"

[HKCR\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\MJPEG Compressor]
"FilterData" = "02 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}]
"FilterData" = "02 00 00 00 01 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB85-524F-11CE-9F53-0020AF0BA770}]
"Source Filter" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCU\Software\Classes\ftp]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}]
"CLSID" = "{D3588AB0-0781-11CE-B03A-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}]
"CLSID" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}]
"FriendlyName" = "Color Space Converter"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}]
"CLSID" = "{6A08CF80-0E18-11CF-A24D-0020AFD79767}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
"FriendlyName" = "Multi-file Parser"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}]
"FilterData" = "02 00 00 00 00 00 40 00 01 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}]
"FilterData" = "02 00 00 00 01 00 00 40 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}]
"CLSID" = "{70E102B0-5556-11CE-97C0-00AA0055595A}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\MJPEG Compressor]
"CLSID" = "{B80AB0A0-7416-11D2-9EEB-006008039E37}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}]
"FilterData" = "02 00 00 00 00 00 60 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}]
"CLSID" = "{1643E180-90F5-11CE-97D5-00AA0055595A}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}]
"FilterData" = "02 00 00 00 00 00 60 00 03 00 00 00 00 00 00 00"

[HKCR\file]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}]
"FriendlyName" = "MPEG Audio Decoder"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}]
"CLSID" = "{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}]
"FilterData" = "02 00 00 00 01 00 68 03 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}]
"FriendlyName" = "MPEG Video Decoder"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}]
"FilterData" = "02 00 00 00 00 00 60 00 03 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{48025243-2D39-11CE-875D-00608CB78066}]
"FilterData" = "02 00 00 00 01 00 80 00 01 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}]
"FriendlyName" = "ACM Wrapper"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}]
"FilterData" = "02 00 00 00 00 00 40 00 01 00 00 00 00 00 00 00"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB85-524F-11CE-9F53-0020AF0BA770}]
"0" = "0, 4, , 52494646, 8, 8, , 43445841666D7420, 36, 20, FFFFFFFF00000000FFFFFFFFFFFFFFFFFFFFFFFF, 646174610000000000FFFFFFFFFFFFFFFFFFFF00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}]
"CLSID" = "{D51BD5A2-7548-11CF-A520-0080C77EF58A}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}]
"CLSID" = "{336475D0-942A-11CE-A870-00AA002FEAB5}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}]
"CLSID" = "{4A2286E0-7BEF-11CE-9BD9-0000E202599C}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}]
"FriendlyName" = "AVI Draw"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}]
"FriendlyName" = "File stream renderer"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}]
"CLSID" = "{301056D0-6DFF-11D2-9EEB-006008039E37}"

The Adware deletes the following registry key(s):

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}]
[HKCU\Software\Microsoft\Multimedia\ActiveMovie\Filter Cache]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}]
[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB85-524F-11CE-9F53-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{48025243-2D39-11CE-875D-00608CB78066}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}]

The process regsvr32.exe:4056 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKCR\FunshionFsv\shellex\IconHandler]
"(Default)" = "{4E3E2094-8FF4-457E-ACB5-29DABF6E1A27}"

[HKCR\CLSID\{4E3E2094-8FF4-457E-ACB5-29DABF6E1A27}]
"(Default)" = "Funshion.ShellExtention Class"

[HKCR\CLSID\{4E3E2094-8FF4-457E-ACB5-29DABF6E1A27}\InprocServer32]
"(Default)" = "%Program Files%\Funshion Online\3.0.6.62\FsShlExt.dll"
"ThreadingModel" = "Apartment"

[HKCR\FunshionFsv\shellex\{00021500-0000-0000-C000-000000000046}]
"(Default)" = "{4E3E2094-8FF4-457E-ACB5-29DABF6E1A27}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
"GlobalAssocChangedCounter" = "100"

[HKCR\FunshionFsv]
"NeverShowExt" = "Type: REG_SZ, Length: 0"

[HKCR\FunshionFsv\DefaultIcon]
"(Default)" = "%1"

[HKCR\FunshionFsv\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}]
"(Default)" = "{4E3E2094-8FF4-457E-ACB5-29DABF6E1A27}"

[HKCR\FunshionFsv\shellex\ContextMenuHandlers\{4E3E2094-8FF4-457E-ACB5-29DABF6E1A27}]
"(Default)" = "Funshion.ShellExtention"

The process regsvr32.exe:1524 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}]
"FilterData" = "02 00 00 00 00 00 60 00 02 00 00 00 00 00 00 00"

[HKCU\Software\Classes\http]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCU\Software\Classes\https]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}]
"FriendlyName" = "AVI/WAV File Source"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}]
"CLSID" = "{CF49D4E0-1115-11CE-B03A-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}]
"FilterData" = "02 00 00 00 01 00 80 00 01 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}]
"FilterData" = "02 00 00 00 00 00 60 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}]
"CLSID" = "{1B544C20-FD0B-11CE-8C63-00AA0044B51E}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}]
"FriendlyName" = "Video Renderer"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}]
"FilterData" = "02 00 00 00 00 00 60 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}]
"FilterData" = "02 00 00 00 02 00 60 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}]
"CLSID" = "{51B4ABF3-748F-4E3B-A276-C828330E926A}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}]
"FilterData" = "02 00 00 00 64 00 60 00 0A 00 00 00 00 00 00 00"

[HKCR\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\MJPEG Compressor]
"FriendlyName" = "MJPEG Compressor"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}]
"CLSID" = "{D51BD5A1-7548-11CF-A520-0080C77EF58A}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}]
"FriendlyName" = "File Source (Async.)"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}]
"CLSID" = "{33FACFE0-A9BE-11D0-A520-00A0D10129C0}"
"FriendlyName" = "SAMI (CC) Parser"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}]
"CLSID" = "{FEB50740-7BEF-11CE-9BD9-0000E202599C}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}]
"FriendlyName" = "Video Port Manager"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}]
"FilterData" = "02 00 00 00 00 00 20 00 01 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}]
"FriendlyName" = "Line 21 Decoder 2"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770}]
"FriendlyName" = "File Source (URL)"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
"CLSID" = "{D51BD5A3-7548-11CF-A520-0080C77EF58A}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}]
"FriendlyName" = "MJPEG Decompressor"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770}]
"CLSID" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}]
"CLSID" = "{E4206432-01A1-4BEE-B3E1-3702C8EDC574}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{48025243-2D39-11CE-875D-00608CB78066}]
"FriendlyName" = "Internal Script Command Renderer"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}]
"CLSID" = "{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}]
"FriendlyName" = "Video Renderer"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}]
"FriendlyName" = "AVI Decompressor"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}]
"FriendlyName" = "Wave Parser"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{48025243-2D39-11CE-875D-00608CB78066}]
"CLSID" = "{48025243-2D39-11CE-875D-00608CB78066}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}]
"FriendlyName" = "MIDI Parser"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}]
"CLSID" = "{D51BD5A5-7548-11CF-A520-0080C77EF58A}"

[HKCR\gopher]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}]
"FriendlyName" = "MPEG-I Stream Splitter"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}]
"FriendlyName" = "AVI Splitter"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}]
"FriendlyName" = "VGA 16 Color Ditherer"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770}]
"FilterData" = "02 00 00 00 00 00 40 00 01 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}]
"CLSID" = "{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}]
"CLSID" = "{A888DF60-1E90-11CF-AC98-00AA004C0FA9}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}]
"FriendlyName" = "Video Mixing Renderer 9"

[HKCR\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\MJPEG Compressor]
"FilterData" = "02 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}]
"FilterData" = "02 00 00 00 01 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB85-524F-11CE-9F53-0020AF0BA770}]
"Source Filter" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCU\Software\Classes\ftp]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}]
"CLSID" = "{D3588AB0-0781-11CE-B03A-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}]
"CLSID" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}]
"FriendlyName" = "Color Space Converter"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}]
"CLSID" = "{6A08CF80-0E18-11CF-A24D-0020AFD79767}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
"FriendlyName" = "Multi-file Parser"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}]
"FilterData" = "02 00 00 00 00 00 40 00 01 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}]
"FilterData" = "02 00 00 00 01 00 00 40 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}]
"CLSID" = "{70E102B0-5556-11CE-97C0-00AA0055595A}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\MJPEG Compressor]
"CLSID" = "{B80AB0A0-7416-11D2-9EEB-006008039E37}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}]
"FilterData" = "02 00 00 00 00 00 60 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}]
"CLSID" = "{1643E180-90F5-11CE-97D5-00AA0055595A}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}]
"FilterData" = "02 00 00 00 00 00 60 00 03 00 00 00 00 00 00 00"

[HKCR\file]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}]
"FriendlyName" = "MPEG Audio Decoder"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}]
"CLSID" = "{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}]
"FilterData" = "02 00 00 00 01 00 68 03 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}]
"FriendlyName" = "MPEG Video Decoder"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}]
"FilterData" = "02 00 00 00 00 00 60 00 03 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{48025243-2D39-11CE-875D-00608CB78066}]
"FilterData" = "02 00 00 00 01 00 80 00 01 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}]
"FriendlyName" = "ACM Wrapper"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}]
"FilterData" = "02 00 00 00 00 00 40 00 01 00 00 00 00 00 00 00"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB85-524F-11CE-9F53-0020AF0BA770}]
"0" = "0, 4, , 52494646, 8, 8, , 43445841666D7420, 36, 20, FFFFFFFF00000000FFFFFFFFFFFFFFFFFFFFFFFF, 646174610000000000FFFFFFFFFFFFFFFFFFFF00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}]
"CLSID" = "{D51BD5A2-7548-11CF-A520-0080C77EF58A}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}]
"CLSID" = "{336475D0-942A-11CE-A870-00AA002FEAB5}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}]
"CLSID" = "{4A2286E0-7BEF-11CE-9BD9-0000E202599C}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}]
"FriendlyName" = "AVI Draw"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}]
"FriendlyName" = "File stream renderer"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}]
"CLSID" = "{301056D0-6DFF-11D2-9EEB-006008039E37}"

The Adware deletes the following registry key(s):

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}]
[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB85-524F-11CE-9F53-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{48025243-2D39-11CE-875D-00608CB78066}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}]

The process regsvr32.exe:3964 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKCR\CLSID\{8D0F6366-8F2E-4F7F-872E-5AB98554D78C}\InprocServer32]
"(Default)" = "%Program Files%\Funshion Online\3.0.6.62\FsMediaBar.dll"
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{8D0F6366-8F2E-4F7F-872E-5AB98554D78C}]
"(Default)" = "FsLibrary.FileContextMenuExt Class"

The process regsvr32.exe:3172 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}]
"FilterData" = "02 00 00 00 00 00 60 00 02 00 00 00 00 00 00 00"

[HKCU\Software\Classes\http]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCU\Software\Classes\https]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}]
"FriendlyName" = "AVI/WAV File Source"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}]
"CLSID" = "{CF49D4E0-1115-11CE-B03A-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}]
"FilterData" = "02 00 00 00 01 00 80 00 01 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}]
"FilterData" = "02 00 00 00 00 00 60 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}]
"CLSID" = "{1B544C20-FD0B-11CE-8C63-00AA0044B51E}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}]
"FriendlyName" = "Video Renderer"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}]
"FilterData" = "02 00 00 00 00 00 60 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}]
"FilterData" = "02 00 00 00 02 00 60 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}]
"CLSID" = "{51B4ABF3-748F-4E3B-A276-C828330E926A}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}]
"FilterData" = "02 00 00 00 64 00 60 00 0A 00 00 00 00 00 00 00"

[HKCR\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\MJPEG Compressor]
"FriendlyName" = "MJPEG Compressor"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}]
"CLSID" = "{D51BD5A1-7548-11CF-A520-0080C77EF58A}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}]
"FriendlyName" = "File Source (Async.)"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}]
"CLSID" = "{33FACFE0-A9BE-11D0-A520-00A0D10129C0}"
"FriendlyName" = "SAMI (CC) Parser"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}]
"CLSID" = "{FEB50740-7BEF-11CE-9BD9-0000E202599C}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}]
"FriendlyName" = "Video Port Manager"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}]
"FilterData" = "02 00 00 00 00 00 20 00 01 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}]
"FriendlyName" = "Line 21 Decoder 2"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770}]
"FriendlyName" = "File Source (URL)"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
"CLSID" = "{D51BD5A3-7548-11CF-A520-0080C77EF58A}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}]
"FriendlyName" = "MJPEG Decompressor"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770}]
"CLSID" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}]
"CLSID" = "{E4206432-01A1-4BEE-B3E1-3702C8EDC574}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{48025243-2D39-11CE-875D-00608CB78066}]
"FriendlyName" = "Internal Script Command Renderer"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}]
"CLSID" = "{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}]
"FriendlyName" = "Video Renderer"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}]
"FriendlyName" = "AVI Decompressor"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}]
"FriendlyName" = "Wave Parser"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{48025243-2D39-11CE-875D-00608CB78066}]
"CLSID" = "{48025243-2D39-11CE-875D-00608CB78066}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}]
"FriendlyName" = "MIDI Parser"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}]
"CLSID" = "{D51BD5A5-7548-11CF-A520-0080C77EF58A}"

[HKCR\gopher]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}]
"FriendlyName" = "MPEG-I Stream Splitter"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}]
"FriendlyName" = "AVI Splitter"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}]
"FriendlyName" = "VGA 16 Color Ditherer"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770}]
"FilterData" = "02 00 00 00 00 00 40 00 01 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}]
"CLSID" = "{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}]
"CLSID" = "{A888DF60-1E90-11CF-AC98-00AA004C0FA9}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}]
"FriendlyName" = "Video Mixing Renderer 9"

[HKCR\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\MJPEG Compressor]
"FilterData" = "02 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}]
"FilterData" = "02 00 00 00 01 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB85-524F-11CE-9F53-0020AF0BA770}]
"Source Filter" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCU\Software\Classes\ftp]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}]
"CLSID" = "{D3588AB0-0781-11CE-B03A-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}]
"CLSID" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}]
"FriendlyName" = "Color Space Converter"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}]
"CLSID" = "{6A08CF80-0E18-11CF-A24D-0020AFD79767}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
"FriendlyName" = "Multi-file Parser"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}]
"FilterData" = "02 00 00 00 00 00 40 00 01 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}]
"FilterData" = "02 00 00 00 01 00 00 40 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}]
"CLSID" = "{70E102B0-5556-11CE-97C0-00AA0055595A}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\MJPEG Compressor]
"CLSID" = "{B80AB0A0-7416-11D2-9EEB-006008039E37}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}]
"FilterData" = "02 00 00 00 00 00 60 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}]
"CLSID" = "{1643E180-90F5-11CE-97D5-00AA0055595A}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}]
"FilterData" = "02 00 00 00 00 00 60 00 03 00 00 00 00 00 00 00"

[HKCR\file]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}]
"FriendlyName" = "MPEG Audio Decoder"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}]
"CLSID" = "{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}]
"FilterData" = "02 00 00 00 01 00 68 03 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}]
"FriendlyName" = "MPEG Video Decoder"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}]
"FilterData" = "02 00 00 00 00 00 60 00 03 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{48025243-2D39-11CE-875D-00608CB78066}]
"FilterData" = "02 00 00 00 01 00 80 00 01 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}]
"FriendlyName" = "ACM Wrapper"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}]
"FilterData" = "02 00 00 00 00 00 40 00 01 00 00 00 00 00 00 00"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB85-524F-11CE-9F53-0020AF0BA770}]
"0" = "0, 4, , 52494646, 8, 8, , 43445841666D7420, 36, 20, FFFFFFFF00000000FFFFFFFFFFFFFFFFFFFFFFFF, 646174610000000000FFFFFFFFFFFFFFFFFFFF00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}]
"CLSID" = "{D51BD5A2-7548-11CF-A520-0080C77EF58A}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}]
"CLSID" = "{336475D0-942A-11CE-A870-00AA002FEAB5}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}]
"CLSID" = "{4A2286E0-7BEF-11CE-9BD9-0000E202599C}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}]
"FriendlyName" = "AVI Draw"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}]
"FriendlyName" = "File stream renderer"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}]
"CLSID" = "{301056D0-6DFF-11D2-9EEB-006008039E37}"

The Adware deletes the following registry key(s):

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}]
[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB85-524F-11CE-9F53-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{48025243-2D39-11CE-875D-00608CB78066}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}]

Dropped PE files

MD5 File path
daf8e56066c1ebdac6418e2d95996a2d c:\Program Files\Funshion Online\3.0.6.62\CoreAAC.ax
0b0464759176d0650cd2e7fbc30e22f7 c:\Program Files\Funshion Online\3.0.6.62\CoreAVC.ax
b70bc7e27bdcf86a4c4d4ec8f9d3396e c:\Program Files\Funshion Online\3.0.6.62\CrashReport.exe
d5b2346d139352af8f33800d66200d3f c:\Program Files\Funshion Online\3.0.6.62\FsLibrary.exe
4a158a32af42fae5873cbfafbb639a14 c:\Program Files\Funshion Online\3.0.6.62\FsMediaBar.dll
71a26a3cc20121189445645a419911b7 c:\Program Files\Funshion Online\3.0.6.62\FsMediaBar64.dll
d1973a65e22a74d77a4c8302790e5749 c:\Program Files\Funshion Online\3.0.6.62\FsShlExt.dll
1043cc8516c4254fefe3b0fc96133c16 c:\Program Files\Funshion Online\3.0.6.62\FsShlExt64.dll
61a9b824d29e926cf92cd20bf01a17ae c:\Program Files\Funshion Online\3.0.6.62\Funshion.exe
ca97e09427eb4b1ee583ba40c670d9bd c:\Program Files\Funshion Online\3.0.6.62\FunshionService.exe
05e3e7ca5f39d25fbde3dba815fd3c30 c:\Program Files\Funshion Online\3.0.6.62\FunshionUpgrade.exe
0662f6e759ba66ce95ba087411146ddd c:\Program Files\Funshion Online\3.0.6.62\FunshionWeb.exe
0c14d0f673d3a6ceff5577d38b8e62a3 c:\Program Files\Funshion Online\3.0.6.62\SimpleIE.dll
00b89adf70db4361743ebc45f5442fbe c:\Program Files\Funshion Online\3.0.6.62\Uninstall.exe
ef48135ebf3cf858dd2e5ff8a9a5326c c:\Program Files\Funshion Online\3.0.6.62\atrc.dll
a7f05995ddfb6c7319222321afa720cc c:\Program Files\Funshion Online\3.0.6.62\avcodec-55.dll
9fa74c089efad6acf0bd08493d4691a5 c:\Program Files\Funshion Online\3.0.6.62\avutil-52.dll
822650761ac85effbdff3952b57d4498 c:\Program Files\Funshion Online\3.0.6.62\cjson.dll
1ca96c1aa1ba0e146920f4a026b3cb02 c:\Program Files\Funshion Online\3.0.6.62\cook.dll
86f1b1a136d1c160fe70bfaa8748da82 c:\Program Files\Funshion Online\3.0.6.62\drvc.dll
a2c7d91a8598c46c42a5a942d08ebf64 c:\Program Files\Funshion Online\3.0.6.62\fpvddec.ax
c9fa8bfab0d6264d80d8c575c5ffc8b3 c:\Program Files\Funshion Online\3.0.6.62\funshionplugin2.dll
0f35c14ffe3f0425e77099b618d6ebae c:\Program Files\Funshion Online\3.0.6.62\gma.dll
c0b11a73904e9b824baf9ea6874ebd6d c:\Program Files\Funshion Online\3.0.6.62\lua5.1.dll
e6997fac5d829fab697fa205066e3e6b c:\Program Files\Funshion Online\3.0.6.62\lua51.dll
5108cf4df0da99b68b93e91d26676e19 c:\Program Files\Funshion Online\3.0.6.62\mime\core.dll
7d6f14359f79e937f24c2d047ddae3b9 c:\Program Files\Funshion Online\3.0.6.62\pncrt.dll
c0a528944cab996460b5f901ff3ef986 c:\Program Files\Funshion Online\3.0.6.62\socket\core.dll
79c2c7a661c956a056742b938d8f81e3 c:\Program Files\Funshion Online\3.0.6.62\swscale-2.dll
b8b6b85f1856c5d67aeca35de5957a1b c:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\AptShadow.exe
976fc18a0a5ca32e8b1920d7048c162e c:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\FunExt.dll
ff5cd22ec6737ab3357340e6a7073c41 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\AptNail.dll
fed2535b35e5d3053cd7be43381fb760 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\AptRegIns.dll
2d10e94899fcd7e450489ab41c987428 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\AptRelay.exe
d3e01788ac1ba20d21a1553c9c4da9f4 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunDodge.dll
5e60ec89504922efb28acbf05b785c7e c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunKoala.dll
e911c1b9c3fdbc25510844f43589f9b9 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunKoala64.dll
042ace2a209f537bb9402a563894cf9e c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunNail.dll
1baf6982cd76f862f9badc79ce5c463a c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunSeed.dll
4cf794f16a0375522091f68c5d4d02b0 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunSeed64.dll
34be1fbbdff0c3407ba416a80d73db2a c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunShadow.dll
d5466f73cafe2b0ddcd036dbb379ed03 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunWorks.dll
71a87f80148844fd3aa93cc6da43c8a6 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunWorks64.dll
eca2712861312a180ef6033a105d3f40 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\Inst.dll
0f35c14ffe3f0425e77099b618d6ebae c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\gma.dll
acbcc54caf60240a72bcaa02715d61a2 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\uninst.exe
9657ce0755919b583cf0a5106ac044e4 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\tools\CrashReport.exe
0f35c14ffe3f0425e77099b618d6ebae c:\Users\"%CurrentUserName%"\AppData\Local\Temp\tools\gma.dll
7eac77c1cba4a6e3c83b01561d0add69 c:\Users\"%CurrentUserName%"\AppData\Roaming\FunTemp\Turkey.dll
ca97e09427eb4b1ee583ba40c670d9bd c:\Users\"%CurrentUserName%"\Funshion\funshiontools\FunshionService.exe
d6cb1b89b54baa6dd7fad363b8762cbb c:\Users\"%CurrentUserName%"\Funshion\funshiontools\funoictl.dll
96a28c15a8b7bb027f50bded2474314d c:\Users\"%CurrentUserName%"\Funshion\funshiontools\funoictl64.dll
b98a6e1533aa2e26390e590f9710b96b c:\Users\"%CurrentUserName%"\Funshion\funshiontools\npFunshion.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version: 3.0.6.62
Legal Copyright: Copyright (C) 2005-2016 All Rights Reserved.
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3.0.6.62
File Description:
Comments:
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 567998 568320 4.57755 9d40244c777fd3fc7e48a612492b1b39
.rdata 573440 140782 140800 3.17285 9a9873465b8d76a34f741babc3b62df7
.data 716800 49120 28672 3.45803 7a9a57fc985ac4103bac7c5771fcd8d9
.tls 765952 2 512 0 bf619eac0cdf3f68d496ea9344137e8b
.rsrc 770048 13568064 13568512 5.54506 a8fd9abf7e0740a2dfafa01ce352b508
.reloc 14340096 95722 95744 2.50574 0e336ac72b80cae5f666d2af23adbb5a

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 8
9d3d092f3bd8e07c028eb04cc00e0c0c
277fcb295468155f42417f599b8302cb
5af849fff8647719453b0d3f61f2c93c
74c005672ac802fd31f4bbe52dce3e55
07fe4b53311c4739e5db323230f6f37c
b43bd98987199a6f12ca8de4df768608
09cd57946eeb49ca961a91e5a73a6f9e
ef334adbb959b9fadaad60eb7968dc7f

URLs

URL IP
hxxp://stat.funshion.net/tools/FsPlatformAction?rprotocol=3*_*action=162.AptShadow*_*actionresult=16101*_*actionobjectver=1*_*channelid=*_*mac=204153594EFF*_*guid=1751A54E-5FB6-48fb-8351-82D78B93E7AE*_*name=AptShadow*_*version=3.1.2.1*_*actiontime=|0|win7-32*_*pullupname=FunWorks*_*pullupversion=*_*cid=7404*_*aptid=1|-1 220.181.178.212
hxxp://stat.funshion.net/client/tmp?rprotocol=2*_*fck=14864001070d6vj*_*mac=DF0E2962FD93*_*guid=AA1138BC-E128-441c-82B9-966FDE87B15F*_*userid=*_*fpc=7404*_*version=3.0.6.62*_*sid=*_*vvid=6482112ef6bcac819aef3bec15548cd6*_*type=aptshadow*_*param=0_0_3148 220.181.178.212
hxxp://stat.funshion.net/client/cinstall?rprotocol=1*_*mac=DF0E2962FD93*_*fck=14864001070d6vj*_*guid=26E9A9C9-E26C-43d9-A4E2-B1AEA1102CEC*_*md5=d10d650e2503a2da1df335a99d3e0fe5*_*modifyhistory=2.13.1.2*_*os=3*_*over=*_*cver=3.0.6.62*_*cid=7404*_*cidn=7404*_*startmode=5*_*imode=silent*_*itype=first*_*cusinstall=*_*preparetime=*_*choosetime=*_*installtime=*_*installresult=*_*repairar=4 220.181.178.212
hxxp://k37.gslb.ksyuncdn.com/tools/envver.ini
hxxp://k37.gslb.ksyuncdn.com/tools/senvclear.zip
hxxp://stat.funshion.net/client/tmp_startbyinstall?rprotocol=1*_*mac=DF0E2962FD93*_*fck=14864001070d6vj*_*guid=26E9A9C9-E26C-43d9-A4E2-B1AEA1102CEC*_*md5=d10d650e2503a2da1df335a99d3e0fe5*_*modifyhistory=2.13.1.2*_*os=3*_*over=*_*cver=3.0.6.62*_*cid=7404*_*cidn=7404*_*startmode=5*_*imode=silent*_*itype=first*_*start=;;3.0.6.62;5.0.0.22Beta;-1;0 220.181.178.212
hxxp://k37.gslb.ksyuncdn.com/tools/turkey.php?name=aptshadow&cid=7404
hxxp://k37.gslb.ksyuncdn.com/airport/files/23/Turkey.dll
hxxp://k37.gslb.ksyuncdn.com/tools/tactics/LoadIE.log
hxxp://stat.funshion.net/ecom-ad/shipyardaction?rprotocol=2*_*mac=204153594EFF*_*fck=*_*os=win7-32*_*name=FunExt*_*version=5.0.0.8*_*actionobject=0*_*actionresult=310*_*cid=1002048*_*aptid=-1*_*accedirid=-1 220.181.178.212
hxxp://stat.funshion.net/tools/FsPlatformAction?rprotocol=3*_*action=162.AptShadow*_*actionresult=13888*_*actionobjectver=1*_*channelid=SGAKeRpsfwBrdgwODB5/AT==*_*mac=204153594EFF*_*guid=1751A54E-5FB6-48fb-8351-82D78B93E7AE*_*name=FunShadow*_*version=3.0.2.2*_*actiontime=|0|win7-32*_*pullupname=FunWorks*_*pullupversion=3.1.6.0*_*cid=1001*_*aptid=1|-1 220.181.178.212
hxxp://k37.gslb.ksyuncdn.com/client/jdmarket/jdmarket306.json
hxxp://stat.funshion.net/tools/FsPlatformAction?rprotocol=3*_*action=162.AptShadow*_*actionresult=13841*_*actionobjectver=1*_*channelid=SGAKeRpsfwBrdgwODB5/AT==*_*mac=204153594EFF*_*guid=1751A54E-5FB6-48fb-8351-82D78B93E7AE*_*name=FunShadow*_*version=3.0.2.2*_*actiontime=|0|win7-32*_*pullupname=FunWorks*_*pullupversion=3.1.6.0*_*cid=1001*_*aptid=1|-1 220.181.178.212
hxxp://pub.funshion.com/interface/config?client=pc&file=pc-aconfig&ver=3.0.6.62&fmt=xml 220.181.167.86
hxxp://k37.gslb.ksyuncdn.com/client/market/baiying1220.zip
hxxp://fld.funshion.com/upgrade/upgrade?bid=64 220.181.167.90
hxxp://partner.funshion.com/v5/config/init?cl=pcclient&ve=3.0.6.62 123.125.20.38
hxxp://stat.funshion.net/ecom-ad/shipyardaction?rprotocol=2*_*mac=204153594EFF*_*fck=2|*_*os=win7-32*_*name=FunExt*_*version=5.0.0.8*_*actionobject=0*_*actionresult=316*_*cid=1002048*_*aptid=-1*_*accedirid=-1 220.181.178.212
hxxp://partner.funshion.com/market/8/track.html 123.125.20.38
hxxp://partner.funshion.com/v6/aggregate/init?cl=pcclient&ve=3.0.6.62&uc=162 123.125.20.38
hxxp://k37.gslb.ksyuncdn.com/client/nirvana/config.xml
hxxp://u955.v.qingcdn.com/attachment/editor/minisite/track/install.html?
hxxp://k37.gslb.ksyuncdn.com/tools/accetesting.ini
hxxp://partner.funshion.com/partner/install_statistic.php?s=DF0E2962FD93&id=7404&idn=7404&c=d10d650e2503a2da1df335a99d3e0fe5&t=first&u=&ov=&v=3.0.6.62&auto=1&mh=2.13.1.2&guid=26E9A9C9-E26C-43d9-A4E2-B1AEA1102CEC&hp=0&rp=4&im=silent&uninstscr=&os=noxp&ps=0&thd=0&pl=0&qy=0&pp=0&lt=0&ql=0&sv=0&bd=0&qb=0&bq=0&al=0&iu=0&DYT=0&YJT=0 123.125.20.38
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=3441807&web_id=3441807
hxxp://stat.funshion.net/tools/FsPlatformAction?rprotocol=3*_*action=162.AptShadow*_*actionresult=16403*_*actionobjectver=1*_*channelid=*_*mac=204153594EFF*_*guid=1751A54E-5FB6-48fb-8351-82D78B93E7AE*_*name=AptShadow*_*version=3.1.2.1*_*actiontime=|0|win7-32*_*pullupname=FunWorks*_*pullupversion=*_*cid=7404*_*aptid=1|-1 220.181.178.212
hxxp://pub.funshion.com/interface/materials?ap=c_b_1|c_b_2|c_l_1&fck= 220.181.167.86
hxxp://u955.v.qingcdn.com/main/new/js/v8/??core-min.js,v8-min.js
hxxp://stat.funshion.net/tools/radarboot?rprotocol=2*_*bootmethod=100*_*mac=204153594EFF*_*guid=1751A54E-5FB6-48fb-8351-82D78B93E7AE*_*fck=14864001070d6vj*_*stamp=1486400126*_*name=Turkey*_*version=3.0.1.23*_*os=win7-32-0*_*parentname=*_*parentversion=*_*info=*_*cid=*_*aptid=*_*accedirid= 220.181.178.212
hxxp://partner.funshion.com/v5/search/hotword?cl=pcclient&ve=3.0.6.62&uc=162 123.125.20.38
hxxp://partner.funshion.com/v7/config/channel?cl=pcclient&ve=3.0.6.62&uc=162 123.125.20.38
hxxp://partner.funshion.com/fpupdate/INI/config_update_funplayer.txt 123.125.20.38
hxxp://stat.funshion.net/dts/proxy_communicate?rprotocol=1&dev=PC&mac=DF0E2962FD93&ver=3.0.6.62&value=1|1|0|125 220.181.178.212
hxxp://hm.e.shifen.com/h.js?771e364ef977959c653b857dacf519c4
hxxp://stat.funshion.net/client/bootnew?rprotocol=1*_*fck=14864001070d6vj*_*mac=DF0E2962FD93*_*guid=DFBE3E3FF30C401e8A47945399E8C556*_*userid=0*_*fpc=*_*version=3.0.6.62*_*sid=*_*vvid=*_*errcode=0*_*tasktm=0*_*bdw=*_*scr=*_*disk=*_*pcm=1535*_*res=1276x846*_*osv=4*_*flashv=23.0.0.185*_*iev=9.0000*_*start=startbyinstall tray*_*lan=0*_*skin=0*_*wsize=0*0*_*wrival=000000000000000*_*cid=0*_*lastplay=0*_*lastboot=0*_*tasknum=0 220.181.178.212
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=23.0&ja=1&ln=en-us&lo=0&nv=1&rnd=1869196257&si=771e364ef977959c653b857dacf519c4&st=1&v=1.2.11&lv=1
hxxp://stat.funshion.net/tools/FsPlatformAction?rprotocol=3*_*action=162.AptShadow*_*actionresult=16206*_*actionobjectver=1*_*channelid=*_*mac=204153594EFF*_*guid=1751A54E-5FB6-48fb-8351-82D78B93E7AE*_*name=AptShadow*_*version=3.1.2.1*_*actiontime=|0|win7-32*_*pullupname=FunWorks*_*pullupversion=*_*cid=7404*_*aptid=1|-1 220.181.178.212
hxxp://stat.funshion.net/client/boot?mac=DF0E2962FD93&version=3.0.6.62&channel=1&os=4&starttype=startbyinstall tray&errorcode=0&hc=0&hardware_acceleration=0&yy=1&tray_limit=0 220.181.178.212
hxxp://partner.funshion.com/fpupdate/UPDATE/HttpFile.txt 123.125.20.38
hxxp://z.gds.cnzz.com/stat.htm?id=3441807&r=&lg=en-us&ntime=none&cnzz_eid=518560824-1486396795-&showp=1276x846&t=&h=1&rnd=86080014
hxxp://static.n.shifen.com/hmt/icon/21.gif
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=3441807&t=z
hxxp://u955.v.qingcdn.com/attachment/editor/minisite/ad/kejet/kejet_v3.js?10
hxxp://stat.funshion.net/dts/agentd?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|0.0.0.0|4294967295|2|1|1|0|0 220.181.178.212
hxxp://u955.v.qingcdn.com/main/new/js/v8/curvycorners-min.js?v=20120511
hxxp://partner.funshion.com/help/soft 123.125.20.38
hxxp://stat.funshion.net/dts/nat_info?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|5|0|1|0|0|0|0|0|0 220.181.178.212
hxxp://u955.v.qingcdn.com/attachment/editor/minisite/flash/funshionPlayerViewV3.swf
hxxp://stat.funshion.net/dts/login?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|1|717|1370292026|0|0 220.181.178.212
hxxp://u955.v.qingcdn.com/attachment/editor/minisite/ad/pub/yian_v1.js?1
hxxp://stat.funshion.net/dts/ptv?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|192.168.11.132|0|390|1|82649209|8000 220.181.178.212
hxxp://monitor-tools.cn.miaozhen.com/monitor/v1/encrypt?user=funshion&pwd=6418a1212d2caaf6d57b86c9bb63c10f 123.103.19.70
hxxp://fld.funshion.com/upgrade/is_upgrade?bid=60&app_version= 220.181.167.90
hxxp://fld.funshion.com/upgrade/upgrade?bid=60 220.181.167.90
hxxp://stat.funshion.net/dts/ptv?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|192.168.11.132|0|452|1|1461981878|8080 220.181.178.212
hxxp://stat.funshion.net/client/cinstall_news?rprotocol=1*_*clientFlag=1*_*fck=14864001070d6vj*_*mac=DF0E2962FD93*_*userid=*_*version=3.0.6.62*_*install_type=first*_*coochannelid=7404*_*channelid=7404*_*auto_flag=1*_*guid=26E9A9C9-E26C-43d9-A4E2-B1AEA1102CEC*_*md5=d10d650e2503a2da1df335a99d3e0fe5*_*os=3*_*old_version=*_*version_history=2.13.1.2*_*install_mode=silent*_*competitive_product=000000000000000*_*position_code= 220.181.178.212
hxxp://stat.funshion.net/crossdomain.xml 220.181.178.212
hxxp://stat.funshion.net/client/tmp?rprotocol=1*_*fck=14864001070d6vj*_*mac=DF0E2962FD93*_*guid=26E9A9C9-E26C-43d9-A4E2-B1AEA1102CEC*_*useid=*_*fpc=*_*ver=3.0.6.62*_*sid=*_*vvid=*_*type=2*_*param=1610080256 220.181.178.212
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep={"netAll":0,"netDns":0,"netTcp":0,"srv":0,"dom":8,"loadEvent":22529,"qid":"","bdDom":0,"bdRun":0,"bdDef":0}&et=87&fl=23.0&ja=1&ln=en-us&lo=0&nv=1&rnd=1037117634&si=771e364ef977959c653b857dacf519c4&st=1&v=1.2.11&lv=1
hxxp://u955.v.qingcdn.com/mat/20160415143037-19757060.flv
hxxp://stat.funshion.net/dts/ptv?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|192.168.11.132|0|639|1|1185742650|8000 220.181.178.212
hxxp://u955.v.qingcdn.com/xdispatch/adm.funshion.com/mat/20160415143037-19757060.flv
hxxp://stat.funshion.net/dts/ptv?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|192.168.11.132|0|639|1|1478759094|8080 220.181.178.212
hxxp://stat.funshion.net/client/cinstall?rprotocol=2*_*mac=DF0E2962FD93*_*fck=14864001070d6vj*_*guid=26E9A9C9-E26C-43d9-A4E2-B1AEA1102CEC*_*md5=d10d650e2503a2da1df335a99d3e0fe5*_*modifyhistory=2.13.1.2*_*os=3*_*over=*_*cver=3.0.6.62*_*cid=7404*_*cidn=7404*_*startmode=5*_*imode=silent*_*itype=first*_*cusinstall=00222*_*preparetime=1825*_*choosetime=0*_*installtime=4805*_*installresult=4*_*repairar=4*_*airportinstall=*_*airportcondition=0*_*othersoft=;,,,, 220.181.178.212
hxxp://stat.funshion.net/dts/ptv?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|192.168.11.132|0|702|1|65871993|8000 220.181.178.212
hxxp://stat.funshion.net/dts/agentd?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|192.168.11.132|4294967295|2|1|1|0|0 220.181.178.212
hxxp://stat.funshion.net/dts/agentd?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|192.168.11.132|4294967295|2|2|1|0|0 220.181.178.212
hxxp://stat.funshion.net/dts/agentd?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|192.168.11.132|2933|0|2|1|1361318582|16415 220.181.178.212
hxxp://stat.funshion.net/dts/agentd?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|192.168.11.132|952|1|1|1|1378095798|36895 220.181.178.212
hxxp://u955.v.qingcdn.com/flash/2012-12/91AA3705_AFA2_C4D5_7E5F_437CB2316D08.swf
hxxp://fld.funshion.com/interface/platform?pid=3&ver= 220.181.167.90
hxxp://k37.gslb.ksyuncdn.com/download/fairyland/files/app/103074.daw
hxxp://u955.v.qingcdn.com/mat/20160901143513-14769429.swf
hxxp://fs.fun.tv/market/8/track.html 123.125.20.37
hxxp://neirong.funshion.com/tools/tactics/LoadIE.log 113.107.207.65
hxxp://img.funshion.com/attachment/editor/minisite/ad/kejet/kejet_v3.js?10 121.12.97.28
hxxp://125.90.58.148/xdispatch/adm.funshion.com/mat/20160415143037-19757060.flv
hxxp://po.funshion.com/v7/config/channel?cl=pcclient&ve=3.0.6.62&uc=162 123.125.20.37
hxxp://neirong.funshion.com/tools/envver.ini 113.107.207.65
hxxp://pam.funshion.com/v6/aggregate/init?cl=pcclient&ve=3.0.6.62&uc=162 123.125.20.37
hxxp://neirong.funshion.com/tools/turkey.php?name=aptshadow&cid=7404 113.107.207.65
hxxp://adm.funshion.com/mat/20160901143513-14769429.swf 125.90.58.147
hxxp://adm.funshion.com/flash/2012-12/91AA3705_AFA2_C4D5_7E5F_437CB2316D08.swf 125.90.58.147
hxxp://update.funshion.com/fpupdate/UPDATE/HttpFile.txt 123.125.20.38
hxxp://neirong.funshion.com/tools/senvclear.zip 113.107.207.65
hxxp://adm.funshion.com/mat/20160415143037-19757060.flv 125.90.58.147
hxxp://neirong.funshion.com/client/nirvana/config.xml 113.107.207.65
hxxp://eiv.baidu.com/hmt/icon/21.gif 115.239.211.92
hxxp://c.cnzz.com/core.php?web_id=3441807&t=z 123.138.67.81
hxxp://img.funshion.com/attachment/editor/minisite/flash/funshionPlayerViewV3.swf 121.12.97.28
hxxp://vas.funshion.com/attachment/editor/minisite/track/install.html? 183.2.219.206
hxxp://www.fun.tv/help/soft 123.125.20.38
hxxp://static.funshion.com/main/new/js/v8/??core-min.js,v8-min.js 183.2.219.206
hxxp://update.funshion.com/fpupdate/INI/config_update_funplayer.txt 123.125.20.38
hxxp://conf.funshion.com/interface/config?client=pc&file=pc-aconfig&ver=3.0.6.62&fmt=xml 220.181.167.87
hxxp://neirong.funshion.com/tools/accetesting.ini 113.107.207.65
hxxp://neirong.funshion.com/client/market/baiying1220.zip 113.107.207.65
hxxp://www.funshion.com/help/soft 123.125.20.37
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=23.0&ja=1&ln=en-us&lo=0&nv=1&rnd=1869196257&si=771e364ef977959c653b857dacf519c4&st=1&v=1.2.11&lv=1 220.181.7.190
hxxp://neirong.funshion.com/client/jdmarket/jdmarket306.json 113.107.207.65
hxxp://img.funshion.com/attachment/editor/minisite/ad/pub/yian_v1.js?1 121.12.97.28
hxxp://hm.baidu.com/h.js?771e364ef977959c653b857dacf519c4 220.181.7.190
hxxp://neirong.funshion.com/airport/files/23/Turkey.dll 113.107.207.65
hxxp://po.funshion.com/v5/config/init?cl=pcclient&ve=3.0.6.62 123.125.20.37
hxxp://hzs23.cnzz.com/stat.htm?id=3441807&r=&lg=en-us&ntime=none&cnzz_eid=518560824-1486396795-&showp=1276x846&t=&h=1&rnd=86080014 1.122.192.18
hxxp://s23.cnzz.com/stat.php?id=3441807&web_id=3441807 1.99.192.16
hxxp://static.funshion.com/main/new/js/v8/curvycorners-min.js?v=20120511 183.2.219.206
hxxp://ps.funshion.com/v5/search/hotword?cl=pcclient&ve=3.0.6.62&uc=162 123.125.20.37
hxxp://fs.funshion.com/market/8/track.html 123.125.20.38
ls.funshion.com 182.18.36.88
ns.funshion.com 121.32.237.15
service-bs.funshion.com 182.18.36.81
q.funshion.com 220.181.167.6
login.funshion.com 58.255.172.81
ns3.funshion.com 122.228.57.101
ls3.funshion.com 121.32.237.3
www.btstream.org 220.181.167.9
tls3.funshion.com 182.18.36.86
imgb.funshion.com 220.181.167.8
tls.funshion.com 121.32.237.11
imgq.funshion.com 220.181.167.6


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY PE EXE or DLL Windows file download HTTP
ET MALWARE Possible Windows executable sent when remote host claims to send html content
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile

Traffic

GET /interface/config?client=pc&file=pc-aconfig&ver=3.0.6.62&fmt=xml HTTP/1.1
Connection: Keep-Alive
User-Agent: Funshion/4.0
Host: conf.funshion.com


HTTP/1.1 200 OK
Server: nginx/1.2.0
Date: Mon, 06 Feb 2017 16:56:18 GMT
Content-Type: text/xml
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
5db..<?xml version="1.0" encoding="utf-8" ?><config><So
urceSys>hermes</SourceSys><MaterialsList>hXXp://pub.fun
shion.com/interface/materials?ap=c_b_1|c_b_2|c_l_1</MaterialsList&g
t;<BufferFpURL>hXXp://pub.funshion.com/interface/deliver?ap=c_b_
1|c_b_2</BufferFpURL><LocalFpURL>hXXp://pub.funshion.com/i
nterface/deliver?ap=c_l_1</LocalFpURL><UITextLink>hXXp://p
ub.funshion.com/interface/deliver?ap=c_t_1</UITextLink><MiniT
extLink>hXXp://pub.funshion.com/interface/deliver?ap=c_mt_1</Min
iTextLink><Subscript>hXXp://static.funshion.com/market/p2p/pr
eroll/webpreroll_20160825.swf</Subscript><WebAdURL>hXXp://
vas.fun.tv/market/player/clientpreroll/2017-1-4/gaodaikuan_20170104.ht
ml</WebAdURL><PlayerHome>hXXp://vas.fun.tv/market/player/p
layerhome/playerhome_20160121.html</PlayerHome><LoadingURL>
;hXXp://adm.funshion.com/flash/2012-07/DC996574_2866_7E4D_83BF_B1977BB
D144B.swf</LoadingURL><LoadingTime>100</LoadingTime>
<AdCountDownText>............</AdCountDownText><PauseAd
Web>hXXp://vas.fun.tv/market/player/clientpause/2016-8-31/clientpau
se_2016083102.html</PauseAdWeb><simTime>300</simTime>
;<simURL>hXXp://mc.funshion.com/interface/mc?mcid=1847</simUR
L><ListBox>hXXp://vas.fun.tv/market/player/listbox/listbox_20
160825.html</ListBox><PcStream>hXXp://static.funshion.com/
market/p2p/pc/2014-12-24/FunPlayerClient_20141224.html</PcStrea
<<< skipped >>>


GET /monitor/v1/encrypt?user=funshion&pwd=6418a1212d2caaf6d57b86c9bb63c10f HTTP/1.1
Connection: Keep-Alive
User-Agent: Funshion/4.0
Host: monitor-tools.cn.miaozhen.com


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:45 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
20..1C5197FD1DBF0D1E1C9AE333DA98B29F..0..HTTP/1.1 200 OK..Server: ngin
x/1.2.9..Date: Mon, 06 Feb 2017 16:55:45 GMT..Content-Type: text/html;
charset=UTF-8..Transfer-Encoding: chunked..Connection: keep-alive..Var
y: Accept-Encoding..20..1C5197FD1DBF0D1E1C9AE333DA98B29F..0..



GET /tools/FsPlatformAction?rprotocol=3*_*action=162.AptShadow*_*actionresult=13888*_*actionobjectver=1*_*channelid=SGAKeRpsfwBrdgwODB5/AT==*_*mac=204153594EFF*_*guid=1751A54E-5FB6-48fb-8351-82D78B93E7AE*_*name=FunShadow*_*version=3.0.2.2*_*actiontime=|0|win7-32*_*pullupname=FunWorks*_*pullupversion=3.1.6.0*_*cid=1001*_*aptid=1|-1 HTTP/1.1
Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/1.0.0.1
Host: stat.funshion.net
Connection: Keep-Alive

GET /tools/FsPlatformAction?rprotocol=3*_*action=162.AptShadow*_*actionresult=13841*_*actionobjectver=1*_*channelid=SGAKeRpsfwBrdgwODB5/AT==*_*mac=204153594EFF*_*guid=1751A54E-5FB6-48fb-8351-82D78B93E7AE*_*name=FunShadow*_*version=3.0.2.2*_*actiontime=|0|win7-32*_*pullupname=FunWorks*_*pullupversion=3.1.6.0*_*cid=1001*_*aptid=1|-1 HTTP/1.1
Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/1.0.0.1
Host: stat.funshion.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:19 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Expires: Mon, 06 Feb 2017 16:55:19 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0



GET /tools/envver.ini HTTP/1.1
Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/1.0.0.1
Host: neirong.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 14
Connection: keep-alive
Accept-Ranges: bytes
Server: nginx/1.2.0
Date: Wed, 01 Feb 2017 04:21:20 GMT
Last-Modified: Tue, 10 Jan 2017 08:14:07 GMT
Expires: Wed, 08 Feb 2017 04:21:20 GMT
X-Cache-Status: HIT from KS-CLOUD-TJ-MP-01-19
Age: 477230
X-Cache-Status: HIT from KS-CLOUD-TJ-CT-01-10
[info]..ver=17....


GET /tools/senvclear.zip HTTP/1.1


Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/1.0.0.1
Host: neirong.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj


HTTP/1.1 200 OK
Content-Type: application/zip
Content-Length: 12348
Connection: keep-alive
Server: nginx/1.2.0
Date: Sat, 04 Feb 2017 18:09:15 GMT
Last-Modified: Tue, 10 Jan 2017 08:14:07 GMT
Accept-Ranges: bytes
Expires: Sat, 11 Feb 2017 18:09:15 GMT
X-Cache-Status: HIT from KS-CLOUD-TJ-MP-01-12
Age: 168361
X-Cache-Status: HIT from KS-CLOUD-TJ-CT-01-05
..TKDS<0...$.w....u.t8VU.T.<..........2B.[6Y.2(#dm....m~.Q....b.
=.t..Xm.....!.o.....b..........X...F..hJ..TI............G)...[..b... .
KZ.1(.a.s../.~A.p.z@s?5".o.A.N.{}.{\...v#O.L.\~... ..h`UF.../..).l..a.
.0.;...*.........7..U,|.3E...m.M..d.........s...NH.=.U]E..=7!...Q..s.e
.I..9,.P...u.aN..JHq.Q.9>^....n6...44);.N.$.Q3.....P.7.6..WK.....p.
....Nr...H.........O.Z.N...Z" .s...n)..E....T.8{O......Mpdn$}.SF...'o2
1...D.3.o....="....G.........MX. 6........uV.S8...b.W..M.=.....S0.....
.ag..C?:...A.....l&....j..}/k:O.w...n.5e....J(......q...r#.b..34...:..
....D]..h...M..w..[]8z.F....1$.k.........g]..1]QXRD.d...u..........r-.
T.8 ..m.j....e}.=......s..j....j.T..H3Q.......j.{.B.FSf....w.).d).A...
..^U.M*...\.a...u.......'...........a.0........U....W...k,\ U.%.......
...5e.E..m.o...d2.k.U..Cu..#x*c..."..*...u.H....]n."X.O..(Wt.......Q.M
......J". .x..[.....J.....x...H..8...]......;.]..@O.....UQW......J*..P
....6..4K...G`w{....9.D..s5.R!riU....{............F.}"...hER...c.[..&l
t;Z...;..Y2.......n.. .o.(.d...K... ..[....FVD..........<..i.]( ?.f
.B.pq..A..J..........*.k....a..#..:Y...Xe.iDG..P. (.~.[...t.n......u.B
*......p.7...MUA.sIr.....$. d...]........p...;..2..........u%..J.J.!T:
.g`.S.....8.s...9P.xe.....G.C......6~..>l. ...U...[..g......5.t...2
[.....'kz...o....@.."....^..[/P..p!Vv....<....Y.6.b6.%O9.0....5...S
l`.....Y.."iR..)*.3M...........lC8:f.X...........F... ..U..tJ.......T2
..?~Fl....t7x^s.{.5.. ..7.y\..#..r7b.........$..oB....'..c_.V..w.U....
a.L;.m......3kG.(.....K.../..ny...'.6.)..Y.l.-.xI./../.k...r ...[.
<<< skipped >>>

GET /tools/turkey.php?name=aptshadow&cid=7404 HTTP/1.1


Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/1.0.0.1
Host: neirong.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj; channelid=7404; _version=3.0.6.62; isnew=1


HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 121
Connection: keep-alive
Server: nginx/1.2.0
Date: Sun, 05 Feb 2017 06:57:54 GMT
Vary: Accept-Encoding
P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
Expires: Sun, 12 Feb 2017 06:57:54 GMT
X-Cache-Status: HIT from KS-CLOUD-TJ-MP-01-14
Age: 122244
X-Cache-Status: HIT from KS-CLOUD-TJ-CT-01-01
{"do":"1","md5":"7EAC77C1CBA4A6E3C83B01561D0ADD69","dll":"http:\/\/nei
rong.funshion.com\/airport\/files\/23\/Turkey.dll"}HTTP/1.1 200 OK..Co
ntent-Type: text/html..Content-Length: 121..Connection: keep-alive..Se
rver: nginx/1.2.0..Date: Sun, 05 Feb 2017 06:57:54 GMT..Vary: Accept-E
ncoding..P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA 
PRE COM NAV OTC NOI DSP COR..Expires: Sun, 12 Feb 2017 06:57:54 GMT..X
-Cache-Status: HIT from KS-CLOUD-TJ-MP-01-14..Age: 122244..X-Cache-Sta
tus: HIT from KS-CLOUD-TJ-CT-01-01..{"do":"1","md5":"7EAC77C1CBA4A6E3C
83B01561D0ADD69","dll":"http:\/\/neirong.funshion.com\/airport\/files\
/23\/Turkey.dll"}....


GET /airport/files/23/Turkey.dll HTTP/1.1


Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/1.0.0.1
Host: neirong.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj; channelid=7404; _version=3.0.6.62; isnew=1


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 203768
Connection: keep-alive
Server: nginx/1.2.0
Date: Tue, 31 Jan 2017 14:37:10 GMT
Last-Modified: Mon, 25 Jul 2016 06:50:37 GMT
Accept-Ranges: bytes
Expires: Tue, 07 Feb 2017 14:37:10 GMT
X-Cache-Status: HIT from KS-CLOUD-TJ-MP-01-11
Age: 526688
X-Cache-Status: HIT from KS-CLOUD-TJ-CT-01-01
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......A....x.@.x.@
.x.@..~@.x.@j.Q@.x.@.6b@.x.@..d@.x.@..P@.x.@..Q@Tx.@..y@.x.@..i@$x.@.x
.@.x.@..U@gx.@..a@.x.@..`@.x.@..g@.x.@Rich.x.@................PE..L...
.<.W...........!................0..................................
...................@.........................,...|.......@............
.......................................................$...H..........
.................................UPX0.................................
...UPX1................................@....rsrc......................
.........@............................................................
......................................................................
......................................................................
......................................................................
......................................................................
..........3.91.UPX!......GA........-....6..&...............`u$..3.h...
.......d.hl....h....-.....a.U..j...J.L_[....!.. u..3... ....`\U.20.Q.W
.....odP...?..S;,w..(O._aQR..l.........l<.^.Hs.;x...x....A.c_...d.;
.~.....k..xX~..........;.}'t..."@~.......w..... .|..;.}n.......L^.....
N....W...N......;.u......q"..^.N..u.o....P...D...X.......O.Q..]..{....
.y...Np...8tN..*}!...n(..}..A.w.6..?'.^......e....E....."..1.^..".....
...f..E..}....5..V.R..x....(8._.F....oE..U.....:.R._......:..69P.}.*~.
..C..9.2......_....\.V..M:.R..........D.....S...F..N.......@.b..H.
<<< skipped >>>


GET /interface/platform?pid=3&ver= HTTP/1.1
Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/1.0.0.1
Host: fld.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj; channelid=7404; _version=3.0.6.62; isnew=1; Mac=DF0E2962FD93; funshion_setup=1; Hm_lvt_771e364ef977959c653b857dacf519c4=1486400129


HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 06 Feb 2017 16:56:01 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
604....TKDS.....$.X..._....^.....V\.g8........d..`CG..W...S.....V.....
.=-.....\.Gh",nUx/.!.yW..A...c.A..(.\.><5.|..............^.Y$...
...t..!?.AA.....7.......K>....t.}r.p.p..X.........y6...j/.*..xg..#O
iMA...%L..g..05 .. o.F.H7;).......y.H...v....(%t:M. <R...ds.......c
. ....:/...<..7..QQ'..du...]5.(29'.Yh..y...Z..7X..x5".k...U.cE.:...
.X.-O......Q...a\.Y$......7.>RP.@....W=cV.l.......z.}....}.........
k..,.U|..2.O..H..b."..O.du...]5...E.IH!.......M.,1w.l.p.X\..I..W.I.>
;....'........2N;p.I..%.j....p.I...\h",nUx/.E.1.........".8...-H....U.
|......a^...\.<=....?js.O.p.1.v.0.&.H...d0..N.....]....@....|B.....
._..p.I...\h",nUx/.E.1.........".8...-H....U.|......a^...\.<=....?j
..a.Q.].v.0.&.H..N.q]..q...JT....Sb...z.8./.#z..p.p..X.........y.....d
..Z.....`..Y...u...J..<a.ta.p... ......x..~y)..e.......v.3Q.G..?1'.
.....X.....\..]~.>..[..........U.|......n].......b."..O.du...]5..x~
...........M...MT..P.X\..I..3....m..g.{Vk._y}-.b.f.../.r.3.V.7..QQ'..d
u...]5_..e.4....xg..#OiMA...%L...R.....y.|.P..X....8.Vb..q..$..o.. .a.
.....@..o.).l O)d.....jQ_.J*E_........z*...R...._......AH.Z.>.1.o!M
......{......<=....?j[[...JA.v.0.&.H.J.......P/.E.....].J.S.7.....w
....YE..f..Y...u..........G...`o....-H....U.|.....^Y`..D...-O.....5.7a
Cy..Y$......l.j....V.0C....ND<.,.Ry...j.c....7..QQ'..du...]5,.rFp0.
...xg..#OiMA...%La...{.......IF.W...J....b..q..$..o.. .a..^.fT3D$o.).l
 O)6.....].6....I...7..QQ'..du...]5,.rFp0....xg..#OiMA...%La...{......
.IF.W.....u...rA6..*.Y$........[.H...&......./...9...j.52/.....r..
<<< skipped >>>


GET /dts/agentd?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|192.168.11.132|2933|0|2|1|1361318582|16415 HTTP/1.0
Connection: Close
Host: stat.funshion.net


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:58 GMT
Content-Type: text/plain
Content-Length: 0
Connection: close
Expires: Mon, 06 Feb 2017 16:55:58 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0



GET /dts/agentd?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|192.168.11.132|952|1|1|1|1378095798|36895 HTTP/1.0
Connection: Close
Host: stat.funshion.net


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:58 GMT
Content-Type: text/plain
Content-Length: 0
Connection: close
Expires: Mon, 06 Feb 2017 16:55:58 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0



GET /xdispatch/adm.funshion.com/mat/20160415143037-19757060.flv HTTP/1.1
Connection: Keep-Alive
User-Agent: Funshion/4.0
Host: 125.90.58.148


HTTP/1.1 200 OK
Date: Mon, 06 Feb 2017 16:55:48 GMT
Content-Type: video/x-flv
Content-Length: 2102709
Connection: keep-alive
Expires: Mon, 01 May 2017 12:55:14 GMT
Cache-Control: max-age=7776000
Accept-Ranges: bytes
ETag: "1441209434"
Last-Modified: Fri, 15 Apr 2016 06:30:37 GMT
Server: lighttpd/1.4.26
X-Ser: BC72_dx-lt-hebei-shijiazhuang-2-cache-1, BC148_dx-guangdong-zhanjiang-1-cache-2
X-Cache: HIT from BC148_dx-guangdong-zhanjiang-1-cache-2(baishan)
FLV.............$..........onMetaData.......duration.@..$./....width.@
.........height.@~........videodatarate.@.j.......framerate.@4........
videocodecid.@.........audiodatarate.@_@.......audiosamplerate.@......
...audiosamplesize.@0........stereo....audiocodecid.@$........encoder.
..Lavf54.6.100..filesize.A@............/... .............M@.....gM@...
P...................h......6..................................d.......
...E....H..,. .#..x264 - core 125 - H.264/MPEG-4 AVC codec - Copyleft 
2003-2012 - hXXp://VVV.videolan.org/x264.html - options: cabac=1 ref=2
 deblock=1:0:0 analyse=0x1:0x131 me=hex subme=6 psy=1 psy_rd=1.00:0.00
 mixed_ref=1 me_range=16 chroma_me=1 trellis=0 8x8dct=0 cqm=0 deadzone
=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=2 lookahead_threads=1 
sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrai
ned_intra=0 bframes=2 b_pyramid=2 b_adapt=0 b_bias=0 direct=1 weightb=
1 open_gop=0 weightp=2 keyint=12 keyint_min=7 scenecut=40 intra_refres
h=0 rc_lookahead=12 rc=abr mbtree=1 bitrate=800 ratetol=1.0 qcomp=0.60
 qpmin=6 qpmax=51 qpstep=4 ip_ratio=1.40 aq=1:1.00.....ce.........<
.lw'.Ma.AL...9S\..........E....A.....z...\H..5C.P.X...................
................[....(......2....'........A.#lI....*..r...~...1../.{!.
W1}#C.W.....;. ..3........P....Jgp".c....^....(>`..%.....D.R.C....x
a.I|....X........<.Ea..:e.>.)e..q.K.V.2..'.;..5..........z...{..
....].g. kv......Z,L.}....4....]NV,Pb.G.........Hm. .V@D^.s...e.n.}q..
.._....m9.\..i..7M.Q.....lT_P......K..Vhl......: .r..~....r2|.>
<<< skipped >>>


GET /fpupdate/UPDATE/HttpFile.txt HTTP/1.1
Connection: Keep-Alive
User-Agent: Funshion/4.0
Host: update.funshion.com


HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 06 Feb 2017 16:55:28 GMT
Content-Type: text/plain
Content-Length: 42673
Last-Modified: Sat, 21 Jan 2017 07:58:18 GMT
Connection: close
Vary: Accept-Encoding
ETag: "5883149a-a6b1"
Accept-Ranges: bytes
[Version]..HttpVersion=1.5.3.232..[Serverlist]..P2PServer= q.funshion.
com|80;api.funshion.com|80..WebServer=hXXp://VVV.funshion.com;hXXp://f
s.funshion.com;hXXp://static.funshion.com;hXXp://VVV.btstream.org..[Cl
ientURL]..PauseAdWeb=1.5.3.8Beta::hXXp://ad.funshion.com/pause/::1.5.3
.10Beta::hXXp://ad.funshion.com/pause/::1.5.3.11Beta::hXXp://ad.funshi
on.com/pause/::1.5.3.12Beta::hXXp://ad.funshion.com/pause/::1.5.3.15Be
ta::hXXp://ad.funshion.com/pause/::1.5.3.16Beta::hXXp://ad.funshion.co
m/pause/::1.5.3.18Beta::hXXp://ad.funshion.com/pause/::1.5.3.19Beta::h
ttp://ad.funshion.com/pause/::1.5.3.25Beta::hXXp://ad.funshion.com/pau
se/::1.5.3.26Beta::hXXp://ad.funshion.com/pause/::2.0.0.10Beta::http:/
/ad.funshion.com/pause/::2.0.0.12Beta::hXXp://ad.funshion.com/pause/::
2.0.0.16Beta::hXXp://ad.funshion.com/pause/::2.0.0.21Beta::hXXp://ad.f
unshion.com/pause/::2.0.0.22Beta::hXXp://ad.funshion.com/pause/..GetPa
ssword = 1.2.3.10Beta::hXXp://VVV.funshion.com/account_password::1.2.3
.16Beta::hXXp://VVV.funshion.com/account_password::1.2.3.19Beta::http:
//VVV.funshion.com/account_password::1.2.4.17Beta::hXXp://VVV.funshion
.com/account_password::1.2.4.25Beta::hXXp://VVV.funshion.com/account_p
assword::1.2.4.27Beta::hXXp://VVV.funshion.com/account_password::1.2.4
.28Beta::hXXp://VVV.funshion.com/account_password::1.5.0.10Beta::http:
//VVV.funshion.com/account_password::1.5.1.2Beta::hXXp://VVV.funshion.
com/account_password::1.5.1.10Beta::hXXp://VVV.funshion.com/account_pa
ssword::1.5.2.15Beta::hXXp://VVV.funshion.com/account_password::1.
<<< skipped >>>


GET /attachment/editor/minisite/ad/pub/yian_v1.js?1 HTTP/1.1
Accept: */*
Referer: hXXp://vas.funshion.com/attachment/editor/minisite/track/install.html?
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: img.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj; channelid=7404; _version=3.0.6.62; isnew=1; Mac=DF0E2962FD93; funshion_setup=1; Hm_lvt_771e364ef977959c653b857dacf519c4=1486400129; Hm_lpvt_771e364ef977959c653b857dacf519c4=1486400129


HTTP/1.1 200 OK
Date: Mon, 06 Feb 2017 16:55:57 GMT
Content-Type: application/x-javascript
Content-Length: 510
Connection: keep-alive
Expires: Sun, 16 Apr 2017 14:58:56 GMT
Server: nginx
Last-Modified: Mon, 31 Dec 2012 07:38:30 GMT
Cache-Control: max-age=7776000
Host: img.funshion.com
X-Cache: HIT from CACHE-129
Accept-Ranges: bytes
X-Ser: BC84_dx-lt-yd-zhejiang-huzhou-2-cache-2, BC26_dx-guangdong-jiangmen-3-cache-6
X-Cache: HIT from BC26_dx-guangdong-jiangmen-3-cache-6(baishan)
if (window.T) T.ready(function(){...var div = T.dom.create('div');...T
.setStyles(div, {width : 2, height: 2, display : 'block', opacity : 0.
1, overflow:'hidden'});...document.body.appendChild(div);...T.swf.crea
te({....id : 'ad-player-yinan',....url : 'hXXp://adm.funshion.com/flas
h/2012-12/91AA3705_AFA2_C4D5_7E5F_437CB2316D08.swf',....width : '100%'
,....height : '100%',....allowScriptAccess : 'always',....allowfullscr
een : 'true',....wmode : 'transparent',....vars :  {.....from : '0'...
.}...}, div);..});HTTP/1.1 200 OK..Date: Mon, 06 Feb 2017 16:55:57 GMT
..Content-Type: application/x-javascript..Content-Length: 510..Connect
ion: keep-alive..Expires: Sun, 16 Apr 2017 14:58:56 GMT..Server: nginx
..Last-Modified: Mon, 31 Dec 2012 07:38:30 GMT..Cache-Control: max-age
=7776000..Host: img.funshion.com..X-Cache: HIT from CACHE-129..Accept-
Ranges: bytes..X-Ser: BC84_dx-lt-yd-zhejiang-huzhou-2-cache-2, BC26_dx
-guangdong-jiangmen-3-cache-6..X-Cache: HIT from BC26_dx-guangdong-jia
ngmen-3-cache-6(baishan)..if (window.T) T.ready(function(){...var div 
= T.dom.create('div');...T.setStyles(div, {width : 2, height: 2, displ
ay : 'block', opacity : 0.1, overflow:'hidden'});...document.body.appe
ndChild(div);...T.swf.create({....id : 'ad-player-yinan',....url : 'ht
tp://adm.funshion.com/flash/2012-12/91AA3705_AFA2_C4D5_7E5F_437CB2316D
08.swf',....width : '100%',....height : '100%',....allowScriptAccess :
 'always',....allowfullscreen : 'true',....wmode : 'transparent',....v
ars :  {.....from : '0'....}...}, div);..});..
<<< skipped >>>


GET /client/nirvana/config.xml HTTP/1.1
Connection: Keep-Alive
User-Agent: Funshion/4.0
Host: neirong.funshion.com


HTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 7103
Connection: keep-alive
Server: nginx/1.2.0
Date: Tue, 31 Jan 2017 14:45:28 GMT
Last-Modified: Fri, 25 Sep 2015 03:26:25 GMT
Accept-Ranges: bytes
Expires: Tue, 07 Feb 2017 14:45:28 GMT
X-Cache-Status: HIT from KS-CLOUD-FS-CT-01-10
Age: 526204
X-Cache-Status: HIT from KS-CLOUD-ZS-CT-01-04
<config>...<template version="36">...    <fonts>... 
       <font name="yahei_16" face="............" size="16" bold="fa
lse" italic="false" underline="false" />...        <font name="y
ahei_15" face="............" size="15" bold="false" italic="false" und
erline="false" />...        <font name="yahei_14" face="........
...." size="14" bold="false" italic="false" underline="false" />...
        <font name="yahei_13" face="............" size="13" bold="f
alse" italic="false" underline="false" />...        <font name="
yahei_12" face="............" size="12" bold="false" italic="false" un
derline="false" />...        <font name="yahei_11" face=".......
....." size="11" bold="false" italic="false" underline="false" />..
.    </fonts>...    <colors>...        <color name="555
555" value="#555555" />...        <color name="666666" value="#6
66666" />...        <color name="888888" value="#888888" />..
.        <color name="f98d00" value="#f98d00" />...        <c
olor name="fe7839" value="#fe7839" />...        <color name="fe3
c3c" value="#fe3c3c" />...        <color name="858e93" value="#8
58e93" />...        <selector name="channel" normal="555555" hov
er="fe7839" pressed="fe7839" selected="fe7839" />...        <sel
ector name="tag" normal="666666" hover="fe7839" pressed="fe7839" selec
ted="fe7839" />...    </colors>...    <drawables>...   
     <color name="f0f0f0" value="#f0f0f0" />...        <c
<<< skipped >>>


GET /v5/config/init?cl=pcclient&ve=3.0.6.62 HTTP/1.1
Connection: Keep-Alive
User-Agent: Funshion/4.0
Host: po.funshion.com


HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 06 Feb 2017 16:55:20 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
iscache: 0
4f..{"retcode":"200","retmsg":"ok","uc":"162","play":"tv","download":"
tv","ia":"0"}..0..



GET /stat.htm?id=3441807&r=&lg=en-us&ntime=none&cnzz_eid=518560824-1486396795-&showp=1276x846&t=&h=1&rnd=86080014 HTTP/1.1
Accept: */*
Referer: hXXp://vas.funshion.com/attachment/editor/minisite/track/install.html?
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: hzs23.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 06 Feb 2017 16:55:30 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Fri, 21 Oct 2016 11:30:28 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..



GET /client/jdmarket/jdmarket306.json HTTP/1.1
Connection: Keep-Alive
User-Agent: Funshion/4.0
Host: neirong.funshion.com


HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 159
Connection: keep-alive
Accept-Ranges: bytes
Server: nginx/1.2.0
Date: Sat, 04 Feb 2017 21:18:29 GMT
Expires: Sat, 11 Feb 2017 21:18:29 GMT
Last-Modified: Tue, 20 Dec 2016 10:18:42 GMT
X-Cache-Status: HIT from KS-CLOUD-GZ-MP-01-09
Age: 157010
X-Cache-Status: HIT from KS-CLOUD-ZS-CT-01-04
{..    "result": "ok",..    "detail": {..        "name": "baiying1220"
,..        "url": "hXXp://neirong.funshion.com/client/market/baiying12
20.zip"..    }..}......


GET /client/market/baiying1220.zip HTTP/1.1


Connection: Keep-Alive
User-Agent: Funshion/4.0
Host: neirong.funshion.com


HTTP/1.1 200 OK
Content-Type: application/zip
Content-Length: 3668041
Connection: keep-alive
Server: nginx/1.2.0
Date: Fri, 03 Feb 2017 02:52:24 GMT
Last-Modified: Tue, 20 Dec 2016 10:18:52 GMT
Accept-Ranges: bytes
Expires: Fri, 10 Feb 2017 02:52:24 GMT
X-Cache-Status: HIT from KS-CLOUD-GZ-MP-01-05
Age: 309776
X-Cache-Status: HIT from KS-CLOUD-ZS-CT-01-05
PK...........I.h..\.7..~8.....default.skin.Z.P$..].p....w_.ww...`.....
..p..kp8.p..C.J.S...=S3=5.....u....4......(.....@.X....:2..".`wu.4....
......c..Y2.....Oh......ML..m...Y_[Y..hK...VU.[P.Q.FK{.......C.*.9.-.y
..p.....A....it\~y4..... .Y.k0X.r.7A8., .4...%..!I..1J....`..ûL....u
...........W.............vu.m6.o#k.l...^..4...9~C.`r....{(...fr...1...
.L..D..N..z5.........J.........-.YJ.F|..k.u..G...........uNq.....<.
.d......g....]0....=.......fI.c_..k.MC.-:.Q#.1..@Dt..G..}'...N..=[[..P
....4.B.....1&1Z.p..-J-8...s/....z..N...N.)..2!... M...DR.....#.%vSa.A
..Ha48.'i..5.,.g.,<.......qo....$.E....,....4T{I .......<.b%.f..
.X.@...:.P...t.\..u..& .RD..,....~.(V.....%.1.2..#...=..8h...e&S......
*^E..s.6..j9...._...F#.g"1}!..)..'....U..g.....-.R./..E3B.."%S...~@l.R
C].'zXD.Q.|..J73..Gc@...9..w[.3..(....R....fw.=.h.1.....#.*....`....Wp
T....`..w._........Z.=......d...u:f.i....&[.......1~Rw.....e..~.....q.
..I7..3.F.o`..........Wl.^...r....\..t$....t.;.M._......{....}....v...
....T0s.WW;..3..%e.....w..&Z.z..1<.........l...&v....3./.S.TU.#V..A
..*..P5...(.i8.2.$B..Ri@.O2...x..nf.....z.kX?.........._1.73...`..(:..
.....ov7;.....W...}..c......eS......T.|.'..&.....9......4...BpiL......
.O..>F..3......".y......`,f.`EH-.s=..Pl.1...*$.~..\...[PD;c...@f...
..^..?.)....z.C.#.O..%:....).ix./^....8.P:.G.../..La..: .n..9......8..
..Y.r..#jv.`.........0..?..i....E..2%.=.{`x.`iIIA...FG...I...M .I...8.
.8.O..A.V....L..;L.'`.g........A.X'v.d ..G.!....H....J..i.pQ/..QY..JB.
..T.G.......l....!.I..t.T!....Bq.Rw~'..]~..<._8...yF.n..Dz.F.3.
<<< skipped >>>


GET /dts/ptv?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|192.168.11.132|0|639|1|1185742650|8000 HTTP/1.0
Connection: Close
Host: stat.funshion.net


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:49 GMT
Content-Type: text/plain
Content-Length: 0
Connection: close
Expires: Mon, 06 Feb 2017 16:55:49 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0



GET /core.php?web_id=3441807&t=z HTTP/1.1
Accept: */*
Referer: hXXp://vas.funshion.com/attachment/editor/minisite/track/install.html?
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 763
Connection: keep-alive
Date: Mon, 06 Feb 2017 16:44:36 GMT
Last-Modified: Mon, 06 Feb 2017 16:44:36 GMT
Expires: Mon, 06 Feb 2017 16:59:36 GMT
Via: cache57.l2nu16-1[0,200-0,H], cache4.l2nu16-1[0,0], kunlun2.cn356[0,200-0,H], kunlun8.cn356[0,0]
Age: 655
X-Cache: HIT TCP_MEM_HIT dirn:-2:-2
X-Swift-SaveTime: Mon, 06 Feb 2017 16:44:37 GMT
X-Swift-CacheTime: 899
Timing-Allow-Origin: *
EagleId: 7b8a430814864001312245237e
!function(){var p,q,r,a=encodeURIComponent,b="3441807",c="",d="",e="on
line_v3.php",f="hzs23.cnzz.com",g="1",h="text",i="z",j="站໳
1;统计",k=window["_CNZZDbridge_" b]["bobject"],l="http:",m
="1",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=
" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&
k["callRequest"]([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k["cr
eateScriptIcon"](n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/websit
e.php?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnz
z.com/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'
><img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="
<a href='" q "' target=_blank title='" j "'>" j "</a>",k["
createIcon"]([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type:
 application/javascript..Content-Length: 763..Connection: keep-alive..
Date: Mon, 06 Feb 2017 16:44:36 GMT..Last-Modified: Mon, 06 Feb 2017 1
6:44:36 GMT..Expires: Mon, 06 Feb 2017 16:59:36 GMT..Via: cache57.l2nu
16-1[0,200-0,H], cache4.l2nu16-1[0,0], kunlun2.cn356[0,200-0,H], kunlu
n8.cn356[0,0]..Age: 655..X-Cache: HIT TCP_MEM_HIT dirn:-2:-2..X-Swift-
SaveTime: Mon, 06 Feb 2017 16:44:37 GMT..X-Swift-CacheTime: 899..Timin
g-Allow-Origin: *..EagleId: 7b8a430814864001312245237e..!function(){va
r p,q,r,a=encodeURIComponent,b="3441807",c="",d="",e="online_v3.php",f
="hzs23.cnzz.com",g="1",h="text",i="z",j="站长统#
745;",k=window["_CNZZDbridge_" b]["bobject"],l="http:",m="1",n=l "
<<< skipped >>>


GET /stat.php?id=3441807&web_id=3441807 HTTP/1.1
Accept: */*
Referer: hXXp://vas.funshion.com/attachment/editor/minisite/track/install.html?
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: s23.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 9938
Connection: keep-alive
Date: Mon, 06 Feb 2017 15:59:55 GMT
Last-Modified: Mon, 06 Feb 2017 15:59:55 GMT
Cache-Control: max-age=5400,s-maxage=5400
Via: cache12.l2nu16-1[0,200-0,H], cache48.l2nu16-1[1,0], kunlun6.cn356[0,200-0,H], kunlun5.cn356[0,0]
Age: 3328
X-Cache: HIT TCP_MEM_HIT dirn:10:121377176
X-Swift-SaveTime: Mon, 06 Feb 2017 15:59:56 GMT
X-Swift-CacheTime: 5399
Timing-Allow-Origin: *
EagleId: 7b8a430514864001238687435e
(function(){function k(){this.c="3441807";this.R="z";this.N="";this.K=
"";this.M="";this.r="1486396795";this.P="hzs23.cnzz.com";this.L="";thi
s.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" 
this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la(
)}function g(a,b){try{var c=.[];c.push("siteid=3441807");c.push("name=
" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.
push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAge
nt));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.rando
m()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}cat
ch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURICompon
ent,n=unescape;k.prototype={la:function(){try{this.U(),this.J(),this.i
a(),this.H(),this.o(),this.ga(),.this.fa(),this.ja(),this.j(),this.ea(
),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.pa(),e[this.t
]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},na:func
tion(){try{var a=this;e._czc={push:function(){return a.B.apply(a,argum
ents)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;if(
"[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b  ){
var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object Stri
ng]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAutoP
ageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch(d)
{g(d,"cS failed")}},pa:function(){try{if("undefined"===typeof e._cz_ac
count||e._cz_account===this.c){e._cz_account=this.c;if("[object Ar
<<< skipped >>>


GET /dts/ptv?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|192.168.11.132|0|452|1|1461981878|8080 HTTP/1.0
Connection: Close
Host: stat.funshion.net


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:39 GMT
Content-Type: text/plain
Content-Length: 0
Connection: close
Expires: Mon, 06 Feb 2017 16:55:39 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0



GET /h.js?771e364ef977959c653b857dacf519c4 HTTP/1.1
Accept: */*
Referer: hXXp://vas.funshion.com/attachment/editor/minisite/track/install.html?
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: hm.baidu.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 8511
Content-Type: application/javascript
Date: Mon, 06 Feb 2017 16:55:27 GMT
Etag: 638fb3eb71efcc32e55065510fc29f05
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMVT=771e364ef977959c653b857dacf519c4|1486400127|; Path=/; Domain=hm.baidu.com
Set-Cookie: HMACCOUNT=87640E5C25847F7D; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
...........5...(function(){var h={},mt={},c={id:"771e364ef977959c653b8
57dacf519c4",dm:["midianying.com","funshion.com"],js:"tongji.baidu.com
/hm-web/js/",etrk:[],icon:'/hmt/icon/21|gif|20|20',ctrk:false,align:-1
,nv:1,vdur:1800000,age:31536000000,rec:0,rp:[],trust:0,vcard:0,qiao:0,
lxb:0,conv:0,med:0,cvcc:'',cvcf:[],apps:''};.:kw..... h4 ..LI....F.I..
..4.I.}.J.HB.#..IJ.k.....>.H.{w}.)p......K.Y._.QhuY......"......Y.L
..F.:..wfy$-.&l.8....)d^..XFcQ....e.l,...I..nR?L...ZN.x..r.n....ws.Q..
4. M..|..?.!.qm.../b)..6..!6..x!..1....5....P.....>/..P.bk.!z.g...(
...........b.^wi....N.DF.I..%..4.I.....Xw.`.....<...\.|.H."J.[0.I..
...=...j.....~..d!......:c..m.F.W..,"......%Hq&..O<K..^.]B(...b...W
ucCw...w.(.9t.N......"...MK.....e..$A...0..."}.d.....B.....(i#....7<
;...~D.u......Q.....[.5Rc......X.d..e,....u.#.._.....(.l....?.s...9...
r..%....9.V....@...\z4...)..71...../<..r.l.......iZ.^...p...x..CJP.
|.e..N,.q1..k...6......M....Ev..g.f...>..8.I,G.H).E0.C.`4 ]...z....
.6H.. .....kM.a.r.._#..Df.qs_..L.....i....y.&..R....1[Q..s...B..5..a.;
...<..$...R".._....TL..........`..@.....t.Bn,...(U.s.......si.....~
...O..).x...1.#L ....y..E..5Vx.r.C.Z.S...<.g...e..F.8/.Z%.a.MUl..V.
G5.v.vV%._.B...../..@6....{.. .@..T.....hn./v..n.US.....0..BP.W.1.....
.H......y.~..#..........l\W.....`}j._.F..#.e. .O.X.....n..j[y.....BO(.
Z.....'.F._qJ@ng@nnn.......h........b&.....;l..{.~L....=......../{...Y
Q...Zt....".3.St......l....m..va.Z.8!'.S....ud.u.B..%. ..{ 7>...x2r
S.f..D5.l.Ts..L53.`........F..g....gW..F.!#.Y.. .Xd..r.%`...~....d
<<< skipped >>>

GET /hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=23.0&ja=1&ln=en-us&lo=0&nv=1&rnd=1869196257&si=771e364ef977959c653b857dacf519c4&st=1&v=1.2.11&lv=1 HTTP/1.1


Accept: */*
Referer: hXXp://vas.funshion.com/attachment/editor/minisite/track/install.html?
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: hm.baidu.com
Connection: Keep-Alive
Cookie: HMVT=771e364ef977959c653b857dacf519c4|1486400127|; HMACCOUNT=87640E5C25847F7D


HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Mon, 06 Feb 2017 16:55:28 GMT
Pragma: no-cache
Server: apache
X-Content-Type-Options: nosniff
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Cont
rol: private, max-age=0, no-cache..Content-Length: 43..Content-Type: i
mage/gif..Date: Mon, 06 Feb 2017 16:55:28 GMT..Pragma: no-cache..Serve
r: apache..X-Content-Type-Options: nosniff..GIF89a.............!......
.,...........L..;..



GET /attachment/editor/minisite/ad/kejet/kejet_v3.js?10 HTTP/1.1
Accept: */*
Referer: hXXp://vas.funshion.com/attachment/editor/minisite/track/install.html?
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: img.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj; channelid=7404; _version=3.0.6.62; isnew=1; Mac=DF0E2962FD93; funshion_setup=1


HTTP/1.1 200 OK
Date: Mon, 06 Feb 2017 16:55:34 GMT
Content-Type: application/x-javascript
Content-Length: 1019
Connection: keep-alive
Expires: Sun, 16 Apr 2017 14:58:55 GMT
Server: nginx
Last-Modified: Tue, 22 Jan 2013 10:08:30 GMT
Cache-Control: max-age=7776000
Host: img.funshion.com
X-Cache: HIT from CACHE-19
Accept-Ranges: bytes
X-Ser: BC86_dx-lt-yd-zhejiang-huzhou-2-cache-2, BC24_dx-guangdong-jiangmen-3-cache-6
X-Cache: HIT from BC24_dx-guangdong-jiangmen-3-cache-6(baishan)
T.ready(function(){...if(!window.__adList) return;...var createFrame =
 function(u){....var obj = document.createElement('iframe');....obj.st
yle.height = '1px';....obj.style.display = 'none';....obj.src = u;....
document.body.appendChild(obj);...}...var div = T.dom.create('div');..
.T.setStyles(div, {width : 2, height: 2, display : 'block', opacity : 
0.1, overflow:'hidden'});...document.body.appendChild(div);...T.observ
er.add('adClickEvent.click', function(e){....if(window.__adList.linkTy
pe == 'i'){.....createFrame(e.link);....}else{.....try{......window.ex
ternal.simulateclick(e.link, 'hXXp://vas.funshion.com/attachment/edito
r/minisite/click-tracker.php');.....}catch(error){}....}...});...T.swf
.create({....id : 'ad-player',....url : 'hXXp://img.funshion.com/attac
hment/editor/minisite/flash/funshionPlayerViewV3.swf',....width : '100
%',....height : '100%',....allowScriptAccess : 'always',....allowfulls
creen : 'true',....wmode : 'transparent',....vars :  {.....adp : windo
w.__adList.adp....}...}, div);..});....


GET /attachment/editor/minisite/flash/funshionPlayerViewV3.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://vas.funshion.com/attachment/editor/minisite/track/install.html?
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: img.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj; channelid=7404; _version=3.0.6.62; isnew=1; Mac=DF0E2962FD93; funshion_setup=1; Hm_lvt_771e364ef977959c653b857dacf519c4=1486400129; Hm_lpvt_771e364ef977959c653b857dacf519c4=1486400129


HTTP/1.1 200 OK
Date: Mon, 06 Feb 2017 16:55:43 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 69086
Connection: keep-alive
Expires: Sun, 16 Apr 2017 14:55:45 GMT
Server: nginx
Last-Modified: Tue, 22 Jan 2013 08:33:29 GMT
Cache-Control: max-age=7776000
Host: img.funshion.com
X-Cache: HIT from CACHE-127
Accept-Ranges: bytes
X-Ser: BC91_dx-lt-yd-zhejiang-huzhou-2-cache-2, BC26_dx-guangdong-jiangmen-3-cache-6
X-Cache: HIT from BC26_dx-guangdong-jiangmen-3-cache-6(baishan)
CWS.T...x.\wst%....m....;..c...m...c..;.Q..m.....y3SkU.uN..k.s.*......
...`..$.....?.(.. .db..,..........H...................................
.........F.?.....N.....v...@#{W.!...V51.?...N6..41f1.1.5.sqfacf.G.....
....".tp..4.. ....laol..t3e2..:[....._...........).7.S.RNR......_...&.
cT..*../.............Of.H....S..pp5..t.0u.v....w..'.'./.....b..".w..{.
... ..TXJ.?w.'..G...0; .....;..y.7%......3.LO. .z.!....g........lH.|m.
..'.!P..qO..S.?..i..4u.|a....`..Hh..}....YS]0..ks..^.I...{.(.%.P.0)...
.PdPq........U.L$1qE1.."....Q....$.Q..}A._.W.W.W.3B......jj.....5(.11 
.u....8.HNN.^.u@.O...........!..>....2.q!......p..2@...T...<....
z8...%..g.....l.J7P.."......pf....{i.W....h...[...~.7P.t.|;.}.`.b.z...
.z.=....I.#1..1s..8!9..b.......6.=. r....o.. .....k>..'nW...\d. (@.
&o.h.<.v.&..f^.T..9Br......Z.q..]...\.lN.1.1<...vJ...a....a.(..[
.....F.e...;..s...@...k. p....M.p.vP..:.b?../.?G.U?.21..>.?..BW....
q... .................c.....^.'.rD.....W...L.......$..&*p..J.......H}`
..x..y..Mq....$'.Q..k...... ..T.GtI.....x..W.S..aI...."....."..o..m`g.
..RRe..~J....5.....d...M.....t.Q.^....4.@..`..%.......,R..h.M0.X.."...
..a.h.=f..y....qZ......x=....y.U..AavTZ..._S......%"X?W4G...R...y.U..z
>......H.W.x......].{........K.;.fm.....?T.o.'..W....:.ZS...v.".=..
n....SN..[.....\@Z.*s[..._.....>Xp.......y~....'z!......1...2$..u.t
...G.........l..>..~s.lo..6.f|U)......W..qsP.D5."l.8........i.._...
g.......p.........CH-........8h...8......GU.;.(..........]].....a...(.
./$...t.t..<..RnDA|./.P.p..%../....|&^........&..4....."X..L..\
<<< skipped >>>


GET /v6/aggregate/init?cl=pcclient&ve=3.0.6.62&uc=162 HTTP/1.1
Connection: Keep-Alive
User-Agent: Funshion/4.0
Host: pam.funshion.com


HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 06 Feb 2017 16:55:22 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
iscache: 1
44..{"retcode":"200","retmsg":"ok","waittime":"5","crack":[],"sites":[
]}..0..



GET /flash/2012-12/91AA3705_AFA2_C4D5_7E5F_437CB2316D08.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://vas.funshion.com/attachment/editor/minisite/track/install.html?
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: adm.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj; channelid=7404; _version=3.0.6.62; isnew=1; Mac=DF0E2962FD93; funshion_setup=1; Hm_lvt_771e364ef977959c653b857dacf519c4=1486400129; Hm_lpvt_771e364ef977959c653b857dacf519c4=1486400129


HTTP/1.1 200 OK
Date: Mon, 06 Feb 2017 16:55:57 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 20175
Connection: keep-alive
Expires: Mon, 01 May 2017 12:56:48 GMT
Cache-Control: max-age=7776000
Accept-Ranges: bytes
ETag: "2041900303"
Last-Modified: Mon, 31 Dec 2012 07:32:32 GMT
Server: lighttpd/1.4.26
X-Ser: BC82_dx-lt-hebei-shijiazhuang-2-cache-1, BC144_dx-guangdong-zhanjiang-1-cache-2
X-Cache: HIT from BC144_dx-guangdong-zhanjiang-1-cache-2(baishan)
CWS.....x....|SE.?|g.&7I....Y4h...... ..h...Y\.....c7...y|~...Td.MD...
& ......R.7\p.}W..{.....<>....{g...9s...s...g .G..~...`.....E.O.
.LQ.i....<..=....4...y.p.a..!.f..<.....3..=......:..S..bPhN].;{P
]...se...!_cuC....Myoe}SxD^..j./.hCSc.l..7._.....CC......|............
j....2{P(X..|.w..P.....3$AHu.......U..~wQ....4wA....I..*...I..R.....!.
..UM>..@S.rr.j.....:..7..Twy].,....h|.~o..#.....o..&......eY</y.
.....?..A.w.P....3.......\e...8G......R...Z......./....p.w.cB....A....
......*....2EA..h....*.e.2Y....l"K..v...u.. ..^...#.G......[_..~}~.Ci.
_..l...........Sw..v.s..... .?..c....p..g......x.....1....x..q...XW...
 .....ulX.yE..._.t>..........o_.. ...<.'.m...y.,|&.._^{4..u.....
..M]..........6..}...s.~.|..................=..m..?}e]...o.O...f......
~...=.o.=.S....=.....}...>.%......Z.^M.d.......5..'w.......mp...X.n
y......_.....C..7........b..C..........^...s......6.|..?....{>.....
6....oY.N.......<._...|............3....P........:(H.}R.wN.L,...pcu
.......*W.`?.C.Y..P.......P..mEMu>R.4...:....S....~md}}..[g..T[.o..
46z....{.F{.^kI.?...5..k.)z.M....}..._..0.6..~F.?..... )ll.o...)~_.z..
@9.N.:iJ..n...'..IYg.../A..d./.....[S.O....#T_g/.R2qj......4\.z..j0..?
..p\'.....R]W..m-.7. .....T.H7...l...U.z....5.;..\h%!..3;.` ...I.L3."$
.".....>wi......F.Kc..`..:....|...6y<x#.F..6....tL|.(X..%...S.A.
:...5..8...B...n.....&.O. ..s. ......%;.uI......(.....Z......A...d...g
...%.kBSuM.:.....o.ED...4...MQ...ce%...>..U55...z..W.].y.....R...zu
..)p5..Z..(..I.L.6...L....RN......2.......S.U.4\.J.~|..E.....NG.qP
<<< skipped >>>


GET /help/soft HTTP/1.1
Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/
Connection: Keep-Alive
Host: VVV.fun.tv
Cookie: _version=3.0.6.62; Mac=DF0E2962FD93; funshion_setup=1


HTTP/1.1 404 Error URL
Server: Tengine/2.1.1
Date: Mon, 06 Feb 2017 16:55:35 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
X-Funshion-Branch: OPEN
5fa8..<!DOCTYPE html>.<!--[if lt IE 7 ]><html class="ie
6 page_404" lang="zh-cn"><![endif]-->.<!--[if IE 7 ]>&l
t;html class="ie7 page_404" lang="zh-cn"><![endif]-->.<!--
[if IE 8 ]><html class="ie8 page_404" lang="zh-cn"><![endi
f]-->.<!--[if IE 9 ]><html class="ie9 page_404" lang="zh-c
n"><![endif]-->.<!--[if (gt IE 9)|!(IE) ]><html page
_404 lang="zh-cn"><![endif]-->.<html class="page_404 " dat
a-fs="">.<head>.<meta http-equiv="Content-Type" content="t
ext/html; charset=utf-8" />.<meta name="Description" content="..
......................,...............................................
........................................................7.............
........,.............................................................
..,................................................,..................
........................................" />.<meta name="keyword
s" content="............,............,............,............" />
.<meta http-equiv="P3P" content='CP="CAO PSA OUR"' />.<meta n
ame="viewport" content="initial-scale=0.85333, width=device-width, min
imum-scale=0.25, maximum-scale=1.0, user-scalable=yes"/><meta na
me="renderer" content="webkit">.<meta property="qc:admins" conte
nt="21563471256656301766375" />.<meta name="360_union_verify" co
ntent="a97838ec6848929c7394d3fd49afcbdd" />.<title>..........
..</title>.<!--<link rel="dns-prefetch" href="//http:/
<<< skipped >>>


GET /interface/materials?ap=c_b_1|c_b_2|c_l_1&fck= HTTP/1.1
Connection: Keep-Alive
User-Agent: Funshion/4.0
Host: pub.funshion.com


HTTP/1.1 200 OK
Server: nginx/1.2.0
Date: Mon, 06 Feb 2017 16:55:46 GMT
Content-Type: text/xml
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
Cache-Control: no-cache, no-store
P3P: CP="NOI DEV PSA PSD IVA PVD OTP OUR OTR IND OTC"
Pragma: no-cache
1fe..<?xml version="1.0" encoding="utf-8" ?>.<root>..<a
d>.<id>14468</id>.<url>hXXp://adm.funshion.com/ma
t/20160415143037-19757060.flv</url>.<time>15</time>.
<length>2102709</length>.<checksum>fad5aff42b66154d3
e760405d315287b</checksum>.<width>640</width><hei
ght>480</height></ad>...<ad>.<id>17303</
id>.<url>hXXp://adm.funshion.com/mat/20160901143513-14769429.
swf</url>.<time>15</time>.<length>1475908</
length>.<checksum>025f57230d49ad626d6719b3fce81657</checks
um>.<width>640</width><height>480</height>&
lt;/ad>..</root>..0..



GET /tools/FsPlatformAction?rprotocol=3*_*action=162.AptShadow*_*actionresult=16101*_*actionobjectver=1*_*channelid=*_*mac=204153594EFF*_*guid=1751A54E-5FB6-48fb-8351-82D78B93E7AE*_*name=AptShadow*_*version=3.1.2.1*_*actiontime=|0|win7-32*_*pullupname=FunWorks*_*pullupversion=*_*cid=7404*_*aptid=1|-1 HTTP/1.1
Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/1.0.0.1
Host: stat.funshion.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:08 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Expires: Mon, 06 Feb 2017 16:55:08 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
HTTP/1.1 200 OK..Server: nginx/1.2.9..Date: Mon, 06 Feb 2017 16:55:08 
GMT..Content-Type: text/plain..Content-Length: 0..Connection: keep-ali
ve..Expires: Mon, 06 Feb 2017 16:55:08 GMT..Cache-Control: max-age=0..
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-
check=0..



GET /dts/agentd?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|192.168.11.132|4294967295|2|1|1|0|0 HTTP/1.0
Connection: Close
Host: stat.funshion.net


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:54 GMT
Content-Type: text/plain
Content-Length: 0
Connection: close
Expires: Mon, 06 Feb 2017 16:55:54 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0



GET /tools/tactics/LoadIE.log HTTP/1.1
Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/
Host: neirong.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj; channelid=7404; _version=3.0.6.62; isnew=1


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 138
Connection: keep-alive
Server: nginx/1.2.0
Accept-Ranges: bytes
Cache-Control: s-maxage=604800
Date: Sat, 04 Feb 2017 10:37:39 GMT
Expires: Sat, 11 Feb 2017 10:37:39 GMT
Last-Modified: Fri, 28 Jun 2013 06:18:04 GMT
X-Cache-Status: HIT from KS-CLOUD-WH-MP-01-17
Age: 195459
X-Cache-Status: HIT from KS-CLOUD-ZS-CT-01-05
open hXXp://vas.funshion.com/attachment/editor/minisite/track/install.
html?|60000..open hXXp://fs.funshion.com/market/8/track.html|30000..HT
TP/1.1 200 OK..Content-Type: application/octet-stream..Content-Length:
 138..Connection: keep-alive..Server: nginx/1.2.0..Accept-Ranges: byte
s..Cache-Control: s-maxage=604800..Date: Sat, 04 Feb 2017 10:37:39 GMT
..Expires: Sat, 11 Feb 2017 10:37:39 GMT..Last-Modified: Fri, 28 Jun 2
013 06:18:04 GMT..X-Cache-Status: HIT from KS-CLOUD-WH-MP-01-17..Age: 
195459..X-Cache-Status: HIT from KS-CLOUD-ZS-CT-01-05..open hXXp://vas
.funshion.com/attachment/editor/minisite/track/install.html?|60000..op
en hXXp://fs.funshion.com/market/8/track.html|30000....



GET /mat/20160415143037-19757060.flv HTTP/1.1
Connection: Keep-Alive
User-Agent: Funshion/4.0
Host: adm.funshion.com


HTTP/1.1 302 Moved Temporarily
Server: baishancloud-nginx
Date: Mon, 06 Feb 2017 16:55:47 GMT
Content-Type: text/html
Content-Length: 228
Connection: keep-alive
Location: hXXp://125.90.58.148/xdispatch/adm.funshion.com/mat/20160415143037-19757060.flv
<html>..<head><title>302 Found</title></hea
d>..<body bgcolor="white">..<center><h1>302 Found
</h1></center>..<hr><center>dx-guangdong-zhanj
iang-1-125-90-58-147</center>..<hr><center>baishancl
oud-nginx</center>..</body>..</html>..HTTP/1.1 302 M
oved Temporarily..Server: baishancloud-nginx..Date: Mon, 06 Feb 2017 1
6:55:47 GMT..Content-Type: text/html..Content-Length: 228..Connection:
 keep-alive..Location: hXXp://125.90.58.148/xdispatch/adm.funshion.com
/mat/20160415143037-19757060.flv..<html>..<head><title&
gt;302 Found</title></head>..<body bgcolor="white">.
.<center><h1>302 Found</h1></center>..<hr&g
t;<center>dx-guangdong-zhanjiang-1-125-90-58-147</center>.
.<hr><center>baishancloud-nginx</center>..</body&
gt;..</html>......


GET /mat/20160901143513-14769429.swf HTTP/1.1


Connection: Keep-Alive
User-Agent: Funshion/4.0
Host: adm.funshion.com


HTTP/1.1 200 OK
Date: Mon, 06 Feb 2017 16:56:08 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 1475908
Connection: keep-alive
Expires: Sun, 07 May 2017 03:00:20 GMT
Cache-Control: max-age=7776000
Accept-Ranges: bytes
ETag: "4079736088"
Last-Modified: Thu, 01 Sep 2016 06:35:14 GMT
Server: lighttpd/1.4.26
X-Ser: BC91_dx-lt-yd-zhejiang-huzhou-2-cache-2, BC148_dx-guangdong-zhanjiang-1-cache-2
X-Cache: HIT from BC148_dx-guangdong-zhanjiang-1-cache-2(baishan)
CWS..7..x....X.A..8..........=.w. .w...A..:.......%@..A....w...{W.M...
.~]]]m......N..........4.k....Z....._(..`(.........J..../.$.._.....S=.
..#...X.K...V..g>.....m.A....r.j.../..S.......G.C...F...&" .T..)-.M
...&.|..;.............o.d_U...X..X.3..........bW$=........B.._@..?..K.
.#..G...E_.......N%............iQF...j.?.D3.6.BS.B..xA...2...........@
8"...Y./.._.k<...G.._.....^..4C.x-Q^...""....{....^......6.......xD
D.W......C...Z."tU..z.....x .....PTdz..oz9.`.xZ8x..:..h.....l=<\...
....-]>X.Y.8..2we.d.`....r5.p....`ec.,J.......R.J.W.C.U...N..d....m
..`!hI%.F!.I.......9.''Ggw.O.T...z.....(.... J%...B_U.B..dE....j...A..
........B............./..%..A.O.z..di-....g_.5Q............d..)((.....
.U..........;...d..-@v..v.......\<=D...5.'WU.....h99..K...he.?k.k{.
Z....]<A.V.......g.........^'..Q.......CQF.......R.......KJ..KV...S
.S.[..K.O@V.[R.._...V.K.G.W..KNP..S.W.._P._N..._Z..K._........V....o[.
..VH.de....vqq.W.h..x.....RHk.R..9[.x......i...he).rq..Gt...C.........
..\r.G- ...*...................:...K...^../......{.X9......x9.`.c.....
g..* ...o......[ ..%.D...""..2.."..**.... ....!.#. "......cb..&.?...y.
.......62l..'8.l.,6..6.K?`..?x8.......p..H0..(...}.o....n..N#"!c......
.........y........SR......./X.9.R....6...DCp..".r....C[g.N..*.;...mIW0
K...'X.WD8D....H..lX8J..W<s\..`..W.i.o[Rx..@.. ..|....^i.m.dZ$.....
.[36.6@.p.(.f..\.z.]V.cn&}M...1..;..........s...W. .v;..S\V.,..t..R...
8...CH..,...Z..{Cr..=%...."..BU.B..?../...w....#.....2V.....d....i...l
.=>!.3..#V.p........i$....p.......66...c..)...W..,.&.F.j*..A. .
<<< skipped >>>


GET /partner/install_statistic.php?s=DF0E2962FD93&id=7404&idn=7404&c=d10d650e2503a2da1df335a99d3e0fe5&t=first&u=&ov=&v=3.0.6.62&auto=1&mh=2.13.1.2&guid=26E9A9C9-E26C-43d9-A4E2-B1AEA1102CEC&hp=0&rp=4&im=silent&uninstscr=&os=noxp&ps=0&thd=0&pl=0&qy=0&pp=0<=0&ql=0&sv=0&bd=0&qb=0&bq=0&al=0&iu=0&DYT=0&YJT=0 HTTP/1.1
Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/
Host: partner.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj; channelid=7404; _version=3.0.6.62; isnew=1; Mac=DF0E2962FD93; funshion_setup=1; Hm_lvt_771e364ef977959c653b857dacf519c4=1486400129


HTTP/1.1 302 Moved Temporarily
Server: Tengine
Date: Mon, 06 Feb 2017 16:55:32 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Location: hXXp://VVV.funshion.com/help/soft
0..



GET /market/8/track.html HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: fs.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj; channelid=7404; _version=3.0.6.62; isnew=1


HTTP/1.1 301 Moved Permanently
Content-length: 0
Location: hXXp://fs.fun.tv/market/8/track.html
Connection: close



GET /ecom-ad/shipyardaction?rprotocol=2*_*mac=204153594EFF*_*fck=*_*os=win7-32*_*name=FunExt*_*version=5.0.0.8*_*actionobject=0*_*actionresult=310*_*cid=1002048*_*aptid=-1*_*accedirid=-1 HTTP/1.1
Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/1.0.0.1
Host: stat.funshion.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:19 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Expires: Mon, 06 Feb 2017 16:55:19 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
HTTP/1.1 200 OK..Server: nginx/1.2.9..Date: Mon, 06 Feb 2017 16:55:19 
GMT..Content-Type: text/plain..Content-Length: 0..Connection: keep-ali
ve..Expires: Mon, 06 Feb 2017 16:55:19 GMT..Cache-Control: max-age=0..
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-
check=0......


GET /ecom-ad/shipyardaction?rprotocol=2*_*mac=204153594EFF*_*fck=2|*_*os=win7-32*_*name=FunExt*_*version=5.0.0.8*_*actionobject=0*_*actionresult=316*_*cid=1002048*_*aptid=-1*_*accedirid=-1 HTTP/1.1


Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/1.0.0.1
Host: stat.funshion.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:20 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Expires: Mon, 06 Feb 2017 16:55:20 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0



GET /upgrade/is_upgrade?bid=60&app_version= HTTP/1.1
Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/1.0.0.1
Host: fld.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj; channelid=7404; _version=3.0.6.62; isnew=1; Mac=DF0E2962FD93; funshion_setup=1


HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 06 Feb 2017 16:57:51 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
29..{"retCode":"200","retMsg":"ok","data":[]}..0..



GET /tools/FsPlatformAction?rprotocol=3*_*action=162.AptShadow*_*actionresult=16403*_*actionobjectver=1*_*channelid=*_*mac=204153594EFF*_*guid=1751A54E-5FB6-48fb-8351-82D78B93E7AE*_*name=AptShadow*_*version=3.1.2.1*_*actiontime=|0|win7-32*_*pullupname=FunWorks*_*pullupversion=*_*cid=7404*_*aptid=1|-1 HTTP/1.1
Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/1.0.0.1
Host: stat.funshion.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:28 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Expires: Mon, 06 Feb 2017 16:55:28 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
....


GET /tools/FsPlatformAction?rprotocol=3*_*action=162.AptShadow*_*actionresult=16206*_*actionobjectver=1*_*channelid=*_*mac=204153594EFF*_*guid=1751A54E-5FB6-48fb-8351-82D78B93E7AE*_*name=AptShadow*_*version=3.1.2.1*_*actiontime=|0|win7-32*_*pullupname=FunWorks*_*pullupversion=*_*cid=7404*_*aptid=1|-1 HTTP/1.1


Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/1.0.0.1
Host: stat.funshion.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:28 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Expires: Mon, 06 Feb 2017 16:55:28 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0



GET /v7/config/channel?cl=pcclient&ve=3.0.6.62&uc=162 HTTP/1.1
Connection: Keep-Alive
User-Agent: Funshion/4.0
Host: po.funshion.com


HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 06 Feb 2017 16:55:27 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
iscache: 0
24bb..{"retcode":"200","retmsg":"ok","channels":[{"nav_id":"1","id":"1
1","code":"home","name":"\u63a8\u8350","template":"csiterec","url":"",
"htemplate":"hnormal","is_common":"0","is_drag":"0","is_audit":"0","st
reamplay":"0","is_auto":"0","icon1":"http:\/\/img.funshion.com\/sdw?oi
d=87582aaf2c3167e8c7061d82ab53e96f&w=0&h=0","icon2":"http:\/\/img.funs
hion.com\/sdw?oid=87582aaf2c3167e8c7061d82ab53e96f&w=0&h=0","icon3":"h
ttp:\/\/img.funshion.com\/sdw?oid=87582aaf2c3167e8c7061d82ab53e96f&w=0
&h=0","icon4":"http:\/\/img3.funshion.com\/sdw?oid=323c60d6b488e7829d1
4631e4d8c03e5&w=0&h=0","icon5":"http:\/\/img2.funshion.com\/sdw?oid=95
3f7fb759fc4d1df3d11f334e3f46ed&w=0&h=0"},{"nav_id":"4","id":"2","code"
:"tv","name":"\u7535\u89c6\u5267","template":"cstill","url":"","htempl
ate":"hnormal","is_common":"0","is_drag":"0","is_audit":"0","streampla
y":"0","is_auto":"0","icon1":"http:\/\/img2.funshion.com\/sdw?oid=b5eb
cd81a4bb0cbd89971470b85a2404&w=0&h=0","icon2":"http:\/\/img2.funshion.
com\/sdw?oid=c3f470a9f28ff5a1ddb2fbf784b67ca6&w=0&h=0","icon3":"http:\
/\/img2.funshion.com\/sdw?oid=872e6ee0606e017be9cd175fedb3114c&w=0&h=0
","icon4":"http:\/\/img.funshion.com\/sdw?oid=8250b071be261e49894f3044
c550fdd1&w=0&h=0","icon5":"http:\/\/img2.funshion.com\/sdw?oid=3a8a44b
0b32c7afbdaa5580a58917573&w=0&h=0"},{"nav_id":"3","id":"1","code":"mov
ie","name":"\u7535\u5f71","template":"cmedia","url":"","htemplate":"hn
ormal","is_common":"0","is_drag":"1","is_audit":"0","streamplay":"0","
is_auto":"0","icon1":"http:\/\/img1.funshion.com\/sdw?oid=91eecd96
<<< skipped >>>


I..}$7a..[i.....




w..A.3_...W......_t.7..'....b{%~.%qroc.6.c.K



GET /tools/accetesting.ini HTTP/1.1
Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/1.0.0.1
Host: neirong.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj; channelid=7404; _version=3.0.6.62; isnew=1


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 6
Connection: keep-alive
Accept-Ranges: bytes
Server: nginx/1.2.0
Cache-Control: s-maxage=604800
Date: Thu, 02 Feb 2017 12:32:12 GMT
Expires: Thu, 09 Feb 2017 12:32:12 GMT
Last-Modified: Tue, 24 Nov 2015 10:44:57 GMT
X-Cache-Status: HIT from KS-CLOUD-WH-MP-01-07
Age: 361390
X-Cache-Status: HIT from KS-CLOUD-ZS-CT-01-04
normalHTTP/1.1 200 OK..Content-Type: application/octet-stream..Content
-Length: 6..Connection: keep-alive..Accept-Ranges: bytes..Server: ngin
x/1.2.0..Cache-Control: s-maxage=604800..Date: Thu, 02 Feb 2017 12:32:
12 GMT..Expires: Thu, 09 Feb 2017 12:32:12 GMT..Last-Modified: Tue, 24
 Nov 2015 10:44:57 GMT..X-Cache-Status: HIT from KS-CLOUD-WH-MP-01-07.
.Age: 361390..X-Cache-Status: HIT from KS-CLOUD-ZS-CT-01-04..normalont>....



GET /dts/agentd?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|192.168.11.132|4294967295|2|1|1|0|0 HTTP/1.0
Connection: Close
Host: stat.funshion.net


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:56 GMT
Content-Type: text/plain
Content-Length: 0
Connection: close
Expires: Mon, 06 Feb 2017 16:55:56 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0



GET /main/new/js/v8/??core-min.js,v8-min.js HTTP/1.1
Accept: */*
Referer: hXXp://vas.funshion.com/attachment/editor/minisite/track/install.html?
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: static.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj; channelid=7404; _version=3.0.6.62; isnew=1


HTTP/1.1 200 OK
Date: Mon, 06 Feb 2017 16:55:25 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Feb 2017 12:27:19 GMT
Server: nginx
Last-Modified: Tue, 20 Dec 2016 03:40:27 GMT
Vary: Accept-Encoding
Cache-Control: max-age=172800
Content-Encoding: gzip
Host: static.funshion.com
X-Cache: MISS from CACHE-128
X-Ser: BC88_dx-lt-yd-zhejiang-huzhou-2-cache-2, BC206_dx-guangdong-foshan-5-cache-1
X-Cache: HIT from BC206_dx-guangdong-foshan-5-cache-1(baishan)
1d67..............i{.8.0......q....,.-...5Iw...x.WR.p..Q..D........(.I
.......H...[m(T}....n....w...f.....A2.[....O..A...r.y.....W..b..'O...i
.|me.:.IPmo.........SO>@v.Z...t.u..p.p....UgY..;./.......$....8....
..f.SN..0...xl....S.....<^,....!.*.P.... .....=;p.~ ...7...i..0....
..H.q..M6....l|o..M.F....>..=.Y.....zV.....iTHu...n.............tmK
..<oq?...A...Z;.....o...$x.V.iD..[....6...<.....>...?.n...=.S
..`....l}."......W....<.@..b.A....@.....o...`1_.....m6T....VP*u.^.`
h...*^... ......w.X..0...J.?.:..{./.......%.N....p......0.GGq.v......"
..q..g9.|..h.t.. ....EgW.7rCs...........00"_..ql...g...B....A....c.D..
...............M.ovd.O./ZGB.$}/.....EC>.Vxt..|1Z.l....M 7t....Q8..h
U;..`.|Maa.o..[....2...d^^B.y.v.fcYf....q7Yy............2(/.ta.*.f...w
.......E........i....H<...I:........PMY>.O.x..7.<..-n!.&.|...
.N.:.G.W...NEGG...`...g.T.X9\x..a2...g...?~.]R....?.`4Xx.......Y<..
..........y4..].5mA.y.U..4.F......dQO8yl~R.....Z\0..:?..... .l........
$..h...m6....&...m"....>...p.........?..Y?..:d."=..............s#..
.......$.............'.M.q..z.|......uY....V.*.Zm.d.......Y..'......[.
.V..h.d.,.H:.H S.y":....9.<.....W.gO........Xf.j.S.&..mU-G`~;hZ.V..
.R\R...G.h.k$.G..d1%...(.Uy....t..."{...p.a......[&..!p{._.....'...s.q
cNy.L.}.)..!'\......7.r..k(J..K.%H.p.........].......c...).>..i.v..
{Z_.kp..5......{. V..d..).(g(s.uHOo.PN_..k...}..K.Dfb....dB.........r.
2._..b..9..i..d.p.0r..Om....M.]qv^.wY...BP.d.<.o..6. .....R-C..Mv=f
D.v.`s[q`.w..Qkv[...n}jG..SoU]._..C.x.\..-..VE.e..n.........N.0..0
<<< skipped >>>

GET /main/new/js/v8/curvycorners-min.js?v=20120511 HTTP/1.1


Accept: */*
Referer: hXXp://vas.funshion.com/attachment/editor/minisite/track/install.html?
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: static.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj; channelid=7404; _version=3.0.6.62; isnew=1; Mac=DF0E2962FD93; funshion_setup=1; Hm_lvt_771e364ef977959c653b857dacf519c4=1486400129; Hm_lpvt_771e364ef977959c653b857dacf519c4=1486400129


HTTP/1.1 200 OK
Date: Mon, 06 Feb 2017 16:55:44 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Feb 2017 12:27:33 GMT
Server: nginx
Last-Modified: Tue, 20 Dec 2016 03:40:26 GMT
Vary: Accept-Encoding
Cache-Control: max-age=172800
Content-Encoding: gzip
Host: static.funshion.com
X-Cache: MISS from CACHE-19
X-Ser: BC90_dx-lt-yd-zhejiang-huzhou-2-cache-2, BC207_dx-guangdong-foshan-5-cache-1
X-Cache: HIT from BC207_dx-guangdong-foshan-5-cache-1(baishan)
1ed8.............=kw........T.. .H.6.!.I.....Jn..br.$H....(Q.....>.
]<(*mo..9...........".f^...$.K.d.f.03..-MZC;....fQ.].....f.,:......
.Iz..K.^...=.z..]^.M#H=. G...76s.........E.....]w.Gd.....9$....9_x.M.&
gt;....(....{..1...........o.X9.......iv...X4..,J...-.....u..$..W.F.C.
f.$4...cf..f..G.A...w;.k..O....5...............g.....6..e.F.4xW..^....
.q.."...E.y.{U..)...%\A.FV.Xgo....U..... .7..8 .X$...O.q.%Yz.%........
r.?U......[....i7qc..]s......1.'./..;..o.;........\gF.....g....PU..;b.
.j. ....(v...g./\...T. :....|.J..eKm.._\..^.B......P..m`5.@.....N...X.
MY.......J..^...9..../..Q!........}.U.s.%.8Z"..)..8JLT..]....G...RP.p.
M{....z.Q6X..&.`.G...X...w...I...[.k..&....7 .W .........y.Er{..]...w.
.C....{%..9Oh..5..G..L.h....t.....5,..V.,\...l85]..ZIm.L...U.>.....
.A.|r.`S\G2...(K..#K.(..P....P..J...Q0.... $.l.2...(.....6.!.ea|....Z3
.7......4I.wafN.FL...b.y..:.&'..G.7.3#.....1.T...(..V....]......[...b.
..1/.....n..H5.....yn..r..r......~...........q..X............#.%./..o.
.....$..7..Sa..m.....< P.\...$m3.....30.....$.o`....Y q..$....X8...
..F.'..G.x..u........f....V..#Mh...i.r....E JZ/....|....K........._P&l
t;......(..... J.h..g~.Ql...E.W.$.A.... .N.aT....Sq..G.....Y..S<7..
..B.",$.qe..>6...X...,.z\......{.5b...^.K?..f.*.r%....)?./.~......c
.Ye.....B ..k....l.y.y..Y..*.Y...F.z..9g...]*...YjGjr.~..v..Q%......q;
.y.VV.j...R..'..j..G.K5..jVO.s..Qq.#9....N.....v{.R...P.0lVW..>..M.
.xM....I..&yp..".2.%..M..I.7....8...$...U/..,5K...I....... |.YJ.......
)8.. ....Y..^.^.....u..%;..;.....^#.....;y..M....t..-.w.?.....j...
<<< skipped >>>


GET /v5/search/hotword?cl=pcclient&ve=3.0.6.62&uc=162 HTTP/1.1
Connection: Keep-Alive
User-Agent: Funshion/4.0
Host: ps.funshion.com


HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 06 Feb 2017 16:55:26 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
iscache: 1
257..{"retcode":"200","retmsg":"ok","keys":["\u897f\u6e38\u4f0f\u5996\
u7bc7","\u5185\u8863","\u5965\u7279\u66fc","\u5251","\u5927\u5510\u836
3\u8000","\u4e61\u6751\u7231\u60c5","\u718a\u51fa\u6ca1","\u4e8e\u6210
\u9f99","\u79d8\u5bc6\u7231","\u5973\u4eba\u7f8e\u5986\u5927\u8d4f","\
u6211\u7684\u4e16\u754c","\u897f\u6e38\u8bb0","\u6218\u706b\u4e2d\u768
4\u5144\u5f1f","\u7236\u6bcd\u7231\u60c5","\u6211\u7684\u4e16\u754c \u
52a8\u753b\u7248","\u5b64\u6218","\u5927\u5934\u513f\u5b50\u548c\u5c0f
\u5934\u7238\u7238","\u4e61\u6751\u7231\u60c5\u8fdb\u884c\u66f2","\u62
10\u9f99","\u7c89\u7ea2\u732a\u5c0f\u59b9"]}..0..



GET /help/soft HTTP/1.1
Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/
Cookie: fck=14864001070d6vj; channelid=7404; _version=3.0.6.62; isnew=1; Mac=DF0E2962FD93; funshion_setup=1; Hm_lvt_771e364ef977959c653b857dacf519c4=1486400129
Connection: Keep-Alive
Host: VVV.funshion.com


HTTP/1.1 301 Moved Permanently
Content-length: 0
Location: hXXp://VVV.fun.tv/help/soft
Connection: close



GET /dts/nat_info?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|5|0|1|0|0|0|0|0|0 HTTP/1.0
Connection: Close
Host: stat.funshion.net


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:34 GMT
Content-Type: text/plain
Content-Length: 0
Connection: close
Expires: Mon, 06 Feb 2017 16:55:34 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0



GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: stat.funshion.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:47 GMT
Content-Type: text/xml
Last-Modified: Wed, 08 Apr 2015 09:02:48 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Wed, 08 Mar 2017 16:55:47 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
70.................Q(K-*....U2.3PRH.K.O..K.U..q..P....I../..M..M...-..
.L...R.I.../.MLNN......*@..*i)....c....m..t.....0..HTTP/1.1 200 OK..Se
rver: nginx/1.2.9..Date: Mon, 06 Feb 2017 16:55:47 GMT..Content-Type: 
text/xml..Last-Modified: Wed, 08 Apr 2015 09:02:48 GMT..Transfer-Encod
ing: chunked..Connection: keep-alive..Expires: Wed, 08 Mar 2017 16:55:
47 GMT..Cache-Control: max-age=2592000..Content-Encoding: gzip..70....
.............Q(K-*....U2.3PRH.K.O..K.U..q..P....I../..M..M...-...L...R
.I.../.MLNN......*@..*i)....c....m..t.....0..



GET /partner/install_statistic.php?s=DF0E2962FD93&id=7404&idn=7404&c=d10d650e2503a2da1df335a99d3e0fe5&t=first&u=&ov=&v=3.0.6.62&auto=1&mh=2.13.1.2&guid=26E9A9C9-E26C-43d9-A4E2-B1AEA1102CEC&hp=0&rp=4&im=silent&uninstscr=&os=noxp&ps=0&thd=0&pl=0&qy=0&pp=0<=0&ql=0&sv=0&bd=0&qb=0&bq=0&al=0&iu=0&DYT=0&YJT=0 HTTP/1.1
Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/
Host: partner.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj; channelid=7404; _version=3.0.6.62; isnew=1


HTTP/1.1 302 Moved Temporarily
Server: Tengine
Date: Mon, 06 Feb 2017 16:55:26 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Location: hXXp://VVV.funshion.com/help/soft
0..



GET /hmt/icon/21.gif HTTP/1.1
Accept: */*
Referer: hXXp://vas.funshion.com/attachment/editor/minisite/track/install.html?
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: eiv.baidu.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=311040000
Content-Length: 1119
Content-Type: image/gif
Date: Mon, 06 Feb 2017 16:55:38 GMT
Etag: "762990053"
Expires: Wed, 16 Dec 2026 16:55:38 GMT
Last-Modified: Tue, 13 Apr 2010 09:38:40 GMT
Server: BWS/1.0
GIF89a........s..E.....M...................ZS.2-.YS.......2,.c[..D....
...0'..:..0.&..]Z..8..>..D.TM.................C................._..
^.....u..w........~........k.4......X..d.......=1.....a.c[.PH.h_.....b
..........PH........A..9....h`..J..1.......g`..W........2........z.#..
.p..m....jd........*.............[Q...........6..G..............6..t..
........... ..TL.....!....$....."..;0.....h.7-..............Z.........
....%..:.....H@....^W.QJ..'. !..........70.._. %.'...T.0'..Q.G?.ws....
-$........h.}w.....>...........L.....#.......:0.............\S.....
........*".....Q..............<..T.!...p.$...}........N..........d_
...........j.......VN.....o.....e........[............................
......................................................................
....................!.......,............u...,..>6.T.T..&T.".H. ...
.3^.PQ.G..:^..H.-.T....2#!........K..iP.&..03%X..x.P/^.$...`...G>Xd
....!..d.T...j.,..fQ..8l<..U%..G|.h.......$p..f......R..b.....*R@W"
2y..8..V3.LV`t.e..7.>.........\D..O.H.....$...^.]..).. ...9..E...d\
...V.U1..i......B]......c.P<0.i...v.]D..G .?p-.CD.Fi;>..v....r`.
.&........./.dp....`.....;HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache
-Control: max-age=311040000..Content-Length: 1119..Content-Type: image
/gif..Date: Mon, 06 Feb 2017 16:55:38 GMT..Etag: "762990053"..Expires:
 Wed, 16 Dec 2026 16:55:38 GMT..Last-Modified: Tue, 13 Apr 2010 09:38:
40 GMT..Server: BWS/1.0..GIF89a........s..E.....M...................ZS
.2-.YS.......2,.c[..D.......0'..:..0.&..]Z..8..>..D.TM.........
<<< skipped >>>


GET /upgrade/upgrade?bid=64 HTTP/1.1
Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/1.0.0.1
Host: fld.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj; channelid=7404; _version=3.0.6.62; isnew=1


HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 06 Feb 2017 16:57:00 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
18c....TKDS.....$.S...T.f*.#W.Jd..............d..`CG..W...S.....V.....
.=-.....\.G............)...<....<r..ZP....X.5.....l$. qB..w....&
.N.w.?X.......S.R.....3...k.P.x..T.J6......_.X....5.....5...2 ./U]. ..
..~.....|.b. ..g......9.....K....>.I.l.=..hU... \........f...}..tT.
.F../.1..k.Lw"N....e..n.kT.Qh...N\..&sJ..UU.#....l3....9....l....Z...F
. ....|8w..1..5.....i ..f.eq..tA.QNL\.10. .IIp.un-..kc.fQ.6...0..



GET /dts/agentd?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|0.0.0.0|4294967295|2|1|1|0|0 HTTP/1.0
Connection: Close
Host: stat.funshion.net


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:31 GMT
Content-Type: text/plain
Content-Length: 0
Connection: close
Expires: Mon, 06 Feb 2017 16:55:31 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0



GET /tools/radarboot?rprotocol=2*_*bootmethod=100*_*mac=204153594EFF*_*guid=1751A54E-5FB6-48fb-8351-82D78B93E7AE*_*fck=14864001070d6vj*_*stamp=1486400126*_*name=Turkey*_*version=3.0.1.23*_*os=win7-32-0*_*parentname=*_*parentversion=*_*info=*_*cid=*_*aptid=*_*accedirid= HTTP/1.1
Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/1.0.0.1
Host: stat.funshion.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:26 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Expires: Mon, 06 Feb 2017 16:55:26 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
HTTP/1.1 200 OK..Server: nginx/1.2.9..Date: Mon, 06 Feb 2017 16:55:26 
GMT..Content-Type: text/plain..Content-Length: 0..Connection: keep-ali
ve..Expires: Mon, 06 Feb 2017 16:55:26 GMT..Cache-Control: max-age=0..
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-
check=0..



GET /client/tmp?rprotocol=2*_*fck=14864001070d6vj*_*mac=DF0E2962FD93*_*guid=AA1138BC-E128-441c-82B9-966FDE87B15F*_*userid=*_*fpc=7404*_*version=3.0.6.62*_*sid=*_*vvid=6482112ef6bcac819aef3bec15548cd6*_*type=aptshadow*_*param=0_0_3148 HTTP/1.1
Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/
Host: stat.funshion.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:10 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Expires: Mon, 06 Feb 2017 16:55:10 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
HTTP/1.1 200 OK..Server: nginx/1.2.9..Date: Mon, 06 Feb 2017 16:55:10 
GMT..Content-Type: text/plain..Content-Length: 0..Connection: keep-ali
ve..Expires: Mon, 06 Feb 2017 16:55:10 GMT..Cache-Control: max-age=0..
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-
check=0......


GET /client/cinstall?rprotocol=1*_*mac=DF0E2962FD93*_*fck=14864001070d6vj*_*guid=26E9A9C9-E26C-43d9-A4E2-B1AEA1102CEC*_*md5=d10d650e2503a2da1df335a99d3e0fe5*_*modifyhistory=2.13.1.2*_*os=3*_*over=*_*cver=3.0.6.62*_*cid=7404*_*cidn=7404*_*startmode=5*_*imode=silent*_*itype=first*_*cusinstall=*_*preparetime=*_*choosetime=*_*installtime=*_*installresult=*_*repairar=4 HTTP/1.1


Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/
Host: stat.funshion.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:12 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Expires: Mon, 06 Feb 2017 16:55:12 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
HTTP/1.1 200 OK..Server: nginx/1.2.9..Date: Mon, 06 Feb 2017 16:55:12 
GMT..Content-Type: text/plain..Content-Length: 0..Connection: keep-ali
ve..Expires: Mon, 06 Feb 2017 16:55:12 GMT..Cache-Control: max-age=0..
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-
check=0......


GET /client/tmp_startbyinstall?rprotocol=1*_*mac=DF0E2962FD93*_*fck=14864001070d6vj*_*guid=26E9A9C9-E26C-43d9-A4E2-B1AEA1102CEC*_*md5=d10d650e2503a2da1df335a99d3e0fe5*_*modifyhistory=2.13.1.2*_*os=3*_*over=*_*cver=3.0.6.62*_*cid=7404*_*cidn=7404*_*startmode=5*_*imode=silent*_*itype=first*_*start=;;3.0.6.62;5.0.0.22Beta;-1;0 HTTP/1.1


Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/
Host: stat.funshion.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:16 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Expires: Mon, 06 Feb 2017 16:55:16 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
HTTP/1.1 200 OK..Server: nginx/1.2.9..Date: Mon, 06 Feb 2017 16:55:16 
GMT..Content-Type: text/plain..Content-Length: 0..Connection: keep-ali
ve..Expires: Mon, 06 Feb 2017 16:55:16 GMT..Cache-Control: max-age=0..
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-
check=0..



GET /dts/ptv?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|192.168.11.132|0|702|1|65871993|8000 HTTP/1.0
Connection: Close
Host: stat.funshion.net


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:53 GMT
Content-Type: text/plain
Content-Length: 0
Connection: close
Expires: Mon, 06 Feb 2017 16:55:53 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0



GET /dts/proxy_communicate?rprotocol=1&dev=PC&mac=DF0E2962FD93&ver=3.0.6.62&value=1|1|0|125 HTTP/1.1
Connection: Keep-Alive
User-Agent: Funshion/4.0
Host: stat.funshion.net


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:27 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Expires: Mon, 06 Feb 2017 16:55:27 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
....


GET /client/bootnew?rprotocol=1*_*fck=14864001070d6vj*_*mac=DF0E2962FD93*_*guid=DFBE3E3FF30C401e8A47945399E8C556*_*userid=0*_*fpc=*_*version=3.0.6.62*_*sid=*_*vvid=*_*errcode=0*_*tasktm=0*_*bdw=*_*scr=*_*disk=*_*pcm=1535*_*res=1276x846*_*osv=4*_*flashv=23.0.0.185*_*iev=9.0000*_*start=startbyinstall tray*_*lan=0*_*skin=0*_*wsize=0*0*_*wrival=000000000000000*_*cid=0*_*lastplay=0*_*lastboot=0*_*tasknum=0 HTTP/1.1


Connection: Keep-Alive
User-Agent: Funshion/4.0
Host: stat.funshion.net


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:28 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Expires: Mon, 06 Feb 2017 16:55:28 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
....


GET /client/boot?mac=DF0E2962FD93&version=3.0.6.62&channel=1&os=4&starttype=startbyinstall tray&errorcode=0&hc=0&hardware_acceleration=0&yy=1&tray_limit=0 HTTP/1.1


Connection: Keep-Alive
User-Agent: Funshion/4.0
Host: stat.funshion.net


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:29 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Expires: Mon, 06 Feb 2017 16:55:29 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
HTTP/1.1 200 OK..Server: nginx/1.2.9..Date: Mon, 06 Feb 2017 16:55:29 
GMT..Content-Type: text/plain..Content-Length: 0..Connection: keep-ali
ve..Expires: Mon, 06 Feb 2017 16:55:29 GMT..Cache-Control: max-age=0..
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-
check=0..



GET /fpupdate/INI/config_update_funplayer.txt HTTP/1.1
Connection: Keep-Alive
User-Agent: Funshion/4.0
Host: update.funshion.com


HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 06 Feb 2017 16:55:28 GMT
Content-Type: text/plain
Content-Length: 6577
Last-Modified: Wed, 04 Jan 2017 09:38:38 GMT
Connection: close
Vary: Accept-Encoding
ETag: "586cc29e-19b1"
Expires: Mon, 06 Feb 2017 17:00:28 GMT
Cache-Control: max-age=300
Accept-Ranges: bytes
[FileVision]...FunshionInstall=2.3.0.25..FunshionInstallFSP=2.3.0.25..
HttpFile=1.5.3.232..Ad1=00001..[HTTP_POST]..First=fs.xikee.com..Second
=10..Third=5..[FileList]..FunshionInstall=/fpupdate/UPDATE/FunshionIns
tall2.3.0.25.exe.torrent..FunshionInstallFSP=/fpupdate/UPDATE/Funshion
Install2.3.0.25.torrent..HttpFile=update.funshion.com/fpupdate/UPDATE/
HttpFile.txt..Ad1=/fpupdate/UPDATE/Ad1_00001.torrent..[common]..revisi
on=438..last_modifier=201203092126..sufficient_fsp_download_speed=1228
80..first_buffering_pieces_threshold=0..task_lowerest_peers_threshold=
28..max_fsp_suppliers=13..max_upload_peer_count=11..minimum_half_open_
connections=18..startup_cache_millis=14000..bt_seed_max_upload_peer_co
unt=14..fsp_startup_percent=30..fsp_ondemand_startup_percent=30..marks
_level_0=0..max_delta_jits_from_ms=4..enable_ms_optimization=1..disabl
e_fsp_urgency_piece=1..report_min_udpt_speed=1024..min_cache_size=5242
88..default_cache_size=262144..enable_increase_udpt_priority=1..disabl
e_udp_direct_back=0..adsl_peak_upload_speed=102400..adsl_up_rate_limit
_for_fsp=33792..dld_need_more_rate=65536..dld_sufficient_fsp_download_
speed=71680..need_more_download_peer_rate=81920..tash_rate_when_boot=1
02400..[3.0.3.53]..minidump_type=0..enable_log_upload=0..upload_log_pr
iority=8..Send_MiniReq_Num=7..send_TimeOut_ReqNum=2..[3.0.3.54]..minid
ump_type=1..enable_log_upload=1..upload_log_priority=8..Send_MiniReq_N
um=7..send_TimeOut_ReqNum=2..[3.0.3.56]..minidump_type=0..enable_log_u
pload=1..upload_log_priority=8..Send_MiniReq_Num=7..send_TimeOut_R
<<< skipped >>>


GET /client/nirvana/config.xml HTTP/1.1
Connection: Keep-Alive
User-Agent: Funshion/4.0
Host: neirong.funshion.com


HTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 7103
Connection: keep-alive
Server: nginx/1.2.0
Date: Tue, 31 Jan 2017 14:45:28 GMT
Last-Modified: Fri, 25 Sep 2015 03:26:25 GMT
Accept-Ranges: bytes
Expires: Tue, 07 Feb 2017 14:45:28 GMT
X-Cache-Status: HIT from KS-CLOUD-FS-CT-01-10
Age: 526194
X-Cache-Status: HIT from KS-CLOUD-ZS-CT-01-04
<config>...<template version="36">...    <fonts>... 
       <font name="yahei_16" face="............" size="16" bold="fa
lse" italic="false" underline="false" />...        <font name="y
ahei_15" face="............" size="15" bold="false" italic="false" und
erline="false" />...        <font name="yahei_14" face="........
...." size="14" bold="false" italic="false" underline="false" />...
        <font name="yahei_13" face="............" size="13" bold="f
alse" italic="false" underline="false" />...        <font name="
yahei_12" face="............" size="12" bold="false" italic="false" un
derline="false" />...        <font name="yahei_11" face=".......
....." size="11" bold="false" italic="false" underline="false" />..
.    </fonts>...    <colors>...        <color name="555
555" value="#555555" />...        <color name="666666" value="#6
66666" />...        <color name="888888" value="#888888" />..
.        <color name="f98d00" value="#f98d00" />...        <c
olor name="fe7839" value="#fe7839" />...        <color name="fe3
c3c" value="#fe3c3c" />...        <color name="858e93" value="#8
58e93" />...        <selector name="channel" normal="555555" hov
er="fe7839" pressed="fe7839" selected="fe7839" />...        <sel
ector name="tag" normal="666666" hover="fe7839" pressed="fe7839" selec
ted="fe7839" />...    </colors>...    <drawables>...   
     <color name="f0f0f0" value="#f0f0f0" />...        <c
<<< skipped >>>


GET /dts/nat_info?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|5|0|1|0|0|0|0|0|0 HTTP/1.0
Connection: Close
Host: stat.funshion.net


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:56:10 GMT
Content-Type: text/plain
Content-Length: 0
Connection: close
Expires: Mon, 06 Feb 2017 16:56:10 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0



GET /dts/ptv?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|192.168.11.132|0|639|1|1478759094|8080 HTTP/1.0
Connection: Close
Host: stat.funshion.net


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:53 GMT
Content-Type: text/plain
Content-Length: 0
Connection: close
Expires: Mon, 06 Feb 2017 16:55:53 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0



GET /attachment/editor/minisite/track/install.html? HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: vas.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj; channelid=7404; _version=3.0.6.62; isnew=1


HTTP/1.1 200 OK
Date: Mon, 06 Feb 2017 16:55:20 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Mon, 02 Oct 2017 08:34:50 GMT
Server: nginx
Last-Modified: Fri, 08 Aug 2014 07:03:29 GMT
Vary: Accept-Encoding
Cache-Control: max-age=31536000
Content-Encoding: gzip
Host: vas.funshion.com
X-Cache: HIT from CACHE-101
X-Ser: BC146_dx-lt-yd-zhejiang-ningbo-2-cache-2, BC147_dx-guangdong-zhanjiang-1-cache-2
X-Cache: HIT from BC147_dx-guangdong-zhanjiang-1-cache-2(baishan)
447.............UYo.F.~N....@*.....'....!(...KQ....#:.............P...
4........?...._...bX.......e...\vC..........2.WC....>l..hO....?.*_~
Q..f....~..0eQe7C?.u.^V'./......C..v.o.b@.go...9.-.......eU..f....~.[.
...]/.e...Uw_...........X..............8Dt........C....O.?Q.rh.E..6...
.mT..e"..s.....a5..l........ZG.'.Bm.( j`.zP&..s..!h...FF..E.A..]&..X..
Q...f.2.d0..G.......lT4Z.IRh...*:..&.....;.*y..s"Rz...7..)&!FkA....:i.
\T...x.j<..!.j( p..$..5B.#.$\...%...N.7N ..hN.e1...2.Z....`,D`^....
.G...L%....!Rg..[..G..}*.Hy..j..AD*..4..h......Z..%...p... .........,.
KN.&..DG.0.L4....R....g.u...[.}.j...w....D...fE.......<.....D$..S..
c$a....i..#N3.Z;0.S...........Y X8...(.=..|8..I$:.........p......i....
.........D%.....R.L.H.L..qgsP..O....MX...ibnKg..X...."OG......~.....w.
..qp.4...it...~5..5.<?.....y.\..~..|z...y.L.....n....../WA3.M.X.V..
y?.........j......N.p....()'....8.o..y..z.X....u..C~....eY.f.|..3.D.6y
uL7g.IqU.........e%..|.~....U.k.M7...p.....,.}..YQ.........Y ..<iM;
....jm.m...F.y..Hj[1:..}.s.......T..........]}.x....t..\..............
,....}.....C.rN.....)..vK...f...f......Y...;e.5....u.....nV.KO.....0..
<<< skipped >>>


GET /dts/agentd?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|192.168.11.132|4294967295|2|2|1|0|0 HTTP/1.0
Connection: Close
Host: stat.funshion.net


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:57 GMT
Content-Type: text/plain
Content-Length: 0
Connection: close
Expires: Mon, 06 Feb 2017 16:55:57 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0



GET /dts/login?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|1|717|1370292026|0|0 HTTP/1.0
Connection: Close
Host: stat.funshion.net


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:36 GMT
Content-Type: text/plain
Content-Length: 0
Connection: close
Expires: Mon, 06 Feb 2017 16:55:36 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0



GET /upgrade/upgrade?bid=60 HTTP/1.1
Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/1.0.0.1
Host: fld.funshion.com
Connection: Keep-Alive
Cookie: fck=14864001070d6vj; channelid=7404; _version=3.0.6.62; isnew=1; Mac=DF0E2962FD93; funshion_setup=1; Hm_lvt_771e364ef977959c653b857dacf519c4=1486400129


HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 06 Feb 2017 16:55:38 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
9c....TKDS.....$..Z$.gy....q.M.?I..x0........d..`CG..W...S.....V......
=-.....\.G..........E...`)d4..*..a}...X.#..Y...}R U....[...\.P.Tq>.
N......<E..t\.EN.F..".`..0..



GET /client/cinstall_news?rprotocol=1*_*clientFlag=1*_*fck=14864001070d6vj*_*mac=DF0E2962FD93*_*userid=*_*version=3.0.6.62*_*install_type=first*_*coochannelid=7404*_*channelid=7404*_*auto_flag=1*_*guid=26E9A9C9-E26C-43d9-A4E2-B1AEA1102CEC*_*md5=d10d650e2503a2da1df335a99d3e0fe5*_*os=3*_*old_version=*_*version_history=2.13.1.2*_*install_mode=silent*_*competitive_product=000000000000000*_*position_code= HTTP/1.1
Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/
Host: stat.funshion.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:44 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Expires: Mon, 06 Feb 2017 16:55:44 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
HTTP/1.1 200 OK..Server: nginx/1.2.9..Date: Mon, 06 Feb 2017 16:55:44 
GMT..Content-Type: text/plain..Content-Length: 0..Connection: keep-ali
ve..Expires: Mon, 06 Feb 2017 16:55:44 GMT..Cache-Control: max-age=0..
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-
check=0......


GET /client/tmp?rprotocol=1*_*fck=14864001070d6vj*_*mac=DF0E2962FD93*_*guid=26E9A9C9-E26C-43d9-A4E2-B1AEA1102CEC*_*useid=*_*fpc=*_*ver=3.0.6.62*_*sid=*_*vvid=*_*type=2*_*param=1610080256 HTTP/1.1


Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/
Host: stat.funshion.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:50 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Expires: Mon, 06 Feb 2017 16:55:50 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
HTTP/1.1 200 OK..Server: nginx/1.2.9..Date: Mon, 06 Feb 2017 16:55:50 
GMT..Content-Type: text/plain..Content-Length: 0..Connection: keep-ali
ve..Expires: Mon, 06 Feb 2017 16:55:50 GMT..Cache-Control: max-age=0..
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-
check=0......


GET /client/cinstall?rprotocol=2*_*mac=DF0E2962FD93*_*fck=14864001070d6vj*_*guid=26E9A9C9-E26C-43d9-A4E2-B1AEA1102CEC*_*md5=d10d650e2503a2da1df335a99d3e0fe5*_*modifyhistory=2.13.1.2*_*os=3*_*over=*_*cver=3.0.6.62*_*cid=7404*_*cidn=7404*_*startmode=5*_*imode=silent*_*itype=first*_*cusinstall=00222*_*preparetime=1825*_*choosetime=0*_*installtime=4805*_*installresult=4*_*repairar=4*_*airportinstall=*_*airportcondition=0*_*othersoft=;,,,, HTTP/1.1


Cache-Control: max-age=43200
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C) Funshion/
Host: stat.funshion.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:51 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Expires: Mon, 06 Feb 2017 16:55:51 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
HTTP/1.1 200 OK..Server: nginx/1.2.9..Date: Mon, 06 Feb 2017 16:55:51 
GMT..Content-Type: text/plain..Content-Length: 0..Connection: keep-ali
ve..Expires: Mon, 06 Feb 2017 16:55:51 GMT..Cache-Control: max-age=0..
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-
check=0..



GET /dts/ptv?rprotocol=1&dev=PC&mac=00000000D457&ver=3.0.6.62&nt=0&fudid=04010BFF00C012000379DF0E296210180A9EFD93&kver=5.0.0.22&value=1|192.168.11.132|0|390|1|82649209|8000 HTTP/1.0
Connection: Close
Host: stat.funshion.net


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Mon, 06 Feb 2017 16:55:35 GMT
Content-Type: text/plain
Content-Length: 0
Connection: close
Expires: Mon, 06 Feb 2017 16:55:35 GMT
Cache-Control: max-age=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0



GET /market/8/track.html HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Connection: Keep-Alive
Host: fs.fun.tv


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 06 Feb 2017 16:55:30 GMT
Content-Type: text/html
Content-Length: 649
Connection: close
Last-Modified: Fri, 08 Aug 2014 03:54:17 GMT
Host: fs.fun.tv
X-Cache: HIT from CACHE-19
Accept-Ranges: bytes
<!DOCTYPE html>..<html class="os_ios">..<head>..<
meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
;..<title>blank</title>..<style type="text/css">...t
ips{padding-top:106px;text-align:center;}..</style>..</head&g
t;..<body>..<div class="tips"><span>loading...</s
pan></div>..<iframe src='hXXp://adk.funshion.com/adpolesta
r/door/;ap=F9AEEFFF_DAF5_55A7_CB63_42D8AA0EA6B4;ct=if;pu=funshion;/' s
tyle='width:2px;height:2px;' frameborder='0'></iframe>..<i
frame src='hXXp://adk.funshion.com/adpolestar/door/;ap=1B4D5A73_FCF7_1
1B9_97B7_635AF8846167;ct=if;pu=funshion;/' style='width:2px;height:2px
;' frameborder='0'></iframe>..</body>..</html>...
.







The Adware connects to the servers at the folowing location(s):







SearchProtocolHost.exe_3168:




.text
`.data
.rsrc
@.reloc
ADVAPI32.dll
ntdll.DLL
KERNEL32.dll
msvcrt.dll
USER32.dll
ole32.dll
OLEAUT32.dll
TQUERY.DLL
MSSHooks.dll
IMM32.dll
SHLWAPI.dll
SrchCollatorCatalogInfo
SrchDSSLogin
SrchDSSPortManager
SrchPHHttp
SrchIndexerQuery
SrchIndexerProperties
SrchIndexerPlugin
SrchIndexerClient
SrchIndexerSchema
Msidle.dll
Failed to get REGKEY_FLTRDMN_MS_TO_IDLE, using default
pfps->psProperty.ulKind is LPWSTR but psProperty.lpwstr is NULL or empty
d:\win7sp1_gdr\enduser\mssearch2\common\utils\crchash.cxx
d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrdmn\fltrdaemon.cxx
d:\win7sp1_gdr\enduser\mssearch2\search\common\include\secutil.hxx
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracerhelpers.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp
d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx
RegDeleteKeyW
RegDeleteKeyExW
8%uiP
Invalid parameter passed to C runtime function.
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp
-d-d-d-d-d-d-d-%d
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h
</MSG></TRC>
<MSG>
<ERR> 0xx=
<LOC> %s(%d) </LOC>
tid="0x%x"
pid="0x%x"
tagname="%s"
tagid="0x%x"
el="0x%x"
time="d/d/d d:d:d.d"
logname="%s"
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx
SHELL32.dll
PROPSYS.dll
ntdll.dll
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
ReportEventW
_amsg_exit
MsgWaitForMultipleObjects
SearchProtocolHost.pdb
2 2(20282|2
4%5S5
Software\Microsoft\Windows Search
https
kernel32.dll
msTracer.dll
msfte.dll
lX-X-X-XX-XXXXXX
SOFTWARE\Microsoft\Windows Search
tquery.dll
%s\%s
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
Windows Search Service
<Exception><HR>0xx</HR><eip>%p</eip><module>%S</module><line>%d</line></Exception>
advapi32.dll
WAPI-MS-Win-Core-LocalRegistry-L1-1-0.dll
winhttp.dll
Software\Microsoft\Windows Search\Tracing
Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported
Software\Microsoft\Windows Search\Tracing\EventThrottleState
<MSG>
<LOC> %S(%d) </LOC>
tagname="%S"
logname="%S"
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}
.\%s.mui
.\%s\%s.mui
%s\%s.mui
%s\%s\%s.mui
Microsoft Windows Search Protocol Host
7.00.7601.17610 (win7sp1_gdr.110503-1502)
SearchProtocolHost.exe
Windows
7.00.7601.17610

SearchFilterHost.exe_1732:




.text
`.data
.rsrc
@.reloc
ADVAPI32.dll
ntdll.DLL
KERNEL32.dll
msvcrt.dll
USER32.dll
ole32.dll
OLEAUT32.dll
TQUERY.DLL
IMM32.dll
MSSHooks.dll
mscoree.dll
SHLWAPI.dll
d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrhost\bufstm.cxx
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp
RegDeleteKeyW
RegDeleteKeyExW
8%uiP
d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx
Invalid parameter passed to C runtime function.
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp
-d-d-d-d-d-d-d-%d
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
ReportEventW
_amsg_exit
SearchFilterHost.pdb
version="5.1.0.0"
name="Microsoft.Windows.Search.MSSFH"
<requestedExecutionLevel
3 3(30383|3
kernel32.dll
Software\Microsoft\Windows Search
SOFTWARE\Microsoft\Windows Search
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
Windows Search Service
tquery.dll
advapi32.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
<Exception><HR>0xx</HR><eip>%p</eip><module>%S</module><line>%d</line></Exception>
Software\Microsoft\Windows Search\Tracing
Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported
Software\Microsoft\Windows Search\Tracing\EventThrottleState
<MSG>
<ERR> 0xx=
<LOC> %S(%d) </LOC>
tid="0x%x"
pid="0x%x"
tagname="%S"
tagid="0x%x"
el="0x%x"
time="d/d/d d:d:d.d"
logname="%S"
</MSG></TRC>
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}
.\%s.mui
.\%s\%s.mui
%s\%s.mui
%s\%s\%s.mui
%s\%s
winhttp.dll
Microsoft Windows Search Filter Host
7.00.7601.17610 (win7sp1_gdr.110503-1502)
SearchFilterHost.exe
Windows
7.00.7601.17610

Funshion.exe_1100:




.text
`.rdata
@.data
.rsrc
@.reloc
t.Ht!Hu
\$0 \$,3
SSSSh(
 ,-./012"3445
*1*1**234
$SShL=W
FTP;J
RSSSSSSh
QSSSSSSh
xSSSh
FTPjKS
FtPj;S
C.PjRV
Visual C   CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
portuguese-brazilian
GetProcessWindowStation
operator
src\StreamCopier.cpp
Property not supported
src\UnicodeConverter.cpp
!_path.empty()
p:\poco-1.4\stage\build\vs100\foundation\src\File_WIN32U.cpp
src\File.cpp
src\TextIterator.cpp
src\TextConverter.cpp
src\Path.cpp
0 <= n && n <= _dirs.size()
!_dirs.empty()
Windows NT
Windows 98
Windows 95
Windows 3.x
Windows ME
Windows 95/Windows NT 4.0
Windows Server 2003/Windows Server 2003 R2
Windows XP
Windows 2000
Windows 7/Server 2008 SP2
Windows Vista/Server 2008
x:x:x:x:x:x
Windows-1252
Invalid HTTP version string
HTTP request URI invalid or too long
HTTP request method invalid or too long
No HTTP request header
HTTP/1.0
HTTP/1.1
HTTP reason string too long
Invalid HTTP status code
No HTTP response header
Unsupported Media Type
HTTP Version not supported
Cannot set the port number for an already connected session
Cannot set the proxy host and port for an already connected session
Cannot set the proxy port number for an already connected session
hXXp://
src\HTTPClientSession.cpp
src\MessageHeader.cpp
HTTP Exception
Unsupported HTTP redirect (protocol change)
FTP Exception
SMTP Exception
WebSocket Exception
HttpOnly
; HttpOnly
()[]/|\',;
src\Socket.cpp
No IPv6 support available
src\SocketImpl.cpp
Address family not supported
Protocol family not supported
Operation not supported
Socket type not supported
Protocol not supported
Socket operation attempted on non-socket
Operation already in progress
Operation now in progress
Operation would block
Missing port number
!hostAndPort.empty()
src\SocketAddress.cpp
Invalid address length passed to SocketAddress()
unsupported IP address family
src\IPAddress.cpp
Invalid or unsupported address family passed to IPAddress()
255.255.255.255
Invalid address length passed to IPAddress()
Invalid or unsupported address family passed to StreamSocketImpl
src\HostEntry.cpp
Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag
boost thread: trying joining itself
src\NumberFormatter.cpp
%I64d%c
%I64u%c
%I64x%c
%Y-%m-%dT%H:%M:%S%z
%Y-%m-%dT%H:%M:%s%z
%w, %e %b %y %H:%M:%S %Z
%w, %e %b %Y %H:%M:%S %Z
%w, %d %b %Y %H:%M:%S %Z
%W, %e-%b-%y %H:%M:%S %Z
%W, %e %b %y %H:%M:%S %Z
%w %b %f %H:%M:%S %Y
%Y-%m-%d %H:%M:%S
src\DateTime.cpp
Unsupported or invalid date/time format
%W, %e %b %r %H:%M:%S %Z
%w, %e %b %r %H:%M:%S %Z
https
bad or invalid port number
%<>{}|\"^`
src\MemoryPool.cpp
WebAdURL
PauseAdWeb
INSERT INTO search(words, tm) VALUES ('%s', '%d-d-d d:d:d')
UPDATE search SET tm = '%d-d-d d:d:d' WHERE words = '%s'
UPDATE search SET words = '%s', tm = '%d-d-d d:d:d' WHERE tm = (SELECT MIN(tm) FROM search);
DELETE FROM search WHERE words = '%s'
SELECT words FROM search ORDER BY tm DESC LIMIT %d
CREATE TABLE IF NOT EXISTS search(words VARCHAR(512) PRIMARY KEY, tm DATETIME)
INSERT INTO history(media_id, channel_id, media_name, still, percent, tm, available) VALUES (%u, %u, '%s', '%s', 0, '%d-d-d d:d:d', 1)
UPDATE history SET video_id = %d, video_name = '%s', percent = %d, tm = '%d-d-d d:d:d' WHERE media_id = %d
INSERT INTO history(media_id, channel_id, media_name, video_id, video_name, percent, tm, available) VALUES (%u, 0, '%s', %u, '%s', %d, '%d-d-d d:d:d', 1)
UPDATE history SET latest = '%s' WHERE media_id = %d
UPDATE history SET channel_id = %d, still = '%s' WHERE media_id = %d
DELETE FROM history WHERE media_id = %u
DELETE FROM history WHERE tm <= '%s'
SELECT * FROM history WHERE tm >= '%s' AND tm <= '%s' ORDER BY tm DESC
SELECT * FROM history WHERE tm >= '%s' ORDER BY tm DESC
SELECT * FROM history WHERE tm <= '%s' ORDER BY tm DESC
CREATE TABLE IF NOT EXISTS history(media_id INTEGER PRIMARY KEY,
id INTEGER PRIMARY KEY AUTOINCREMENT,
id INTEGER PRIMARY KEY AUTOINCREMENT,
hash_id VARCHAR(48) PRIMARY KEY,
fsp_url VARCHAR(1024),
INSERT INTO task_v1(media_id, aggregate, name, last_play) VALUES (%u, %d, '%s', '%s');
INSERT INTO childtask_v1(hash_id, parent_id, site_id, video_id, name, idx, definition, fsp_url, save_path, state, progress, play_pos) VALUES ('%s', %u, %u, %u, '%s', %u, %u, '%s', '%s', %u, %u, %u);
DELETE FROM task_v1 WHERE id = %u;
DELETE FROM childtask_v1 WHERE parent_id = %u;
DELETE FROM childtask_v1 WHERE hash_id = '%s';
SELECT COUNT(*) FROM childtask_v1 WHERE parent_id = %u;
SELECT hash_id, site_id, video_id, name, idx, definition, fsp_url, save_path, state, progress, play_pos FROM childtask_v1 WHERE parent_id = %u ORDER BY idx;
UPDATE childtask_v1 SET progress = %d WHERE hash_id = '%s';
UPDATE childtask_v1 SET play_pos = %d WHERE hash_id = '%s';
UPDATE task_v1 SET last_play = '%s' WHERE id = %u;
3.0.6.62
IReportHelper
operation failed
unsupported file feature
E:\gitProject\DTS_5.0.0\library\boost_1_51_0\boost/exception/detail/exception_ptr.hpp
funshion_port_memory
funshion_port_mutex_name
proxy|%d|%d|%d|%d|%d|%d|%d
{"cmd":5,"param":{"message":"
127.0.0.1
inflate 1.2.5 Copyright 1995-2010 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
SQLite format 3
CREATE TABLE sqlite_master(
sql text
CREATE TEMP TABLE sqlite_temp_master(
.NOPQRSTXY|}~
BEFOREIGNOREGEXPLAINSTEADDESCAPEACHECKEYCONSTRAINTERSECTABLEFTHENDATABASELECTRANSACTIONATURALTERAISELSEXCEPTRIGGEREFERENCESUNIQUERYATTACHAVINGROUPDATEMPORARYBEGINNEREINDEXCLUSIVEXISTSBETWEENOTNULLIKECASCADEFERRABLECASECOLLATECREATECURRENT_DATEDELETEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFINTOFFSETISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
3.5.6
webinterface
%d-d-d d:d:d
keys
XXxXXXXXXXX
FunPlayerPluginExports
play_url
keyid
retmsg
sqlite_version
sqlite_rename_trigger
sqlite_rename_table
RowKey
d-d-d d:d:d
d:d:d
d-d-d
922337203685477580
%s\etilqs_
invalid page number %d
2nd reference to page %d
Failed to read ptrmap key=%d
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
%d of %d pages missing from overflow list starting at %d
failed to get page %d
freelist leaf count too big on page %d
Page %d:
unable to get the page. error code=%d
sqlite3BtreeInitPage() returns error code %d
On tree page %d cell %d:
On page %d at right child:
Corruption detected in cell %d on page %d
Multiple uses for byte %d of page %d
Fragmented space is %d byte reported as %d on page %d
Unable to malloc %d bytes
Page %d is never used
Pointer map page %d is referenced
Outstanding page count goes from %d to %d during this analysis
keyinfo(%d
%s(%d)
%s-mjX
unable to use function %s in the requested context
transaction - SQL statements in progress
sqlite_temp_master
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s
no such column: "%s"
cannot open indexed column for writing
cannot open value of type %s
variable number must be between ?1 and ?%d
too many SQL variables
too many columns in %s
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s
%s: %s
not authorized to use function: %s
Expression tree is too large (maximum depth %d)
%.*s%Q%s
%s OR name=%Q
there is already another table or index with this name: %s
sqlite_
table %s may not be altered
view %s may not be altered
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
sqlite_sequence
UPDATE %Q.sqlite_sequence set name = %Q WHERE name = %Q
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
UPDATE %Q.%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_stat1
CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
SELECT idx, stat FROM %Q.sqlite_stat1
too many attached databases - max %d
database %s is already in use
unable to open database: %s
no such database: %s
cannot detach database %s
database %s is locked
sqlite_detach
sqlite_attach
%s %T cannot reference objects in database %s
illegal return value (%d) from the authorization function - should be SQLITE_OK, SQLITE_IGNORE, or SQLITE_DENY
access to %s.%s.%s is prohibited
access to %s.%s is prohibited
object name reserved for internal use: %s
there is already an index named %s
too many columns on %s
duplicate column name: %s
default value of column [%s] is not constant
table "%s" has more than one primary key
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE TABLE %Q.sqlite_sequence(name,seq)
view %s is circularly defined
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
DELETE FROM %s.sqlite_sequence WHERE name=%Q
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
indexed columns are not unique
table %s may not be indexed
views may not be indexed
virtual tables may not be indexed
there is already a table named %s
index %s already exists
sqlite_autoindex_
table %s has no column named %s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q
unable to identify the object to be reindexed
no such collation sequence: %s
table %s may not be modified
cannot modify %s because it is a view
table %S has %d columns but %d values were supplied
%d values for %d columns
table %S has no column named %s
PRIMARY KEY must be unique
sqlite3_extension_init
unable to open shared library [%s]
no entry point [%s] in shared library [%s]
error during initialization: %s
automatic extension loading failed: %s
foreign_key_list
*** in database %s ***
unsupported encoding: %s
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s
database schema is locked: %s
unknown or unsupported join type: %T%s%T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
column%d
%z:%d
sqlite_subquery_%p_
%s.%s
no such table: %s
too many terms in %s BY clause
%r %s BY term out of range - should be between 1 and %d
%r ORDER BY term out of range - should be between 1 and %d
ORDER BY clause should come after %s not before
LIMIT clause should come after %s not before
SELECTs to the left and right of %s do not have the same number of result columns
sqlite3_get_table() called with two or more incompatible queries
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
-- TRIGGER %s
no such column: %s
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor did not declare schema: %s
no such module: %s
at most %d tables in a join
TABLE %s
%z AS %s
%z WITH INDEX %s
%z USING PRIMARY KEY
%z VIRTUAL TABLE INDEX %d:%s
SQL logic error or missing database
kernel lacks large file support
no such vfs: %s
password
Burlywood
1.5.4
libpng error: %s
libpng warning: %s
&#xX;
</%s>
%s="%s"
%s='%s'
<!--%s-->
<![CDATA[%s]]>
version="%s"
encoding="%s"
standalone="%s"
.lzma
.sitx
unsupported file feature; compression method
operation failed; problem unzipping data
unsupported file feature; gzip larger than 2GB
?#%X.y
D:\buildRel3.0.6\Funshion\Rel\bin\Release\Funshion.pdb
SHDeleteKeyW
SHLWAPI.dll
WININET.dll
WTSAPI32.dll
dbghelp.dll
lua5.1.dll
ConnectNamedPipe
CreateNamedPipeW
SetThreadExecutionState
GetProcessHeap
CreatePipe
KERNEL32.dll
GetKeyState
ExitWindowsEx
MsgWaitForMultipleObjects
USER32.dll
GDI32.dll
COMDLG32.dll
RegDeleteKeyW
RegOpenKeyExW
RegCloseKey
RegEnumKeyW
RegOpenKeyW
RegCreateKeyExW
ADVAPI32.dll
ShellExecuteW
ShellExecuteExW
SHFileOperationW
SHELL32.dll
ole32.dll
OLEAUT32.dll
WINMM.dll
WS2_32.dll
IPHLPAPI.DLL
WinHttpReceiveResponse
WinHttpSetTimeouts
WinHttpSendRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpSetStatusCallback
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpOpenRequest
WinHttpCrackUrl
WinHttpReadData
WINHTTP.dll
VERSION.dll
COMCTL32.dll
RICHED20.dll
MSIMG32.dll
WINTRUST.dll
ImageGetCertificateData
ImageGetCertificateHeader
imagehlp.dll
CRYPT32.dll
RPCRT4.dll
GetCPInfo
zcÁ
.?AVPropertyNotSupportedException@Poco@@
.?AVWindows1252Encoding@Poco@@
.?AVHTTPRequest@Net@Poco@@
.?AVHTTPMessage@Net@Poco@@
.?AVHTTPException@Net@Poco@@
.?AVHTTPResponse@Net@Poco@@
.?AVHTTPSession@Net@Poco@@
.?AVHTTPClientSession@Net@Poco@@
.?AVUnsupportedRedirectException@Net@Poco@@
.?AVFTPException@Net@Poco@@
.?AVSMTPException@Net@Poco@@
.?AVWebSocketException@Net@Poco@@
.?AVHTTPStreamBuf@Net@Poco@@
.?AV?$BasicBufferedStreamBuf@DU?$char_traits@D@std@@VHTTPBufferAllocator@Net@Poco@@@Poco@@
.?AVHTTPIOS@Net@Poco@@
.?AVHTTPInputStream@Net@Poco@@
.?AVHTTPOutputStream@Net@Poco@@
.?AVHTTPFixedLengthStreamBuf@Net@Poco@@
.?AVHTTPFixedLengthIOS@Net@Poco@@
.?AVHTTPFixedLengthInputStream@Net@Poco@@
.?AVHTTPFixedLengthOutputStream@Net@Poco@@
.?AVHTTPChunkedStreamBuf@Net@Poco@@
.?AVHTTPChunkedIOS@Net@Poco@@
.?AVHTTPChunkedInputStream@Net@Poco@@
.?AVHTTPChunkedOutputStream@Net@Poco@@
.?AVHTTPHeaderStreamBuf@Net@Poco@@
.?AVHTTPHeaderIOS@Net@Poco@@
.?AVHTTPHeaderInputStream@Net@Poco@@
.?AVHTTPHeaderOutputStream@Net@Poco@@
.?AVKeyPressListener@ui@@
.?AVIReportHelper@library@@
.?AVHttpRequest@util@@
.?AVFunshionWebMgr@@
.?AVAsyncAnonymousPipeListener@@
.?AVWebPageListener@@
.?AVUserLoginDlg@user@@
.?AVWebPlayBottomBarTip@WebPlay@@
.?AVWebPlayBottomBar@WebPlay@@
.?AVWebPlayControlBarListener@@
.?AVWebPlayControlBar@@
.?AVWebPlayErrorView@WebPlay@@
.?AVWebPlayLoadingView@WebPlay@@
.?AV?$_connection0@VWebPlayModule@WebPlay@@Vsingle_threaded@sigslot@@@sigslot@@
.?AVWebPlayModule@WebPlay@@
.?AVWebPlayLabel@WebPlay@@
.?AVWebPlayLableListener@WebPlay@@
.?AV?$_connection0@VWebPlayView@WebPlay@@Vsingle_threaded@sigslot@@@sigslot@@
.?AVLayoutWnd@WebPlay@@
.?AVWebPlayView@WebPlay@@
.?AVWebPlayViewListener@WebPlay@@
.?AVWebBrowser@ui@@
.?AVWebBrowserImpl@ui@@
P<webinterface version="18">
<interface name="init" url="hXXp://po.funshion.com/v5/config/init"/>
<interface name="navigator" url="hXXp://po.funshion.com/v7/config/channel"/>
<interface name="channelhome" url="hXXp://po.funshion.com/v5/config/channelhome"/>
<interface name="hotword" url="hXXp://ps.funshion.com/v5/search/hotword"/>
<interface name="suggestions" url="hXXp://ps.funshion.com/v5/search/suggestions"/>
<interface name="search_media" url="hXXp://ps.funshion.com/v7/search/media"/>
<interface name="profile" url="hXXp://pm.funshion.com/v5/media/profile"/>
<interface name="episode" url="hXXp://pm.funshion.com/v5/media/episode"/>
<interface name="play" url="hXXp://pm.funshion.com/v5/media/play"/>
<interface name="retrieval" url="hXXp://pm.funshion.com/v5/media/retrieval"/>
<interface name="aggregate_retrieval" url="hXXp://pam.funshion.com/v5/aggregate/retrieval"/>
<interface name="filters" url="hXXp://pm.funshion.com/v5/media/filters"/>
<interface name="aggregate_filters" url="hXXp://pam.funshion.com/v5/aggregate/filters"/>
<interface name="video_retrieval" url="hXXp://pv.funshion.com/v5/video/retrieval"/>
<interface name="video_filters" url="hXXp://pv.funshion.com/v5/video/filters"/>
<interface name="video_profile" url="hXXp://pv.funshion.com/v5/video/profile"/>
<interface name="video_relate" url="hXXp://pv.funshion.com/v5/video/relate"/>
<interface name="video_play" url="hXXp://pv.funshion.com/v5/video/play"/>
<interface name="aggregate_profile" url="hXXp://pam.funshion.com/v5/aggregate/profile"/>
<interface name="aggregate_episode" url="hXXp://pam.funshion.com/v5/aggregate/episode"/>
<interface name="aggregate_play" url="hXXp://pam.funshion.com/v5/aggregate/play"/>
<interface name="aggregate_init" url="hXXp://pam.funshion.com/v6/aggregate/init"/>
<interface name="aggregate_search" url="hXXp://pam.funshion.com/v5/aggregate/search"/>
<interface name="account_reg" url="hXXp://VVV.fun.tv/client/account_reg"/>
<interface name="auth_validate" url="hXXp://par.funshion.com/auth/validate"/>
<interface name="product_list" url="hXXp://par.funshion.com/product/getProductList"/>
<interface name="payment_gateway" url="hXXp://par.funshion.com/gateway/getGatewayList"/>
<interface name="consume" url="hXXp://par.funshion.com/consume/productConsume"/>
<interface name="order_status" url="hXXp://par.funshion.com/order/getOrderStatus"/>
<interface name="account" url="hXXp://fs.fun.tv/account/client"/>
<interface name="vip_auth" url="hXXp://pvip.funshion.com/v1/vip/checkauth"/>
<interface name="vip_pay" url="hXXp://fs.fun.tv/client_vip_pay"/>
</webinterface>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
=#>*>4>>>
7 7'717;7
3 3$3(3,3
>#>*>1>8>>>
5d6x6
=1=6=<=_=
?"?*?1?8?
? ?$?(?,?0?
2!3-33393
< <*<5<@<|<
7(8,8084888
<,=0=4=8=<=^=0>4>8><>
? ?$?(?,?
12$6(6,6064686
97;>;$>(>,>0>4>'?
2,2J2T22383
5&5-575[5
2 2$2(2,2024282<2@2
7 7'7-757
8 8'878[8
X01D1N1]1e1t1
1-2I2
(0-030W0}0
3!424:4@4\4~4
=$>(>,>0>4>8>
9 9$9(9,9094989
0X0{0
4$8.8~8*9)>
7 7$7(7,7074787<7
6m6f6
2 2$2(2,20242
;!;3;^;~;
<,=0=4=8=
> >$>(>,>0>4>8><>@>,?0?4?8?
3 3$3(3,303
= =$=(=,=
8 8$8(8,8084888
: :$:(:,:0:4:
7 7$7(7,7
0 0$0(0,0004080<0
0 0$0(0,0004080
= =(=4=\=
mscoree.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
nKERNEL32.DLL
WUSER32.DLL
hXXp://mc.funshion.com/interface/mc?mcid=1774
hXXp://mc.funshion.com/interface/mc?mcid=1773
hXXp://mc.funshion.com/interface/mc?mcid=1772
hXXp://fs.funshion.com/client_play_after_2/
hXXp://mc.funshion.com/interface/mc?mcid=1797
hXXp://mc.funshion.com/interface/mc?mcid=1771
%s?session_id=%s&play_id=%d
%s&session_id=%s&play_id=%d
\update\adConfig.xml
%s&fck=%s
\update\adMaterialsTable1.xml
%s\%u.swf
.date%I64d
.date
.date*
ui_record=AdManager::downLoadAdMaterialsTable|url=%s|Err=%d
ui_record=AdManager::parseAdMaterialsTable|filename=%s|size=%d
ui_record=AdManager::getLocalAdFiles|pathName=%s|vct_local_ad.size=%d
ui_record=AdManager::getLocalAdFiles|path=%s|exist_filename=%s
ui_record=AdManager::downloadToFile|ad_url=%s|vct_download_ad.size=%d|idx=%d|Err=%d
hXXp://stat.funshion.net/business/pclient_configlog
(0,%d)
%s?rprotocol=1*_*ad_info=%d*_*ad_playerload=%d*_*ad_player_default=*_*uid=%d*_*mac=%s*_*session_id=%s*_*play_id=%d*_*client=pc*_*ver=%s*_*channel=%s*_*videoid=%s*_*platform=pc*_*hashid=%s
%s?rprotocol=1*_*ad_info=%d*_*ad_playerload=*_*ad_player_default=%d*_*uid=%d*_*mac=%s*_*session_id=%s*_*play_id=%d*_*client=pc*_*ver=%s*_*channel=%s*_*videoid=%s*_*platform=pc*_*hashid=%s
hXXp://stat.funshion.net/business/pclient_prematlog
%s?rprotocol=1*_*ad_preload_list=%d*_*ad_preload_get=%s*_*pre_matid=%s*_*uid=%d*_*mac=%s*_*session_id=%s*_*client=pc*_*ver=%s*_*platform=pc
hXXp://stat.funshion.net/client/play_stop?mac=%s&v=%s&cid=%d&os=%d&ErrorCode=%d
search.db
Failed to open search.db, reason:
Successed to open search.db!
history.db
Failed to open history.db, reason:
Successed to open history.db!
task.db
Failed to open task.db, reason:
Successed to open task.db!
hXXp://crm2.qq.com/page/portalpage/wpa.php?uin=800056608&f=1&ty=1&aty=0&a=&from=6
FunshionUpgrade.exe
%s?channel=%u&%s&pg=%d&sz=%d
fsp://%u
fsp://%u/%u?channel=1001
@string/footer_cooperation
hXXp://VVV.fun.tv/aboutus/
hXXp://VVV.fun.tv/aboutus/relation/
hXXp://VVV.fun.tv/aboutus/cooperate/
hXXp://VVV.fun.tv/privacy/
hXXp://VVV.bestv.com.cn/
hXXp://VVV.smg.cn/
fsp://%u/%u
@string/loading_innerweb
Win32_Process.Handle="%u"
FunshionService.exe
@string/webbrowserplay
hXXp://neirong.funshion.com/base/Shipyard.zip
%s?cl=pcclient&ve=%s&uc=%d
%s?cl=pcclient&ve=%s&nav_id=%d&channel=%d
\template.xml
fsp://%u/%u/dvd?channel=%u
fsp://%u/%u/hd
fsp://%u/%u/%s
%s?channel=%u
SearchActor :: HTTP_EVENT_COMPLETE
%s?q=%s&cl=pcclient&ve=%s&uc=%d
%s?q=%s&vip=0&uc=%d&pg=1&sz=15&cl=pcclient
%d-%d
fsp://%u/
%d-d-d %s
hXXp://ps.funshion.com/v7/search/video?q=%s&pg=%d&sz=15&&cl=pcclient
%s?channel=%u&year=0&area=0&cate=0&pg=1&sz=35
%s?channel=%u&%s&pg=1&sz=%d
\FunshionWeb.exe
%u,%u
\windows.lua
%s?id=%d&cl=pcclient&ve=%s&uc=%d
==.html
.html
hXXp://player.youku.com/player.php/sid/%s/v.swf?isAutoPlay=true&winType=interior
hXXp://stat.funshion.net/ecom_mobile/aplay?dev=winpc_0_0&mac=%s&ver=%s&nt=3&fudid=%s&sid=%s&mid=%d&eid=%d&vid=&siteid=%d&apptype=winpc_app_main&rprotocol=1
%s?id=%u&cl=pcclient&ve=%s&uc=%d
%s\Json\profile_%u.json
%s\Json\episode_%u.json
%s?id=%u&sz=49
%s\Json\relate_%u.json
%s?id=%u
%s\Json\aggregate_profile_%d.json
%s?id=%u&site_id=%u
%s\Json\aggregate_episode_%u_%u.json
library::`anonymous-namespace'::<lambda0>::operator ()
fsp://%u/%s/%s
hXXp://stat.funshion.net/client/fsopen?rprotocol=1*_*fck=%s*_*mac=%s*_*guid=%s*_*userid=%d*_*fpc=*_*version=%s*_*sid=%s*_*vvid=*_*result=%d*_*tm=%u*_*engine=%d
hXXp://neirong.funshion.com/client/jdmarket/jdmarket306.json
\funshion\jdmarket\market.ini
manifest.json
default.skin
@drawable/%s
%s\base
\Minisite.zip
\Minisite.dll
\cargo_list.json
hXXp://neirong.funshion.com/popup/minisite.zip
(2) Get the version of local Minisite.dll...
(2) Get the version of local Minisite.dll failed!
(2) minisite.dll dose not exist!
(3) Get the latest version of minisite.dll...
(3) The latest version of minisite.dll is
(3) cargo_list.json is wrong!
(3) Parse cargo_list.json error!
(3) cargo_list.json does not exist!
(4) Download Minisite.zip...
(4) Download Minisite.zip success!
(4.1) Unzip Minisite.zip...
(4.1) Unzip Minisite.zip success!
(4.1) Unzip Minisite.zip failed!
(4) Download Minisite.zip failed!
(4) Local Minisite.dll is the latest!
(5) Check the signature of local Minisite.dll...
(5) Local Minisite.dll is invalid!
(5) Local Minisite.dll is valid.
(6) Create a named pipe for Minisite.dll...
\\.\pipe\NamedPipe.%d
(6) Create a named pipe for Minisite.dll failed!
(6) Create a named pipe for Minisite.dll success!
(7) Launch rundll32.exe to load Minisite.dll...
rundll32.exe
"%s",runDllW %s
(7) Launch rundll32.exe to load Minisite.dll failed! Because of missing rundll32.exe!
(7) Launch rundll32.exe to load Minisite.dll failed!
(7) Launch rundll32.exe to load Minisite.dll success!
(8) Waiting for Minisite.dll connecting...
(8) Minisite.dll connected!
hXXp://stat.funshion.net/client/popup?rprotocol=2*_*clientFlag=2*_*fck=%s*_*mac=%s*_*userid=0*_*version=%s*_*url*_*count=0*_*duration=%I64d*_*systime=%I64d*_*error=%d*_*clientstate=%d
\icon\fmp.ico
\fmp.exe
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.%s\UserChoice
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.%s
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.%s\OpenWithList
BRST%s_UsrProgid.backup
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.%s\UserChoice\Progid
BRST%s_Progid.backup
"%s",0
"%s" "%%1"
fmp%s
fmp%s.backup
fmp%s\shell
fmp%s\shell\open\ddeexec
fmp.exe
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.%s\OpenWithProgIds
.%s\OpenWithProgIds
SOFTWARE\Microsoft\Windows\Roaming\OpenWith\FileExts\.%s\UserChoice
SOFTWARE\Microsoft\Windows\Roaming\OpenWith\FileExts\.%s
\fmp\fmp.exe
FunshionV\FunshionV.ini
%s\shell\open\command
FunshionV.ini
funv_searchword=%s
hXXp://neirong.funshion.com/client/fmp/fmp.7z
\funby\funby.exe
%s\CrashReport.exe
%s\gma.dll
%s\fskernel\fskernel.exe
crashreport
%s\funby\funby.exe
%s\fmp\fmp.exe
hXXp://stat.funshion.net/client/tmp?rprotocol=2*_*fck=%s*_*mac=%s*_*guid=%s*_*userid=0*_*fpc=*_*version=%s*_*sid=*_*vvid=*_*type=%s*_*param=%d
hXXp://stat.funshion.net/client/tmp?rprotocol=2*_*fck=%s*_*mac=%s*_*guid=%s*_*userid=0*_*fpc=*_*version=%s*_*sid=*_*vvid=*_*type=%s*_*param=%s
hXXp://q1.fun.tv/tips/?sub=baiying
\TitanRecommend.jpg
%s\%s.lnk
%d%% %s
%s : %d%% %s/s
%s\FsLibrary.exe
track=fsp://play/%u/%u/hd
mixer line dwComponentType: %d
d:d
d:d/
funshionplugin2.dll
Player Status = FirstBufferingNoKeydata
(*.mp4)
*.mp4
(*.rmvb)
*.rmvb
(*.fc!)
*.fc!
%s\%s%ld.jpg
/select,%s
explorer.exe
@string/welcome_login
OpenUrl
.rmvb
%s?ver=%s&mac=%s
%s&ver=%s&mac=%s
%s&port=%u&time=%s&oc=0&openPlatform=false&vchannel=%s&plid=&vid=&title=%s
\funshion.ini
hXXp://stat.funshion.net/ecom_vas/hight_bw_data?c_hu_define=%d&last_perv=%d
%s&mid=%u&uid=%d&mac=%s&fck=%s&ver=%s&refer=&hashid=%s&time=%s&filename=%s&oc=0&openPlatform=false&vchannel=%s&plid=&vid=&title=%s
%s%s/adback?c=%s&mid=%d&ver=%s
%s&view=client_subscript&mid=%u&uid=%d&mac=%s&fck=%s&ver=%s&refer=&hashid=%s&time=%s&filename=%s&oc=0&openPlatform=false&vchannel=%s&plid=&vid=&title=%s
%s?port=%u
fsp://%s/%s/%s
hXXp:///?session_id=
hXXp://stat.funshion.net/ecom_mobile/fbuffer?
%sdev=pc_app_main&mac=%s&ver=%s&nt=3&fudid=%s&sid=%s&ih=%s&svr=127.0.0.1&ok=%d&bpos=%d&btm=%d&drate=-1&nrate=-1&msok=&ptype=&rt=&ip=
&cl=%d&mid=%d&eid=%d&vid=&vt=%d&messageid=&type=%d&lian=%d&rtm=%d&stype=2&apptype=&rprotocol=
hXXp://stat.funshion.net/ecom_mobile/dbuffer?
%sdev=pc_app_main&mac=%s&ver=%s&nt=3&fudid=%s&sid=%s&ih=%s&svr=127.0.0.1&ok=%d&dpos=%d&spos=%d&bpos=%d&btm=%d&drate=-1&ptype=&rt=&ip=&cl=%d&stype=2&apptype=&rprotocol=
hXXp://stat.funshion.net/ecom_mobile/stuck?
%sdev=pc_app_main&mac=%s&ver=%s&nt=3&fudid=%s&sid=%s&ih=%s&svr=127.0.0.1&ok=%d&stkpos=%d&stktm=%d&drate=-1&stkres=&ptype=&rt=&ip=&cl=%d&stype=2&apptype=&rprotocol=
hXXp://stat.funshion.net/ecom_mobile/playtm?
%sdev=pc_app_main&mac=%s&ver=%s&nt=3&fudid=%s&sid=%s&ih=%s&spos=%s&epos=%s&vtm=%s&pn=%d&tu=%d
&ptype=&pbre=%d&rt=&ip=&cl=%d&vt=%d&type=%d&mid=%d&eid=%d&vid=&sn=%d&st=%d&stype=2&apptype=&rprotocol=
hXXp://pinter.funshion.com/history?fudid=&brand=&type=&os=&os_version=&ip=&mac=×tamp=%d&app_code=pc&user_id=%d&token=%s&mtype=%s&mid=%d&eid=%d
hXXp://stat.funshion.net/website/play?rprotocol=2*_*clientFlag=2*_*fck=%s*_*mac=%s*_*userid=%d*_*fpc=*_*version=%s*_*sid=%s*_*pvid=*_*config=*_*url=%s*_*referurl=%s*_*channelid=%s*_*mediatype=media*_*target=%d*_*hashid=%s*_*vvid=%s*_*lian=%s*_*platform=0*_*videolength=%I64d*_*format=%dkbs*_*ext=*_*playstep=0*_*playsestep=%d*_*seidcount=0
hXXp://stat.funshion.net/client/ptlog?rprotocol=2
type=%s*_*gid=%d*_*gtid=%d*_*vid=%d*_*defination=*_*playlength=%I64d*_*startprogress=%.2f*_*startdlprogress=%.2f*_*progress=%.2f*_*dloadprogress=%.2f*_*haltn=%d*_*haltm=%I64d
hXXp://stat.funshion.net/ecom_mobile/vip?dev=pc_app_main&mac=%s&ver=%s&nt=3&fudid=%s&sid=%s&mid=%d&eid=%d&vid=0&type=vip&apptype=pc_app_main&rprotocol=1
fsp://%u/%u/dvd?channel=%d
Funshion.exe
FunshionWeb
hXXp://i.fun.tv
\FsLibrary.exe
shipyard.zip
shipyard.dll
shipyard%s
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
hXXp://stat.funshion.net/ecom-ad/shipyardaction?rprotocol=1*_*mac=%s*_*fck=%s*_*os=%s*_*name=funshion.exe*_*version=%s*_*actionobject=%s*_*actionresult=d
%s\Json\episode_%s.json
%s?id=%s&cl=pcclient&ve=%s&uc=%d
%s\Json\play_%s_%s.json
fsp://%s|auto=4|vt=%d|c=mr|m=%s|v=%s|cid=%d|vip=%d|ts=%s|sz=%s|td=%s|crt=%d|torrent=null.fsp|mn=%s|fn=%s|idx=%d|jm=%s|jv=%I64d
%s?id=%u%&cl=pcclient&ve=%s&uc=%d
fsp://%s|vt=1|small=1|m=%s|v=%u|cid=%d|hash=%s|f=%s|ts=%s|sz=%s|td=%u|mn=%s|fn=%s|idx=%d|jm=%s
\DontKillFunshionService.txt
Kill FunshionService.exe Failed!
Will Startup FunshionService.exe...
FunshionService.exe crash frequently!
Startup FunshionService.exe Success!
startbywindows tray
Funshion\Database\task.db
Funshion\Database\task.db-journal
FunshionService.exe Exit!
funshion.db
Failed to open funshion.db, reason:
hXXp://stat.funshion.net/client/AddTask?rprotocol=1*_*fck=%s*_*mac=%s*_*guid=%s*_*userid=0*_*fpc=*_*version=%s*_*sid=*_*vvid=*_*AddType=%d*_*taskStatus=%d*_*newTaskdlg=0*_*addNum=%d*_*suscessNum=%d
hXXp://stat.funshion.net/dts/proxy_communicate?rprotocol=1&dev=PC&mac=%s&ver=%s&value=1|%d|%d|%d
hXXp://stat.funshion.net/client/bootnew?rprotocol=1*_*fck=%s*_*mac=%s*_*guid=%s*_*userid=0*_*fpc=*_*version=%s*_*sid=*_*vvid=*_*errcode=%d*_*tasktm=%d*_*bdw=%s*_*scr=%s*_*disk=%s*_*pcm=%d*_*res=%s*_*osv=%d*_*flashv=%s*_*iev=%s*_*start=%s*_*lan=%d*_*skin=%d*_*wsize=%s*_*wrival=%s*_*cid=%d*_*lastplay=%d*_*lastboot=%d*_*tasknum=%d
hXXp://stat.funshion.net/client/boot?mac=%s&version=%s&channel=%s&os=%d&starttype=%s&errorcode=%d&hc=%d&hardware_acceleration=%d&yy=%d&tray_limit=%d
@drawable/load_login
@string/load_login
onLogin
openurl
%s?cl=pc&ve=%s&user_id=%u&token=%s&type=media&mid=%u&ctime=%I64d
, RetMsg =
hXXp://puser.funshion.com/user/rptcredit?fudid=&brand=&type=&os=&os_version=&ip=&mac=×tamp=%d&app_code=pc&user_id=%d&token=%s
&ve=%s
&uc=%d
&si=%s
%s?mid=%u
\CrashReport.exe
\funshion\fsps.txt
tasklist.exe
\funshion\crash_dump.dmp
%dx%d
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"%s\Funshion.exe" startbywindows tray
Software\Microsoft\Windows NT\CurrentVersion\NetworkCards
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\PPStream.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\PPLive.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\PPTV.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\QiyiClient.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PIPI_is1
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PIPI_is1
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\LeTVLoader.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\QvodPlayer.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\StormPlayer.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Alexa Toolbar
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Alexa Toolbar
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iUserTracker
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iUserTracker
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iUserTracker
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iUserTracker
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A6C97A5-5C5T-434E-B5C3-E881726FAFF9}_is1
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A6C97A5-5C5T-434E-B5C3-E881726FAFF9}_is1
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A6C97A5-5C5T-434E-B5C3-E881726FAEE9}_is1
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A6C97A5-5C5T-434E-B5C3-E881726FAEE9}_is1
InstallExe
\Funshion.ini
\ini\temp_config.ini
hXXp://update.funshion.com/fpupdate/INI/config_update_funplayer.txt
hXXp://update.funshion.com/fpupdate/UPDATE/HttpFile.txt
HttpFile
\ini\httpfile.ini
ClientURL
\webinterface.xml
%s?cl=pcclient&ve=%s
curblock=%d, curpos=%d, curtotalpos=%d
WebPlayBottomBar
WebPlayBottomBarTip
@drawable/webbrowserlable
@string/webbrowserclose
HTTP/
kernel32.dll
%H:%M:%S
%s%s%s
\StringFileInfo\lx\%s
values/fonts.xml
values/drawables.xml
values/colors.xml
values/layouts.xml
shlwapi.dll
msimg32.dll
RICHED20.DLL
gma.dll
Ieframe.dll
%a, %d-%b-%Y, %H:%M:%S GMT
%s;expires = %s
hXXp://fun.tv
hXXp://funshion.com
SELECT * FROM Win32_Process WHERE Name = '%s'
Funshion.ini
hXXp://conf.funshion.com/interface/config?client=pc&file=pc-aconfig&ver=%s&fmt=xml
ConfigUrl
hXXp://neirong.funshion.com/client/nirvana/config.xml
WebinterfaceVersion
hXXp://fs.fun.tv/publish/first?ver=5&cv=
HomeURL
hXXp://game.funshion.com/door.php?source=client_tab
GameBtnUrl
hXXp://shop.fun.tv/?pcclient
ShopBtnUrl
ASSOCIATORS OF {Win32_DiskPartition.DeviceID='
ASSOCIATORS OF {Win32_DiskDrive.DeviceID='
UpdateUrl
0000000000000
hXXp://neirong.funshion.com/client/funby/funby.7z
MultipleDownloadURL
%s*_*fck=%s*_*mac=%s*_*guid=%s*_*userid=0*_*sid=%d*_*comid=%s*_*ver=%s*_*cid=%s*_*
{X-X-x-XX-XXXXXX}
Software\Microsoft\Windows\CurrentVersion\RunOnce
hXXp://update.funshion.com/update/check.php
%s?s=%s&id=%s&v=%s&xml=false
\FunshionUpgrade.exe
\funshion\update\updatexmlfile.txt
%Program Files%\Funshion Online\3.0.6.62\Funshion.exe

FunshionWeb.exe_1548:




.text
`.rdata
@.data
.rsrc
@.reloc
8%u/P
SSSSh
xSSSh
FTPjKS
FtPj;S
C.PjRV
Visual C   CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
portuguese-brazilian
GetProcessWindowStation
operator
3.0.6.62
%s Fengxing/%s MZ/%s
RegOpenKeyTransactedW
RegCreateKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyExW
D:\buildRel3.0.6\Funshion\Rel\src\ThirdParty\boost/property_tree/detail/json_parser_read.hpp
D:\buildRel3.0.6\Funshion\Rel\src\ThirdParty\boost/property_tree/detail/ptree_implementation.hpp
D:\buildRel3.0.6\Funshion\Rel\src\ThirdParty\boost/property_tree/string_path.hpp
boost::too_few_args: format-string referred to more arguments than were passed
boost::too_many_args: format-string referred to less arguments than were passed
D:\buildRel3.0.6\Funshion\Rel\bin\Release\FunshionWeb.pdb
UrlMkSetSessionOption
UrlMkGetSessionOption
urlmon.dll
KERNEL32.dll
USER32.dll
GDI32.dll
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
ADVAPI32.dll
ShellExecuteW
SHELL32.dll
ole32.dll
OLEAUT32.dll
SHLWAPI.dll
WinHttpReceiveResponse
WinHttpSetTimeouts
WinHttpSendRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpOpenRequest
WinHttpCrackUrl
WinHttpReadData
WINHTTP.dll
WININET.dll
GetCPInfo
GetProcessHeap
zcÁ
.?AVWebBrowser@@
.?AVFunshionWebApp@@
.?AVAsyncAnonymousPipeListener@@
.?AVWebBrowserEngineListener@@
.?AVMessageFilterImpl@WebBrowserEngine@@
.?AVWebPlay@@
.?AU?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@
.?AV?$sp_counted_impl_p@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@detail@boost@@
.?AU?$concrete_parser@U?$alternative@V?$action@V?$chset@D@classic@spirit@boost@@Ua_escape@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@V?$action@U?$uint_parser@K$0BA@$03$03@classic@spirit@boost@@Ua_unicode@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$alternative@V?$action@U?$difference@U?$difference@Uanychar_parser@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@Ua_char@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$positive@U?$contiguous@U?$confix_parser@U?$chlit@D@classic@spirit@boost@@U?$kleene_star@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@U1234@Uunary_parser_category@234@Unon_nested@234@Unon_lexeme@234@@classic@spirit@boost@@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$sequence@U?$optional@U?$chlit@D@classic@spirit@boost@@@classic@spirit@boost@@U?$alternative@U?$chlit@D@classic@spirit@boost@@U?$sequence@U?$range@D@classic@spirit@boost@@U?$kleene_star@Udigit_parser@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$sequence@V?$chset@D@classic@spirit@boost@@U?$optional@V?$chset@D@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@Ua_name@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$chlit@D@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_s@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$alternative@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$list_parser@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@U?$chlit@D@234@Uno_list_endtoken@234@Uplain_parser_category@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$alternative@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@V1234@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Uend_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
<$< <2<9<
6"72797@7_7
4O4X4
4%4 444;4]4
4 4&4*40444:4>4
5 5$5(5,505
= =$=(=,=
6 6$6064686<6@6
? ?$?(?,?0?4?
mscoree.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
nKERNEL32.DLL
WUSER32.DLL
<invoke name="sub_add_para_and_play"><arguments><string>%s</string></arguments></invoke>
hXXp://127.0.0.1/stop.swf
<invoke name="%s"><arguments></arguments></invoke>
login
WebFinish
OnLogin
SupportVIP
SupportBaiying
.rmvb
\funshion.ini
%s|%s|hu=%d|sp=%d|uid=%d|mac=%s|fck=%s|ver=%s|mid=%u|hashid=%s
FunshionWebMessageWindow
funshion.ini
show_web_log
SupportNewFsp
hXXp://stat.funshion.net/client/dump?version=%s&module=W&mac=%s&date=%uuu&time=uuuu&filename=
FunshionWeb.exe
Funshion.exe
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_PERFORMANCE_DATA
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
Advapi32.dll
{6BF52A52-394A-11d3-B153-00C04F79FAA6}
%H:%M:%S
gma.dll
Ieframe.dll
hXXp://fun.tv
hXXp://funshion.com
Funshion.ini
ClientURL
0000000000000
FunshionWeb
hXXp://adk.funshion.com/adpolestar/door/;ap=DA58438C_88B2_6E75_83E6_1C9840AC309F;ct=js;pu=funshion;/?
bdopenconfig.json
dhXXp://stat.funshion.net/ecom-vas/brower?fck=%1%&coBDInstTime=%2%&daytime=%3%&timeday=%4%&CompUser=%5%
bbinfo.txt
\Funshion.ini
%Y%m%d
\baidubrowser.exe
http\shell\open\command
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE
%Program Files%\Funshion Online\3.0.6.62\FunshionWeb.exe

rundll32.exe_3388:




.text
`.data
.rsrc
@.reloc
KERNEL32.dll
USER32.dll
msvcrt.dll
imagehlp.dll
ntdll.dll
?.ulf
.ue9]
ole32.dll
_amsg_exit
_wcmdln
rundll32.pdb
name="Microsoft.Windows.Shell.rundll32"
version="5.1.0.0"
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
name="Microsoft.Windows.Shell.rundll32"
version="5.1.0.0"
.....eZXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
...eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
%Xnnnnnnnnnnnnnnn1
O3$dS7"%U9
.manifest
{00000000-0000-0000-0000-000000000000}
\\?\Volume
\\?\UNC\
rundll32.exe
Windows host process (Rundll32)
6.1.7600.16385 (win7_rtm.090713-1255)
RUNDLL32.EXE
Windows
Operating System
6.1.7600.16385

rundll32.exe_3388_rwx_6AE51000_0008B000:




3|$83|$0
3|$@3|$4
~$)~()|$
xSSSh
FTPjKS
FtPj;S
C.PjRV
Visual C   CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
portuguese-brazilian
operator
GetProcessWindowStation
<4,$?7/'
(3-!0,1'8"5.*2$
copying file .... %d bytes copy
neirong.funshion.com
1007880
%s Process ID: %d -- Thread ID: %d --
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
************Is Testing: %s; Is Log: %s; Is Disable Avoid: %s; Is DisableFunshionSignChecking: %s.****************
: this object doesn't support resynchronization
: this object doesn't support multiple channels
is not a valid key length
retMsg
j1.3.6.1.4.1.311.2.1.12
E:\winproject\Fun Player\Rel2.8.6\src\toolkits\bin\Release\Turkey.pdb
zcÁ
.?AVHexEncoder@CryptoPP@@
.?AV?$FixedKeyLength@$0BI@$03$0A@@CryptoPP@@
.?AVSimpleKeyingInterface@CryptoPP@@
.?AV?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@UDES_EDE3_Info@2@@CryptoPP@@V12@@CryptoPP@@
.?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@UDES_EDE3_Info@2@@CryptoPP@@V12@@CryptoPP@@V12@@CryptoPP@@
.PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AUNoChannelSupport@BufferedTransformation@CryptoPP@@
.?AVInvalidKeyLength@CryptoPP@@
.?AV?$_Ref_count_obj@VCFpLspInstallReportUrlParameter@@@tr1@std@@
.?AV?$_Ref_count_obj@VCFpLspDownloadReportUrlParameter@@@tr1@std@@
.?AVCFpLspInstallReportUrlParameter@@
.?AVCFpLspDownloadReportUrlParameter@@
.?AVCFpLspReportUrlParameter@@
.?AVCFpLspActionReportUrlParameter@@
C:\Windows\system32\rundll32.exe
GetProcessHeap
GetCPInfo
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
CertCloseStore
CryptMsgGetParam
CryptMsgClose
CertFreeCertificateContext
UrlMkGetSessionOption
InternetOpenUrlW
HttpQueryInfoW
""8)( \!
E-cSSHgI?H8@PH88(
.text
`.rdata
@.data
.rsrc
@.reloc
mscoree.dll
nKERNEL32.DLL
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
WUSER32.DLL
ieframe.dll
FunAcce.dll
FunAcceil.dll
Turkey.daw
FunshionSync.exe
The Acceil.dll is done I will check if install succeed.
The Acceil.dll is installed failed[RegistedLspDir:%s, NewFolder:%s]
This is the %d times install lsp.
Copy files from %s to %s
hXXp://fld.funshion.com/upgrade/is_upgrade?bid=60&app_version=%s
\gma.dll
\AirportTesting.ini
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\
\NailCmd.daw
Global\FunTurkeyLogMutex-20131205
%s\Turkey.log
The folder %s is invalid so the change folder operation will be break
type is %s.
Can not install Lsp beacuse of %d.
2.0.2.5
\FunKoala64.dll
\FunKoala.dll
Run lsp installer with location %s.
Koala not ingegrity which path is %s
hXXp://neirong.funshion.com/download/fairyland/files/app/%s.daw
%s%s_%s
hXXp://fld.funshion.com/interface/platform?pid=%d&ver=%s
hXXp://neirong.funshion.com/tools/accetesting.ini
1.dat
AptShadow.exe
hXXp://fld.funshion.com/upgrade/upgrade?bid=60
dir_type:%d
dir_name:%s
%x_%x_%x
Turkey Startup Param:%s.
Global\Funshion_Turkey_20131205
There is some Turkey running.
--------------------Param:%s,RadarId:%s,LspFolder:%s,Cid:%s--------------------
"D:\testTurkey"
C:\Users\qiangp\AppData\Roaming\butterfly\
%m-%d %H:%M:%S --
\FunUninst\bugrecord.daw
bugrecord.daw
uninst.exe
Cache-Control:max-age=%u
1.0.0.1
hXXp://
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
\funshion.exe
checkrunBypassUACPara
not exist koalaPath %s,GetLastError() = %d
exeType != L"1" && exeType != L"2"
not exist exeFullPath %s
%s, %s, %s, %s, %s
checkrunBypassUACPara fail
\kernel32.dll
rundll32.exe
\StringFileInfo\xx\%s
X-X-x-XX-XXXXXX
\platFormGuid.txt
\FunDodge.dll
taskmgr.exe
\DangerAppInfo.dll
_old_%d
%s\%s
%s%s%s
%s%s:%d
config.ini
hXXp://stat.funshion.net/tools/radarerror?rprotocol=2*_*mac=%s*_*guid=%s*_*fck=%s*_*stamp=%s*_*name=%s*_*version=%s*_*os=%s*_*errortype=%d*_*errorcode=%s*_*info=%s*_*cid=%s*_*aptid=%s*_*accedirid=%s
hXXp://stat.funshion.net/tools/radarboot?rprotocol=2*_*bootmethod=%d*_*mac=%s*_*guid=%s*_*fck=%s*_*stamp=%s*_*name=%s*_*version=%s*_*os=%s*_*parentname=%s*_*parentversion=%s*_*info=%s*_*cid=%s*_*aptid=%s*_*accedirid=%s
hXXp://funshion.com
hXXp://stat.funshion.net/tools/radaraction?rprotocol=2*_*mac=%s*_*guid=%s*_*fck=%s*_*stamp=%s*_*name=%s*_*version=%s*_*os=%s*_*action=%d*_*actionresult=%d*_*actionobject=%s*_*actionobjectver=%s*_*info=%s*_*cid=%s*_*aptid=%s*_*accedirid=%s
%a, %d-%b-%Y, %H:%M:%S GMT

FunshionService.exe_1296:




.text
`.rdata
@.data
.rsrc
@.reloc
xSSSh
FTPjKS
FtPj;S
C.PjRV
t0hP%U
Qj.hd
Rj.hD
Qj.hL
Qj.hT
Rj.hd
Rj.hl
Rj.ht
Rj.hGxG
t.hp9U
|set_tracker_addrs|ip=%1%|port=%2%|
|DNS|host=%1%|ip=%2%|port=%3%|
ls.funshion.com
ls3.funshion.com
|switch connect|ip=%1%|port=%2%|
|server timeout|ip=%1%|port=%2%|connect_time=%3%|
|tcp recv exception|ip=%1%|port=%2%|msg=%3%|
|tcp report|ip=%1%|port=%2%|report num=%3%|
|tcp remove|ip=%1%|port=%2%|remove num=%3%|
|udp connect|ip=%1%|port=%2%|
|udp report|ip=%1%|port=%2%|report num=%3%|
|udp remove|ip=%1%|port=%2%|remove num=%3%|
|deconstruct|ip=%1%|port=%2%|
|retry login|ip=%1%|port=%2%|wait time=%3%|type=%4%|
|recv redirect|ip=%1%|port=%2%|
|need relogin|ip=%1%|port=%2%|
|heartbeat resp|ip=%1%|port=%2%|
|login success|ip=%1%|port=%2%|timeout=%3%|interval=%4%|
|login|ip=%1%|port=%2%|task=%3%|
|heartbeat|ip=%1%|port=%2%|
|handler report|ip=%1%|port=%2%|report=%3%|
|handler remove|ip=%1%|port=%2%|remove=%3%|
Visual C   CRT: Not enough memory to complete call to strerror.
portuguese-brazilian
GetProcessWindowStation
Broken pipe
Inappropriate I/O control operation
Operation not permitted
operator
Property not supported
%I64d%c
%I64u%c
%I64x%c
e:\code\perforce\library\src\poco_1_4_6\foundation\src\FileStream_WIN32.cpp
src\Path.cpp
0 <= n && n <= _dirs.size()
!_dirs.empty()
cannot join thread
cannot allocate thread context key
!_path.empty()
e:\code\perforce\library\src\poco_1_4_6\foundation\src\File_WIN32U.cpp
src\File.cpp
src\DateTime.cpp
%Y%m%d%H%M%S%i
src\UnicodeConverter.cpp
deflate 1.2.5 Copyright 1995-2010 Jean-loup Gailly and Mark Adler
1.2.5
https
bad or invalid port number
%<>{}|\"^`
Windows NT
Windows 98
Windows 95
Windows 3.x
Windows ME
Windows 95/Windows NT 4.0
Windows Server 2003/Windows Server 2003 R2
Windows XP
Windows 2000
Windows 8/Server 2012
Windows 7/Server 2008 R2
Windows Vista/Server 2008
x:x:x:x:x:x
src\ErrorHandler.cpp
src\Process.cpp
inPipe == 0 || (inPipe != outPipe && inPipe != errPipe)
src\PurgeStrategy.cpp
Unsupported or invalid date/time format
%W, %e %b %r %H:%M:%S %Z
%w, %e %b %r %H:%M:%S %Z
src\NumberFormatter.cpp
src\TextIterator.cpp
src\TextConverter.cpp
inflate 1.2.5 Copyright 1995-2010 Mark Adler
anonymous pipe
e:\code\perforce\library\src\poco_1_4_6\foundation\src\PipeImpl_WIN32.cpp
src\ActiveDispatcher.cpp
src\StreamCopier.cpp
%Y-%m-%dT%H:%M:%S%z
%Y-%m-%dT%H:%M:%s%z
%w, %e %b %y %H:%M:%S %Z
%w, %e %b %Y %H:%M:%S %Z
%w, %d %b %Y %H:%M:%S %Z
%W, %e-%b-%y %H:%M:%S %Z
%W, %e %b %y %H:%M:%S %Z
%w %b %f %H:%M:%S %Y
%Y-%m-%d %H:%M:%S
src\NotificationQueue.cpp
Windows-1252
src\NotificationCenter.cpp
boost thread: trying joining itself
Missing port number
!hostAndPort.empty()
src\SocketAddress.cpp
Invalid address length passed to SocketAddress()
unsupported IP address family
Invalid HTTP version string
HTTP request URI invalid or too long
HTTP request method invalid or too long
No HTTP request header
Cannot set the port number for an already connected session
Cannot set the proxy host and port for an already connected session
Cannot set the proxy port number for an already connected session
hXXp://
src\HTTPClientSession.cpp
Login denied
Cannot login to server
PORT command failed
PORT
src\IPAddress.cpp
Invalid or unsupported address family passed to IPAddress()
255.255.255.255
Invalid address length passed to IPAddress()
HTTP reason string too long
Invalid HTTP status code
No HTTP response header
Unsupported Media Type
HTTP Version not supported
HTTP/1.0
HTTP/1.1
src\Socket.cpp
Invalid or unsupported address family passed to DatagramSocketImpl
src\HostEntry.cpp
HTTP Exception
Unsupported HTTP redirect (protocol change)
FTP Exception
SMTP Exception
WebSocket Exception
src\MessageHeader.cpp
Invalid or null SocketImpl passed to SocketStreamBuf
HttpOnly
; HttpOnly
()[]/|\',;
No IPv6 support available
src\SocketImpl.cpp
Address family not supported
Protocol family not supported
Operation not supported
Socket type not supported
Protocol not supported
Socket operation attempted on non-socket
Operation already in progress
Operation now in progress
Operation would block
Invalid or unsupported address family passed to StreamSocketImpl
src\Compress.cpp
_files.size() < 65536
_infos.size() == _files.size()
_disks.insert(std::make_pair(nfo.getDiskNumber(), nfo)).second
_infos.insert(std::make_pair(info.getFileName(), info)).second
_entries.insert(std::make_pair(entry.getFileName(), entry)).second
src\ZipArchive.cpp
Unsupported compression method
Encryption not supported
src\ZipStream.cpp
src\ZipFileInfo.cpp
src\ZipLocalFileHeader.cpp
!fileName.empty()
_fileName.empty()
src\ZipDataInfo.cpp
src\ZipArchiveInfo.cpp
src\PartialStream.cpp
src\ConfigurationView.cpp
src\MemoryPool.cpp
boost::too_many_args: format-string referred to less arguments than were passed
HTTPS
Bind local port to socket failed |
%1%|%2%|%3%|%4%|%5%|%6%|%7%
[peer]send msg|peer=%1%|cmd=%2%|
%1%|%2%|%3%|%4%|%5%
%1%|%2%|%3%|%4%|%5%|%6%|%7%|%8%
%1%|%2%|%3%
%1%|%2%|%3%|%4%
%1%|%2%|%3%|%4%|%5%|%6%
ip:%1%,tcp port:%2%,udp port:%3%,ms:%4%,hm:%5%,sock:%6%
%1%,%2%,%3%
%1%,%2%,%3%,%4%
release_req_queue|peer=%1%|cmd=%2%|tmp_cmd=%3%|
cancel_request|idx=%1%|ofs=%2%|peer=%3%|rate=%4%|rq=%5%|cmd=%6%|
[recv_donothave]|handle_msg_donot_have|peer=%1%|dldpeer=%2%|reqs=%3%|idx=%4%|ofs=%5%|timeout=%6%|
/dts/cdn?rprotocol=1&dev=%s&mac=%s&ver=%s&nt=%u&fudid=%s&kver=%s&value=%s
-1|%1%|%2%|%3%|%4%|%5%
%1%|%2%|%3%|%4%|%5%|%6%|%7%|%8%|%9%|%|%
1|%1%|%2%|%3%|%4%|%5%
[peer]recv live handshake|peer=%1%|win_start=%2%|start_utc=%3%|abi=%4%|win_len=%5%|need_real_bit=%6%|msg_len=%7%|
[peer]send handshake to live peer|peer=%1%|win_start=%2%|win_len=%3%|abi=%4%|msg_len=%5%|
HTTP/1.1
[httppeer]format_request|peer=%1%|peermode=%2%|host_name=%3%|url=%4%|
[httppeer]get_resp_code|peer=%1%|peermode=%2%|resp_code=%3%|
[httppeer]get_sha_value|peer=%1%|peermode=%2%|sha_value=%3%|
[httppeer]head_parse|peer=%1%|peermode=%2%|resp_code=%3%|file_size=%4%|content_size=%5%|
[httppeer]request_timeout|peer=%1%|peermode=%2%|host_name=%3%|url=%4%|ct=%5%|
[httppeer]recv_first_resp|peer=%1%|peermode=%2%|host_name=%3%|url=%4%|ct=%5%|
[httppeer]parse_fail|peer=%1%|peermode=%2%|host_name=%3%|url=%4%|
[httppeer]do_run|peer=%1%|peermode=%2%|state=%3%|url=%4%|
[httppeer]download_success|peer=%1%|peermode=%2%|filesize=%3%|ct=%4%|
[httppeer]write_file|peer=%1%|peermode=%2%|filesize=%3%|rst=%4%|
[httppeer]netio_error|peer=%1%|peermode=%2%|state=%3%|url=%4%|
ip:%1%,tcp port:%2%,udp port:%3%
add_chunk_info_req|peer=%1%|start=%2%|len=%3%|utc=%4%|host=%5%|url=%6%|
[hlspeer]ms timeout|peer=%1%|cmd=%2%|
[peer]ms timeout|peer=%1%|cmd=%2%|
HTTP/
127.0.0.1
%Y-%m-%dT%H:%M:%SZ
Microsoft Windows 7
Microsoft Windows Vista
Microsoft Windows Server 2003,
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows NT
Web Edition
Microsoft Windows 95
Microsoft Windows 98
Microsoft Windows Millennium Edition
name.utf-8
path.utf-8
SHFileOperation failed for %1% !
T.observer.send('client.server');
application/x-www-form-urlencoded
application/vnd.apple.mpegurl
HTTP/1.0 404 Not Found
HTTP/1.0 200 OK
create_web_server_handler|type=%1%|sock=%2%|
|accept a web client connection|sock=%1%|
|bind port of web server listen fail|err=%1%|port=%2%|
|bind port of web server listen socket|port = %1%|
|recv data from web client|sock=%1%|data=%2%|
|Web IO send data revert|sock=%1%|data_len=%2%|send_len=%3%|
funshion_port_mutex_name
funshion_port_memory
crossdomain.xml
|remove_web_taskr|id=%1%|
|is_token_valid|method=%1%|force_check_web_token=%2%|
E:\gitProject\DTS_5.0.0\library\boost_1_51_0\boost/exception/detail/exception_ptr.hpp
%d %d %d %d
%d %d
ip%d=%s|
lv dns success|url=%d|tu=%ld|ipn=%d|%s
tls.funshion.com
tls3.funshion.com
lv dns success|url=local|ipn=1|ip0=%s|
trs info|sip=%s|
ipn=%d|
restart_handler_success|ip=%1%|port=%2%|
get_local_addr|ip=%1%|port=%2%|
%6%sppart_%1%_%2%_%3%_%4%_%5%.dat
*.dat
%2%sppart_%1%_*.dat
verify_files|infohash_id:%1%|bitfield.set:%2%|bitfield_need_check.set:%3%|
Create Operation|type=%1%|
compare_piece_idx_if_first_big|first.file_idx:%1%|second.file_idx:%2%|first.piece_idx:%3%|second.piece_idx:%4%|
kernel32.dll
ns3.funshion.com
%1%|%2%|%3%|%4%|0|0|0|0|0|0
ns.funshion.com
login.funshion.com
Reportflux task failed|
Re-login Server|
%1%|0|%2%|%3%|%4%|%5%|%6%|%7%|%8%|%9%
/dts/nat_info?rprotocol=1&dev=%s&mac=%s&ver=%s&nt=%u&fudid=%s&kver=%s&value=%s
Login totally failed|waitting for 5 mins|
172.168.10.1
Login fail|server ip=%1%|login type=%2%|reason=%3%|
|tuner_send_http_request|http_status=%1%|
Login server success|spent time=%1%|ip=%2%|port=%3%|login type=%4%|
Login BS success|spent time=%1%|server ip=%2%|login type=%3%|
|tuner_send_http_request|resp_string=%1%|
|tuner_parse_json|urlsize=%1%|
urls
|tuner_parse_json|urls=%1%|
|tuner_parse_json_fail|urls=%1%|
E:\gitProject\DTS_5.0.0\library\boost_1_51_0\boost/property_tree/detail/ptree_implementation.hpp
E:\gitProject\DTS_5.0.0\library\boost_1_51_0\boost/property_tree/detail/json_parser_read.hpp
E:\gitProject\DTS_5.0.0\library\boost_1_51_0\boost/property_tree/string_path.hpp
.json
jobsfe.funshion.com
jobsff.funshion.com
|tuner_ms|ip=%1%|port=%2%|uri=%3%|
1.2.3
service-bs.funshion.com
create proxy task fail|login status=%1%|
Agentd login status|last status=%1%|next status=%2%|
PreviousFunshionService.log
common.revision
Windows
FunshionService.log
funshion.ini
CFsLog::dump_log():tryJoin crashed
service-PTF.funshion.com
[udpt component]
[reporter component]
[login server component]
[httppeer component]
[web server component]
[http visitor component]
000000000000
005345000000
000000000030
%uuuuuuu
dt=fsmac&mtm=%d&ercd=%u&oser=%ld&wvin=%d&src=%s&same=%d&msrc=%s&psrc=%s
stat.funshion.net
.param.task_list[
/dts/temporary?rprotocol=1&dev=%s&mac=%s&ver=%s&nt=%u&fudid=%s&kver=%s&value=%s
].url
].task_type
].file_name
].media_save_path
].media_store_type
].available_memory
].preloaded
.param.mode
].infohash
.param.infohash_list[
.param.keyid
.param.infohash
.param.file_name
].keyid
.param.global_param_list[
].value
set_global_param|key=%1%|value=%2%|
set_global_param_error|key=%1%|value=%2%|
.param.message
resp_cmd
play_url
respond_msg2ui|command=%1%|handler_id=%2%|
0|%1%|%2%
report_sth_ui|content=%1%|
init socket ready|port=%1%|
/dts/dtsf?rprotocol=1&dev=%s&mac=%s&ver=%s&nt=%u&fudid=%s&kver=%s&value=%s
%1%|%2%|%3%|%4%|%5%|%6%|%7%|%8%|%9%
/dts/taskflux_source?rprotocol=1&dev=%s&mac=%s&ver=%s&nt=%u&fudid=%s&kver=%s&value=%s
[reporter]task flux statistic, infohash:%1%, ms flux:%2%, hidden ms flux:%3%, normal flux:%4%, task download rate:%5%, act peer count:%6%, tmp peer count:%7%, upload flux:%8%|
[reporter]task detail, infohash:%1%, udp download:%2%, udp upload:%3%, tcp download:%4%, tcpupload:%5%, nat type:%6%|
report_init_info|taskid=%1%|start_time=%2%|init_time=%3%|read_succ_time=%4%|download_time=%5%|
report_delay_info|taskid=%1%|end_idx=%2%|read_idx=%3%|jumped=%4%|report_counts=%5%|
[reporter]task_play_or_stop, infohash:%1%, command:%2%|
%1%|%2%|%3%|%4%|%5%|%6%|%7%|%8%|%9%|%|%|%|%|%
/dts/play_halt?rprotocol=1&dev=%s&mac=%s&ver=%s&nt=%u&fudid=%s&kver=%s&value=%s
.ret.mid
.ret.ver
.ret.name
start dld fsp|url=%1%|
%1%|0|%2%
start dld json|url=%1%|
parse url=%1%|
[url_parser]parse of auto|%1%|
[url_parser]parse of abi|%1%|
[url_parser]parse of br|%1%|
[url_parser]parse of c|%1%|
[url_parser]parse of cn|%1%|
[url_parser]parse of crt|%1%|
[url_parser]parse of dur|%1%|
[url_parser]parse of father name|%1%|
[url_parser]parse of index|%1%|
[url_parser]parse of json ver|%1%|
[url_parser]parse of mid|%1%|
[url_parser]parse of task name|%1%|
[url_parser]parse of sub file size|%1%|
[url_parser]parse of fsp url|%1%|
[url_parser]parse of utc|%1%|
[url_parser]parse of vc|%1%|
[url_parser]parse of vt|%1%|
[url_parser]parse of jm|%1%|
[url_parser]parse of task fhash|%1%|
[url_parser]parse of task td|%1%|
[url_parser] parse url error|%1%|
|[preload task]check_hitted|not hitted|url_parse_error|
.hashid
.ret.tors[%d].hashid
.ret.tors[%d].fsp
Duplicate proxy-msg:%1%|mdresult %3%-%4% from %2%|
|create new udp handler|ptr=%x|
CFsAsioTcpHandler post_connect except|code=%1%|what=%2%|
|CFsAsioTcpHandler::~CFsAsioTcpHandler|this=%x|
CFsAsioTcpHandler recvfrom|ip=%1%|port=%2%|len=%3%|
CFsAsioTcpHandler post_connect|ip=%1%|port=%2%|
CFsAsioTcpHandler sendto|ip=%1%|port=%2%|len=%3%|
CFsAsioTcpHandler continue_recv|ip=%1%|port=%2%|
CFsAsioTcpHandler_handle_io_err|err.value=%1%|msg=%2%|
asio::handle_recv_data|ip=%1%|port=%2%|msg=%3%|len=%4%|
|udpt transmit (connect)|error=%1%|ip=%2%|
|udpt transmit (send)|error=%1%|ip=%2%|
|udpt transmit (post_recv)|CFpPerIOPkt=%x|
/dts/nat_traversal?rprotocol=1&dev=%s&mac=%s&ver=%s&nt=%u&fudid=%s&kver=%s&value=%s
|host=%1%|type=%2%|tu=%3%|ptl=%4%|ip=%5%|port=%6%|
|set need remove udp handler finish|current_use_handler_=%1%|
|CFsAsioTcpHandler()|this=%x|
|CFsAsioTcpHandler::shutdown_socket|this=%x|
|report success|ip=%1%|port=%2%|tid=%3%|
CFsAsioTcpAcceptHandler::handle_accept|ip=%1%|port=%2%|msg=%3%|
|remove success|ip=%1%|port=%2%|tid=%3%|
relogin|ip=%1%|port=%2%|reason=%3%|
/dts/ttv?rprotocol=1&dev=%s&mac=%s&ver=%s&nt=%u&fudid=%s&kver=%s&value=%s
/dts/ptv?rprotocol=1&dev=%s&mac=%s&ver=%s&nt=%u&fudid=%s&kver=%s&value=%s
|redirect|ip=%1%|port=%2%|redirect_ip=%3%|redirect_port=%4%|
/dts/tuner?rprotocol=1&dev=%s&mac=%s&ver=%s&nt=%u&fudid=%s&kver=%s&value=%s
/dts/login?rprotocol=1&dev=%s&mac=%s&ver=%s&nt=%u&fudid=%s&kver=%s&value=%s
/dts/agentd?rprotocol=1&dev=%s&mac=%s&ver=%s&nt=%u&fudid=%s&kver=%s&value=%s
|report|hash=%1%|
erase report task|hash=%1%|
update report task|hash=%1%|
relogin|denied|not init|
relogin|denied|same nat|
relogin|accepted|nat changed|
login|nat success|
login|nat failed|
|Passive udpt(send ACK)|ip=%1%|port=%2%|CMD=%3%|seq=%4%|
|execute_tuner_tasks|stop_time=%1%|announce_time=%2%|
CMD_ACK
|Initiative udpt(send ACK)|ip=%1%|port=%2%|CMD=%3%|seq=%4%|
CMD_SYN
|Passive udpt(send timeout ACK)|ip=%1%|port=%2%|CMD=%3%|seq=%4%|
|Initiative udpt(send SYN)|ip=%1%|port=%2%|CMD=%3%|seq=%4%|age=%5%|
|Initiative udpt(recv ACK)|ip=%1%|port=%2%|CMD=%3%|seq=%4%|
|Passive udpt(recv CMD_SYN)|ip=%1%|port=%2%|CMD=%3%|seq=%4%|age=%5%|
|Passive udpt(recv ACK)|ip=%1%|port=%2%|CMD=%3%|seq=%4%|
|recv ctl msg|ip=%1%|port=%2%|ctl cmd=%3%|
recv seq(1)|ip=%1%|port=%2%|seq=%3%|
recv seq(2)|ip=%1%|port=%2%|seq=%3%|
recv same ctl|ip=%1%|port=%2%|
recv same ctl(>30s)|ip=%1%|port=%2%|
recv same ctl(<=30s)|ip=%1%|port=%2%|time=%3%|
not record|ip=%1%|port=%2%|
send ctl ack|ip=%1%|port=%2%|ctl cmd=%3%|
|send ctl msg|ip=%1%|port=%2%|ctl cmd=%3%|APP CMD=%4%|
|recv udpt packet|ip=%1%|port=%2%|cmd=%3%|
|uplayer post req msg|ip=%1%|port=%2%|ctl cmd=%3%|idx=%4%|ofs=%5%|
|uplayer post ctl msg|ip=%1%|port=%2%|ctl cmd=%3%|
|uplayer post piece msg|ip=%1%|port=%2%|ctl cmd=%3%|idx=%4%|ofs=%5%|
|map_socket_udpt_size_in_~CFpUdptSocket|size=%1%|
|remove_map_socket_in_~CFpUdptSocket|sock=%1%|
|insert_map_socket_to_udpt_in_open|sock=%1%|size=%2%|
|udpt connect|ip=%1%|port=%2%|
|udpt_close|sock=%1%|ip=%2%|port=%3%|
|udpt accept connect|ip=%1%|port=%2%|
|udpt connect success|ip=%1%|port=%2%|
received_pkt_.size=%1%|
CFpUdpts::destroy|
|udpt listen|ip=%1%|port=%2%|status=%3%|
|udpt_perf|upload=%1%|download=%2%|connect_num=%3%|valid_upload=%4%|init_connect_rate=%5%|succ_connect_rate=%6%|
|udpt reconnect|ip=%1%|port=%2%|
|reconnect peer|time interval=%1%|ip=%2%|port=%3%|peer mode=%4%|
tcp fail|connecting=%1%|
produce tcp connector|ip=%1%|port=%2%|nat=%3%|t=%4%|
produce udpt connector|ip=%1%|port=%2%|nat=%3%|t=%4%|
produce natsession|ip=%1%|port=%2%|nat=%3%|t=%4%|
post_connect|connect_fail|t=%1%|ip=%2%|port=%3%|nat=%4%|nt=%5%|
post_connect|connect_suc|t=%1%|ip=%2%|port=%3%|nat=%4%|nt=%5%|
5.0.0.22
5.0.0.22Beta
FS %5% has run %3% millis, download %1% B/s, upload %2% B/s and udpdl %4% KB/s
High resolution timer is not supported by your computer!
init_http Ready|
asio.misc
asio.misc error
boost::too_few_args: format-string referred to more arguments than were passed
thread.entry_event
thread.exit_event
Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag
/dts/task_stat?rprotocol=1&dev=%s&mac=%s&ver=%s&nt=%u&fudid=%s&kver=%s&value=%s
%1%|%2%|%3%|%4%|%5%|%6%|%7%|%8%|%9%|%|%|%|%
%1%|%2%|%3%|%4%|%5%|%6%|%7%|%8%|%9%|%
[kernel]add_act_peer|pubip=%1%|localip=%2%|tcpport=%3%|udpport=%4%|nat=%5%|location=%6%|mode=%7%|supernode=%8%|
new peer close for boot tcp when entity task begin|
reset http peer status|
[ptv report]|%1%|%2%|
%1%|%2%|%3%|%4%|%5%|%6%|%7%|%8%|%9%|%|%|%
[peerspool]is_support_p2p_task|net_type=3G|
[kernel]return_request|rpeer_ip=%1%|cmd=%2%|idx=%3%|offset=%4%|len=%5%|
query_http_server_ip|host=%1%|ip=%2%|
add http peer|path=%1%|
/dts/peer_info?rprotocol=1&dev=%s&mac=%s&ver=%s&nt=%u&fudid=%s&kver=%s&value=%s
|%u %d %d %d %d %d %d
[taskdispatch]key|num%1%|app%2%|energy%3%|age%4%|pause_dld%5%|pause_seed%6%|hold_upload%7%|
[kernel]add_temp_peer|now=%1%|pubip=%2%|localip=%3%|tcpport=%4%|udpport=%5%|nat=%6%|location=%7%|peertype=%8%|priority=%9%|max_download_rate=%|nRet=%|
%1%|%2%|%3%|%4%|%5%|%6%|%7%|%8%|%9%|%|
[err]web path exist
[peer node]|add saved ms|pubip=%1%|tcp_port=%2%|udp_port=%3%|bytes=%4%|
retry http dld fsp|param=%1%|
retry http dld json|param=%1%|
[kernel]post_connect_peer|pubip=%1%|localip=%2%|tcpport=%3%|type=%4%|
[kernel]get_alloc_param|rpeer_ip=%1%|bits=%2%|subbits=%3%|timeout=%4%|udpt_send_win=%5%|last_subpiece_time=%6%|peer_win_size=%7%|
[max suc piece idx with key data]|max_check_suc_idx_=%1%|check_suc_idx=%2%|key_data=%3%|
[max suc piece idx with key data]|max_check_suc_idx_=%1%|check_suc_idx=%2%|
[kernel]add_peer|mode=to_http_ms_peer|num=%1%|super_node=%2%|hashid=%3%|
[kernel]add_peer|mode=to_http_torrent|num=1|hashid=%1%|
[kernel]add_peer|mode=to_http_json|num=1|hashid=%1%|
[kernel]add_peer|mode=to_tcpudp_peer_and_ms|num=%1%|hashid=%2%
E:\gitProject\DTS_5.0.0\symbols\FunshionService.pdb
dbghelp.dll
ADVAPI32.dll
ShellExecuteW
SHELL32.dll
USER32.dll
SHLWAPI.dll
WS2_32.dll
IPHLPAPI.DLL
GetProcessHeap
CreateIoCompletionPort
GetCPInfo
CreatePipe
KERNEL32.dll
OLEAUT32.dll
MSWSOCK.dll
SensApi.dll
RegOpenKeyW
RegEnumKeyExW
RegCloseKey
SHFileOperationW
ole32.dll
PeekNamedPipe
FunshionService.exe
.?AVCFsPeerTrackerUdpHandler@ptv@@
.?AVCFsPeerTrackerTcpHandler@ptv@@
.?AVCFsPeerTrackerUdpSubject@ptv@@
zcÁ
.?AVPropertyNotSupportedException@Poco@@
.?AVProcessHandleImpl@Poco@@
.?AVPipeImpl@Poco@@
.?AVWindows1252Encoding@Poco@@
.?AVHTTPException@Net@Poco@@
.?AVHTTPClientSession@Net@Poco@@
.?AVHTTPSession@Net@Poco@@
.?AVFTPClientSession@Net@Poco@@
.?AVFTPException@Net@Poco@@
.?AVUnsupportedRedirectException@Net@Poco@@
.?AVSMTPException@Net@Poco@@
.?AVWebSocketException@Net@Poco@@
.?AVHTTPStreamBuf@Net@Poco@@
.?AV?$BasicBufferedStreamBuf@DU?$char_traits@D@std@@VHTTPBufferAllocator@Net@Poco@@@Poco@@
.?AVHTTPIOS@Net@Poco@@
.?AVHTTPInputStream@Net@Poco@@
.?AVHTTPOutputStream@Net@Poco@@
.?AVHTTPFixedLengthStreamBuf@Net@Poco@@
.?AVHTTPFixedLengthIOS@Net@Poco@@
.?AVHTTPFixedLengthInputStream@Net@Poco@@
.?AVHTTPFixedLengthOutputStream@Net@Poco@@
.?AVHTTPChunkedStreamBuf@Net@Poco@@
.?AVHTTPChunkedIOS@Net@Poco@@
.?AVHTTPChunkedInputStream@Net@Poco@@
.?AVHTTPChunkedOutputStream@Net@Poco@@
.?AVHTTPHeaderStreamBuf@Net@Poco@@
.?AVHTTPHeaderIOS@Net@Poco@@
.?AVHTTPHeaderInputStream@Net@Poco@@
.?AVHTTPHeaderOutputStream@Net@Poco@@
.?AV?$BasicEvent@VKeyValue@AbstractConfiguration@Util@Poco@@VFastMutex@4@@Poco@@
.?AV?$AbstractEvent@VKeyValue@AbstractConfiguration@Util@Poco@@V?$DefaultStrategy@VKeyValue@AbstractConfiguration@Util@Poco@@V?$AbstractDelegate@VKeyValue@AbstractConfiguration@Util@Poco@@@4@@4@V?$AbstractDelegate@VKeyValue@AbstractConfiguration@Util@Poco@@@4@VFastMutex@4@@Poco@@
.?AV?$BasicEvent@$$CBVKeyValue@AbstractConfiguration@Util@Poco@@VFastMutex@4@@Poco@@
.?AV?$AbstractEvent@$$CBVKeyValue@AbstractConfiguration@Util@Poco@@V?$DefaultStrategy@$$CBVKeyValue@AbstractConfiguration@Util@Poco@@V?$AbstractDelegate@$$CBVKeyValue@AbstractConfiguration@Util@Poco@@@4@@4@V?$AbstractDelegate@$$CBVKeyValue@AbstractConfiguration@Util@Poco@@@4@VFastMutex@4@@Poco@@
.?AV?$DefaultStrategy@VKeyValue@AbstractConfiguration@Util@Poco@@V?$AbstractDelegate@VKeyValue@AbstractConfiguration@Util@Poco@@@4@@Poco@@
.?AV?$NotificationStrategy@VKeyValue@AbstractConfiguration@Util@Poco@@V?$AbstractDelegate@VKeyValue@AbstractConfiguration@Util@Poco@@@4@@Poco@@
.?AV?$DefaultStrategy@$$CBVKeyValue@AbstractConfiguration@Util@Poco@@V?$AbstractDelegate@$$CBVKeyValue@AbstractConfiguration@Util@Poco@@@4@@Poco@@
.?AV?$NotificationStrategy@$$CBVKeyValue@AbstractConfiguration@Util@Poco@@V?$AbstractDelegate@$$CBVKeyValue@AbstractConfiguration@Util@Poco@@@4@@Poco@@
.?AV?$sp_counted_impl_p@VCFsUdptListener@@@detail@boost@@
.?AV?$sp_counted_impl_p@VCFsAsioTcpAcceptHandler@@@detail@boost@@
.?AV?$sp_counted_impl_p@VCFsUdptTransmit@@@detail@boost@@
.?AV?$enable_shared_from_this@VCFsUdptHandler@@@boost@@
.?AVCFsUdptHandler@@
.?AVCFsUdptListener@@
.?AV?$thread_data@$$CBV?$reference_wrapper@VCFpUdpts@@@boost@@@detail@boost@@
.?AVCFpUdpts@@
.?AVCFpUdptSocket@@
.?AVCFpUdptStatics@@
.?AVCFpUdpt@@
.?AVCFpUdptSendPiece@@
.?AVCFpUdptSendReq@@
.?AVCFpUdptCtrlMsg@@
.?AVCFpUdptSyn@@
.?AVCFpUdptRcv@@
.?AVCFpUdptBuildSession@@
.?AVCFpUdptInitiative@@
.?AVCFpUdptPassive@@
.?AVCFsLoginServerContext@@
.?AVCFsUdptTransmit@@
.?AV?$sp_counted_impl_p@VCFsAsioTcpHandler@@@detail@boost@@
.?AVCFsTcpTransmit@@
.?AV?$enable_shared_from_this@VCFsAsioTcpAcceptHandler@@@boost@@
.?AVCFsTcpListener@@
.?AVCFsAsioTcpAcceptHandler@@
.?AV?$service_base@V?$socket_acceptor_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@
.?AV?$socket_acceptor_service@Vtcp@ip@asio@boost@@@asio@boost@@
.?AV?$typeid_wrapper@V?$socket_acceptor_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@
.?AV?$enable_shared_from_this@VCFsAsioTcpHandler@@@boost@@
.?AVCFsAsioTcpHandler@@
.?AV?$service_base@V?$stream_socket_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@
.?AV?$stream_socket_service@Vtcp@ip@asio@boost@@@asio@boost@@
.?AV?$typeid_wrapper@V?$stream_socket_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@
.?AVCFsUdpData@@
.?AV?$sp_counted_impl_p@VCFsAsioUdpHandler@@@detail@boost@@
.?AV?$sp_counted_impl_p@VCFsPocoUdpHandler@@@detail@boost@@
.?AVCFsUdpHandler@@
.?AV?$sp_counted_impl_p@V?$basic_datagram_socket@Vudp@ip@asio@boost@@V?$datagram_socket_service@Vudp@ip@asio@boost@@@34@@asio@boost@@@detail@boost@@
.?AV?$enable_shared_from_this@VCFsAsioUdpHandler@@@boost@@
.?AVCFsAsioUdpHandler@@
.?AV?$service_base@V?$datagram_socket_service@Vudp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@
.?AV?$datagram_socket_service@Vudp@ip@asio@boost@@@asio@boost@@
.?AV?$typeid_wrapper@V?$datagram_socket_service@Vudp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@
.?AVCFsPocoUdpHandler@@
.?AV?$Observer@VCFsPocoUdpHandler@@VReadableNotification@Net@Poco@@@Poco@@
.?AV?$Observer@VCFsPocoUdpHandler@@VWritableNotification@Net@Poco@@@Poco@@
.?AVCFsPassiveStrategy@@
.?AVCFsVirtualTaskParam@url_def@@
.?AVCFsUrlSmallVideo@url_def@@
.?AVCFsTaskParam@url_def@@
.?AVCFsUrlVirtual@url_def@@
.?AVCFsUrlBoot@url_def@@
.?AVCFsUrlLive@url_def@@
.?AVCFsUrlCommon@url_def@@
.?AVCFsExpBadurl@@
.?AVCFsPlayChokeReport@@
.?AVCFsVODPlayChokeReport@@
.?AVCFsHttpReporterImpl@@
.?AVIFsHttpReporter@@
.?AVCFsHttpBase@@
.?AVCFsHttpDataReporter@@
.?AVcfs_login_task@Agentd@@
.?AVic2s_msg_decoder@@
.?AVcfs_login_decoder@Agentd@@
.?AVic2s_msg_encoder@@
.?AVcfs_login_encoder@Agentd@@
.?AVtask_state_response_udp@@
.?AVconnector_udp@@
.?AVconnector_tcp@@
.?AV?$sp_counted_impl_pd@PAUdelete_data@?$thread_specific_ptr@V?$weak_ptr@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@boost@@@boost@@U?$do_heap_delete@Udelete_data@?$thread_specific_ptr@V?$weak_ptr@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@boost@@@boost@@@detail@3@@detail@boost@@
.?AV?$sp_counted_impl_p@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@detail@boost@@
.?AU?$concrete_parser@U?$alternative@V?$action@V?$chset@D@classic@spirit@boost@@Ua_escape@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@V?$action@U?$uint_parser@K$0BA@$03$03@classic@spirit@boost@@Ua_unicode@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$alternative@V?$action@U?$difference@U?$difference@Uanychar_parser@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@Ua_char@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$positive@U?$contiguous@U?$confix_parser@U?$chlit@D@classic@spirit@boost@@U?$kleene_star@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@U1234@Uunary_parser_category@234@Unon_nested@234@Unon_lexeme@234@@classic@spirit@boost@@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$sequence@U?$optional@U?$chlit@D@classic@spirit@boost@@@classic@spirit@boost@@U?$alternative@U?$chlit@D@classic@spirit@boost@@U?$sequence@U?$range@D@classic@spirit@boost@@U?$kleene_star@Udigit_parser@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$sequence@V?$chset@D@classic@spirit@boost@@U?$optional@V?$chset@D@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@Ua_name@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$chlit@D@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_s@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$alternative@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$list_parser@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@U?$chlit@D@234@Uno_list_endtoken@234@Uplain_parser_category@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$alternative@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@V1234@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Uend_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AUdelete_data@?$thread_specific_ptr@V?$weak_ptr@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@boost@@@boost@@
.?AU?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@
.?AU?$do_heap_delete@Udelete_data@?$thread_specific_ptr@V?$weak_ptr@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@boost@@@boost@@@detail@boost@@
.?AVcfs_login_task@lsv@@
.?AVcfs_relogin_task@lsv@@
.?AVcfs_relogin_decoder@lsv@@
.?AVcfs_login_decoder@lsv@@
.?AVcfs_login_encoder@lsv@@
.?AVCFsConnectorTcp@@
.?AVCFsConnectorUdp@@
.?AV?$thread_data@$$CBV?$reference_wrapper@VCFsWebServerThread@@@boost@@@detail@boost@@
.?AVCFsWebServers@@
.?AVCFsSharedMemoryIO@@
.?AVCFsWebServerIO@@
.?AVCFsWebServerHandler@@
.?AVHTTPMessage@Net@Poco@@
.?AVHTTPRequest@Net@Poco@@
.?AVCFsWebServerRequestParser@@
.?AVHTTPResponse@Net@Poco@@
.?AVCFsWebServerResponse@@
.?AVCFsWebServerFlashHandler@@
.?AVCFsWebServerLocalHandler@@
.?AVCFsWebServerCommandHandler@@
.?AVCFsWebServerDebugHandler@@
.?AVCFsWebServerPlayHandler@@
.?AVCFpPriKey@@
.?AVCFsKeyReqStr@@
.?AVCFsHttpSmallVideoMSPeer@@
.?AVCFsHttpLiveMSPeer@@
.?AVCFsHttpPeer@@
.?AVc2s_net_udp@@
.?AVc2s_net_tcp@@
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><application xmlns="urn:schemas-microsoft-com:asm.v3"><windowsSettings><ms_windowsSettings:dpiAware xmlns:ms_windowsSettings="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings" xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</ms_windowsSettings:dpiAware></windowsSettings></application></assembly>PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
4 4$4(4,404
7Ÿ9x9E:
4%4X5
6 6$6<6{6
0
0L0_0~0
4O4M4]4m4
2?3
8\<6=<>|?
9':7:<:~:
0 0$0(0,0004080<0@0
1,2024282<3
8&929?9_9
4 4$4(4,464
3(343>3&4~4
6&7^8&:2;&<
11x1
8$8,828:8@8
2 2(20282
; ;$;(;,;0;4;8;
8 8$8(8,80848
= =$=(=,=0=
; ;$;(;,;0;4;
7 7@7\7`7|7
9 9@9\9`9
9$9,989\9|9
0 0$0,080\0|0
0$0,080\0|0
2$2,282\2|2
:$:,:8:\:|:
mscoree.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
KERNEL32.DLL
WUSER32.DLL
\FunShion.ini
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009
%USERPROFILE%\FunShion.ini
.mp4.fc!
E:\gitProject\DTS_5.0.0\library\boost_1_51_0\boost/format/alt_sstream_impl.hpp
E:\gitProject\DTS_5.0.0\library\boost_1_51_0\boost/format/parsing.hpp
static_cast<unsigned int>(cur_item) < items_.size() || cur_item==0
E:\gitProject\DTS_5.0.0\library\boost_1_51_0\boost/format/format_implementation.hpp
bound_.size()==0 || num_args_ == static_cast<int>(bound_.size())
E:\gitProject\DTS_5.0.0\library\boost_1_51_0\boost/format/internals.hpp
!(fmtstate_.flags_ &(std::ios_base::adjustfield ^std::ios_base::left))
E:\gitProject\DTS_5.0.0\library\boost_1_51_0\boost/format/feed_args.hpp
res.size() == static_cast<size_type>(w)
item.pad_scheme_ & format_item_t::tabulation
E:\gitProject\DTS_5.0.0\library\boost_1_51_0\boost/thread/win32/once.hpp
t.fc!
.rmvb
sppart_*.dat
%static_cast<unsigned int>(cur_item) < items_.size() || cur_item==0
%E:\gitProject\DTS_5.0.0\library\boost_1_51_0\boost/format/format_implementation.hpp
%E:\gitProject\DTS_5.0.0\library\boost_1_51_0\boost/format/feed_args.hpp
|E:\gitProject\DTS_5.0.0\library\boost_1_51_0\boost/format/feed_args.hpp
|E:\gitProject\DTS_5.0.0\library\boost_1_51_0\boost/format/alt_sstream_impl.hpp
%E:\gitProject\DTS_5.0.0\library\boost_1_51_0\boost/format/internals.hpp
|E:\gitProject\DTS_5.0.0\library\boost_1_51_0\boost/format/internals.hpp
%E:\gitProject\DTS_5.0.0\library\boost_1_51_0\boost/format/alt_sstream_impl.hpp
%cur_item == num_items
|static_cast<unsigned int>(cur_item) < items_.size() || cur_item==0
|E:\gitProject\DTS_5.0.0\library\boost_1_51_0\boost/format/format_implementation.hpp
play.lv.funshion.com
jobsfl.funshion.com
%crashreport.exe
reportPreLog
\funshion\ini\temp_config.ini
crashreport.exe
reportLog
key_slice_request_timeout
enable_key_peers_optimized
enable_increase_udpt_priority
enable_crash_report
disable_udp_direct_back
disable_tcp_connection
disable_udpt_connection
ms_add_udpt
max_concurrent_tcp
disable_tcp_listening
disable_udpt_listening
disable_tcp_connections_filter
labin_task_state_report_interval
udpt_time_out
report_min_udpt_speed
reporter_bootstrap_port
report_funcs_mask
tls_port
Report_Flux_Timeout
max_tcp_login_retry_times
max_login_retry_times
login_retry_interval
default_winhttp_timeout
max_cocurrent_tcps
just_peer_port
just_peer_udp_port
listening_port
saved_ms_tcp_port
saved_ms_udp_port
show_web_log
force_connect_http
enable_just_udpt_peer
enable_udpt_dump
enable_reporter_dump
enable_login_server_dump
enable_httppeer_dump
enable_web_server_dump
enable_http_visitor_dump
reporter_bootstrap_name
report_quality_timeout
force_check_web_token
vod_taskflux_report_interval
live_taskflux_report_interval
smallvideo_taskflux_report_interval
.diagnose
%USERPROFILE%\funshion\FunShion.ini
\funshion.ini
SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\
funshionservice.exe
hXXp://q.funshion.com/api/torrents_long
imgb.funshion.com
VVV.btstream.org
imgq.funshion.com
q.funshion.com
E:\FunshionMedia
crt=1
_v1.dat
null.fsp
%sz_err
%*.dat
LISTEN_PORT
startbywindows tray
FunshionService.timestamp
tasklist.exe
\funshion\fsps.txt
\funshion\crash_dump.dmp
Assertion failed: %s, file %s, line %d
%Program Files%\Funshion Online\3.0.6.62\FunshionService.exe
Funshion Network Transport Service






Remove it with Ad-Aware




    

  1. Click (here) to download and install Ad-Aware Free Antivirus.
    2. 

  2. Update the definition files.
    3. 

  3. Run a full scan of your computer.
    4. 





Manual removal*




    

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):
    

    FunshionService.exe:1296
    %original file name%.exe:3676
    AptShadow.exe:3148
    Funshion.exe:1100
    rundll32.exe:1928
    rundll32.exe:100
    rundll32.exe:3024
    rundll32.exe:4048
    regsvr32.exe:1024
    regsvr32.exe:2600
    regsvr32.exe:4056
    regsvr32.exe:1524
    regsvr32.exe:3964
    regsvr32.exe:3172
    

    2. 

  2. Delete the original Adware file.
    3. 

  3. Delete or disinfect the following files created/modified by the Adware:
    

    C:\Users\"%CurrentUserName%"\Funshion\Funshion.ini (4326 bytes)
    %Program Files%\Funshion Online\3.0.6.62\FunshionService.log (390 bytes)
    %Program Files%\Funshion Online\3.0.6.62\funshion.ini (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lang\Funshion.en_US.bak (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\爷们儿.jpg (31 bytes)
    C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\004_扑克王.fsv (481 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\socket\smtp.lua (8 bytes)
    C:\Users\Public\Desktop\Funshion.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\Uninstall.exe (837 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\WDU138VJ.txt (517 bytes)
    %Program Files%\Funshion Online\3.0.6.62\atrc.dll (601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\003_暴力街区.fsv (535 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\奇葩一家亲.jpg (39 bytes)
    %Program Files%\Funshion Online\3.0.6.62\pncrt.dll (1425 bytes)
    C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\综艺娱乐\001_超级先生.fsv (563 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\TPGLK7MO.txt (508 bytes)
    %Program Files%\Funshion Online\3.0.6.62\avutil-52.dll (1425 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\icon\RMVB.ico (58 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Funshion\Hot Game.lnk (1 bytes)
    %Program Files%\Funshion Online\3.0.6.62\lang\Funshion.en_US (19 bytes)
    %Program Files%\Funshion Online\3.0.6.62\fpvddec.ax (6841 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tools\tools.7z (247 bytes)
    C:\ProgramData\Funshion\MediaLibrary\中国梦之声 第二季.jpg (37 bytes)
    %Program Files%\Funshion Online\3.0.6.62\FunshionWeb.exe (7385 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lang\Funshion.zh_CN (19 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\SeedIcon.ico (31 bytes)
    %Program Files%\Funshion Online\3.0.6.62\lang\FunshionUpgrade.zh_CN (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunKoala64.dll (1281 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\atrc.dll (96 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\windows.lua (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunKoala64.dll (210 bytes)
    %Program Files%\Funshion Online\3.0.6.62\lua\socket\tp.lua (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunNail.dll (960 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunShadow.dll (525 bytes)
    %Program Files%\Funshion Online\3.0.6.62\SimpleIE.dll (673 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunNail.dll (7345 bytes)
    %Program Files%\Funshion Online\3.0.6.62\lua\socket\url.lua (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\socket.lua (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\002_为奴十二年.fsv (685 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\B05KHRNM.txt (529 bytes)
    C:\ProgramData\Funshion\MediaLibrary\为奴十二年.jpg (39 bytes)
    C:\ProgramData\Funshion\MediaLibrary\谈判冤家.jpg (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\猫和老鼠.jpg (24 bytes)
    %Program Files%\Funshion Online\3.0.6.62\lua\socket.lua (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\最新电影\001_海神密码.fsv (537 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\L45CSEFH.txt (523 bytes)
    C:\Users\"%CurrentUserName%"\Funshion\Shortcut\FunShortcut.ini (789 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\uninst.exe (1281 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\mime.lua (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\超级先生.jpg (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FsMediaBar.dll (164 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\动漫卡通\001_猫和老鼠.fsv (527 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\Default1.jpg (14 bytes)
    C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\009_探索.fsv (472 bytes)
    %Program Files%\Funshion Online\3.0.6.62\lua\mime.lua (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\004_扑克王.fsv (481 bytes)
    %Program Files%\Funshion Online\3.0.6.62\Funshion.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\001_幻影车神：魔盗激情.fsv (715 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunWorks64.dll (4185 bytes)
    %Program Files%\Funshion Online\3.0.6.62\FsMediaBar64.dll (673 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5ENFIZ2I.txt (81 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IMFD3ND3.txt (78 bytes)
    %Program Files%\Funshion Online\3.0.6.62\CoreAAC.ax (4185 bytes)
    %Program Files%\Funshion Online\3.0.6.62\CoreAVC.ax (1425 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\SimpleIE.dll (146 bytes)
    %Program Files%\Funshion Online\3.0.6.62\lang\Funshion.en_US.bak (5 bytes)
    %Program Files%\Funshion Online\3.0.6.62\swscale-2.dll (2321 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\ssdodge.daw (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lang\Funshion.zh_CN.bak (19 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\海神密码.jpg (37 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\gma.dll (3073 bytes)
    %Program Files%\Funshion Online\3.0.6.62\windows.lua (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\010_中国梦之声 第二季.fsv (647 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\暴力街区.jpg (37 bytes)
    %Program Files%\Funshion Online\3.0.6.62\funshionplugin2.dll (22430 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\drvc.dll (272 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\avutil-52.dll (322 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FunshionWeb.exe (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunWorks64.dll (622 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\AptRegIns.dll (1281 bytes)
    %Program Files%\Funshion Online\3.0.6.62\icon\MP4.ico (57 bytes)
    C:\ProgramData\Funshion\MediaLibrary\扑克王.jpg (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\TVR1C6E8.txt (78 bytes)
    %Program Files%\Funshion Online\3.0.6.62\FsShlExt.dll (3361 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\icon\show.ico (143 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunWorks.dll (492 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\2N1SZ07V.txt (355 bytes)
    C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\010_中国梦之声 第二季.fsv (647 bytes)
    C:\ProgramData\Funshion\MediaLibrary\探索.jpg (24 bytes)
    %Program Files%\Funshion Online\3.0.6.62\lua\socket\http.lua (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\AptRegIns.dll (242 bytes)
    %Program Files%\Funshion Online\3.0.6.62\gma.dll (6146 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\FunExt.dll (495 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\winusb.dll (22 bytes)
    C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\动漫卡通\001_猫和老鼠.fsv (527 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FsShlExt64.dll (463 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\谈判冤家.jpg (34 bytes)
    C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\经典电影\001_终结者.fsv (492 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\icon\FunshionGame2.ico (26 bytes)
    C:\Users\"%CurrentUserName%"\Funshion\funshiontools\npFunshion.dll (2105 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\ssdodge.daw (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Funshion.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FunshionTools\funoictl.dll (271 bytes)
    %Program Files%\Funshion Online\3.0.6.62\FsMediaBar.dll (673 bytes)
    %Program Files%\Funshion Online\3.0.6.62\cjson.dll (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunSeed.dll (295 bytes)
    C:\ProgramData\Funshion\MediaLibrary\分手大师.jpg (30 bytes)
    C:\ProgramData\Funshion\MediaLibrary\爷们儿.jpg (31 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunDodge.dll (2105 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FunshionUpgrade.exe (1 bytes)
    %Program Files%\Funshion Online\3.0.6.62\icon\Funshop4.ico (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\skin\default.skin (3 bytes)
    %Program Files%\Funshion Online\3.0.6.62\FunshionUpgrade.exe (7726 bytes)
    C:\Users\"%CurrentUserName%"\Funshion\funshiontools\LoadIE.log (138 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\风行热播\001_分手大师.fsv (519 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\gma.dll (495 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\为奴十二年.jpg (39 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua51.dll (17 bytes)
    %Program Files%\Funshion Online\3.0.6.62\cook.dll (601 bytes)
    C:\ProgramData\Funshion\MediaLibrary\终结者.jpg (18 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\AptRelay.exe (673 bytes)
    %Program Files%\Funshion Online\3.0.6.62\CrashReport.exe (4545 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HS2VXI8I.txt (526 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\icon\Funshop4.ico (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\CoreAAC.ax (612 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\E1MBW261.txt (529 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\I2S4DNUW.txt (78 bytes)
    %Program Files%\Funshion Online\3.0.6.62\lang\Funshion.zh_CN.bak (19 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunSeed64.dll (329 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\W5U42C1J.txt (361 bytes)
    %Program Files%\Funshion Online\3.0.6.62\drvc.dll (1425 bytes)
    C:\ProgramData\Funshion\MediaLibrary\Default0.jpg (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Funshion.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\funshion.ini (1005 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\Funshion.exe (3 bytes)
    C:\ProgramData\Funshion\MediaLibrary\猫和老鼠.jpg (24 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\swscale-2.dll (427 bytes)
    %Program Files%\Funshion Online\3.0.6.62\avcodec-55.dll (22350 bytes)
    C:\ProgramData\Funshion\MediaLibrary\Default1.jpg (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\Inst.dll (2321 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FsMediaBar64.dll (196 bytes)
    C:\ProgramData\Funshion\MediaLibrary\倒霉熊.jpg (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\mime\core.dll (19 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\cook.dll (72 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\SeedIcon.ico (31 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\funshionplugin2.dll (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunWorks.dll (3073 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\AptShadow.exe (487 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunDodge.dll (332 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\探索.jpg (24 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\socket\core.dll (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\socket\tp.lua (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FunshionTools\npFunshion.dll (385 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\uninst.exe (246 bytes)
    C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\007_爷们儿.fsv (486 bytes)
    %Program Files%\Funshion Online\3.0.6.62\icon\show.ico (673 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\socket\http.lua (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\skin\upgradedefault.skin (11 bytes)
    C:\Users\Public\Desktop\VR游戏.lnk (1 bytes)
    %Program Files%\Funshion Online\3.0.6.62\icon\RMVB.ico (58 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\分手大师.jpg (30 bytes)
    C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\005_马向阳下乡记.fsv (527 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\CoreAVC.ax (278 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunSeed.dll (1425 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunShadow.dll (3361 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\海外剧场\001_玻璃鞋.fsv (459 bytes)
    %Program Files%\Funshion Online\3.0.6.62\socket\core.dll (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\内地剧场\001_奇葩一家亲.fsv (484 bytes)
    C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\006_谈判冤家.fsv (468 bytes)
    C:\ProgramData\Funshion\MediaLibrary\超级先生.jpg (25 bytes)
    %Program Files%\Funshion Online\3.0.6.62\lang\FunshionUpgrade.en_US (1 bytes)
    %Program Files%\Funshion Online\3.0.6.62\FsShlExt64.dll (3073 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lang\FunshionUpgrade.zh_CN (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\005_马向阳下乡记.fsv (527 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\C1PSQ8S6.txt (379 bytes)
    C:\Users\"%CurrentUserName%"\Funshion\funshiontools\funoictl.dll (2850 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\终结者.jpg (18 bytes)
    C:\ProgramData\Funshion\MediaLibrary\玻璃鞋.jpg (11 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Funshion\Unistall.lnk (1 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Funshion\Versions History.lnk (369 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\CrashReport.exe (710 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FunshionService.exe (4 bytes)
    C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\002_为奴十二年.fsv (685 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\avcodec-55.dll (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\0OB51DHV.txt (349 bytes)
    %Program Files%\Funshion Online\3.0.6.62\skin\default.skin (25426 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Libraries\~行高清影视.tmp (560 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FsShlExt.dll (588 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\PZXT9XB5.txt (511 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua5.1.dll (174 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tools\gma.dll (994 bytes)
    C:\ProgramData\Funshion\MediaLibrary\暴力街区.jpg (37 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\泡沫之夏.jpg (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FunshionTools\funoictl64.dll (274 bytes)
    %Program Files%\Funshion Online\3.0.6.62\mime\core.dll (19 bytes)
    C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\海外剧场\001_玻璃鞋.fsv (459 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\7GLZOPMG.txt (81 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\008_倒霉熊.fsv (410 bytes)
    C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\003_暴力街区.fsv (535 bytes)
    %Program Files%\Funshion Online\3.0.6.62\icon\FunshionGame2.ico (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\fundata.7z (713 bytes)
    C:\ProgramData\Funshion\MediaLibrary\海神密码.jpg (37 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\Inst.dll (448 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\幻影车神：魔盗激情.jpg (39 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\MQ8J51N9.txt (227 bytes)
    C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\最新电影\001_海神密码.fsv (537 bytes)
    %Program Files%\Funshion Online\3.0.6.62\lua\ltn12.lua (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\icon\MP4.ico (57 bytes)
    %Program Files%\Funshion Online\3.0.6.62\FunshionService.exe (31556 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\socket\url.lua (10 bytes)
    %Program Files%\Funshion Online\3.0.6.62\lua\socket\smtp.lua (8 bytes)
    C:\ProgramData\Funshion\MediaLibrary\泡沫之夏.jpg (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\pncrt.dll (284 bytes)
    C:\Windows\System32\funshion.ini (3093 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tools\CrashReport.exe (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\Default0.jpg (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\007_爷们儿.fsv (486 bytes)
    C:\Users\"%CurrentUserName%"\FunShion.ini (76 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\socket\ftp.lua (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\港台剧场\001_泡沫之夏.fsv (515 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\扑克王.jpg (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\001_幻影车神：魔盗激情.fsv (715 bytes)
    C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\风行热播\001_分手大师.fsv (519 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\FsLibrary.exe (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\中国梦之声 第二季.jpg (37 bytes)
    %Program Files%\Funshion Online\3.0.6.62\FsLibrary.exe (12336 bytes)
    %Program Files%\Funshion Online\3.0.6.62\Uninstall.exe (6712 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\SetupFiles.7z (11 bytes)
    C:\ProgramData\Funshion\MediaLibrary\幻影车神：魔盗激情.jpg (39 bytes)
    C:\Users\"%CurrentUserName%"\Funshion\funshiontools\funoictl64.dll (2850 bytes)
    %Program Files%\Funshion Online\3.0.6.62\skin\upgradedefault.skin (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\马向阳下乡记.jpg (25 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Funshion\Funshion.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\Funshion\funshiontools\FunshionService.exe (31071 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\AptNail.dll (504 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\009_探索.fsv (472 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\AptNail.dll (3073 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\倒霉熊.jpg (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lang\FunshionUpgrade.en_US (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\综艺娱乐\001_超级先生.fsv (563 bytes)
    %Program Files%\Funshion Online\3.0.6.62\lua51.dll (17 bytes)
    %Program Files%\Funshion Online\3.0.6.62\Funshion.exe (23695 bytes)
    C:\ProgramData\Funshion\MediaLibrary\奇葩一家亲.jpg (39 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Funshion.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OR79SQ18.txt (511 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Funshion.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunSeed64.dll (2105 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\poster\玻璃鞋.jpg (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\gma.dll (495 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\经典电影\001_终结者.fsv (492 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\FsLibrary\fsv\006_谈判冤家.fsv (468 bytes)
    C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\008_倒霉熊.fsv (410 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\fpvddec.ax (883 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Fundata\FunKoala.dll (673 bytes)
    C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\港台剧场\001_泡沫之夏.fsv (515 bytes)
    %Program Files%\Funshion Online\3.0.6.62\lua5.1.dll (673 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\lua\ltn12.lua (8 bytes)
    C:\Users\"%CurrentUserName%"\Documents\Funshion HD Media\内地剧场\001_奇葩一家亲.fsv (484 bytes)
    %Program Files%\Funshion Online\3.0.6.62\lua\socket\ftp.lua (9 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Funshion\Funshion HD Media.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\funshiontmp\setup.ini (210 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Funshion\cjson.dll (25 bytes)
    C:\ProgramData\Funshion\MediaLibrary\马向阳下乡记.jpg (25 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Funshion\Help.lnk (347 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\FunKoala.dll (165 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SetupFiles\3.0.6.62\Fundata\AptRelay.exe (146 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\261TYHKH.txt (81 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\touch.daw (21 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\senvclear.zip (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\ssenvclear.daw (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\FunTemp\Turkey.dll (12984 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\senvclear.daw (784 bytes)
    C:\Users\"%CurrentUserName%"\Funshion\Config\template.xml (5 bytes)
    C:\Users\"%CurrentUserName%"\Funshion\jdmarket\baiying1220.zip.dl (753304 bytes)
    C:\Users\"%CurrentUserName%"\Funshion\Config\webinterface.xml (2 bytes)
    C:\Users\"%CurrentUserName%"\Funshion\Cache\flashNew\1351296.swf.dl (561110 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Funshion\Cache\neirong.funshion.com\client\nirvana\config.xml.dl (2894 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\92BIY313.txt (70 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Funshion\Cache\ps.funshion.com\v5\search\hotword?cl=pcclient&ve=3.0.6.62&uc=162 (599 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IR3P5N8O.txt (673 bytes)
    C:\Users\"%CurrentUserName%"\Funshion\jdmarket\baiying1220\default.skin (114695 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\9KFBJOP4.txt (523 bytes)
    C:\Users\"%CurrentUserName%"\Funshion\ini\httpfile.ini.dl (7010 bytes)
    C:\Users\"%CurrentUserName%"\Funshion\Cache\flashNew\1372668.swf.dl (331175 bytes)
    C:\Users\"%CurrentUserName%"\Funshion\update\adConfig.xml.bak (1 bytes)
    C:\Users\"%CurrentUserName%"\Funshion\jdmarket\baiying1220\manifest.json (475 bytes)
    C:\Users\"%CurrentUserName%"\Funshion\update\adMaterialsTable1.xml.dl (510 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Y474JNLF.txt (208 bytes)
    C:\Users\"%CurrentUserName%"\Funshion\jdmarket\market.ini (31 bytes)
    C:\Users\"%CurrentUserName%"\Funshion\ini\temp_config.ini.dl (854 bytes)
    C:\Users\"%CurrentUserName%"\Funshion\update\adConfig.xml.dl (500 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Funshion\Cache\po.funshion.com\v7\config\channel?cl=pcclient&ve=3.0.6.62&uc=162.dl (888 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\0Z6STD2S.txt (823 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OA7NFLKQ.txt (346 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\pulllog.db (155 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1486400107AptShadow\pulllog.db-journal (5062 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\kejet_v3[1].js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\21[1].gif (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\stat[1].gif (43 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\CHLYAVDY.txt (135 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\funshionPlayerViewV3[1].swf (19801 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\yian_v1[1].js (510 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\core[1].js (763 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\DOMStore\WMZUWJRG\vas.funshion[1].xml (150 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\curvycorners-min[1].js (16066 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\91AA3705_AFA2_C4D5_7E5F_437CB2316D08[1].swf (4253 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\crossdomain[1].xml (116 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\h[1].js (12274 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\v8[1].js (42551 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QDS08KDR.txt (94 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (672 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\UU67513I.txt (1065 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\stat[1].js (1081 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\install[1].htm (1926 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\errorPageStrings[1] (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\httpErrorPagesScripts[1] (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\ErrorPageTemplate[1] (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\navcancl[1] (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\track[1].htm (649 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\info_48[1] (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\background_gradient[1] (453 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\httpErrorPagesScripts[1] (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\bullet[1] (447 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\background_gradient[1] (453 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\navcancl[1] (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\errorPageStrings[1] (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\bullet[1] (447 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\ErrorPageTemplate[1] (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\info_48[1] (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\4KJ7X6JP.txt (829 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IGCYX4S9.txt (835 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\funspeed\FunAcce_new.daw (308 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ZL1FLWKJ.txt (841 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\funspeed\Turkey_new.daw (1 bytes)
    

    4. 

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):
    

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Funshion" = "%Program Files%\Funshion Online\3.0.6.62\Funshion.exe startbywindows tray"
    

    5. 

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
    6. 

  6. Reboot the computer.
    7. 



*Manual removal may cause unexpected system behaviour and should be performed at your own risk.












 
 




 
No votes yet












				


							


			

				
					  
							

		

		


					
							

	

	
	        


	

        
      
 

      
      

      
    
 

    
  
 

		


		

		
			

			

				

					Lavasoft is the maker of Ad-Aware,
					the world's most popular anti-malware 
					software with over 450 million 
					downloads.
				

				

					© 2025 Lavasoft. All rights reserved.

					Terms Of Use |   Privacy Policy
					


								

			


		

		


	

	
	

	

		x
		
Our best antivirus yet!

		
Fresh new look. Faster scanning. Better protection.

		

			
Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

			
For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

			
			Download adaware antivirus 12
		

		No thanks, continue to lavasoft.com
	

	

		

			close x
			
Discover the new adaware antivirus 12

			
Our best antivirus yet

			Download Now